Profilaktyka - bsod przy wyłączaniu pc, błąd services.exe...

[Filas]

... w folderze Users\Local\Temp\services.exe. Podejrzewam infekcję, tym bardziej, że zostaję obdarowany BSODami przy każdym wyłączeniu. Logów z GMERa nie mam jak zrobić, nie lubi się z patchowanym jądrem. Skan z Malwarebytes usunął jeden Malware.trace co raczej wskazuje na coś większego.
OTL.txt
Extras.txt.

[NieWiem]

Filas, jest grubo. I to nawet po pijaku widzę

Zamknij wszystko nad czym aktualnie pracujesz, także wyłącz swój program antywirusowy, zaporę, programy antyspyware. To ważne. Jak to zrobić, opisane tutaj.

Pamiętaj także o wyinstalowaniu wirtualnych napędów i usunięciu ich sterownika: klik

Pobierz ComboFixa od sUBs'a:
stąd lub stąd

ZANIM UŻYJESZ - Przeczytaj dokładnie jego instrukcję:
http://www.bleepingcomputer.com/combofix/pl/instrukcja-uzycia-combofix

Zalecam instalowanie Konsoli Odzyskiwania (XP, 2000), lub zaopatrzenie się w płytę WinRE (Vista, Se7en). Mimo wszystko ComboFix nie jest doskonały.

Przeklej na forum wyniki pracy narzędzia. Będą automatycznie otwarte w notatniku, znajdziesz je także w pliku C:\ComboFix.txt


Potem,

Pobierz AVZ od Z-Olega
link

Wypakuj na pulpicie i uruchom. Zrób aktualizację wciskając przycisk
Jeśli zwróci błąd, wybierz inne źródło.

Potem idź do menu File - wybierz Standard Scripts.
Zaznacz opcję Advanced System Analysis i wybierz Execute selected Scripts. Zatwierdź i poczekaj na ukończenie pracy.

Idź do Folderu avz4, znajdź folder LOG. Znajdziesz tam plik virusinfo_syscheck.zip - wrzuć go na www.speedyshare.com i podaj mi linka do paczki.

[Filas]

Cóż, niestety jestem w kropce - gdy ComboFix kończy skanowanie i przychodzi do restartu(albo wyłączenia powłoki i innych pierdół, nie wiem, co odczynia przed etapami) wita mnie wspaniały BSOD...
EDIT:Już wiem co jest powodem - system wykrywa explorer.exe jako kluczowy... Próbując wyłączyć powłokę, kraszuję sobie system. Świetnie...

[Andziorka]

Spróbuj w Trybie Awaryjnym.

[NieWiem]

Filas, masz dostęp do innego komputera? W razie czego będziemy się ratować skanami z zewnątrz.

Pobierz Dr Web Cure It
mirror

• Kliknij dwukrotnie na ikonę, aby uruchomić program (użytkownicy systemów Vista oraz Se7en => prawoklik oraz wybrać opcję Uruchom jako Administrator).
• Kliknij Scan żeby odpalić szybkie skanowanie, w wyskakującym okienku wciśnij OK.
• Jeśli coś zostanie znalezione, kliknij Yes żeby wyleczyć/usunąć.
• Po szybkim skanowaniu wybierz opcję Complete Scan.
• Po prawej stronie kliknij zieloną strzałkę.
• Jeśli zostaniesz poproszony w trakcie skanowania, kliknij Yes to all (automatyczne leczenie i/lub usuwanie).
• Ten skan może trwać bardzo długo - zalecam, żeby odpalić go na noc, zostawiając komputer włączonym!
• Po ukończeniu skanowania, wybierz Menu File => Save Report list.
• Plik zapisz na pulpicie. Będzie nazywał się DrWeb.cvs
• Zrestartuj komputer - to bardzo ważne, ponieważ Dr Web niektóre pliki będzie mógł wyleczyć/usunąć dopiero po restarcie!
• Za pomocą notatnika otwórz plik DrWeb.csv i wklej jego zawartość na forum w znacznikach [code] na forum, albo na stronie http://www.wklej.org, a w poście daj tylko linka.

[Filas]

Kod: Zaznacz wszystko

PerX.exe;C:\Documents and Settings\filas312\DoctorWeb\Quarantine;BackDoor.Poison.2753;Niewyleczalny.Przeniesiony.;
p19.exe;C:\Documents and Settings\filas312\Documents\Downloads;Prawdopodobnie BACKDOOR.Trojan;;
Project1.exe;C:\Documents and Settings\filas312\Downloads;Program.Monitor.1358;;
bfbc2_privatcracked.exe;C:\Documents and Settings\filas312\Downloads\bfbc2_privathack_cracked\bfbc2_privathack_cracked;Trojan.PWS.Kunden.2;Usunięty.;
32bitversion.exe;C:\Documents and Settings\filas312\Downloads\bfbc2_privathack_cracked\bfbc2_privathack_cracked\32 Bit;Trojan.PWS.Kunden.2;Usunięty.;
bfbc2_privatcracked.exe;C:\Documents and Settings\filas312\Downloads\bfbc2_privathack_cracked\bfbc2_privathack_cracked\64 Bit;Trojan.PWS.Kunden.2;Usunięty.;
CoD 4.exe;C:\Documents and Settings\filas312\Downloads\cod;Trojan.PWS.Siggen.6777;Niewyleczalny.Przeniesiony.;
CoD4Bot.Mombot.Cracked.exe;C:\Documents and Settings\filas312\Downloads\CoD4Bot.Mombot.Cracked;Trojan.PWS.Lineage;Usunięty.;
Injector.exe;C:\Documents and Settings\filas312\Downloads\MHP;Trojan.Siggen1.62490;Niewyleczalny.Przeniesiony.;
p19.exe;C:\Documents and Settings\filas312\Moje dokumenty\Downloads;Prawdopodobnie BACKDOOR.Trojan;;
WPE PRO.exe;C:\fil\Prizee Hack\Blazing Flames, Snuggy Pilot  i inne;Program.Wpe;;
WpeSpy.dll;C:\fil\Prizee Hack\Blazing Flames, Snuggy Pilot  i inne;Trojan.WpePro;Usunięty.;
Blaero Start Orb - Normal Taskbar.exe;C:\fil\vistatransf\Normal Taskbar;Trojan.PWS.Spy.1986;Niewyleczalny.Przeniesiony.;
Start Button - Normal Taskbar.exe;C:\fil\vistatransf\Normal Taskbar;Trojan.PWS.Spy.4236;Niewyleczalny.Przeniesiony.;
Process.exe;C:\firefox\SmitfraudFix;Tool.Killproc.3;;
restart.exe;C:\firefox\SmitfraudFix;Tool.ShutDown.14;;
AutoLoader_DT_loader_0.4.exe;C:\Program Files\DAEMON Tools Pro;Trojan.Siggen1.33641;Niewyleczalny.Przeniesiony.;
DT_loader_0.4.exe;C:\Program Files\DAEMON Tools Pro;Trojan.Siggen2.259;Niewyleczalny.Przeniesiony.;
Process.exe;C:\SDFix\apps;Tool.Killproc.3;;
Process.exe;C:\SDFix\SDFix\apps;Tool.Killproc.3;;
p19.exe;C:\Users\filas312\Documents\Downloads;Prawdopodobnie BACKDOOR.Trojan;;
Project1.exe;C:\Users\filas312\Downloads;Program.Monitor.1358;;
4921bce5.qua\data001;C:\Windows.old\Documents and Settings\All Users\Dane aplikacji\AntiVir PersonalEdition Classic\INFECTED\4921bce5.qua;Trojan.Siggen.224;;
4921bce5.qua;C:\Windows.old\Documents and Settings\All Users\Dane aplikacji\AntiVir PersonalEdition Classic\INFECTED;Kontener zawiera zainfekowane obiekty;Przeniesiony.;
4921bcf1.qua\data001;C:\Windows.old\Documents and Settings\All Users\Dane aplikacji\AntiVir PersonalEdition Classic\INFECTED\4921bcf1.qua;Trojan.Siggen.224;;
4921bcf1.qua;C:\Windows.old\Documents and Settings\All Users\Dane aplikacji\AntiVir PersonalEdition Classic\INFECTED;Kontener zawiera zainfekowane obiekty;Przeniesiony.;
4921c80e.qua\data001;C:\Windows.old\Documents and Settings\All Users\Dane aplikacji\AntiVir PersonalEdition Classic\INFECTED\4921c80e.qua;Trojan.Siggen.224;;
4921c80e.qua;C:\Windows.old\Documents and Settings\All Users\Dane aplikacji\AntiVir PersonalEdition Classic\INFECTED;Kontener zawiera zainfekowane obiekty;Przeniesiony.;
4921c9ae.qua\data001;C:\Windows.old\Documents and Settings\All Users\Dane aplikacji\AntiVir PersonalEdition Classic\INFECTED\4921c9ae.qua;Trojan.Siggen.224;;
4921c9ae.qua;C:\Windows.old\Documents and Settings\All Users\Dane aplikacji\AntiVir PersonalEdition Classic\INFECTED;Kontener zawiera zainfekowane obiekty;Przeniesiony.;
TeknoGods.dll;C:\Windows.old\Documents and Settings\filas312\Pulpit\Nowy folder;Trojan.Packed.436;Usunięty.;
TeknoGods.dll;C:\Windows.old\Documents and Settings\filas312\Pulpit\Nowy folder\TeknoGods_Beta12;Trojan.Packed.436;Usunięty.;
TogglerSP.exe;D:\PacSteamT\SteamApps\common\zero gear;Trojan.KillFiles.1009;Niewyleczalny.Przeniesiony.;
init.lua;D:\PacSteamT\SteamApps\filas312\garrysmod\garrysmod\Dismemberment Mod 1.9\lua\bodies\vortigaunt;Odmiana wirusa VBS.LoveLetter;Przeniesiony.;
List-C.bat;E:\327882R2FWJFW;Prawdopodobnie BATCH.Virus;;
psexec.cfexe;E:\327882R2FWJFW;Program.PsExec.171;;
TestDriveUnlimited.exe;E:\Downloads\Test Drive Unlimited - MegaPack (   CRACK) pobierz download(1)\Test Drive Unlimited - MegaPack ( + CRACK)\crack;Trojan.Elite.10;Usunięty.;
jcmtrn.exe;E:\Users\filas312\Desktop\Ikony\Bibeloty\giery;Trojan.Click.61356;Niewyleczalny.Przeniesiony.;
TeknoGods.dll;E:\Users\filas312\Desktop\Ikony\Bibeloty\soft;Trojan.Packed.436;Usunięty.;
C&C Zero Hour +3 Trainer English v 1.4.exe;F:\odzyskane\filas312\Pulpit\Games;Tool.GameCrack;;
Tc-C&CGeneralsV1.8.exe;F:\odzyskane\filas312\Pulpit\Games;Tool.GameCrack;;
ETcry.exe;F:\odzyskane\filas312\Pulpit\Games\trefne;Trojan.Click.34073;Niewyleczalny.Przeniesiony.;
jcmtrn.exe;F:\odzyskane\filas312\Pulpit\Games\trefne;Trojan.Click.61356;Niewyleczalny.Przeniesiony.;
yuri1001.exe;F:\odzyskane\filas312\Pulpit\Programy itp;Tool.GameCrack;;
jcmtrn.exe;F:\odzyskane\Kopia\C\Filas312\wszystko;Trojan.Click.61356;Niewyleczalny.Przeniesiony.;
mtatecfg.exe;F:\odzyskane\Kopia\C\Filas312\wszystko\Pulpet\mata;Tool.BuildSisDL.49;;
eaw1.2+2.exe.exe;F:\odzyskane\Kopia\C\Filas312\wszystko\Pulpet\wszystko\folderuś;Tool.GameCrack;;
jcmtrn.exe;F:\odzyskane\Kopia\C\Filas312\wszystko\Pulpet\wszystko\nowweee;Trojan.Click.61356;Niewyleczalny.Przeniesiony.;
Corel Paint Shop Pro X v10.03 Trial to Full by Great Elmo!!.EXE;F:\odzyskane\Kopia\dyszczek E\fil\photoshop & paintshop\CRACK PaintShopPro X;Tool.GameCrack;;
sd4hide.exe;F:\odzyskane\Kopia\dyszczek E\fil\simsole;Tool.DiskHide;;
yuri.pjt.exe;G:\fil\Firefox;Tool.GameCrack;;
yuri1001.exe;G:\fil\yr;Tool.GameCrack;;
ca_setup.exe;G:\Firefox;Tool.Cain.51;;
installer(2).exe;G:\Firefox;Trojan.DownLoad.50005;Niewyleczalny.Przeniesiony.;
installer-53243-18en-Portable-XnView-English.exe;G:\Firefox;Trojan.Click.19777;Usunięty.;
SetupRevelationV2.exe;G:\Firefox;Tool.ShowPass.26;;
JoyToKey.exe;G:\jtk374en;Trojan.MulDrop1.20335;Usunięty.;
init.lua;H:\ares i torrenty\dismemberment_mod_1.9_(2)\Dismemberment Mod 1.9\lua\bodies\vortigaunt;Odmiana wirusa VBS.LoveLetter;Przeniesiony.;
A0001304.exe;H:\System Volume Information\_restore{FF5A99B3-CBDD-4E14-B329-E6B074667326}\RP29;Trojan.PWS.Spy.1986;Niewyleczalny.Przeniesiony.;
A0001305.exe;H:\System Volume Information\_restore{FF5A99B3-CBDD-4E14-B329-E6B074667326}\RP29;Trojan.PWS.Spy.4236;Niewyleczalny.Przeniesiony.;
A0001371.exe;H:\System Volume Information\_restore{FF5A99B3-CBDD-4E14-B329-E6B074667326}\RP29;Program.Wpe;;
A0001372.dll;H:\System Volume Information\_restore{FF5A99B3-CBDD-4E14-B329-E6B074667326}\RP29;Trojan.WpePro;Usunięty.;
A0001721.exe;H:\System Volume Information\_restore{FF5A99B3-CBDD-4E14-B329-E6B074667326}\RP29;Tool.Killproc.3;;
A0001723.exe;H:\System Volume Information\_restore{FF5A99B3-CBDD-4E14-B329-E6B074667326}\RP29;Tool.ShutDown.14;;
A0002540.exe;H:\System Volume Information\_restore{FF5A99B3-CBDD-4E14-B329-E6B074667326}\RP29;Tool.Killproc.3;;
A0002607.exe;H:\System Volume Information\_restore{FF5A99B3-CBDD-4E14-B329-E6B074667326}\RP29;Tool.Killproc.3;;
A0005072.exe;H:\System Volume Information\_restore{FF5A99B3-CBDD-4E14-B329-E6B074667326}\RP29;Trojan.Click.61356;Niewyleczalny.Przeniesiony.;


http://www.speedyshare.com/files/23811832/virusinfo_syscheck.zip

[NieWiem]

Dzisiaj i tak juz nic nie zrobimy. Jutro bede od 8 rano to bede sie przygladal sprawie.

Dodano Dzisiaj, 16:48:
Spróbuj uruchomić ComboFixa, jeśli nie da rady to przynajmniej nowe logi z poziomu OTL.

[Filas]

Dało radę odpalić CFa z awaryjki. Mogę już ubijać explorera

Kod: Zaznacz wszystko

ComboFix 10-08-12.03 - filas312 2010-08-17  16:05:19.1.2 - x86 MINIMAL
Microsoft Windows 7 Ultimate   6.1.7600.0.1250.48.1045.18.4095.3373 [GMT 2:00]
Uruchomiony z: c:\users\filas312\Downloads\cfx.exe
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\data
c:\users\filas312\AppData\Local\Microsoft\Windows\Temporary Internet Files\Sys5889.Data Repository.sys
c:\users\filas312\AppData\Roaming\EurekaLog
c:\users\filas312\AppData\Roaming\EurekaLog\EurekaLog.ini
c:\users\filas312\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\updpxe32.exe
c:\windows\system32\Explorer
c:\windows\system32\Explorer\cd.txt
c:\windows\system32\Explorer\Decrypt.txt
c:\windows\system32\Explorer\melt.txt
c:\windows\system32\Explorer\pic\Img%.jpeg
c:\windows\system32\Explorer\pic\Img1.jpeg
c:\windows\system32\Explorer\pic\Img10.jpeg
c:\windows\system32\Explorer\pic\Img11.jpeg
c:\windows\system32\Explorer\pic\Img2.jpeg
c:\windows\system32\Explorer\pic\Img3.jpeg
c:\windows\system32\Explorer\pic\Img4.jpeg
c:\windows\system32\Explorer\pic\Img5.jpeg
c:\windows\system32\Explorer\pic\Img6.jpeg
c:\windows\system32\Explorer\pic\Img7.jpeg
c:\windows\system32\Explorer\pic\Img8.jpeg
c:\windows\system32\Explorer\pic\Img9.jpeg
c:\windows\system32\themeservice.dll.Back
c:\windows\system32\themeui.dll.Back
c:\windows\system32\uxtheme.dll.Back
D:\install.exe
E:\explorer.exe
E:\install.exe
G:\BASSMOD.DLL
H:\install.exe

.
(((((((((((((((((((((((((((((((((((((((   Sterowniki/Usługi   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_PROCEXP141


(((((((((((((((((((((((((   Pliki utworzone od 2010-07-17 do 2010-08-17  )))))))))))))))))))))))))))))))
.

2010-08-17 14:11 . 2010-08-17 14:12   --------   d-----w-   c:\users\filas312\AppData\Local\temp
2010-08-17 14:11 . 2010-08-17 14:11   --------   d-----w-   c:\users\Default\AppData\Local\temp
2010-08-16 09:49 . 2010-08-16 09:49   --------   d-----w-   c:\program files\Seagate
2010-08-15 16:16 . 2010-08-15 16:16   3288   ------w-   C:\bootsqm.dat
2010-08-15 14:26 . 2010-08-15 19:04   --------   d-----w-   c:\program files\ModernRcon
2010-08-14 22:11 . 2010-08-14 22:11   --------   d-----w-   c:\users\filas312\AppData\Local\G4G.PL
2010-08-14 11:03 . 2010-08-14 13:23   --------   d-----w-   c:\users\filas312\DoctorWeb
2010-08-14 10:02 . 2010-08-14 10:02   --------   d-----w-   c:\program files\Trend Micro
2010-08-13 14:51 . 2010-08-13 14:51   --------   d-----w-   c:\program files\Microsoft Games for Windows - LIVE
2010-08-13 14:51 . 2010-08-13 14:51   --------   d-----w-   c:\windows\system32\xlive
2010-08-13 14:50 . 2010-08-13 14:50   --------   d-----w-   c:\windows\6833245EDD86479A882A8360D62C8194.TMP
2010-08-13 00:40 . 2010-08-13 00:40   --------   d-----w-   c:\program files\Lavalys
2010-08-10 18:14 . 2010-08-10 18:14   --------   d-----w-   c:\programdata\EA Core
2010-08-10 18:14 . 2010-08-10 18:14   --------   d-----w-   c:\programdata\Electronic Arts
2010-08-10 11:20 . 2010-08-10 11:20   --------   d-----w-   c:\program files\Google
2010-08-09 22:54 . 2010-08-09 22:54   --------   d-----w-   c:\users\filas312\AppData\Local\Midway
2010-08-09 13:20 . 2010-08-09 13:20   --------   d-----w-   c:\program files\Poedit
2010-08-08 18:44 . 2010-08-08 18:44   --------   d-----w-   c:\windows\45235788142C44BE8A4DDDE9A84492E5.TMP
2010-08-07 17:52 . 2010-08-07 17:52   --------   d-----w-   c:\users\filas312\AppData\Roaming\PowerUp Software
2010-08-07 17:52 . 2010-08-07 17:52   --------   d-----w-   c:\programdata\PowerUp Software
2010-08-07 17:51 . 2008-04-13 18:11   619008   ----a-w-   c:\windows\system32\dx7vb.dll
2010-08-07 17:51 . 2008-01-13 15:36   91632   ----a-w-   c:\windows\system32\dsofile.dll
2010-08-07 17:51 . 2001-04-05 05:43   94208   --s---r-   c:\windows\system32\msstkprp.dll
2010-08-07 17:51 . 1998-06-17 22:00   89360   ----a-w-   c:\windows\system32\VB5DB.DLL
2010-08-07 17:51 . 2010-08-17 08:31   119296   ----a-w-   c:\windows\system32\zlib.dll
2010-08-07 17:51 . 2010-08-07 17:51   --------   d-----w-   c:\program files\PowerUp Software
2010-08-07 17:51 . 2008-01-13 18:59   36864   ----a-w-   c:\windows\system32\dxinputdll.dll
2010-08-07 17:51 . 2003-01-26 12:41   40960   ----a-w-   c:\windows\system32\SSubTmr6.dll
2010-08-07 17:51 . 1999-05-17 12:55   57344   ------w-   c:\windows\system32\ADsSecurity.dll
2010-08-04 20:02 . 2010-08-04 20:02   --------   d-----w-   c:\program files\GOG.com
2010-08-04 17:56 . 2010-08-04 21:36   1048   ----a-w-   c:\windows\eReg.dat
2010-08-03 23:02 . 2010-08-03 23:02   --------   d-----w-   c:\program files\NovodexRocket_1_1
2010-08-03 13:56 . 2010-08-03 13:56   --------   d-----w-   c:\users\filas312\AppData\Roaming\W
2010-08-03 13:55 . 2010-08-03 13:55   --------   d-----w-   c:\users\filas312\AppData\Roaming\wargaming.net
2010-08-03 11:53 . 2010-08-03 11:54   --------   d-----w-   c:\users\filas312\AppData\Roaming\Command and Conquer 3 Tiberium Wars
2010-07-28 20:58 . 2010-07-28 20:58   --------   d-----w-   c:\users\filas312\AppData\Local\CrashRpt
2010-07-27 12:53 . 2010-07-27 12:53   --------   d-----w-   c:\users\filas312\AppData\Roaming\Locktime
2010-07-27 12:33 . 2010-07-27 12:33   --------   d-----w-   c:\programdata\Locktime
2010-07-27 12:19 . 2010-06-16 15:07   334040   ------w-   c:\windows\system32\cfosspeed.dll
2010-07-27 11:08 . 2010-07-27 11:08   --------   d-----w-   c:\programdata\Nexon
2010-07-27 10:46 . 2010-07-27 10:46   --------   d-----w-   c:\program files\freedompeace
2010-07-27 10:42 . 2010-07-27 11:08   --------   d-----w-   c:\programdata\NexonEU
2010-07-27 01:07 . 2010-05-12 07:42   1467200   ----a-w-   c:\windows\system32\msvcr100d.dll
2010-07-27 01:02 . 2010-07-27 01:02   --------   d-----w-   c:\users\filas312\AppData\Local\freedompeace
2010-07-27 00:54 . 2010-07-27 00:54   --------   d-----w-   c:\programdata\NexonUS
2010-07-27 00:15 . 2010-07-27 00:59   --------   d-----w-   c:\users\filas312\AppData\Local\PMB Files
2010-07-27 00:15 . 2010-07-27 00:16   --------   d-----w-   c:\programdata\PMB Files
2010-07-27 00:15 . 2010-07-27 00:15   --------   d-----w-   c:\program files\Pando Networks
2010-07-24 18:02 . 2010-08-15 00:52   --------   d-----w-   c:\program files\DAEMON Tools Pro
2010-07-24 10:01 . 2010-07-24 10:01   --------   d-----w-   c:\users\filas312\AppData\Local\LAG
2010-07-24 10:01 . 2010-07-24 10:01   --------   d-----w-   c:\programdata\LAG
2010-07-24 10:01 . 2010-07-24 10:01   --------   d-----w-   c:\windows\11AE680750D24F5982B32C3E695E94C2.TMP
2010-07-24 09:13 . 2010-07-24 09:13   --------   d-----w-   c:\users\filas312\AppData\Roaming\InstallShield
2010-07-23 09:39 . 2010-07-23 09:39   --------   d-----w-   c:\users\filas312\AppData\Roaming\Jeskola
2010-07-23 09:33 . 2010-07-23 09:33   --------   d-----w-   c:\program files\Microsoft.NET
2010-07-23 09:32 . 2009-11-25 19:47   49472   ----a-w-   c:\windows\system32\netfxperf.dll
2010-07-23 09:32 . 2009-11-25 19:47   297808   ----a-w-   c:\windows\system32\mscoree.dll
2010-07-23 09:32 . 2009-11-25 19:47   99176   ----a-w-   c:\windows\system32\PresentationHostProxy.dll
2010-07-23 09:32 . 2009-11-25 19:47   295264   ----a-w-   c:\windows\system32\PresentationHost.exe
2010-07-23 09:32 . 2009-11-25 19:47   1130824   ----a-w-   c:\windows\system32\dfshim.dll
2010-07-22 10:22 . 2010-07-22 11:48   --------   d-----w-   c:\program files\GameSpy Arcade
2010-07-22 08:58 . 2010-07-22 09:01   --------   d-----w-   c:\program files\Real War

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-17 13:08 . 2010-06-07 16:36   --------   d-----w-   c:\users\filas312\AppData\Roaming\mIRC
2010-08-17 13:08 . 2010-03-05 19:08   --------   d-----w-   c:\users\filas312\AppData\Roaming\foobar2000
2010-08-17 13:04 . 2010-06-07 16:36   --------   d-----w-   c:\program files\mIRC
2010-08-16 21:43 . 2010-03-23 21:21   --------   d-----w-   c:\users\filas312\AppData\Roaming\vlc
2010-08-16 21:05 . 2010-03-03 15:26   139128   ----a-w-   c:\windows\system32\drivers\PnkBstrK.sys
2010-08-16 17:30 . 2010-03-03 15:25   215128   ----a-w-   c:\windows\system32\PnkBstrB.exe
2010-08-16 16:05 . 2010-03-03 14:30   --------   d-----w-   c:\users\filas312\AppData\Roaming\Xfire
2010-08-16 09:49 . 2010-03-24 13:59   --------   d-----w-   c:\program files\Common Files\Wise Installation Wizard
2010-08-15 14:36 . 2010-03-07 20:06   --------   d-----w-   c:\users\filas312\AppData\Roaming\HLSW
2010-08-13 14:39 . 2010-03-07 18:42   --------   d--h--w-   c:\program files\InstallShield Installation Information
2010-08-13 08:53 . 2010-04-17 09:32   --------   d-----w-   c:\users\filas312\AppData\Roaming\Kadu
2010-08-12 13:57 . 2010-03-03 15:08   --------   d-----w-   c:\users\filas312\AppData\Roaming\uTorrent
2010-08-12 10:35 . 2010-04-11 18:56   --------   d-----w-   c:\program files\A-FF Find and Mount
2010-08-12 10:34 . 2010-08-12 10:34   16   ----a-w-   c:\users\filas312\AppData\Roaming\bawuho.dat
2010-08-11 14:55 . 2010-04-21 17:49   --------   d-----w-   c:\users\filas312\AppData\Roaming\Mumble
2010-08-10 22:25 . 2010-05-02 17:53   --------   d-----w-   c:\program files\TeamSpeak 3 Client
2010-08-10 20:18 . 2010-05-07 22:34   107888   ----a-w-   c:\windows\system32\CmdLineExt.dll
2010-08-10 19:15 . 2010-03-03 15:26   138056   ----a-w-   c:\users\filas312\AppData\Roaming\PnkBstrK.sys
2010-08-10 19:15 . 2010-03-03 15:26   138056   ----a-w-   c:\users\filas312\AppData\Roaming\PnkBstrK.sys
2010-08-10 19:14 . 2010-03-03 15:25   2434856   ----a-w-   c:\windows\system32\pbsvc_bc2.exe
2010-08-10 19:01 . 2010-03-27 12:26   --------   d-----w-   c:\program files\Common Files\Adobe AIR
2010-08-10 19:01 . 2010-08-10 18:11   53632   ----a-w-   c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-08-10 18:10 . 2010-08-10 18:14   53632   ----a-w-   c:\users\filas312\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-08-10 18:10 . 2010-03-07 18:42   --------   d-----w-   c:\program files\Electronic Arts
2010-08-09 22:53 . 2010-04-03 19:16   --------   d-----w-   c:\users\filas312\AppData\Roaming\IrfanView
2010-08-09 09:45 . 2010-03-03 15:20   --------   d-----w-   c:\program files\Common Files\Steam
2010-08-04 18:37 . 2010-03-03 14:38   59896   ----a-w-   c:\users\filas312\AppData\Local\GDIPFONTCACHEV1.DAT
2010-08-03 13:54 . 2010-08-03 13:54   2853   ----a-w-   c:\programdata\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
2010-08-03 13:54 . 2010-08-03 13:54   2853   ----a-w-   c:\programdata\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
2010-08-03 13:54 . 2010-08-03 13:54   2853   ----a-w-   c:\programdata\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
2010-08-03 13:54 . 2010-08-03 13:54   2853   ----a-w-   c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
2010-08-03 13:54 . 2010-08-03 13:54   2853   ----a-w-   c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
2010-08-03 13:54 . 2010-08-03 13:54   2853   ----a-w-   c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
2010-08-03 13:54 . 2010-08-03 13:54   2853   ----a-w-   c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
2010-08-03 13:54 . 2010-08-03 13:54   2853   ----a-w-   c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
2010-08-03 13:54 . 2010-08-03 13:54   2853   ----a-w-   c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
2010-08-03 13:54 . 2010-08-03 13:54   2853   ----a-w-   c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
2010-07-28 08:45 . 2010-06-17 15:04   90720   ---ha-w-   c:\windows\system32\mlfcache.dat
2010-07-27 22:15 . 2010-07-03 15:41   81408   ----a-w-   c:\users\filas312\AppData\Roaming\MotioninJoy\DS3tool\update\DS3_Tool.exe
2010-07-27 10:46 . 2010-07-27 10:46   70830   ----a-r-   c:\users\filas312\AppData\Roaming\Microsoft\Installer\{A944C55A-ECF0-42A9-B66C-0225C6428720}\_73D368264803CCFCACA48B.exe
2010-07-27 10:46 . 2010-07-27 10:46   70830   ----a-r-   c:\users\filas312\AppData\Roaming\Microsoft\Installer\{A944C55A-ECF0-42A9-B66C-0225C6428720}\_63B63CACF06671E288D570.exe
2010-07-27 00:54 . 2010-07-27 00:54   98304   ----a-w-   c:\programdata\NexonUS\NGM\npNxGameUS.dll
2010-07-24 20:00 . 2010-06-16 05:59   --------   d-----w-   c:\program files\WeGame
2010-07-24 18:02 . 2010-03-24 13:49   697328   ----a-w-   c:\windows\system32\drivers\sptd.sys
2010-07-24 09:15 . 2010-04-20 13:13   --------   d-----w-   c:\users\filas312\AppData\Roaming\Razer
2010-07-24 09:14 . 2010-04-19 17:21   --------   d-----w-   c:\programdata\Razer
2010-07-24 09:13 . 2010-04-19 17:21   --------   d-----w-   c:\program files\Razer
2010-07-23 09:35 . 2009-07-14 08:07   737242   ----a-w-   c:\windows\system32\perfh015.dat
2010-07-23 09:35 . 2009-07-14 08:07   153930   ----a-w-   c:\windows\system32\perfc015.dat
2010-07-22 10:21 . 2010-03-07 18:41   --------   d-----w-   c:\program files\Common Files\InstallShield
2010-07-20 19:13 . 2010-07-11 21:08   --------   d-----w-   c:\program files\Ai1
2010-07-20 13:03 . 2010-03-03 14:30   --------   d-----w-   c:\programdata\Xfire
2010-07-18 19:02 . 2010-03-31 20:30   --------   d-----w-   c:\program files\Uplink
2010-07-17 09:53 . 2010-07-17 09:53   22   --sha-w-   c:\windows\Sys3390 SettingsCollection.bin
2010-07-17 09:53 . 2010-07-17 09:53   22   --sha-w-   c:\users\filas312\AppData\Roaming\Sys6925.Config Collection.sys
2010-07-17 09:53 . 2010-07-17 09:53   22   --sha-w-   c:\users\filas312\AppData\Roaming\Sys6925.Config Collection.sys
2010-07-17 09:53 . 2010-07-17 09:53   --------   d-----w-   c:\program files\jv16 PowerTools 2010
2010-07-16 19:32 . 2010-04-02 08:28   --------   d-----w-   c:\program files\Microsoft Silverlight
2010-07-16 13:53 . 2010-05-29 15:09   --------   d-----w-   c:\users\filas312\AppData\Roaming\Dropbox
2010-07-16 13:52 . 2010-06-28 23:58   0   ----a-w-   c:\windows\system32\Access.dat
2010-07-16 13:39 . 2010-07-16 13:39   --------   d-----w-   c:\users\filas312\AppData\Roaming\Malwarebytes
2010-07-16 13:39 . 2010-07-16 13:39   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2010-07-16 13:39 . 2010-07-16 13:39   --------   d-----w-   c:\programdata\Malwarebytes
2010-07-16 00:15 . 2010-07-16 00:15   --------   d-----w-   c:\program files\MW2CU
2010-07-16 00:01 . 2010-07-16 00:01   --------   d-----w-   c:\program files\ExamDiff
2010-07-15 20:13 . 2005-02-24 20:31   --------   d-----w-   c:\program files\DAEMON Tools Lite
2010-07-14 16:07 . 2010-03-31 20:13   --------   d-----w-   c:\program files\Onlink
2010-07-13 05:23 . 2010-03-03 15:05   --------   d-----w-   c:\program files\Xfire
2010-07-12 13:50 . 2010-07-12 13:50   --------   d-----w-   c:\program files\Nem's Tools
2010-07-11 10:18 . 2010-07-11 10:18   --------   d-----w-   c:\program files\SpeedFan
2010-07-10 17:56 . 2010-07-10 17:56   --------   d-----w-   c:\program files\Advanced Port Scanner
2010-07-09 19:04 . 2010-07-09 19:04   41872   ----a-w-   c:\windows\system32\xfcodec.dll
2010-07-09 11:18 . 2010-07-09 19:08   20328   ----a-w-   c:\windows\system32\drivers\cpuz134_x32.sys
2010-07-09 09:59 . 2010-05-02 17:53   --------   d-----w-   c:\users\filas312\AppData\Roaming\TS3Client
2010-07-08 14:04 . 2010-05-03 00:19   --------   d-----w-   c:\users\filas312\AppData\Roaming\TeamViewer
2010-07-08 14:03 . 2010-07-08 14:03   --------   d-----w-   c:\users\filas312\AppData\Roaming\UltraVNC
2010-07-08 14:02 . 2010-07-08 14:02   --------   d-----w-   c:\program files\UltraVNC
2010-07-08 13:56 . 2010-05-03 00:19   --------   d-----w-   c:\program files\TeamViewer
2010-07-08 13:55 . 2010-07-08 13:55   --------   d-----w-   c:\program files\QS
2010-07-07 15:25 . 2010-06-29 19:25   --------   d-----w-   c:\program files\Metin2
2010-07-06 22:16 . 2010-04-11 20:06   --------   d-----w-   c:\users\filas312\AppData\Roaming\Hamachi
2010-07-05 22:47 . 2010-07-05 22:38   --------   d-----w-   c:\program files\Hitman - Krwawa Forsa
2010-07-05 12:11 . 2010-07-05 12:11   --------   d-----w-   c:\users\filas312\AppData\Roaming\GameRanger
2010-07-03 15:55 . 2010-07-03 15:55   --------   d-----w-   c:\users\filas312\AppData\Roaming\Need for Speed World
2010-07-03 15:41 . 2010-07-03 15:41   51712   ----a-w-   c:\users\filas312\AppData\Roaming\MotioninJoy\DS3tool\update\drivers\x86\MijXfilt.sys
2010-07-03 15:41 . 2010-04-24 20:48   51712   ----a-w-   c:\windows\system32\drivers\mijxfilt.sys
2010-06-29 22:45 . 2010-06-29 22:45   1240800   ----a-w-   c:\users\filas312\AppData\Roaming\GameRanger\GameRanger\GameRanger.exe
2010-06-29 22:43 . 2010-06-29 22:43   159456   ----a-w-   c:\users\filas312\AppData\Roaming\GameRanger\GameRanger\Data\GameRanger.dll
2010-06-28 23:40 . 2010-05-02 23:08   --------   d-----w-   c:\users\filas312\AppData\Roaming\Skype
2010-06-28 22:00 . 2010-05-02 23:09   --------   d-----w-   c:\users\filas312\AppData\Roaming\skypePM
2010-06-28 21:10 . 2010-06-28 21:09   --------   d-----w-   c:\program files\Tunngle
2010-06-28 21:10 . 2010-06-28 21:09   --------   d-----w-   c:\users\filas312\AppData\Roaming\Tunngle
2010-06-28 21:09 . 2010-06-28 21:09   --------   d-----w-   c:\programdata\Tunngle
2010-06-28 19:58 . 2010-06-28 19:58   --------   d-----w-   c:\users\filas312\AppData\Roaming\Leawo
2010-06-28 19:56 . 2010-06-28 19:56   --------   d-----w-   c:\program files\Leawo
2010-06-25 17:57 . 2010-06-25 17:57   --------   d-----w-   c:\users\filas312\AppData\Roaming\Ahead
2010-06-25 17:57 . 2010-06-25 17:57   --------   d-----w-   c:\program files\Common Files\Ahead
2010-06-25 17:57 . 2010-06-25 17:57   --------   d-----w-   c:\program files\Nero
2010-06-25 09:32 . 2010-06-25 09:32   --------   d-----w-   c:\users\filas312\AppData\Roaming\Ubisoft
2010-06-25 09:32 . 2010-05-14 20:22   --------   d-----w-   c:\programdata\Ubisoft
2009-06-10 21:26 . 2009-07-14 02:04   9633792   --sha-r-   c:\windows\Fonts\StaticCache.dat
2010-05-09 15:31 . 2010-05-09 15:31   87552   --sh--w-   c:\windows\System32\h4x0r.dll
2009-07-14 01:14 . 2009-07-13 23:42   396800   --sha-w-   c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

------- Sigcheck -------

[-] 2010-03-03 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19   94208   ----a-w-   c:\users\filas312\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19   94208   ----a-w-   c:\users\filas312\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19   94208   ----a-w-   c:\users\filas312\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BigDog303"="c:\windows\VM303_STI.EXE" [2006-01-24 61440]
"P17RunE"="P17RunE.dll" [2007-05-09 18432]
"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2008-04-04 88584]
"Xfire Music"="c:\program files\Xfire\xfiremusic.exe" [2006-11-21 253650]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-05-27 102400]
"Lycosa"="c:\program files\Razer\Lycosa\razerhid.exe" [2007-11-20 147456]
"Lachesis"="c:\program files\Razer\Lachesis\razerhid.exe" [2009-11-10 248320]

c:\users\filas312\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Xfire.lnk - c:\program files\Xfire\Xfire.exe [2010-7-9 3493776]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Steam.lnk - d:\pacsteamt\Steam.exe [2009-10-10 1242448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WeGame.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WeGame.lnk
backup=c:\windows\pss\WeGame.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^filas312^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\filas312\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2010-03-06 01:44   500208   ------w-   c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2008-08-14 06:58   611712   ----a-w-   c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-02-22 02:57   406992   ----a-w-   c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICustomerCare]
2010-03-04 12:31   311296   ----a-w-   c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-04-12 22:46   1135912   ----a-w-   c:\program files\DivX\DivX Update\DivXUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-03-03 14:49   135664   ----atw-   c:\users\filas312\AppData\Local\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
2007-09-04 17:25   81920   ----a-w-   c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 10:43   248040   ----a-w-   c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
2010-02-19 11:37   517096   ----a-w-   c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VolPanel]
2009-07-07 12:13   241789   ------w-   c:\program files\Creative\Volume Panel\VolPanlu.exe

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.SYS [2009-06-23 99352]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2010-03-26 79360]
R3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.SYS [2009-06-23 555032]
R3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.SYS [2009-06-23 100888]
R3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.SYS [2009-06-23 566296]
R3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys [2010-07-03 51712]
R3 SliceDisk5;SliceDisk5;c:\program files\A-FF Find and Mount\slicedisk.sys [2008-04-03 10240]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys [2009-09-16 27136]
R3 WatAdminSvc;Usługa Technologie aktywacji systemu Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-03-03 1343400]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-07-24 697328]
R4 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R4 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-07-06 173352]
R4 TunngleService;TunngleService;c:\program files\Tunngle\TnglCtrl.exe [2010-06-23 715512]
S1 atitray;atitray;c:\program files\Ray Adams\ATI Tray Tools\atitray.sys [2010-04-22 19232]
S1 se32;EnTech softEngine;c:\windows\system32\drivers\se32.sys [2007-05-03 12112]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-05-27 176128]
S2 cpuz133;cpuz133;c:\windows\system32\drivers\cpuz133_x32.sys [2010-03-30 20968]
S2 cpuz134;cpuz134;c:\windows\system32\drivers\cpuz134_x32.sys [2010-07-09 20328]
S2 PStrip;PStrip;c:\windows\system32\DRIVERS\PSTRIP.SYS [2007-07-15 27992]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-05-27 5586432]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-05-27 209920]
S3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\DRIVERS\vrtaucbl.sys [2009-05-15 42496]
S3 LachesisFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys [2009-09-28 12032]


--- Inne Usługi/Sterowniki w Pamięci ---

*Deregistered* - gjvmndhi
.
Zawartość folderu 'Zaplanowane zadania'

2010-08-16 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3105989464-1593778788-2663742427-1000Core.job
- c:\users\filas312\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-03 14:49]

2010-08-17 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3105989464-1593778788-2663742427-1000UA.job
- c:\users\filas312\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-03 14:49]
.
.
------- Skan uzupełniający -------
.
uStart Page =
TCP: {7B829223-5454-43E0-891E-FBCEB27EE3B8} = 83.238.44.4,83.238.44.3
FF - ProfilePath - c:\users\filas312\AppData\Roaming\Mozilla\Firefox\Profiles\tb7oozw9.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\users\filas312\AppData\Local\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\users\filas312\AppData\Roaming\Mozilla\Firefox\Profiles\tb7oozw9.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll
.
- - - - USUNIĘTO PUSTE WPISY - - - -

AddRemove-Beta-EU - c:\program files\Realtime Worlds\APB\Beta-EU\uninstall.exe
AddRemove-Call of Duty Modern Warfare 2_is1 - g:\gry\Call of Duty Modern Warfare 2\unins000.exe
AddRemove-Earth 2160 - h:\gry\EARTH2~1\Uninstall_Earth2160.exe
AddRemove-MOTORM4X - h:\gry\MotorM4X\uninstall.exe
AddRemove-Sniper Elite PL_is1 - h:\gry\Sniper Elite\unins000.exe
AddRemove-Unreal Tournament 2004_is1 - h:\gry\UT2004\unins000.exe
AddRemove-{1064CABD-7390-4336-94E4-8A53DFBCB636}_is1 - g:\gry\GTL\Support\unins000.exe
AddRemove-{5A0B7BA5-4682-4273-81C2-69B17E649103} - c:\program files\InstallShield Installation Information\{5A0B7BA5-4682-4273-81C2-69B17E649103}\setup.exe
AddRemove-{7B2CC3DF-64FA-44AE-8F57-B0F915147E4F}_is1 - h:\gry\Need For Speed World\unins000.exe



[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gjvmndhi]

.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

[HKEY_USERS\S-1-5-21-3105989464-1593778788-2663742427-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:38,56,fe,8d,a3,0e,d8,a9,92,38,11,52,24,12,3e,35,f0,56,f0,2d,0f,34,f4,
   78,61,36,d6,85,c5,b9,6a,77,b7,54,1a,25,eb,e0,53,19,06,89,c5,bc,64,27,b7,28,\
"??"=hex:3f,eb,b2,a8,d5,51,4b,c2,1b,01,ec,08,0f,18,11,95

[HKEY_USERS\S-1-5-21-3105989464-1593778788-2663742427-1000\Software\SecuROM\License information*]
"datasecu"=hex:ef,7f,34,4b,0c,5a,44,fa,a9,e0,07,af,20,9b,bc,63,bf,40,81,89,3d,
   8d,37,16,29,d9,15,16,3a,3b,a7,8b,81,8a,0f,6e,b2,02,d6,03,a3,38,ee,ac,98,80,\
"rkeysecu"=hex:d9,6f,58,8f,46,7b,7a,96,27,37,73,6b,ad,da,28,aa

[HKEY_USERS\S-1-5-21-3105989464-1593778788-2663742427-1000\¬ Ä*Y*]
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-3105989464-1593778788-2663742427-1000\¬ 
4*]
@Allowed: (Read) (RestrictedCode)
DUMPHIVE0.003 (REGF)

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'Explorer.exe'(3076)
c:\program files\Xfire\xfire_toucan_43094.dll
c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
c:\program files\TortoiseSVN\bin\TortoiseStub.dll
c:\program files\TortoiseSVN\bin\TortoiseSVN.dll
c:\program files\TortoiseSVN\bin\intl3_tsvn.dll
c:\users\filas312\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
c:\users\filas312\AppData\Local\Temp\catchme.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\AUDIODG.EXE
c:\windows\system32\atieclxx.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\windows\System32\rundll32.exe
c:\program files\TortoiseSVN\bin\TSVNCache.exe
c:\program files\Razer\Lachesis\OSD.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Razer\Lachesis\razertra.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Razer\Lachesis\razerofa.exe
c:\users\filas312\AppData\Local\Google\Chrome\Application\chrome.exe
c:\users\filas312\AppData\Local\Google\Chrome\Application\chrome.exe
.
**************************************************************************
.
Czas ukończenia: 2010-08-17  16:17:11 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2010-08-17 14:17

Przed: 1 399 091 200 bajtów wolnych
Po: 2 471 854 080 bajtów wolnych

- - End Of File - - 40D4766BDB8566BAE8E9AF2C97296CA1


[NieWiem]

= = = = = C o m b o F i x = = = = =

Zamknij wszystko nad czym aktualnie pracujesz.
Upewnij się, że żadne programy AV, FW, AS nie działają - mogą przeszkadzać ComboFixowi.

Skopiuj zawartość ramki do notatnika:

Kod: Zaznacz wszystko

File::
C:\bootsqm.dat
c:\windows\6833245EDD86479A882A8360D62C8194.TMP
c:\windows\45235788142C44BE8A4DDDE9A84492E5.TMP
c:\windows\11AE680750D24F5982B32C3E695E94C2.TMP
c:\users\filas312\AppData\Roaming\bawuho.dat

Driver::
gjvmndhi

Registry::
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\gjvmndhi]



Plik -> zapisz jako -> CFScript.txt
Po czym plik ten zapisujesz na pulpicie i przeciągasz na ikonę ComboFixa jak na obrazku poniżej:



Gdy program ukończy, wygeneruje loga. Proszę go wkleić.

Możesz to zrobić z trybu awaryjnego, ale jeszcze lepiej by było, gdyby się dało z poziomu normalnego

[Filas]

CF poleciał ze skryptu.

Kod: Zaznacz wszystko

ComboFix 10-08-24.0A - filas312 2010-08-25  13:56:57.2.2 - x86
Microsoft Windows 7 Ultimate   6.1.7600.0.1250.48.1045.18.4095.3023 [GMT 2:00]
Uruchomiony z: c:\users\filas312\Downloads\combos.exe
Użyto następujących komend :: c:\users\filas312\Downloads\CFScript.txt

FILE ::
"C:\bootsqm.dat"
"c:\users\filas312\AppData\Roaming\bawuho.dat"
"c:\windows\11AE680750D24F5982B32C3E695E94C2.TMP"
"c:\windows\45235788142C44BE8A4DDDE9A84492E5.TMP"
"c:\windows\6833245EDD86479A882A8360D62C8194.TMP"
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\filas312\AppData\Roaming\bawuho.dat
c:\users\filas312\AppData\Roaming\filas3123SQLite3.dll
c:\users\filas312\AppData\Roaming\logs.dat
c:\users\filas312\AppData\Roaming\SQLite3.dll
c:\windows\system32\ealregsnapshot1.reg

c:\windows\system32\wininit.exe . . . jest zainfekowany!!

.
(((((((((((((((((((((((((((((((((((((((   Sterowniki/Usługi   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_GJVMNDHI
-------\Service_gjvmndhi


(((((((((((((((((((((((((   Pliki utworzone od 2010-07-25 do 2010-08-25  )))))))))))))))))))))))))))))))
.

2010-08-25 12:04 . 2010-08-25 12:04   --------   d-----w-   c:\users\Public\AppData\Local\temp
2010-08-25 12:04 . 2010-08-25 12:04   --------   d-----w-   c:\users\Default\AppData\Local\temp
2010-08-25 10:23 . 2010-08-25 10:23   --------   d-----w-   c:\users\filas312\AppData\Local\Locktime
2010-08-24 21:46 . 2010-08-24 21:46   --------   d-----w-   c:\program files\NetLimiter 3
2010-08-24 17:40 . 2010-08-24 17:40   --------   d-----w-   C:\vcs5BGEffects
2010-08-24 17:39 . 2007-06-28 16:02   102400   ----a-w-   c:\program files\Vcs6Hook.dll
2010-08-24 17:28 . 2010-08-24 17:28   --------   d-----w-   c:\users\filas312\AppData\Roaming\Avnex
2010-08-24 17:28 . 2010-08-24 17:32   --------   d-----w-   C:\AV_LOGS
2010-08-24 17:27 . 2008-12-26 10:56   17792   ----a-w-   c:\windows\system32\drivers\vcsvad.sys
2010-08-24 17:23 . 2010-08-24 17:23   --------   d-----w-   c:\users\filas312\AppData\Roaming\Screaming Bee
2010-08-22 18:08 . 2010-08-22 18:08   --------   d-----w-   c:\users\filas312\AppData\Local\Opera
2010-08-22 18:08 . 2010-08-22 18:08   --------   d-----w-   c:\program files\Opera
2010-08-21 09:47 . 2010-08-21 09:51   --------   d-----w-   C:\OP&ED
2010-08-20 20:39 . 2010-08-20 20:48   --------   d-----w-   C:\!KillBox
2010-08-20 20:38 . 2010-08-20 20:38   --------   d-----w-   c:\program files\Unlocker
2010-08-20 13:34 . 2010-08-20 13:34   --------   d-----w-   c:\users\filas312\AppData\Local\Criterion Games
2010-08-17 14:11 . 2010-08-25 12:07   --------   d-----w-   c:\users\filas312\AppData\Local\temp
2010-08-16 09:49 . 2010-08-16 09:49   --------   d-----w-   c:\program files\Seagate
2010-08-15 14:26 . 2010-08-15 19:04   --------   d-----w-   c:\program files\ModernRcon
2010-08-14 22:11 . 2010-08-14 22:11   --------   d-----w-   c:\users\filas312\AppData\Local\G4G.PL
2010-08-14 11:03 . 2010-08-14 13:23   --------   d-----w-   c:\users\filas312\DoctorWeb
2010-08-14 10:02 . 2010-08-14 10:02   --------   d-----w-   c:\program files\Trend Micro
2010-08-13 14:51 . 2010-08-13 14:51   --------   d-----w-   c:\program files\Microsoft Games for Windows - LIVE
2010-08-13 14:51 . 2010-08-13 14:51   --------   d-----w-   c:\windows\system32\xlive
2010-08-13 14:50 . 2010-08-13 14:50   --------   d-----w-   c:\windows\6833245EDD86479A882A8360D62C8194.TMP
2010-08-13 00:40 . 2010-08-13 00:40   --------   d-----w-   c:\program files\Lavalys
2010-08-12 10:34 . 2010-08-25 12:04   585472   ----a-w-   c:\windows\system32\drivers\gjvmndhi.sys
2010-08-10 18:14 . 2010-08-10 18:14   --------   d-----w-   c:\programdata\EA Core
2010-08-10 18:14 . 2010-08-10 18:14   --------   d-----w-   c:\programdata\Electronic Arts
2010-08-10 11:20 . 2010-08-10 11:20   --------   d-----w-   c:\program files\Google
2010-08-09 22:54 . 2010-08-09 22:54   --------   d-----w-   c:\users\filas312\AppData\Local\Midway
2010-08-09 13:20 . 2010-08-09 13:20   --------   d-----w-   c:\program files\Poedit
2010-08-08 18:44 . 2010-08-08 18:44   --------   d-----w-   c:\windows\45235788142C44BE8A4DDDE9A84492E5.TMP
2010-08-07 17:52 . 2010-08-07 17:52   --------   d-----w-   c:\users\filas312\AppData\Roaming\PowerUp Software
2010-08-07 17:52 . 2010-08-07 17:52   --------   d-----w-   c:\programdata\PowerUp Software
2010-08-07 17:51 . 2008-04-13 18:11   619008   ----a-w-   c:\windows\system32\dx7vb.dll
2010-08-07 17:51 . 2008-01-13 15:36   91632   ----a-w-   c:\windows\system32\dsofile.dll
2010-08-07 17:51 . 2001-04-05 05:43   94208   --s---r-   c:\windows\system32\msstkprp.dll
2010-08-07 17:51 . 1998-06-17 22:00   89360   ----a-w-   c:\windows\system32\VB5DB.DLL
2010-08-07 17:51 . 2010-08-24 22:06   119296   ----a-w-   c:\windows\system32\zlib.dll
2010-08-07 17:51 . 2010-08-07 17:51   --------   d-----w-   c:\program files\PowerUp Software
2010-08-07 17:51 . 2008-01-13 18:59   36864   ----a-w-   c:\windows\system32\dxinputdll.dll
2010-08-07 17:51 . 2003-01-26 12:41   40960   ----a-w-   c:\windows\system32\SSubTmr6.dll
2010-08-07 17:51 . 1999-05-17 12:55   57344   ------w-   c:\windows\system32\ADsSecurity.dll
2010-08-04 20:02 . 2010-08-04 20:02   --------   d-----w-   c:\program files\GOG.com
2010-08-04 17:56 . 2010-08-04 21:36   1048   ----a-w-   c:\windows\eReg.dat
2010-08-03 23:02 . 2010-08-03 23:02   --------   d-----w-   c:\program files\NovodexRocket_1_1
2010-08-03 13:56 . 2010-08-03 13:56   --------   d-----w-   c:\users\filas312\AppData\Roaming\W
2010-08-03 13:55 . 2010-08-03 13:55   --------   d-----w-   c:\users\filas312\AppData\Roaming\wargaming.net
2010-08-03 11:53 . 2010-08-03 11:54   --------   d-----w-   c:\users\filas312\AppData\Roaming\Command and Conquer 3 Tiberium Wars
2010-07-28 20:58 . 2010-07-28 20:58   --------   d-----w-   c:\users\filas312\AppData\Local\CrashRpt
2010-07-27 12:53 . 2010-07-27 12:53   --------   d-----w-   c:\users\filas312\AppData\Roaming\Locktime
2010-07-27 12:33 . 2010-07-27 12:33   --------   d-----w-   c:\programdata\Locktime
2010-07-27 12:19 . 2010-06-16 15:07   334040   ------w-   c:\windows\system32\cfosspeed.dll
2010-07-27 11:08 . 2010-07-27 11:08   --------   d-----w-   c:\programdata\Nexon
2010-07-27 10:46 . 2010-07-27 10:46   --------   d-----w-   c:\program files\freedompeace
2010-07-27 10:42 . 2010-07-27 11:08   --------   d-----w-   c:\programdata\NexonEU
2010-07-27 01:07 . 2010-05-12 07:42   1467200   ----a-w-   c:\windows\system32\msvcr100d.dll
2010-07-27 01:02 . 2010-07-27 01:02   --------   d-----w-   c:\users\filas312\AppData\Local\freedompeace
2010-07-27 00:54 . 2010-07-27 00:54   --------   d-----w-   c:\programdata\NexonUS
2010-07-27 00:15 . 2010-07-27 00:59   --------   d-----w-   c:\users\filas312\AppData\Local\PMB Files
2010-07-27 00:15 . 2010-07-27 00:16   --------   d-----w-   c:\programdata\PMB Files
2010-07-27 00:15 . 2010-07-27 00:15   --------   d-----w-   c:\program files\Pando Networks

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-25 11:50 . 2010-03-05 19:08   --------   d-----w-   c:\users\filas312\AppData\Roaming\foobar2000
2010-08-25 11:40 . 2010-06-07 16:36   --------   d-----w-   c:\users\filas312\AppData\Roaming\mIRC
2010-08-25 11:40 . 2010-06-07 16:36   --------   d-----w-   c:\program files\mIRC
2010-08-24 22:49 . 2010-03-03 14:30   --------   d-----w-   c:\users\filas312\AppData\Roaming\Xfire
2010-08-24 22:06 . 2010-03-03 14:30   --------   d-----w-   c:\programdata\Xfire
2010-08-24 21:37 . 2010-04-21 17:49   --------   d-----w-   c:\users\filas312\AppData\Roaming\Mumble
2010-08-24 17:39 . 2010-03-03 15:08   --------   d-----w-   c:\users\filas312\AppData\Roaming\uTorrent
2010-08-24 17:36 . 2010-04-17 09:32   --------   d-----w-   c:\users\filas312\AppData\Roaming\Kadu
2010-08-24 10:23 . 2010-03-03 15:26   139128   ----a-w-   c:\windows\system32\drivers\PnkBstrK.sys
2010-08-24 10:23 . 2010-03-03 15:25   215128   ----a-w-   c:\windows\system32\PnkBstrB.exe
2010-08-20 20:45 . 2005-04-08 02:16   10425   ---ha-w-   c:\users\filas312\AppData\Roaming\filas312log.dat
2010-08-18 16:48 . 2010-06-05 10:40   --------   d-----w-   c:\programdata\regid.1986-12.com.adobe
2010-08-18 12:55 . 2010-03-07 20:06   --------   d-----w-   c:\users\filas312\AppData\Roaming\HLSW
2010-08-16 21:43 . 2010-03-23 21:21   --------   d-----w-   c:\users\filas312\AppData\Roaming\vlc
2010-08-16 09:49 . 2010-03-24 13:59   --------   d-----w-   c:\program files\Common Files\Wise Installation Wizard
2010-08-15 00:52 . 2010-07-24 18:02   --------   d-----w-   c:\program files\DAEMON Tools Pro
2010-08-13 14:39 . 2010-03-07 18:42   --------   d--h--w-   c:\program files\InstallShield Installation Information
2010-08-12 10:35 . 2010-04-11 18:56   --------   d-----w-   c:\program files\A-FF Find and Mount
2010-08-10 22:25 . 2010-05-02 17:53   --------   d-----w-   c:\program files\TeamSpeak 3 Client
2010-08-10 20:18 . 2010-05-07 22:34   107888   ----a-w-   c:\windows\system32\CmdLineExt.dll
2010-08-10 19:15 . 2010-03-03 15:26   138056   ----a-w-   c:\users\filas312\AppData\Roaming\PnkBstrK.sys
2010-08-10 19:15 . 2010-03-03 15:26   138056   ----a-w-   c:\users\filas312\AppData\Roaming\PnkBstrK.sys
2010-08-10 19:14 . 2010-03-03 15:25   2434856   ----a-w-   c:\windows\system32\pbsvc_bc2.exe
2010-08-10 19:01 . 2010-03-27 12:26   --------   d-----w-   c:\program files\Common Files\Adobe AIR
2010-08-10 19:01 . 2010-08-10 18:11   53632   ----a-w-   c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-08-10 18:10 . 2010-08-10 18:14   53632   ----a-w-   c:\users\filas312\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-08-10 18:10 . 2010-03-07 18:42   --------   d-----w-   c:\program files\Electronic Arts
2010-08-09 22:53 . 2010-04-03 19:16   --------   d-----w-   c:\users\filas312\AppData\Roaming\IrfanView
2010-08-09 09:45 . 2010-03-03 15:20   --------   d-----w-   c:\program files\Common Files\Steam
2010-08-04 18:37 . 2010-03-03 14:38   59896   ----a-w-   c:\users\filas312\AppData\Local\GDIPFONTCACHEV1.DAT
2010-08-03 13:54 . 2010-08-03 13:54   2853   ----a-w-   c:\programdata\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
2010-08-03 13:54 . 2010-08-03 13:54   2853   ----a-w-   c:\programdata\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
2010-08-03 13:54 . 2010-08-03 13:54   2853   ----a-w-   c:\programdata\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
2010-08-03 13:54 . 2010-08-03 13:54   2853   ----a-w-   c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
2010-08-03 13:54 . 2010-08-03 13:54   2853   ----a-w-   c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
2010-08-03 13:54 . 2010-08-03 13:54   2853   ----a-w-   c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
2010-08-03 13:54 . 2010-08-03 13:54   2853   ----a-w-   c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
2010-08-03 13:54 . 2010-08-03 13:54   2853   ----a-w-   c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
2010-08-03 13:54 . 2010-08-03 13:54   2853   ----a-w-   c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
2010-08-03 13:54 . 2010-08-03 13:54   2853   ----a-w-   c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
2010-07-28 08:45 . 2010-06-17 15:04   90720   ---ha-w-   c:\windows\system32\mlfcache.dat
2010-07-27 22:15 . 2010-07-03 15:41   81408   ----a-w-   c:\users\filas312\AppData\Roaming\MotioninJoy\DS3tool\update\DS3_Tool.exe
2010-07-27 10:46 . 2010-07-27 10:46   70830   ----a-r-   c:\users\filas312\AppData\Roaming\Microsoft\Installer\{A944C55A-ECF0-42A9-B66C-0225C6428720}\_73D368264803CCFCACA48B.exe
2010-07-27 10:46 . 2010-07-27 10:46   70830   ----a-r-   c:\users\filas312\AppData\Roaming\Microsoft\Installer\{A944C55A-ECF0-42A9-B66C-0225C6428720}\_63B63CACF06671E288D570.exe
2010-07-27 00:54 . 2010-07-27 00:54   98304   ----a-w-   c:\programdata\NexonUS\NGM\npNxGameUS.dll
2010-07-24 20:00 . 2010-06-16 05:59   --------   d-----w-   c:\program files\WeGame
2010-07-24 18:02 . 2010-03-24 13:49   697328   ----a-w-   c:\windows\system32\drivers\sptd.sys
2010-07-24 10:01 . 2010-07-24 10:01   --------   d-----w-   c:\programdata\LAG
2010-07-24 09:15 . 2010-04-20 13:13   --------   d-----w-   c:\users\filas312\AppData\Roaming\Razer
2010-07-24 09:14 . 2010-04-19 17:21   --------   d-----w-   c:\programdata\Razer
2010-07-24 09:13 . 2010-04-19 17:21   --------   d-----w-   c:\program files\Razer
2010-07-24 09:13 . 2010-07-24 09:13   --------   d-----w-   c:\users\filas312\AppData\Roaming\InstallShield
2010-07-23 09:39 . 2010-07-23 09:39   --------   d-----w-   c:\users\filas312\AppData\Roaming\Jeskola
2010-07-23 09:35 . 2009-07-14 08:07   737242   ----a-w-   c:\windows\system32\perfh015.dat
2010-07-23 09:35 . 2009-07-14 08:07   153930   ----a-w-   c:\windows\system32\perfc015.dat
2010-07-23 09:33 . 2010-07-23 09:33   --------   d-----w-   c:\program files\Microsoft.NET
2010-07-22 11:48 . 2010-07-22 10:22   --------   d-----w-   c:\program files\GameSpy Arcade
2010-07-22 10:21 . 2010-03-07 18:41   --------   d-----w-   c:\program files\Common Files\InstallShield
2010-07-22 09:01 . 2010-07-22 08:58   --------   d-----w-   c:\program files\Real War
2010-07-20 19:13 . 2010-07-11 21:08   --------   d-----w-   c:\program files\Ai1
2010-07-18 19:02 . 2010-03-31 20:30   --------   d-----w-   c:\program files\Uplink
2010-07-17 09:53 . 2010-07-17 09:53   22   --sha-w-   c:\windows\Sys3390 SettingsCollection.bin
2010-07-17 09:53 . 2010-07-17 09:53   22   --sha-w-   c:\users\filas312\AppData\Roaming\Sys6925.Config Collection.sys
2010-07-17 09:53 . 2010-07-17 09:53   22   --sha-w-   c:\users\filas312\AppData\Roaming\Sys6925.Config Collection.sys
2010-07-17 09:53 . 2010-07-17 09:53   --------   d-----w-   c:\program files\jv16 PowerTools 2010
2010-07-16 19:32 . 2010-04-02 08:28   --------   d-----w-   c:\program files\Microsoft Silverlight
2010-07-16 13:53 . 2010-05-29 15:09   --------   d-----w-   c:\users\filas312\AppData\Roaming\Dropbox
2010-07-16 13:52 . 2010-06-28 23:58   0   ----a-w-   c:\windows\system32\Access.dat
2010-07-16 13:39 . 2010-07-16 13:39   --------   d-----w-   c:\users\filas312\AppData\Roaming\Malwarebytes
2010-07-16 13:39 . 2010-07-16 13:39   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2010-07-16 13:39 . 2010-07-16 13:39   --------   d-----w-   c:\programdata\Malwarebytes
2010-07-16 00:15 . 2010-07-16 00:15   --------   d-----w-   c:\program files\MW2CU
2010-07-16 00:01 . 2010-07-16 00:01   --------   d-----w-   c:\program files\ExamDiff
2010-07-15 20:13 . 2005-02-24 20:31   --------   d-----w-   c:\program files\DAEMON Tools Lite
2010-07-14 16:07 . 2010-03-31 20:13   --------   d-----w-   c:\program files\Onlink
2010-07-13 05:23 . 2010-03-03 15:05   --------   d-----w-   c:\program files\Xfire
2010-07-12 13:50 . 2010-07-12 13:50   --------   d-----w-   c:\program files\Nem's Tools
2010-07-11 10:18 . 2010-07-11 10:18   --------   d-----w-   c:\program files\SpeedFan
2010-07-10 17:56 . 2010-07-10 17:56   --------   d-----w-   c:\program files\Advanced Port Scanner
2010-07-09 19:04 . 2010-07-09 19:04   41872   ----a-w-   c:\windows\system32\xfcodec.dll
2010-07-09 11:18 . 2010-07-09 19:08   20328   ----a-w-   c:\windows\system32\drivers\cpuz134_x32.sys
2010-07-09 09:59 . 2010-05-02 17:53   --------   d-----w-   c:\users\filas312\AppData\Roaming\TS3Client
2010-07-08 14:04 . 2010-05-03 00:19   --------   d-----w-   c:\users\filas312\AppData\Roaming\TeamViewer
2010-07-08 14:03 . 2010-07-08 14:03   --------   d-----w-   c:\users\filas312\AppData\Roaming\UltraVNC
2010-07-08 14:02 . 2010-07-08 14:02   --------   d-----w-   c:\program files\UltraVNC
2010-07-08 13:56 . 2010-05-03 00:19   --------   d-----w-   c:\program files\TeamViewer
2010-07-08 13:55 . 2010-07-08 13:55   --------   d-----w-   c:\program files\QS
2010-07-07 15:25 . 2010-06-29 19:25   --------   d-----w-   c:\program files\Metin2
2010-07-06 22:16 . 2010-04-11 20:06   --------   d-----w-   c:\users\filas312\AppData\Roaming\Hamachi
2010-07-05 22:47 . 2010-07-05 22:38   --------   d-----w-   c:\program files\Hitman - Krwawa Forsa
2010-07-05 12:11 . 2010-07-05 12:11   --------   d-----w-   c:\users\filas312\AppData\Roaming\GameRanger
2010-07-03 15:55 . 2010-07-03 15:55   --------   d-----w-   c:\users\filas312\AppData\Roaming\Need for Speed World
2010-07-03 15:41 . 2010-07-03 15:41   51712   ----a-w-   c:\users\filas312\AppData\Roaming\MotioninJoy\DS3tool\update\drivers\x86\MijXfilt.sys
2010-07-03 15:41 . 2010-04-24 20:48   51712   ----a-w-   c:\windows\system32\drivers\mijxfilt.sys
2010-06-29 22:45 . 2010-06-29 22:45   1240800   ----a-w-   c:\users\filas312\AppData\Roaming\GameRanger\GameRanger\GameRanger.exe
2010-06-29 22:43 . 2010-06-29 22:43   159456   ----a-w-   c:\users\filas312\AppData\Roaming\GameRanger\GameRanger\Data\GameRanger.dll
2010-06-28 23:40 . 2010-05-02 23:08   --------   d-----w-   c:\users\filas312\AppData\Roaming\Skype
2010-06-28 22:00 . 2010-05-02 23:09   --------   d-----w-   c:\users\filas312\AppData\Roaming\skypePM
2010-06-28 21:10 . 2010-06-28 21:09   --------   d-----w-   c:\program files\Tunngle
2010-06-28 21:10 . 2010-06-28 21:09   --------   d-----w-   c:\users\filas312\AppData\Roaming\Tunngle
2009-06-10 21:26 . 2009-07-14 02:04   9633792   --sha-r-   c:\windows\Fonts\StaticCache.dat
2010-05-09 15:31 . 2010-05-09 15:31   87552   --sh--w-   c:\windows\System32\h4x0r.dll
2009-07-14 01:14 . 2009-07-13 23:42   396800   --sha-w-   c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

------- Sigcheck -------

[-] 2010-03-03 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll
.
(((((((((((((((((((((((((((((   SnapShot@2010-08-17_14.12.39   )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-03-03 15:05 . 2010-08-25 10:24   35442              c:\windows\System32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 04:55 . 2010-08-25 12:08   36716              c:\windows\System32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-03-03 14:47 . 2010-08-25 12:08   13072              c:\windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-3105989464-1593778788-2663742427-1000_UserData.bin
- 2009-07-14 04:50 . 2010-08-12 18:40   86016              c:\windows\System32\DriverStore\infpub.dat
+ 2009-07-14 04:50 . 2010-08-24 22:07   86016              c:\windows\System32\DriverStore\infpub.dat
+ 2010-08-24 17:27 . 2008-12-26 10:56   17792              c:\windows\System32\DriverStore\FileRepository\vcsvad.inf_x86_neutral_25fd3c3be1a986d2\i386\vcsvad.sys
+ 2009-12-01 13:49 . 2009-12-01 13:49   34384              c:\windows\System32\DriverStore\FileRepository\sbaudio-x86.inf_x86_neutral_c5cfd53e5132b1c0\ScreamingBAudio.sys
+ 2009-12-01 13:49 . 2009-12-01 13:49   34384              c:\windows\System32\drivers\ScreamingBAudio.sys
- 2010-03-03 14:22 . 2010-08-16 09:51   16384              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-03-03 14:22 . 2010-08-24 21:39   16384              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-03-03 14:22 . 2010-08-24 21:39   65536              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-03-03 14:22 . 2010-08-16 09:51   65536              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-08-24 21:37 . 2010-08-24 21:39   32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\MSHist012010082420100825\index.dat
- 2009-07-14 04:41 . 2010-08-16 09:51   32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:41 . 2010-08-24 21:39   32768              c:\windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2009-07-14 04:34 . 2010-08-19 01:55   77296              c:\windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat
+ 2010-03-03 14:32 . 2010-08-25 12:05   16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
- 2010-03-03 14:32 . 2010-08-17 14:12   16384              c:\windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\Windows\Cookies\index.dat
+ 2010-03-03 15:02 . 2010-08-25 12:08   32768              c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
- 2010-03-03 15:02 . 2010-08-17 12:03   32768              c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Temporary Internet Files\Content.IE5\index.dat
- 2010-03-03 15:02 . 2010-08-17 12:03   16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\History\History.IE5\index.dat
+ 2010-03-03 15:02 . 2010-08-25 12:08   16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\History\History.IE5\index.dat
- 2010-03-03 15:02 . 2010-08-17 12:03   16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat
+ 2010-03-03 15:02 . 2010-08-25 12:08   16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Temp\Cookies\index.dat
+ 2010-03-03 14:32 . 2010-08-25 12:08   32768              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
- 2010-03-03 14:32 . 2010-08-17 14:12   32768              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\index.dat
+ 2010-03-03 14:32 . 2010-08-25 12:05   16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
- 2010-03-03 14:32 . 2010-08-17 14:12   16384              c:\windows\ServiceProfiles\LocalService\AppData\Local\Microsoft\Windows\History\History.IE5\index.dat
+ 2010-08-24 21:46 . 2010-08-24 21:46   63488              c:\windows\assembly\tmp\IVUPVGXB\NLStatsIo.dll
+ 2010-08-24 21:45 . 2010-08-24 21:45   63488              c:\windows\assembly\tmp\14WTPLFR\NLStatsIo.dll
+ 2010-08-24 22:07 . 2010-08-24 22:07   63488              c:\windows\assembly\GAC_MSIL\NLStatsIo\1.0.0.0__8d7d6f0fa78e0f7c\NLStatsIo.dll
- 2010-08-13 14:50 . 2010-08-13 14:50   12800              c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
+ 2010-08-20 13:27 . 2010-08-20 13:27   12800              c:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
+ 2010-08-20 13:27 . 2010-08-20 13:27   53248              c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
- 2010-08-13 14:50 . 2010-08-13 14:50   53248              c:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
+ 2010-08-25 10:22 . 2010-08-25 12:05   2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2010-08-25 10:22 . 2010-08-25 12:05   2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2010-08-11 09:05 . 2010-08-17 14:12   2048              c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 04:50 . 2010-08-12 18:40   143360              c:\windows\System32\DriverStore\infstrng.dat
+ 2009-07-14 04:50 . 2010-08-24 22:07   143360              c:\windows\System32\DriverStore\infstrng.dat
- 2009-07-14 04:50 . 2010-08-12 18:40   143360              c:\windows\System32\DriverStore\infstor.dat
+ 2009-07-14 04:50 . 2010-08-24 21:45   143360              c:\windows\System32\DriverStore\infstor.dat
+ 2010-03-03 14:26 . 2010-08-24 19:42   245760              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2010-03-03 14:26 . 2010-08-09 22:53   245760              c:\windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\IETldCache\index.dat
- 2009-07-14 04:47 . 2010-08-11 01:08   328800              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 04:47 . 2010-08-25 02:03   328800              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2010-08-20 13:30 . 2010-08-20 13:30   295606              c:\windows\Installer\{9A996B6A-846E-4A89-B9C4-17546B7BE49F}\Burnout.exe
- 2010-08-13 14:50 . 2010-08-13 14:50   223232              c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
+ 2010-08-20 13:27 . 2010-08-20 13:27   223232              c:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
+ 2010-08-20 13:27 . 2010-08-20 13:27   178176              c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
- 2010-08-13 14:50 . 2010-08-13 14:50   178176              c:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
- 2010-08-13 14:50 . 2010-08-13 14:50   364544              c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
+ 2010-08-20 13:27 . 2010-08-20 13:27   364544              c:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
- 2010-08-13 14:50 . 2010-08-13 14:50   159232              c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
+ 2010-08-20 13:27 . 2010-08-20 13:27   159232              c:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
- 2010-08-13 14:50 . 2010-08-13 14:50   145920              c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
+ 2010-08-20 13:27 . 2010-08-20 13:27   145920              c:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
+ 2010-08-20 13:27 . 2010-08-20 13:27   578560              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2010-08-13 14:50 . 2010-08-13 14:50   578560              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-08-20 13:27 . 2010-08-20 13:27   578560              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2010-08-13 14:50 . 2010-08-13 14:50   578560              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-08-20 13:27 . 2010-08-20 13:27   577536              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2010-08-13 14:50 . 2010-08-13 14:50   577536              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-08-20 13:27 . 2010-08-20 13:27   577536              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2010-08-13 14:50 . 2010-08-13 14:50   577536              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2010-08-13 14:50 . 2010-08-13 14:50   577024              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-08-20 13:27 . 2010-08-20 13:27   577024              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-08-20 13:27 . 2010-08-20 13:27   576000              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2010-08-13 14:50 . 2010-08-13 14:50   576000              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2010-08-13 14:50 . 2010-08-13 14:50   567296              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-08-20 13:27 . 2010-08-20 13:27   567296              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2010-08-13 14:50 . 2010-08-13 14:50   563712              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-08-20 13:27 . 2010-08-20 13:27   563712              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-08-20 13:27 . 2010-08-20 13:27   473600              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
- 2010-08-13 14:50 . 2010-08-13 14:50   473600              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
+ 2009-07-14 02:03 . 2010-08-25 10:37   7077888              c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT
- 2009-07-14 02:03 . 2010-08-17 09:22   7077888              c:\windows\System32\SMI\Store\Machine\SCHEMA.DAT
+ 2010-05-25 16:56 . 2010-05-25 16:56   5230088              c:\windows\System32\DriverStore\FileRepository\netsf.inf_x86_neutral_ab6a64950e5c044f\nlndis.sys
+ 2010-05-25 16:56 . 2010-05-25 16:56   5230088              c:\windows\System32\drivers\nlndis.sys
+ 2010-08-20 13:21 . 2010-08-20 13:21   6979584              c:\windows\Installer\b301ba.msi
+ 2010-08-24 21:46 . 2010-08-24 21:46   4263424              c:\windows\Installer\33a67.msi
+ 2008-12-12 18:58 . 2008-12-12 18:58   6979584              c:\windows\Installer\2a5928c.msi
+ 2010-08-24 22:07 . 2010-08-24 22:07   4263424              c:\windows\Installer\1c331.msi
+ 2010-08-20 13:27 . 2010-08-20 13:27   2846720              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2010-08-13 14:50 . 2010-08-13 14:50   2846720              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2010-08-20 13:27 . 2010-08-20 13:27   2676224              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2010-08-13 14:50 . 2010-08-13 14:50   2676224              c:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
- 2010-03-14 21:17 . 2010-08-11 01:08   18118856              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3105989464-1593778788-2663742427-1000-12288.dat
+ 2010-03-14 21:17 . 2010-08-25 02:03   18118856              c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-3105989464-1593778788-2663742427-1000-12288.dat
+ 2010-08-22 18:07 . 2010-08-22 18:07   14311424              c:\windows\Installer\506ae8.msi
.
-- Migawka wyzerowana --
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19   94208   ----a-w-   c:\users\filas312\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19   94208   ----a-w-   c:\users\filas312\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19   94208   ----a-w-   c:\users\filas312\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NetLimiter"="c:\program files\NetLimiter 3\NLClientApp.exe" [2010-05-24 1777664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BigDog303"="c:\windows\VM303_STI.EXE" [2006-01-24 61440]
"P17RunE"="P17RunE.dll" [2007-05-09 18432]
"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2008-04-04 88584]
"Xfire Music"="c:\program files\Xfire\xfiremusic.exe" [2006-11-21 253650]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-05-27 102400]
"Lycosa"="c:\program files\Razer\Lycosa\razerhid.exe" [2007-11-20 147456]
"Lachesis"="c:\program files\Razer\Lachesis\razerhid.exe" [2009-11-10 248320]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2010-07-04 17408]

c:\users\filas312\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Xfire.lnk - c:\program files\Xfire\Xfire.exe [2010-7-9 3493776]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Steam.lnk - d:\pacsteamt\Steam.exe [2009-10-10 1242448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WeGame.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WeGame.lnk
backup=c:\windows\pss\WeGame.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^filas312^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\filas312\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2010-03-06 01:44   500208   ------w-   c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2008-08-14 06:58   611712   ----a-w-   c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-02-22 02:57   406992   ----a-w-   c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICustomerCare]
2010-03-04 12:31   311296   ----a-w-   c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-04-12 22:46   1135912   ----a-w-   c:\program files\DivX\DivX Update\DivXUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-03-03 14:49   135664   ----atw-   c:\users\filas312\AppData\Local\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
2007-09-04 17:25   81920   ----a-w-   c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 10:43   248040   ----a-w-   c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
2010-02-19 11:37   517096   ----a-w-   c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VolPanel]
2009-07-07 12:13   241789   ------w-   c:\program files\Creative\Volume Panel\VolPanlu.exe

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.SYS [2009-06-23 99352]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2010-03-26 79360]
R3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.SYS [2009-06-23 555032]
R3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.SYS [2009-06-23 100888]
R3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.SYS [2009-06-23 566296]
S1 atitray;atitray;c:\program files\Ray Adams\ATI Tray Tools\atitray.sys [2010-04-22 19232]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-05-27 176128]
S2 cpuz133;cpuz133;c:\windows\system32\drivers\cpuz133_x32.sys [2010-03-30 20968]
S2 cpuz134;cpuz134;c:\windows\system32\drivers\cpuz134_x32.sys [2010-07-09 20328]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-05-27 5586432]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-05-27 209920]
S3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\DRIVERS\vrtaucbl.sys [2009-05-15 42496]

.
Zawartość folderu 'Zaplanowane zadania'

2010-08-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3105989464-1593778788-2663742427-1000Core.job
- c:\users\filas312\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-03 14:49]

2010-08-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3105989464-1593778788-2663742427-1000UA.job
- c:\users\filas312\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-03 14:49]
.
.
------- Skan uzupełniający -------
.
uStart Page =
TCP: {7B829223-5454-43E0-891E-FBCEB27EE3B8} = 83.238.44.4,83.238.44.3
FF - ProfilePath - c:\users\filas312\AppData\Roaming\Mozilla\Firefox\Profiles\tb7oozw9.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\programdata\NexonEU\NGM\npNxGameeu.dll
FF - plugin: c:\programdata\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\users\filas312\AppData\Local\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\users\filas312\AppData\Roaming\Mozilla\Firefox\Profiles\tb7oozw9.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll
.
- - - - USUNIĘTO PUSTE WPISY - - - -

HKLM-Explorer_Run-svchost - c:\windows\System32\svchost\svchost.exe
ActiveSetup-{1Q4R340W-4F05-Y706-WBX4-FOWK73BX4647} - c:\windows\System32\svchost\svchost.exe
ActiveSetup-{J4QJ516Y-162F-125O-0DE4-UAO5D48I53TA} - c:\windows\System32\install\winlogin.exe
ActiveSetup-{YB8BB034-7A5U-N7I1-6K3K-6UEC7AG88HH3} - c:\windows\svchost\svchost.exe


.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

[HKEY_USERS\S-1-5-21-3105989464-1593778788-2663742427-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:38,56,fe,8d,a3,0e,d8,a9,92,38,11,52,24,12,3e,35,f0,56,f0,2d,0f,34,f4,
   78,61,36,d6,85,c5,b9,6a,77,b7,54,1a,25,eb,e0,53,19,06,89,c5,bc,64,27,b7,28,\
"??"=hex:3f,eb,b2,a8,d5,51,4b,c2,1b,01,ec,08,0f,18,11,95

[HKEY_USERS\S-1-5-21-3105989464-1593778788-2663742427-1000\Software\SecuROM\License information*]
"datasecu"=hex:44,8f,91,3e,ba,a7,17,4d,36,97,0e,fe,37,18,34,0c,e5,af,b8,f0,a8,
   40,05,ea,1e,10,b6,43,d0,f7,d4,ad,8b,c8,e9,84,b7,92,2e,56,e2,bf,77,13,41,04,\
"rkeysecu"=hex:0b,57,55,e9,f6,21,96,8a,29,89,9d,f4,a7,14,2e,f0

[HKEY_USERS\S-1-5-21-3105989464-1593778788-2663742427-1000\¬ Ä*Y*]
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-3105989464-1593778788-2663742427-1000\¬ 
4*]
@Allowed: (Read) (RestrictedCode)
DUMPHIVE0.003 (REGF)

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'Explorer.exe'(3540)
c:\program files\Xfire\xfire_toucan_43094.dll
c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
c:\program files\TortoiseSVN\bin\TortoiseStub.dll
c:\program files\TortoiseSVN\bin\TortoiseSVN.dll
c:\program files\TortoiseSVN\bin\intl3_tsvn.dll
c:\users\filas312\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
c:\windows\system32\ntshrui.dll
c:\users\filas312\AppData\Local\Temp\catchme.dll
c:\windows\system32\prnfldr.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\AUDIODG.EXE
c:\windows\system32\atieclxx.exe
c:\program files\NetLimiter 3\nlsvc.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\windows\System32\rundll32.exe
c:\program files\Razer\Lachesis\OSD.exe
c:\program files\TortoiseSVN\bin\TSVNCache.exe
c:\program files\Razer\Lachesis\razertra.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Razer\Lachesis\razerofa.exe
c:\program files\TeamSpeak 3 Client\ts3client_win32.exe
.
**************************************************************************
.
Czas ukończenia: 2010-08-25  14:13:55 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2010-08-25 12:13
ComboFix2.txt  2010-08-17 14:17

Przed: 1 225 465 856 bajtów wolnych
Po: 1 111 130 112 bajtów wolnych

- - End Of File - - A2188FED85E0E7AB4E32A4D0FD1FDF07


Zaobserwowałem dzisiaj podejrzane wysyłanie pakietów przez services.exe :|

[NieWiem]

Montuj taki skrypt:

Kod: Zaznacz wszystko

FILE::
c:\windows\6833245EDD86479A882A8360D62C8194.TMP
c:\windows\system32\drivers\gjvmndhi.sys
c:\windows\45235788142C44BE8A4DDDE9A84492E5.TMP
c:\programdata\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
c:\programdata\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
c:\programdata\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif

i jak poprzednio.


Oprócz tego plik

c:\windows\system32\wininit.exe

trafia na www.virscan.org i proszę o wyniki skanu.

[Filas]

Wininit czysty wg. skanu.

Kod: Zaznacz wszystko

ComboFix 10-08-24.0A - filas312 2010-08-25  15:51:20.3.2 - x86
Microsoft Windows 7 Ultimate   6.1.7600.0.1250.48.1045.18.4095.2757 [GMT 2:00]
Uruchomiony z: c:\users\filas312\Downloads\combos.exe
Użyto następujących komend :: c:\users\filas312\Downloads\CFScript.txt
* Utworzono nowy punkt przywracania

FILE ::
"c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif"
"c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif"
"c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif"
"c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif"
"c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif"
"c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif"
"c:\programdata\Dane aplikacji\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif"
"c:\programdata\Dane aplikacji\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif"
"c:\programdata\Dane aplikacji\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif"
"c:\programdata\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif"
"c:\windows\45235788142C44BE8A4DDDE9A84492E5.TMP"
"c:\windows\6833245EDD86479A882A8360D62C8194.TMP"
"c:\windows\system32\drivers\gjvmndhi.sys"
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\programdata\Microsoft\Windows\Start Menu\Programs\World of Tanks closed Beta\World of Tanks closed Beta on the Web.pif
c:\windows\system32\Drivers\gjvmndhi.sys

Zainfekowana kopia c:\windows\system32\wininit.exe została znaleziona. Problem naprawiono
Plik odzyskano z - c:\combos\HarddiskVolumeShadowCopy1_!Windows!System32!wininit.exe

.
(((((((((((((((((((((((((   Pliki utworzone od 2010-07-25 do 2010-08-25  )))))))))))))))))))))))))))))))
.

2010-08-25 14:00 . 2010-08-25 14:00   --------   d-----w-   c:\users\Public\AppData\Local\temp
2010-08-25 14:00 . 2010-08-25 14:00   --------   d-----w-   c:\users\Default\AppData\Local\temp
2010-08-25 10:23 . 2010-08-25 10:23   --------   d-----w-   c:\users\filas312\AppData\Local\Locktime
2010-08-24 21:46 . 2010-08-24 21:46   --------   d-----w-   c:\program files\NetLimiter 3
2010-08-24 17:40 . 2010-08-24 17:40   --------   d-----w-   C:\vcs5BGEffects
2010-08-24 17:39 . 2007-06-28 16:02   102400   ----a-w-   c:\program files\Vcs6Hook.dll
2010-08-24 17:28 . 2010-08-24 17:28   --------   d-----w-   c:\users\filas312\AppData\Roaming\Avnex
2010-08-24 17:28 . 2010-08-24 17:32   --------   d-----w-   C:\AV_LOGS
2010-08-24 17:27 . 2008-12-26 10:56   17792   ----a-w-   c:\windows\system32\drivers\vcsvad.sys
2010-08-24 17:23 . 2010-08-24 17:23   --------   d-----w-   c:\users\filas312\AppData\Roaming\Screaming Bee
2010-08-22 18:08 . 2010-08-22 18:08   --------   d-----w-   c:\users\filas312\AppData\Local\Opera
2010-08-22 18:08 . 2010-08-22 18:08   --------   d-----w-   c:\program files\Opera
2010-08-21 09:47 . 2010-08-21 09:51   --------   d-----w-   C:\OP&ED
2010-08-20 20:39 . 2010-08-20 20:48   --------   d-----w-   C:\!KillBox
2010-08-20 20:38 . 2010-08-20 20:38   --------   d-----w-   c:\program files\Unlocker
2010-08-20 13:34 . 2010-08-20 13:34   --------   d-----w-   c:\users\filas312\AppData\Local\Criterion Games
2010-08-17 14:11 . 2010-08-25 14:02   --------   d-----w-   c:\users\filas312\AppData\Local\temp
2010-08-16 09:49 . 2010-08-16 09:49   --------   d-----w-   c:\program files\Seagate
2010-08-15 14:26 . 2010-08-15 19:04   --------   d-----w-   c:\program files\ModernRcon
2010-08-14 22:11 . 2010-08-14 22:11   --------   d-----w-   c:\users\filas312\AppData\Local\G4G.PL
2010-08-14 11:03 . 2010-08-14 13:23   --------   d-----w-   c:\users\filas312\DoctorWeb
2010-08-14 10:02 . 2010-08-14 10:02   --------   d-----w-   c:\program files\Trend Micro
2010-08-13 14:51 . 2010-08-13 14:51   --------   d-----w-   c:\program files\Microsoft Games for Windows - LIVE
2010-08-13 14:51 . 2010-08-13 14:51   --------   d-----w-   c:\windows\system32\xlive
2010-08-13 14:50 . 2010-08-13 14:50   --------   d-----w-   c:\windows\6833245EDD86479A882A8360D62C8194.TMP
2010-08-13 00:40 . 2010-08-13 00:40   --------   d-----w-   c:\program files\Lavalys
2010-08-10 18:14 . 2010-08-10 18:14   --------   d-----w-   c:\programdata\EA Core
2010-08-10 18:14 . 2010-08-10 18:14   --------   d-----w-   c:\programdata\Electronic Arts
2010-08-10 11:20 . 2010-08-10 11:20   --------   d-----w-   c:\program files\Google
2010-08-09 22:54 . 2010-08-09 22:54   --------   d-----w-   c:\users\filas312\AppData\Local\Midway
2010-08-09 13:20 . 2010-08-09 13:20   --------   d-----w-   c:\program files\Poedit
2010-08-08 18:44 . 2010-08-08 18:44   --------   d-----w-   c:\windows\45235788142C44BE8A4DDDE9A84492E5.TMP
2010-08-07 17:52 . 2010-08-07 17:52   --------   d-----w-   c:\users\filas312\AppData\Roaming\PowerUp Software
2010-08-07 17:52 . 2010-08-07 17:52   --------   d-----w-   c:\programdata\PowerUp Software
2010-08-07 17:51 . 2008-04-13 18:11   619008   ----a-w-   c:\windows\system32\dx7vb.dll
2010-08-07 17:51 . 2008-01-13 15:36   91632   ----a-w-   c:\windows\system32\dsofile.dll
2010-08-07 17:51 . 2001-04-05 05:43   94208   --s---r-   c:\windows\system32\msstkprp.dll
2010-08-07 17:51 . 1998-06-17 22:00   89360   ----a-w-   c:\windows\system32\VB5DB.DLL
2010-08-07 17:51 . 2010-08-24 22:06   119296   ----a-w-   c:\windows\system32\zlib.dll
2010-08-07 17:51 . 2010-08-07 17:51   --------   d-----w-   c:\program files\PowerUp Software
2010-08-07 17:51 . 2008-01-13 18:59   36864   ----a-w-   c:\windows\system32\dxinputdll.dll
2010-08-07 17:51 . 2003-01-26 12:41   40960   ----a-w-   c:\windows\system32\SSubTmr6.dll
2010-08-07 17:51 . 1999-05-17 12:55   57344   ------w-   c:\windows\system32\ADsSecurity.dll
2010-08-04 20:02 . 2010-08-04 20:02   --------   d-----w-   c:\program files\GOG.com
2010-08-04 17:56 . 2010-08-04 21:36   1048   ----a-w-   c:\windows\eReg.dat
2010-08-03 23:02 . 2010-08-03 23:02   --------   d-----w-   c:\program files\NovodexRocket_1_1
2010-08-03 13:56 . 2010-08-03 13:56   --------   d-----w-   c:\users\filas312\AppData\Roaming\W
2010-08-03 13:55 . 2010-08-03 13:55   --------   d-----w-   c:\users\filas312\AppData\Roaming\wargaming.net
2010-08-03 11:53 . 2010-08-03 11:54   --------   d-----w-   c:\users\filas312\AppData\Roaming\Command and Conquer 3 Tiberium Wars
2010-07-28 20:58 . 2010-07-28 20:58   --------   d-----w-   c:\users\filas312\AppData\Local\CrashRpt
2010-07-27 12:53 . 2010-07-27 12:53   --------   d-----w-   c:\users\filas312\AppData\Roaming\Locktime
2010-07-27 12:33 . 2010-07-27 12:33   --------   d-----w-   c:\programdata\Locktime
2010-07-27 12:19 . 2010-06-16 15:07   334040   ------w-   c:\windows\system32\cfosspeed.dll
2010-07-27 11:08 . 2010-07-27 11:08   --------   d-----w-   c:\programdata\Nexon
2010-07-27 10:46 . 2010-07-27 10:46   --------   d-----w-   c:\program files\freedompeace
2010-07-27 10:42 . 2010-07-27 11:08   --------   d-----w-   c:\programdata\NexonEU
2010-07-27 01:07 . 2010-05-12 07:42   1467200   ----a-w-   c:\windows\system32\msvcr100d.dll
2010-07-27 01:02 . 2010-07-27 01:02   --------   d-----w-   c:\users\filas312\AppData\Local\freedompeace
2010-07-27 00:54 . 2010-07-27 00:54   --------   d-----w-   c:\programdata\NexonUS
2010-07-27 00:15 . 2010-07-27 00:59   --------   d-----w-   c:\users\filas312\AppData\Local\PMB Files
2010-07-27 00:15 . 2010-07-27 00:16   --------   d-----w-   c:\programdata\PMB Files
2010-07-27 00:15 . 2010-07-27 00:15   --------   d-----w-   c:\program files\Pando Networks

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-08-25 11:50 . 2010-03-05 19:08   --------   d-----w-   c:\users\filas312\AppData\Roaming\foobar2000
2010-08-25 11:40 . 2010-06-07 16:36   --------   d-----w-   c:\users\filas312\AppData\Roaming\mIRC
2010-08-25 11:40 . 2010-06-07 16:36   --------   d-----w-   c:\program files\mIRC
2010-08-24 22:49 . 2010-03-03 14:30   --------   d-----w-   c:\users\filas312\AppData\Roaming\Xfire
2010-08-24 22:06 . 2010-03-03 14:30   --------   d-----w-   c:\programdata\Xfire
2010-08-24 21:37 . 2010-04-21 17:49   --------   d-----w-   c:\users\filas312\AppData\Roaming\Mumble
2010-08-24 17:39 . 2010-03-03 15:08   --------   d-----w-   c:\users\filas312\AppData\Roaming\uTorrent
2010-08-24 17:36 . 2010-04-17 09:32   --------   d-----w-   c:\users\filas312\AppData\Roaming\Kadu
2010-08-24 10:23 . 2010-03-03 15:26   139128   ----a-w-   c:\windows\system32\drivers\PnkBstrK.sys
2010-08-24 10:23 . 2010-03-03 15:25   215128   ----a-w-   c:\windows\system32\PnkBstrB.exe
2010-08-20 20:45 . 2005-04-08 02:16   10425   ---ha-w-   c:\users\filas312\AppData\Roaming\filas312log.dat
2010-08-18 16:48 . 2010-06-05 10:40   --------   d-----w-   c:\programdata\regid.1986-12.com.adobe
2010-08-18 12:55 . 2010-03-07 20:06   --------   d-----w-   c:\users\filas312\AppData\Roaming\HLSW
2010-08-16 21:43 . 2010-03-23 21:21   --------   d-----w-   c:\users\filas312\AppData\Roaming\vlc
2010-08-16 09:49 . 2010-03-24 13:59   --------   d-----w-   c:\program files\Common Files\Wise Installation Wizard
2010-08-15 00:52 . 2010-07-24 18:02   --------   d-----w-   c:\program files\DAEMON Tools Pro
2010-08-13 14:39 . 2010-03-07 18:42   --------   d--h--w-   c:\program files\InstallShield Installation Information
2010-08-12 10:35 . 2010-04-11 18:56   --------   d-----w-   c:\program files\A-FF Find and Mount
2010-08-10 22:25 . 2010-05-02 17:53   --------   d-----w-   c:\program files\TeamSpeak 3 Client
2010-08-10 20:18 . 2010-05-07 22:34   107888   ----a-w-   c:\windows\system32\CmdLineExt.dll
2010-08-10 19:15 . 2010-03-03 15:26   138056   ----a-w-   c:\users\filas312\AppData\Roaming\PnkBstrK.sys
2010-08-10 19:15 . 2010-03-03 15:26   138056   ----a-w-   c:\users\filas312\AppData\Roaming\PnkBstrK.sys
2010-08-10 19:14 . 2010-03-03 15:25   2434856   ----a-w-   c:\windows\system32\pbsvc_bc2.exe
2010-08-10 19:01 . 2010-03-27 12:26   --------   d-----w-   c:\program files\Common Files\Adobe AIR
2010-08-10 19:01 . 2010-08-10 18:11   53632   ----a-w-   c:\users\Default\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-08-10 18:10 . 2010-08-10 18:14   53632   ----a-w-   c:\users\filas312\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-08-10 18:10 . 2010-03-07 18:42   --------   d-----w-   c:\program files\Electronic Arts
2010-08-09 22:53 . 2010-04-03 19:16   --------   d-----w-   c:\users\filas312\AppData\Roaming\IrfanView
2010-08-09 09:45 . 2010-03-03 15:20   --------   d-----w-   c:\program files\Common Files\Steam
2010-08-04 18:37 . 2010-03-03 14:38   59896   ----a-w-   c:\users\filas312\AppData\Local\GDIPFONTCACHEV1.DAT
2010-07-28 08:45 . 2010-06-17 15:04   90720   ---ha-w-   c:\windows\system32\mlfcache.dat
2010-07-27 22:15 . 2010-07-03 15:41   81408   ----a-w-   c:\users\filas312\AppData\Roaming\MotioninJoy\DS3tool\update\DS3_Tool.exe
2010-07-27 10:46 . 2010-07-27 10:46   70830   ----a-r-   c:\users\filas312\AppData\Roaming\Microsoft\Installer\{A944C55A-ECF0-42A9-B66C-0225C6428720}\_73D368264803CCFCACA48B.exe
2010-07-27 10:46 . 2010-07-27 10:46   70830   ----a-r-   c:\users\filas312\AppData\Roaming\Microsoft\Installer\{A944C55A-ECF0-42A9-B66C-0225C6428720}\_63B63CACF06671E288D570.exe
2010-07-27 00:54 . 2010-07-27 00:54   98304   ----a-w-   c:\programdata\NexonUS\NGM\npNxGameUS.dll
2010-07-24 20:00 . 2010-06-16 05:59   --------   d-----w-   c:\program files\WeGame
2010-07-24 18:02 . 2010-03-24 13:49   697328   ----a-w-   c:\windows\system32\drivers\sptd.sys
2010-07-24 10:01 . 2010-07-24 10:01   --------   d-----w-   c:\programdata\LAG
2010-07-24 09:15 . 2010-04-20 13:13   --------   d-----w-   c:\users\filas312\AppData\Roaming\Razer
2010-07-24 09:14 . 2010-04-19 17:21   --------   d-----w-   c:\programdata\Razer
2010-07-24 09:13 . 2010-04-19 17:21   --------   d-----w-   c:\program files\Razer
2010-07-24 09:13 . 2010-07-24 09:13   --------   d-----w-   c:\users\filas312\AppData\Roaming\InstallShield
2010-07-23 09:39 . 2010-07-23 09:39   --------   d-----w-   c:\users\filas312\AppData\Roaming\Jeskola
2010-07-23 09:35 . 2009-07-14 08:07   737242   ----a-w-   c:\windows\system32\perfh015.dat
2010-07-23 09:35 . 2009-07-14 08:07   153930   ----a-w-   c:\windows\system32\perfc015.dat
2010-07-23 09:33 . 2010-07-23 09:33   --------   d-----w-   c:\program files\Microsoft.NET
2010-07-22 11:48 . 2010-07-22 10:22   --------   d-----w-   c:\program files\GameSpy Arcade
2010-07-22 10:21 . 2010-03-07 18:41   --------   d-----w-   c:\program files\Common Files\InstallShield
2010-07-22 09:01 . 2010-07-22 08:58   --------   d-----w-   c:\program files\Real War
2010-07-20 19:13 . 2010-07-11 21:08   --------   d-----w-   c:\program files\Ai1
2010-07-18 19:02 . 2010-03-31 20:30   --------   d-----w-   c:\program files\Uplink
2010-07-17 09:53 . 2010-07-17 09:53   22   --sha-w-   c:\windows\Sys3390 SettingsCollection.bin
2010-07-17 09:53 . 2010-07-17 09:53   22   --sha-w-   c:\users\filas312\AppData\Roaming\Sys6925.Config Collection.sys
2010-07-17 09:53 . 2010-07-17 09:53   22   --sha-w-   c:\users\filas312\AppData\Roaming\Sys6925.Config Collection.sys
2010-07-17 09:53 . 2010-07-17 09:53   --------   d-----w-   c:\program files\jv16 PowerTools 2010
2010-07-16 19:32 . 2010-04-02 08:28   --------   d-----w-   c:\program files\Microsoft Silverlight
2010-07-16 13:53 . 2010-05-29 15:09   --------   d-----w-   c:\users\filas312\AppData\Roaming\Dropbox
2010-07-16 13:52 . 2010-06-28 23:58   0   ----a-w-   c:\windows\system32\Access.dat
2010-07-16 13:39 . 2010-07-16 13:39   --------   d-----w-   c:\users\filas312\AppData\Roaming\Malwarebytes
2010-07-16 13:39 . 2010-07-16 13:39   --------   d-----w-   c:\program files\Malwarebytes' Anti-Malware
2010-07-16 13:39 . 2010-07-16 13:39   --------   d-----w-   c:\programdata\Malwarebytes
2010-07-16 00:15 . 2010-07-16 00:15   --------   d-----w-   c:\program files\MW2CU
2010-07-16 00:01 . 2010-07-16 00:01   --------   d-----w-   c:\program files\ExamDiff
2010-07-15 20:13 . 2005-02-24 20:31   --------   d-----w-   c:\program files\DAEMON Tools Lite
2010-07-14 16:07 . 2010-03-31 20:13   --------   d-----w-   c:\program files\Onlink
2010-07-13 05:23 . 2010-03-03 15:05   --------   d-----w-   c:\program files\Xfire
2010-07-12 13:50 . 2010-07-12 13:50   --------   d-----w-   c:\program files\Nem's Tools
2010-07-11 10:18 . 2010-07-11 10:18   --------   d-----w-   c:\program files\SpeedFan
2010-07-10 17:56 . 2010-07-10 17:56   --------   d-----w-   c:\program files\Advanced Port Scanner
2010-07-09 19:04 . 2010-07-09 19:04   41872   ----a-w-   c:\windows\system32\xfcodec.dll
2010-07-09 11:18 . 2010-07-09 19:08   20328   ----a-w-   c:\windows\system32\drivers\cpuz134_x32.sys
2010-07-09 09:59 . 2010-05-02 17:53   --------   d-----w-   c:\users\filas312\AppData\Roaming\TS3Client
2010-07-08 14:04 . 2010-05-03 00:19   --------   d-----w-   c:\users\filas312\AppData\Roaming\TeamViewer
2010-07-08 14:03 . 2010-07-08 14:03   --------   d-----w-   c:\users\filas312\AppData\Roaming\UltraVNC
2010-07-08 14:02 . 2010-07-08 14:02   --------   d-----w-   c:\program files\UltraVNC
2010-07-08 13:56 . 2010-05-03 00:19   --------   d-----w-   c:\program files\TeamViewer
2010-07-08 13:55 . 2010-07-08 13:55   --------   d-----w-   c:\program files\QS
2010-07-07 15:25 . 2010-06-29 19:25   --------   d-----w-   c:\program files\Metin2
2010-07-06 22:16 . 2010-04-11 20:06   --------   d-----w-   c:\users\filas312\AppData\Roaming\Hamachi
2010-07-05 22:47 . 2010-07-05 22:38   --------   d-----w-   c:\program files\Hitman - Krwawa Forsa
2010-07-05 12:11 . 2010-07-05 12:11   --------   d-----w-   c:\users\filas312\AppData\Roaming\GameRanger
2010-07-03 15:55 . 2010-07-03 15:55   --------   d-----w-   c:\users\filas312\AppData\Roaming\Need for Speed World
2010-07-03 15:41 . 2010-07-03 15:41   51712   ----a-w-   c:\users\filas312\AppData\Roaming\MotioninJoy\DS3tool\update\drivers\x86\MijXfilt.sys
2010-07-03 15:41 . 2010-04-24 20:48   51712   ----a-w-   c:\windows\system32\drivers\mijxfilt.sys
2010-06-29 22:45 . 2010-06-29 22:45   1240800   ----a-w-   c:\users\filas312\AppData\Roaming\GameRanger\GameRanger\GameRanger.exe
2010-06-29 22:43 . 2010-06-29 22:43   159456   ----a-w-   c:\users\filas312\AppData\Roaming\GameRanger\GameRanger\Data\GameRanger.dll
2010-06-28 23:40 . 2010-05-02 23:08   --------   d-----w-   c:\users\filas312\AppData\Roaming\Skype
2010-06-28 22:00 . 2010-05-02 23:09   --------   d-----w-   c:\users\filas312\AppData\Roaming\skypePM
2010-06-28 21:10 . 2010-06-28 21:09   --------   d-----w-   c:\program files\Tunngle
2010-06-28 21:10 . 2010-06-28 21:09   --------   d-----w-   c:\users\filas312\AppData\Roaming\Tunngle
2010-06-28 21:09 . 2010-06-28 21:09   --------   d-----w-   c:\programdata\Tunngle
2010-06-28 19:58 . 2010-06-28 19:58   --------   d-----w-   c:\users\filas312\AppData\Roaming\Leawo
2010-06-28 19:56 . 2010-06-28 19:56   --------   d-----w-   c:\program files\Leawo
2010-06-18 09:27 . 2010-06-18 09:27   217088   ----a-w-   c:\windows\system32\ssleay32.dll
2010-06-18 09:27 . 2010-06-18 09:27   217088   ----a-w-   c:\windows\system32\libssl32.dll
2010-06-18 09:27 . 2010-06-18 09:27   1048576   ----a-w-   c:\windows\system32\libeay32.dll
2010-06-17 10:48 . 2009-07-04 19:46   5197   ----a-w-   c:\program files\mirc.ini
2010-06-17 10:47 . 2007-09-26 18:04   861   ----a-w-   c:\program files\ircap.ini
2010-06-02 02:55 . 2010-06-13 19:18   74072   ----a-w-   c:\windows\system32\XAPOFX1_5.dll
2010-06-02 02:55 . 2010-06-13 19:18   527192   ----a-w-   c:\windows\system32\XAudio2_7.dll
2009-06-10 21:26 . 2009-07-14 02:04   9633792   --sha-r-   c:\windows\Fonts\StaticCache.dat
2010-05-09 15:31 . 2010-05-09 15:31   87552   --sh--w-   c:\windows\System32\h4x0r.dll
2009-07-14 01:14 . 2009-07-13 23:42   396800   --sha-w-   c:\windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7600.16385_none_f12e83abb108c86c\WinMail.exe
.

------- Sigcheck -------

[-] 2010-03-03 . 7BD7F45FF37FA0669CD32CA0EF46E22C . 811520 . . [6.1.7600.16385] . . c:\windows\System32\user32.dll
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\1TortoiseNormal]
@="{C5994560-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994560-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\2TortoiseModified]
@="{C5994561-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994561-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\3TortoiseConflict]
@="{C5994562-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994562-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\4TortoiseLocked]
@="{C5994563-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994563-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\5TortoiseReadOnly]
@="{C5994564-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994564-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\6TortoiseDeleted]
@="{C5994565-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994565-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\7TortoiseAdded]
@="{C5994566-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994566-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\8TortoiseIgnored]
@="{C5994567-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994567-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\9TortoiseUnversioned]
@="{C5994568-53D9-4125-87C9-F193FC689CB2}"
[HKEY_CLASSES_ROOT\CLSID\{C5994568-53D9-4125-87C9-F193FC689CB2}]
2010-01-18 18:12   86280   ----a-w-   c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19   94208   ----a-w-   c:\users\filas312\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19   94208   ----a-w-   c:\users\filas312\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2009-12-09 01:19   94208   ----a-w-   c:\users\filas312\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NetLimiter"="c:\program files\NetLimiter 3\NLClientApp.exe" [2010-05-24 1777664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BigDog303"="c:\windows\VM303_STI.EXE" [2006-01-24 61440]
"P17RunE"="P17RunE.dll" [2007-05-09 18432]
"Start WingMan Profiler"="c:\program files\Logitech\Gaming Software\LWEMon.exe" [2008-04-04 88584]
"Xfire Music"="c:\program files\Xfire\xfiremusic.exe" [2006-11-21 253650]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-05-27 102400]
"Lycosa"="c:\program files\Razer\Lycosa\razerhid.exe" [2007-11-20 147456]
"Lachesis"="c:\program files\Razer\Lachesis\razerhid.exe" [2009-11-10 248320]
"UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2010-07-04 17408]

c:\users\filas312\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Xfire.lnk - c:\program files\Xfire\Xfire.exe [2010-7-9 3493776]

c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Steam.lnk - d:\pacsteamt\Steam.exe [2009-10-10 1242448]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^WeGame.lnk]
path=c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\WeGame.lnk
backup=c:\windows\pss\WeGame.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^filas312^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Dropbox.lnk]
path=c:\users\filas312\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
backup=c:\windows\pss\Dropbox.lnk.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeAAMUpdater-1.0]
2010-03-06 01:44   500208   ------w-   c:\program files\Common Files\Adobe\OOBE\PDApp\UWA\updaterstartuputility.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
2008-08-14 06:58   611712   ----a-w-   c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS5ServiceManager]
2010-02-22 02:57   406992   ----a-w-   c:\program files\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICustomerCare]
2010-03-04 12:31   311296   ----a-w-   c:\program files\ATI\ATICustomerCare\ATICustomerCare.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DivXUpdate]
2010-04-12 22:46   1135912   ----a-w-   c:\program files\DivX\DivX Update\DivXUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Update]
2010-03-03 14:49   135664   ----atw-   c:\users\filas312\AppData\Local\Google\Update\GoogleUpdate.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVIDIA nTune]
2007-09-04 17:25   81920   ----a-w-   c:\program files\NVIDIA Corporation\nTune\nTuneCmd.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-02-18 10:43   248040   ----a-w-   c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SwitchBoard]
2010-02-19 11:37   517096   ----a-w-   c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VolPanel]
2009-07-07 12:13   241789   ------w-   c:\program files\Creative\Volume Panel\VolPanlu.exe

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 COMMONFX;COMMONFX;c:\windows\system32\drivers\COMMONFX.SYS [2009-06-23 99352]
R3 Creative ALchemy AL6 Licensing Service;Creative ALchemy AL6 Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe [2010-03-26 79360]
R3 CTAUDFX;CTAUDFX;c:\windows\system32\drivers\CTAUDFX.SYS [2009-06-23 555032]
R3 CTERFXFX;CTERFXFX;c:\windows\system32\drivers\CTERFXFX.SYS [2009-06-23 100888]
R3 CTSBLFX;CTSBLFX;c:\windows\system32\drivers\CTSBLFX.SYS [2009-06-23 566296]
R3 MotioninJoyXFilter;MotioninJoy Virtual Xinput device Filter Driver;c:\windows\system32\DRIVERS\MijXfilt.sys [2010-07-03 51712]
R3 NLNdisPT;NetLimiter Ndis Protocol Service;c:\windows\system32\DRIVERS\nlndis.sys [2010-05-25 5230088]
R3 SCREAMINGBDRIVER;Screaming Bee Audio;c:\windows\system32\drivers\ScreamingBAudio.sys [2009-12-01 34384]
R3 SliceDisk5;SliceDisk5;c:\program files\A-FF Find and Mount\slicedisk.sys [2008-04-03 10240]
R3 tap0901t;TAP-Win32 Adapter V9 (Tunngle);c:\windows\system32\DRIVERS\tap0901t.sys [2009-09-16 27136]
R3 WatAdminSvc;Usługa Technologie aktywacji systemu Windows;c:\windows\system32\Wat\WatAdminSvc.exe [2010-03-03 1343400]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-07-24 697328]
R4 SwitchBoard;SwitchBoard;c:\program files\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-02-19 517096]
R4 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-07-06 173352]
R4 TunngleService;TunngleService;c:\program files\Tunngle\TnglCtrl.exe [2010-06-23 715512]
S1 atitray;atitray;c:\program files\Ray Adams\ATI Tray Tools\atitray.sys [2010-04-22 19232]
S1 nltdi;nltdi;c:\program files\NetLimiter 3\nltdi.sys [2010-05-25 5281672]
S1 se32;EnTech softEngine;c:\windows\system32\drivers\se32.sys [2007-05-03 12112]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-05-27 176128]
S2 cpuz133;cpuz133;c:\windows\system32\drivers\cpuz133_x32.sys [2010-03-30 20968]
S2 cpuz134;cpuz134;c:\windows\system32\drivers\cpuz134_x32.sys [2010-07-09 20328]
S2 PStrip;PStrip;c:\windows\system32\DRIVERS\PSTRIP.SYS [2007-07-15 27992]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [2010-05-27 5586432]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [2010-05-27 209920]
S3 EuMusDesignVirtualAudioCableWdm;Virtual Audio Cable (WDM);c:\windows\system32\DRIVERS\vrtaucbl.sys [2009-05-15 42496]
S3 LachesisFltr;Lachesis Mouse Driver;c:\windows\system32\drivers\Lachesis.sys [2009-09-28 12032]
S3 NLNdisMP;NLNdisMP;c:\windows\system32\DRIVERS\nlndis.sys [2010-05-25 5230088]
S3 VCSVADHWSer;Avnex Virtual Audio Device (WDM);c:\windows\system32\DRIVERS\vcsvad.sys [2008-12-26 17792]

.
Zawartość folderu 'Zaplanowane zadania'

2010-08-24 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3105989464-1593778788-2663742427-1000Core.job
- c:\users\filas312\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-03 14:49]

2010-08-25 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3105989464-1593778788-2663742427-1000UA.job
- c:\users\filas312\AppData\Local\Google\Update\GoogleUpdate.exe [2010-03-03 14:49]
.
.
------- Skan uzupełniający -------
.
uStart Page =
TCP: {7B829223-5454-43E0-891E-FBCEB27EE3B8} = 83.238.44.4,83.238.44.3
FF - ProfilePath - c:\users\filas312\AppData\Roaming\Mozilla\Firefox\Profiles\tb7oozw9.default\
FF - component: c:\program files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}\components\SkypeFfComponent.dll
FF - plugin: c:\program files\Pando Networks\Media Booster\npPandoWebPlugin.dll
FF - plugin: c:\program files\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: c:\programdata\NexonEU\NGM\npNxGameeu.dll
FF - plugin: c:\programdata\NexonUS\NGM\npNxGameUS.dll
FF - plugin: c:\users\filas312\AppData\Local\Google\Update\1.2.183.29\npGoogleOneClick8.dll
FF - plugin: c:\users\filas312\AppData\Roaming\Mozilla\Firefox\Profiles\tb7oozw9.default\extensions\battlefieldheroespatcher@ea.com\platform\WINNT_x86-msvc\plugins\npBFHUpdater.dll
.
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

[HKEY_USERS\S-1-5-21-3105989464-1593778788-2663742427-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:38,56,fe,8d,a3,0e,d8,a9,92,38,11,52,24,12,3e,35,f0,56,f0,2d,0f,34,f4,
   78,61,36,d6,85,c5,b9,6a,77,b7,54,1a,25,eb,e0,53,19,06,89,c5,bc,64,27,b7,28,\
"??"=hex:3f,eb,b2,a8,d5,51,4b,c2,1b,01,ec,08,0f,18,11,95

[HKEY_USERS\S-1-5-21-3105989464-1593778788-2663742427-1000\Software\SecuROM\License information*]
"datasecu"=hex:a0,da,19,c9,ad,68,49,f2,6e,07,11,c3,21,27,b7,32,b9,3d,9e,d3,1f,
   60,68,b2,b6,e5,e8,9e,96,b2,d9,8c,27,5b,00,74,6f,80,8d,e9,b3,b4,7e,8d,58,23,\
"rkeysecu"=hex:e4,73,ce,d2,fb,95,79,e8,b4,b5,77,11,10,62,6f,6a

[HKEY_USERS\S-1-5-21-3105989464-1593778788-2663742427-1000\¬ Ä*Y*]
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-3105989464-1593778788-2663742427-1000\¬ 
4*]
@Allowed: (Read) (RestrictedCode)
DUMPHIVE0.003 (REGF)

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'Explorer.exe'(3868)
c:\program files\Xfire\xfire_toucan_43094.dll
c:\program files\Common Files\TortoiseOverlays\TortoiseOverlays.dll
c:\program files\TortoiseSVN\bin\TortoiseStub.dll
c:\program files\TortoiseSVN\bin\TortoiseSVN.dll
c:\program files\TortoiseSVN\bin\intl3_tsvn.dll
c:\users\filas312\AppData\Roaming\Dropbox\bin\DropboxExt.13.dll
c:\users\filas312\AppData\Local\Temp\catchme.dll
c:\windows\system32\prnfldr.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\AUDIODG.EXE
c:\windows\system32\atieclxx.exe
c:\program files\NetLimiter 3\nlsvc.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\WUDFHost.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\windows\System32\rundll32.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
c:\program files\Razer\Lachesis\OSD.exe
c:\program files\TortoiseSVN\bin\TSVNCache.exe
c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\program files\Razer\Lachesis\razertra.exe
c:\program files\Razer\Lachesis\razerofa.exe
c:\users\filas312\AppData\Local\Google\Chrome\Application\chrome.exe
c:\users\filas312\AppData\Local\Google\Chrome\Application\chrome.exe
c:\users\filas312\AppData\Local\Google\Chrome\Application\chrome.exe
c:\program files\TeamSpeak 3 Client\ts3client_win32.exe
c:\users\filas312\AppData\Local\Google\Chrome\Application\chrome.exe
c:\users\filas312\AppData\Local\Google\Chrome\Application\chrome.exe
.
**************************************************************************
.
Czas ukończenia: 2010-08-25  16:08:33 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2010-08-25 14:08
ComboFix2.txt  2010-08-25 12:13
ComboFix3.txt  2010-08-17 14:17

Przed: 757 678 080 bajtów wolnych
Po: 1 034 366 976 bajtów wolnych

- - End Of File - - 03112FB34AEDD9BFD06187AC8007EC4B


[NieWiem]

Filas, urwę Ci jaja za wirtualne napędy. W pierwszym moim poście o nichpisałem, a tymczasem fruwają aż miło ;]

Generalnie jest dobrze. A na pewno lepiej niż było... jak objawy?

Pobierz AVZ od Z-Olega
link

Wypakuj na pulpicie i uruchom. Zrób aktualizację wciskając przycisk
Jeśli zwróci błąd, wybierz inne źródło.

Potem idź do menu File - wybierz Standard Scripts.
Zaznacz opcję Advanced System Analysis i wybierz Execute selected Scripts. Zatwierdź i poczekaj na ukończenie pracy.

Idź do Folderu avz4, znajdź folder LOG. Znajdziesz tam plik virusinfo_syscheck.zip - wrzuć go na http://www.speedyshare.com i podaj mi linka do paczki.

[Filas]

Filas, urwę Ci jaja za wirtualne napędy. W pierwszym moim poście o nichpisałem, a tymczasem fruwają aż miło ;]

Generalnie jest dobrze. A na pewno lepiej niż było... jak objawy?

Żebym jeszcze miał SPTD tudzież sterownik od A120% poinstalowane oba usunięte od początku.
Objawy? Brak.
http://www.speedyshare.com/files/23968705/virusinfo_syscheck.zip

[NieWiem]

Filas, ja Cię proszę Ty mnie nie drażnij
Widzę przecież w logu z CF:

R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-07-24 697328]

ComboFix dokładnie listuje datę i rozmiar, więc plik sptd jest i ma się dobrze. A nawet działa i przeszkadza CF

Powtórz procedurę usunięcia, potem wygeneruj nowe logi z OTL i Gmera.
Po czym zacznij szukać kogoś, kto w Twoim imieniu kupi mi flachę jako podzękowanie

[Filas]

No to zaraz ręcznie się go pozbędę a z Gmera raczej logów nie zrobię - pierwszy post .

[NieWiem]

Gmer nie chce działać przez te napędy i sterownik.

Nic się nie pozbywaj ręcznie, tylko weź mnie posłuchaj najpierw.

Ściągnij to: http://www.jpshortstuff.247fixes.com/Defogger.exe
Uruchom i wybierz Disable. Zresetuj komputer i przeklej loga (będzie tam, gdzie Defogger).

Potem spróbuj wykonać loga z Gmera.

[Filas]

Kod: Zaznacz wszystko

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 12:43 on 26/08/2010 (filas312)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
SPTD -> Already disabled


-=E.O.F=-

[NieWiem]

No to teraz wio z Gmerem.

[Filas]

Kod: Zaznacz wszystko

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-08-26 13:36:17
Windows 6.1.7600
Running: 9ldhfnjc.exe; Driver: C:\Users\filas312\AppData\Local\Temp\fxddakow.sys


---- System - GMER 1.0.15 ----

INT 0x1F        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)              82434AF8
INT 0x37        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)              82434104
INT 0xC1        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)              824343F4
INT 0xD1        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)              8241C634
INT 0xD2        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)              8241C898
INT 0xDF        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)              824341DC
INT 0xE1        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)              82434958
INT 0xE3        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)              824346F8
INT 0xFD        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)              82434F2C
INT 0xFE        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)              824351A8

---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrlStaforce.exe!ZwSaveKeyEx + 13DD                                                                  82494609 1 Byte  [06]
.text           ntkrlStaforce.exe!KiDispatchInterrupt + 5A2                                                           824B9052 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

---- Devices - GMER 1.0.15 ----

Device          \Driver\ACPI_HAL \Device\00000061                                                                     halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                                                                rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume5                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume5                                                                rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume6                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume6                                                                rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume7                                                                fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume7                                                                rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                     
Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                   0x65 0x2A 0x00 0x00 ...
Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                   0
Reg             HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                0x8D 0x17 0xBE 0xD0 ...
Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) 
Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                       0x65 0x2A 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                       0
Reg             HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                    0x8D 0x17 0xBE 0xD0 ...

---- EOF - GMER 1.0.15 ----