prosze o spr loga

[rafi9-92]

Witam ! Mam pewien problem z kompem otoz ostatnimi czasy przy wylaczaniu systemu trwa to niewyobrazalnie dlugo ! System zamyka sie z 5 minut jak nie lepiej ! A i jeszcze nie wiem czemu ale w windows media player nie wyswietla napisow ( a wszytko bylo dobrze nic nie zmienialem w opcjach ) nie wiem czy to zwiazek jakiegos syfu ! Daje logi do spr :

Logfile of HijackThis v1.99.1
Scan saved at 18:54:48, on 2008-01-22
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Programy\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programy\AutoConnect\AutoConnect.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Netia\Net\netianet.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\PROGRA~1\Symbian\Shared\SYMBIA~1\SYMBIA~1.EXE
C:\PROGRA~1\Symbian\Shared\SYMBIA~1\SCBAL.exe
C:\PROGRA~1\Intuwave\Shared\MROUTE~1\MROUTE~2.EXE
C:\WINDOWS\system32\svchost.exe
C:\Programy\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\dwwin.exe
C:\Gry\Valve\Steam\Steam.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Gry\skan kompa\hijack\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.allegro.pl/?mm=1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programy\Acrobat Reader 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\Programy\FlashFXP\IEFlash.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programy\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [SmartSync - ScheduleSync] C:\PROGRA~1\MOBILE~1\SMARTS~1\SCHEDU~1.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVP] "C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [PC Suite for Smartphones] "C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AutoConnect] C:\Programy\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NETIANET] C:\Program Files\Netia\Net\netianet.exe
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Documents and Settings\Krzysztof\Pulpit\amv converter\AMVConverter\grab.html
O8 - Extra context menu item: Add to AMV Converter... - C:\Documents and Settings\Krzysztof\Pulpit\amv converter\AMVConverter\grab.html
O8 - Extra context menu item: Download with GetRight - C:\Programy\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Programy\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Documents and Settings\Krzysztof\Pulpit\amv converter\MediaManager\grab.html
O8 - Extra context menu item: Open with GetRight Browser - C:\Programy\GetRight\GRbrowse.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programy\MICROS~1\OFFICE11\REFIEBAR.DLL
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_71.cab
O16 - DPF: {2A781DED-C22D-4153-9812-CEA98A32981C} (GameDesire Makao) - http://67.15.101.3/g_bin/pl/cardsmakao_2_0_0_24.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/webplayer/stage6/windows/DivXBrowserPlugin.cab
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_43.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://cf.sobotka.net/activex/AxisCamControl.cab
O16 - DPF: {AC120B1D-9411-4111-AF52-118052D85D45} (GameDesire Darts Games) - http://67.15.101.3/g_bin/pl/darts_2_0_0_35.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{36750057-CD22-4033-81EC-4C1BAD06E012}: NameServer = 213.241.79.37 83.238.255.76
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: pagecnt32 - C:\WINDOWS\SYSTEM32\pagecnt32.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Microsoft ASPI Manager (aspimgr) - Unknown owner - C:\WINDOWS\system32\aspimgr.exe (file missing)
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Loki Drivers Auto Removal (pr2agqwb) (pr2agqwb) - Cyanide - C:\WINDOWS\system32\pr2agqwb.exe
O23 - Service: Loki Drivers Auto Removal (pr2agqwc) (pr2agqwc) - Cyanide - C:\WINDOWS\system32\pr2agqwc.exe

[wojtas]

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

[rafi9-92]

Troche sie robilo ale w koncu Done Juz wrzucam logi

HJ :

Logfile of HijackThis v1.99.1
Scan saved at 22:05:10, on 2008-01-23
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programy\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programy\AutoConnect\AutoConnect.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Netia\Net\netianet.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\PROGRA~1\Symbian\Shared\SYMBIA~1\SYMBIA~1.EXE
C:\PROGRA~1\Symbian\Shared\SYMBIA~1\SCBAL.exe
C:\PROGRA~1\Intuwave\Shared\MROUTE~1\MROUTE~2.EXE
C:\Programy\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\dwwin.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Gry\skan kompa\hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.allegro.pl/?mm=1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programy\Acrobat Reader 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\Programy\FlashFXP\IEFlash.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programy\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [SmartSync - ScheduleSync] C:\PROGRA~1\MOBILE~1\SMARTS~1\SCHEDU~1.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVP] "C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [PC Suite for Smartphones] "C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AutoConnect] C:\Programy\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NETIANET] C:\Program Files\Netia\Net\netianet.exe
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Documents and Settings\Krzysztof\Pulpit\amv converter\AMVConverter\grab.html
O8 - Extra context menu item: Add to AMV Converter... - C:\Documents and Settings\Krzysztof\Pulpit\amv converter\AMVConverter\grab.html
O8 - Extra context menu item: Download with GetRight - C:\Programy\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Programy\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Documents and Settings\Krzysztof\Pulpit\amv converter\MediaManager\grab.html
O8 - Extra context menu item: Open with GetRight Browser - C:\Programy\GetRight\GRbrowse.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programy\MICROS~1\OFFICE11\REFIEBAR.DLL
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_71.cab
O16 - DPF: {2A781DED-C22D-4153-9812-CEA98A32981C} (GameDesire Makao) - http://67.15.101.3/g_bin/pl/cardsmakao_2_0_0_24.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/webplayer/stage6/windows/DivXBrowserPlugin.cab
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_43.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://cf.sobotka.net/activex/AxisCamControl.cab
O16 - DPF: {AC120B1D-9411-4111-AF52-118052D85D45} (GameDesire Darts Games) - http://67.15.101.3/g_bin/pl/darts_2_0_0_35.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{36750057-CD22-4033-81EC-4C1BAD06E012}: NameServer = 213.241.79.37 83.238.255.76
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: pagecnt32 - C:\WINDOWS\SYSTEM32\pagecnt32.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Loki Drivers Auto Removal (pr2agqwb) (pr2agqwb) - Cyanide - C:\WINDOWS\system32\pr2agqwb.exe
O23 - Service: Loki Drivers Auto Removal (pr2agqwc) (pr2agqwc) - Cyanide - C:\WINDOWS\system32\pr2agqwc.exe

SD.FIX

SDFix: Version 1.130

Run by Krzysztof on 2008-01-22 at 21:14

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:

Name:
aspimgr

Path:
C:\WINDOWS\system32\aspimgr.exe

aspimgr - Deleted



Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\DOCUME~1\KRZYSZ~1\USTAWI~1\Temp\GLF8C.tmp.dll - Deleted
C:\DOCUME~1\KRZYSZ~1\USTAWI~1\Temp\GLF95.tmp.dll - Deleted
C:\WINDOWS\offlog.txt - Deleted
C:\WINDOWS\plugin1.dat - Deleted
C:\WINDOWS\s32.txt - Deleted
C:\WINDOWS\ws386.ini - Deleted





Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1344.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-22 21:34:24
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s0"=dword:02a882e2
"s1"=dword:871407c3
"s2"=dword:a7fc3595

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c]
"Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,..

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\WINDOWS\\system32\\usmt\\migwiz.exe"="C:\\WINDOWS\\system32\\usmt\\migwiz.exe:*:Enabled:Kreator transferu plik˘w i ustawieä"
"C:\\Programy\\Gadu-Gadu\\gg.exe"="C:\\Programy\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program glowny"
"C:\\Documents and Settings\\Krzysztof\\Pulpit\\eMule\\emule.exe"="C:\\Documents and Settings\\Krzysztof\\Pulpit\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Documents and Settings\\Krzysztof\\Pulpit\\Bit Lord 1.1\\BitLord.exe"="C:\\Documents and Settings\\Krzysztof\\Pulpit\\Bit Lord 1.1\\BitLord.exe:*:Enabled:BitLord"
"C:\\Programy\\Kaspersky\\Kaspersky Anti-Virus 6.0\\avp.exe"="C:\\Programy\\Kaspersky\\Kaspersky Anti-Virus 6.0\\avp.exe:*:Enabled:Kaspersky Anti-Virus"
"C:\\Programy\\eMule\\emule.exe"="C:\\Programy\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Gry\\Ubisoft\\Heroes of Might and Magic V Demo\\bin\\H5_Game.exe"="C:\\Gry\\Ubisoft\\Heroes of Might and Magic V Demo\\bin\\H5_Game.exe:*:Enabled:Heroes of Might and Magic V"
"C:\\Dema\\Ubisoft\\Heroes of Might and Magic V\\Demo\\bin\\H5_Game.exe"="C:\\Dema\\Ubisoft\\Heroes of Might and Magic V\\Demo\\bin\\H5_Game.exe:*:Enabled:Heroes of Might and Magic V"
"C:\\Dema\\Ubisoft\\Heroes of Might and Magic V Demo\\bin\\H5_Game.exe"="C:\\Dema\\Ubisoft\\Heroes of Might and Magic V Demo\\bin\\H5_Game.exe:*:Enabled:Heroes of Might and Magic V"
"C:\\Gry\\Microsoft Games\\Dungeon Siege 2\\DungeonSiege2.exe"="C:\\Gry\\Microsoft Games\\Dungeon Siege 2\\DungeonSiege2.exe:*:Enabled:Dungeon Siege 2 Game Executable"
"C:\\WINDOWS\\system32\\dpnsvr.exe"="C:\\WINDOWS\\system32\\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server"
"C:\\Programy\\FlashFXP\\flashfxp.exe"="C:\\Programy\\FlashFXP\\flashfxp.exe:*:Enabled:FlashFXP v3"
"C:\\Gry\\Ubisoft\\Ghost Recon Advanced Warfighter\\graw.exe"="C:\\Gry\\Ubisoft\\Ghost Recon Advanced Warfighter\\graw.exe:*:Enabled:graw"
"C:\\Gry\\Ubisoft\\Heroes of Might and Magic V\\bin\\H5_Game.exe"="C:\\Gry\\Ubisoft\\Heroes of Might and Magic V\\bin\\H5_Game.exe:*:Enabled:Heroes of Might and Magic V"
"C:\\Gry\\LittleFighter2\\LF2_v1.9c\\lf2.exe"="C:\\Gry\\LittleFighter2\\LF2_v1.9c\\lf2.exe:*:Enabled:lf2"
"C:\\Gry\\BearShare\\BearShare.exe"="C:\\Gry\\BearShare\\BearShare.exe:*:Enabled:BearShare"
"C:\\Gry\\Ubisoft\\Tom Clancy's Splinter Cell Chaos Theory\\System\\SPLINTERCELL3.EXE"="C:\\Gry\\Ubisoft\\Tom Clancy's Splinter Cell Chaos Theory\\System\\SPLINTERCELL3.EXE:*:Enabled:SPLINTERCELL3"
"C:\\Programy\\NAPI-PROJEKT\\napisy.exe"="C:\\Programy\\NAPI-PROJEKT\\napisy.exe:*:Enabled:napisy"
"C:\\Gry\\Valve\\hlds.exe"="C:\\Gry\\Valve\\hlds.exe:*:Enabled:HLDS Launcher"
"C:\\Gry\\Valve\\hl.exe"="C:\\Gry\\Valve\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Gry\\Warcraft III\\Warcraft III.exe"="C:\\Gry\\Warcraft III\\Warcraft III.exe:*:Enabled:Warcraft III"
"C:\\Gry\\BioWare\\NeverwinterNights\\nwmain.exe"="C:\\Gry\\BioWare\\NeverwinterNights\\nwmain.exe:*:Enabled:Neverwinter Nights"
"C:\\Gry\\Sierra\\FEARCombat\\FEARMP.exe"="C:\\Gry\\Sierra\\FEARCombat\\FEARMP.exe:*:Enabled:FEAR Combat"
"C:\\Gry\\Sierra\\FEARCombat\\FEARServer.exe"="C:\\Gry\\Sierra\\FEARCombat\\FEARServer.exe:*:Enabled:F.E.A.R. - Stand-Alone Server"
"C:\\Program Files\\GigaByte\\VGA Utility Manager\\G-vga.exe"="C:\\Program Files\\GigaByte\\VGA Utility Manager\\G-vga.exe:*:Disabled:Menu"
"C:\\Gry\\EA GAMES\\Need for Speed Most Wanted\\speed.exe"="C:\\Gry\\EA GAMES\\Need for Speed Most Wanted\\speed.exe:*:Enabled:speed"
"C:\\Gry\\Starbreeze Studios\\Knights of the Temple\\Templar.exe"="C:\\Gry\\Starbreeze Studios\\Knights of the Temple\\Templar.exe:*:Enabled:Templar"
"C:\\Gry\\EA SPORTS\\NHL07\\nhl2007.exe"="C:\\Gry\\EA SPORTS\\NHL07\\nhl2007.exe:*:Enabled:nhl2007"
"C:\\Gry\\Soldat\\Soldat.exe"="C:\\Gry\\Soldat\\Soldat.exe:*:Enabled:Soldat"
"C:\\Gry\\Soldat2\\Soldat.exe"="C:\\Gry\\Soldat2\\Soldat.exe:*:Enabled:Soldat"
"C:\\Documents and Settings\\Krzysztof\\Pulpit\\TibiCam_7.71\\TibiCAM.exe"="C:\\Documents and Settings\\Krzysztof\\Pulpit\\TibiCam_7.71\\TibiCAM.exe:*:Disabled:TibiCAM"
"C:\\WINDOWS\\scvhost.exe"="C:\\WINDOWS\\scvhost.exe:*:Enabled:Microsoft Windows"
"C:\\Gry\\OniGames\\Crashday\\Crashday.exe"="C:\\Gry\\OniGames\\Crashday\\Crashday.exe:*:Enabled:Crashday"
"C:\\WINDOWS\\system32\\svchost.exe"="C:\\WINDOWS\\system32\\svchost.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\69exmodul32f.i.exe"="C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\69exmodul32f.i.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\95exmodul32f.i.exe"="C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\95exmodul32f.i.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\99exmodul32f.i.exe"="C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\99exmodul32f.i.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\59exmodul32f.i.exe"="C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\59exmodul32f.i.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\40exmodul32f.i.exe"="C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\40exmodul32f.i.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\54exmodul32f.i.exe"="C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\54exmodul32f.i.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\9exmodul32f.i.exe"="C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\9exmodul32f.i.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\67exmodul32f.i.exe"="C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\67exmodul32f.i.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\84exmodul32f.i.exe"="C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\84exmodul32f.i.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\68exmodul32f.i.exe"="C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\68exmodul32f.i.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\21exmodul32f.i.exe"="C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\21exmodul32f.i.exe:*:Enabled:Microsoft Update"
"C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\76exmodul32f.i.exe"="C:\\DOCUME~1\\KRZYSZ~1\\USTAWI~1\\Temp\\76exmodul32f.i.exe:*:Enabled:Microsoft Update"
"C:\\Gry\\Coding Workshop Polyphonic Wizard\\cwpolywz.exe"="C:\\Gry\\Coding Workshop Polyphonic Wizard\\cwpolywz.exe:*:Enabled:Coding Workshop Polyphonic Wizard"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype. The whole world can talk for free."
"C:\\Programy\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe"="C:\\Programy\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe:*:Enabled:Kaspersky Anti-Virus"
"C:\\Documents and Settings\\Krzysztof\\Pulpit\\TibiCam\\TibiCAM.exe"="C:\\Documents and Settings\\Krzysztof\\Pulpit\\TibiCam\\TibiCAM.exe:*:Enabled:TibiCAM"
"C:\\Gry\\Empire Interactive\\FlatOut\\flatout.exe"="C:\\Gry\\Empire Interactive\\FlatOut\\flatout.exe:*:Enabled:flatout"
"C:\\Gry\\Nival Interactive\\Etherlords II\\Etherlords2.exe"="C:\\Gry\\Nival Interactive\\Etherlords II\\Etherlords2.exe:*:Enabled:Etherlords 2 main executable file"
"C:\\Gry\\Valve\\hltv.exe"="C:\\Gry\\Valve\\hltv.exe:*:Disabled:HLTV Launcher"
"C:\\Gry\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe"="C:\\Gry\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\XR_3DA.exe:*:Enabled:S.T.A.L.K.E.R. - Shadow of Chernobyl (CLI)"
"C:\\Gry\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe"="C:\\Gry\\THQ\\S.T.A.L.K.E.R. - Shadow of Chernobyl\\bin\\dedicated\\XR_3DA.exe:*:Enabled:S.T.A.L.K.E.R. - Shadow of Chernobyl (SRV)"
"C:\\Documents and Settings\\Krzysztof\\Pulpit\\Ip changer\\Tibia7\\Tibia.exe"="C:\\Documents and Settings\\Krzysztof\\Pulpit\\Ip changer\\Tibia7\\Tibia.exe:*:Enabled:Tibia Player"
"C:\\Gry\\Tibia79\\Tibia.exe"="C:\\Gry\\Tibia79\\Tibia.exe:*:Enabled:Tibia Player"
"C:\\Program Files\\BitTorrent_DNA\\dna.exe"="C:\\Program Files\\BitTorrent_DNA\\dna.exe:*:Enabled:DNA"
"C:\\Programy\\BitTorrent\\bittorrent.exe"="C:\\Programy\\BitTorrent\\bittorrent.exe:*:Enabled:BitTorrent"
"C:\\Gry\\CAPCOM\\LOST_PLANET_TRIAL_DX9\\LostPlanetDX9.exe"="C:\\Gry\\CAPCOM\\LOST_PLANET_TRIAL_DX9\\LostPlanetDX9.exe:*:Enabled:LostPlanetDX9"
"C:\\Gry\\Codemasters\\DiRT Demo\\DiRTDemo.exe"="C:\\Gry\\Codemasters\\DiRT Demo\\DiRTDemo.exe:*:Enabled:DiRT Demo Executable"
"C:\\Documents and Settings\\Krzysztof\\Pulpit\\utorrent.exe"="C:\\Documents and Settings\\Krzysztof\\Pulpit\\utorrent.exe:*:Enabled:uTorrent"
"C:\\Gry\\Serious Sam Drugie Starcie\\Bin\\SeriousSam.exe"="C:\\Gry\\Serious Sam Drugie Starcie\\Bin\\SeriousSam.exe:*:Enabled:SeriousSam"
"C:\\Gry\\Electronic Arts\\Bitwa o —r˘dziemie II\\game.dat"="C:\\Gry\\Electronic Arts\\Bitwa o —r˘dziemie II\\game.dat:*:Enabled:Bitwa o —r˘dziemiet II"
"C:\\Gry\\EA GAMES\\Medal of Honor Pacific Assault(tm)\\mohpa.exe"="C:\\Gry\\EA GAMES\\Medal of Honor Pacific Assault(tm)\\mohpa.exe:*:Enabled:Medal of Honor Pacific Assault(tm)"
"C:\\Gry\\Cyanide\\Loki\\Loki.exe"="C:\\Gry\\Cyanide\\Loki\\Loki.exe:*:Enabled:Loki"
"C:\\Gry\\Cyanide\\Loki\\Autorun\\AutoRun.exe"="C:\\Gry\\Cyanide\\Loki\\Autorun\\AutoRun.exe:*:Enabled:Loki - AutoRun"
"C:\\Documents and Settings\\Krzysztof\\Pulpit\\wowclient-downloader.exe"="C:\\Documents and Settings\\Krzysztof\\Pulpit\\wowclient-downloader.exe:*:Enabled:Blizzard Downloader"
"C:\\Gry\\Metin2_PL\\metin2.bin"="C:\\Gry\\Metin2_PL\\metin2.bin:*:Enabled:metin2"
"C:\\Gry\\KONAMI\\Pro Evolution Soccer 6\\PES6.exe"="C:\\Gry\\KONAMI\\Pro Evolution Soccer 6\\PES6.exe:*:Enabled:pes6.exe"
"C:\\Gry\\Steam\\SteamApps\\rafi992\\dark messiah might and magic multi-player\\mm.exe"="C:\\Gry\\Steam\\SteamApps\\rafi992\\dark messiah might and magic multi-player\\mm.exe:*:Enabled:mm"
"C:\\Gry\\Steam\\Steam.exe"="C:\\Gry\\Steam\\Steam.exe:*:Enabled:Steam"
"C:\\Gry\\id Software\\Enemy Territory - QUAKE Wars Demo\\etqw.exe"="C:\\Gry\\id Software\\Enemy Territory - QUAKE Wars Demo\\etqw.exe:*:Enabled:Enemy Territory - QUAKE Wars(TM) Demo"
"C:\\Gry\\id Software\\Enemy Territory - QUAKE Wars Demo\\etqwded.exe"="C:\\Gry\\id Software\\Enemy Territory - QUAKE Wars Demo\\etqwded.exe:*:Enabled:etqwded.exe"
"C:\\Gry\\Counter-Strike 1.6\\hl.exe"="C:\\Gry\\Counter-Strike 1.6\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Gry\\Tibia8.0\\tibia.exe"="C:\\Gry\\Tibia8.0\\tibia.exe:*:Enabled:Tibia Player"
"C:\\WINDOWS\\system32\\dpvsetup.exe"="C:\\WINDOWS\\system32\\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\\WINDOWS\\system32\\rundll32.exe"="C:\\WINDOWS\\system32\\rundll32.exe:*:Enabled:Uruchamia plik DLL jako aplikacj©"
"C:\\Gry\\Valve\\Steam\\SteamApps\\rafi992\\counter-strike\\hl.exe"="C:\\Gry\\Valve\\Steam\\SteamApps\\rafi992\\counter-strike\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Gry\\Valve\\Steam\\SteamApps\\rafi992\\condition zero\\hl.exe"="C:\\Gry\\Valve\\Steam\\SteamApps\\rafi992\\condition zero\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Gry\\Valve\\Steam\\SteamApps\\rafi992\\ricochet\\hl.exe"="C:\\Gry\\Valve\\Steam\\SteamApps\\rafi992\\ricochet\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Gry\\Valve\\Steam\\SteamApps\\rafi992\\deathmatch classic\\hl.exe"="C:\\Gry\\Valve\\Steam\\SteamApps\\rafi992\\deathmatch classic\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Gry\\Valve\\Steam\\SteamApps\\rafi992\\day of defeat\\hl.exe"="C:\\Gry\\Valve\\Steam\\SteamApps\\rafi992\\day of defeat\\hl.exe:*:Enabled:Half-Life Launcher"
"C:\\Gry\\Valve\\Steam\\SteamApps\\rafi992\\team fortress 2\\hl2.exe"="C:\\Gry\\Valve\\Steam\\SteamApps\\rafi992\\team fortress 2\\hl2.exe:*:Enabled:hl2"
"C:\\Program Files\\Intuwave\\Shared\\mRouterRuntime\\mRouterRuntime.exe"="C:\\Program Files\\Intuwave\\Shared\\mRouterRuntime\\mRouterRuntime.exe:*:Enabled:mRouterRuntime Module"
"C:\\Programy\\Skype\\Skype.exe"="C:\\Programy\\Skype\\Skype.exe:*:Enabled:Skype"
"C:\\Gry\\Atari\\Neverwinter Nights 2\\nwn2main.exe"="C:\\Gry\\Atari\\Neverwinter Nights 2\\nwn2main.exe:*:Enabled:Neverwinter Nights 2 Main"
"C:\\Gry\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe"="C:\\Gry\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe:*:Enabled:Neverwinter Nights 2 AMD"
"C:\\Gry\\Atari\\Neverwinter Nights 2\\nwupdate.exe"="C:\\Gry\\Atari\\Neverwinter Nights 2\\nwupdate.exe:*:Enabled:Neverwinter Nights 2 Updater"
"C:\\Gry\\Atari\\Neverwinter Nights 2\\nwn2server.exe"="C:\\Gry\\Atari\\Neverwinter Nights 2\\nwn2server.exe:*:Enabled:Neverwinter Nights 2 Server"
"C:\\Programy\\Skype\\Phone\\Skype.exe"="C:\\Programy\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Programy\\FlashFXP\\flashfxp.exe"="C:\\Programy\\FlashFXP\\flashfxp.exe:*:Enabled:FlashFXP v3"

Remaining Files:
---------------

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Tue 4 Jun 2002 84,992 A..HR --- "C:\Gry\Replay Converter\14_43260.dll"
Tue 4 Jun 2002 44,032 A..HR --- "C:\Gry\Replay Converter\28_83260.dll"
Tue 10 Dec 2002 73,766 A..HR --- "C:\Gry\Replay Converter\atrc3260.dll"
Tue 10 Dec 2002 65,575 A..HR --- "C:\Gry\Replay Converter\cook3260.dll"
Sun 26 Jun 2005 616,448 A.SHR --- "C:\Gry\Replay Converter\cygwin1.dll"
Wed 22 Jun 2005 45,568 A.SHR --- "C:\Gry\Replay Converter\cygz.dll"
Tue 4 Jun 2002 20,480 A..HR --- "C:\Gry\Replay Converter\dnet3260.dll"
Tue 10 Dec 2002 176,165 A..HR --- "C:\Gry\Replay Converter\drv23260.dll"
Tue 10 Dec 2002 94,208 A..HR --- "C:\Gry\Replay Converter\drv33260.dll"
Tue 10 Dec 2002 217,127 A..HR --- "C:\Gry\Replay Converter\drv43260.dll"
Sat 3 Nov 2001 225,280 A..HR --- "C:\Gry\Replay Converter\ivvideo.dll"
Tue 10 Apr 2001 225,280 A..HR --- "C:\Gry\Replay Converter\qtmlClient.dll"
Fri 20 Feb 2004 548,940 A..HR --- "C:\Gry\Replay Converter\raac.dll"
Tue 10 Dec 2002 102,439 A..HR --- "C:\Gry\Replay Converter\sipr3260.dll"
Tue 28 Dec 2004 4,348 A..H. --- "C:\Muza\Kopia zapasowa licencji\drmv1key.bak"
Wed 7 Dec 2005 20 A..H. --- "C:\Muza\Kopia zapasowa licencji\drmv1lic.bak"
Wed 29 Dec 2004 312 A..H. --- "C:\Muza\Kopia zapasowa licencji\drmv2key.bak"
Fri 10 Mar 2000 84,992 A.SH. --- "C:\Programy\1\14_43260.DLL"
Fri 10 Mar 2000 44,032 A.SH. --- "C:\Programy\1\28_83260.DLL"
Fri 10 Mar 2000 30,208 A.SH. --- "C:\Programy\1\AUTH3260.DLL"
Fri 10 Mar 2000 23,552 A.SH. --- "C:\Programy\1\BASC3260.DLL"
Fri 10 Mar 2000 23,552 A.SH. --- "C:\Programy\1\COKR3260.DLL"
Fri 10 Mar 2000 25,088 A.SH. --- "C:\Programy\1\COOK3260.DLL"
Fri 10 Mar 2000 20,480 A.SH. --- "C:\Programy\1\DNET3260.DLL"
Fri 10 Mar 2000 78,848 A.SH. --- "C:\Programy\1\EDNT3260.DLL"
Fri 10 Mar 2000 446,976 A.SH. --- "C:\Programy\1\ENCN3260.DLL"
Fri 10 Mar 2000 21,504 A.SH. --- "C:\Programy\1\ENLV3260.DLL"
Fri 10 Mar 2000 92,672 A.SH. --- "C:\Programy\1\ERV13260.DLL"
Fri 10 Mar 2000 272,384 A.SH. --- "C:\Programy\1\ERV23260.DLL"
Fri 10 Mar 2000 59,392 A.SH. --- "C:\Programy\1\ESPR3260.DLL"
Tue 16 Oct 2001 139,264 A.SH. --- "C:\Programy\1\jpeglib.dll"
Fri 10 Mar 2000 278,528 A.SH. --- "C:\Programy\1\PNCRT.DLL"
Fri 10 Mar 2000 379,904 A.SH. --- "C:\Programy\1\PNGU3264.DLL"
Fri 10 Mar 2000 11,264 A.SH. --- "C:\Programy\1\PNRS3260.DLL"
Fri 10 Mar 2000 508,928 A.SH. --- "C:\Programy\1\RMBE3260.DLL"
Fri 10 Mar 2000 521,216 A.SH. --- "C:\Programy\1\RMME3260.DLL"
Fri 10 Mar 2000 328,192 A.SH. --- "C:\Programy\1\RMTO3260.DLL"
Fri 10 Mar 2000 28,160 A.SH. --- "C:\Programy\1\RN5A3260.DLL"
Fri 10 Mar 2000 500,224 A.SH. --- "C:\Programy\1\RNCO3260.DLL"
Fri 10 Mar 2000 30,208 A.SH. --- "C:\Programy\1\RV103260.DLL"
Fri 10 Mar 2000 90,624 A.SH. --- "C:\Programy\1\RV203260.DLL"
Fri 10 Mar 2000 41,472 A.SH. --- "C:\Programy\1\SDPP3260.DLL"
Fri 10 Mar 2000 17,408 A.SH. --- "C:\Programy\1\SIPR3260.DLL"
Tue 16 Oct 2001 569,344 A.SH. --- "C:\Programy\1\tablib.dll"
Tue 16 Oct 2001 1,167,360 A.SH. --- "C:\Programy\1\tassdll.dll"
Tue 16 Oct 2001 32,768 A.SH. --- "C:\Programy\1\thereal.dll"
Tue 16 Oct 2001 20,480 A.SH. --- "C:\Programy\1\vidfowin.dll"
Tue 16 Oct 2001 20,480 A.SH. --- "C:\Programy\1\wavout.dll"
Tue 16 Oct 2001 98,304 A.SH. --- "C:\Programy\1\wmfwrite.dll"
Sun 20 Mar 2005 3,111,064 A..H. --- "C:\Programy\Picasa2\setup.exe"
Fri 9 Mar 2007 27,648 A.SH. --- "C:\WINDOWS\system32\AVSredirect.dll"
Mon 27 Jun 2005 616,448 A.SHR --- "C:\WINDOWS\system32\cygwin1.dll"
Wed 22 Jun 2005 45,568 A.SHR --- "C:\WINDOWS\system32\cygz.dll"
Fri 12 May 2006 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Mon 13 Nov 2006 319,456 A..H. --- "C:\Program Files\Common Files\Motorola Shared\MotPCSDrivers\difxapi.dll"
Tue 22 Jan 2008 1,714 ...HR --- "C:\Documents and Settings\Krzysztof\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak"

Finished!

Combofix

ComboFix 08-01-23.1 - Krzysztof 2008-01-22 21:45:31.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.644 [GMT 1:00]
Running from: C:\Documents and Settings\Krzysztof\Pulpit\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Krzysztof\Dane aplikacji\macromedia\Flash Player\#SharedObjects\JA897ZYP\www.broadcaster.com
C:\Documents and Settings\Krzysztof\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\Krzysztof\Dane aplikacji\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol

.
((((((((((((((((((((((((( Files Created from 2007-12-23 to 2008-01-23 )))))))))))))))))))))))))))))))
.

2008-01-22 21:44 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-22 21:13 . 2008-01-22 21:13 <DIR> d-------- C:\WINDOWS\ERUNT
2008-01-19 18:55 . 2008-01-19 18:55 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-19 18:55 . 2008-01-19 18:55 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-05 14:45 . 2008-01-06 10:38 23 --a------ C:\WINDOWS\popcinfot.dat
2008-01-04 14:08 . 2008-01-04 14:09 <DIR> d-------- C:\AVOneExport
2008-01-04 14:08 . 2007-07-28 20:56 3,889,728 --a------ C:\WINDOWS\system32\avcodec.dll
2008-01-04 14:08 . 2007-07-28 20:56 1,143,989 --a------ C:\WINDOWS\system32\avformat.dll
2008-01-04 14:08 . 2007-07-28 20:56 64,512 --a------ C:\WINDOWS\system32\ffmpeg.exe
2008-01-04 14:07 . 2008-01-04 14:16 76 --a------ C:\WINDOWS\system32\buyurl0502.dat
2008-01-03 20:14 . 2008-01-03 20:14 <DIR> d-------- C:\WINDOWS\nview
2008-01-03 20:14 . 2007-12-05 01:41 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-01-03 20:14 . 2008-01-03 20:15 163,353 --a------ C:\WINDOWS\system32\nvapps.xml
2008-01-03 20:14 . 2007-12-05 01:41 17,737 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-01-03 20:07 . 2007-12-05 02:53 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2008-01-02 21:03 . 2008-01-02 21:03 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-01-02 21:03 . 2008-01-02 21:03 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
2008-01-02 20:33 . 2008-01-02 20:33 <DIR> d-------- C:\Program Files\Common Files\Motorola Shared
2008-01-02 20:33 . 2006-11-13 14:45 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-01-02 20:33 . 2007-02-27 14:31 21,504 --a------ C:\WINDOWS\system32\drivers\motmodem.sys
2007-12-31 21:35 . 2007-12-31 21:35 <DIR> d-------- C:\WINDOWS\system32\URTTEMP
2007-12-31 18:24 . 2007-04-13 08:50 108,424 -ra------ C:\WINDOWS\system32\drivers\zebrmdmc.sys
2007-12-31 18:24 . 2007-04-13 08:50 108,296 -ra------ C:\WINDOWS\system32\drivers\zebrmdm.sys
2007-12-31 18:24 . 2007-04-13 08:50 90,888 -ra------ C:\WINDOWS\system32\drivers\zebrsce.sys
2007-12-31 18:24 . 2007-04-13 08:50 83,080 -ra------ C:\WINDOWS\system32\drivers\zebrbus.sys
2007-12-31 18:24 . 2007-04-13 08:50 15,112 -ra------ C:\WINDOWS\system32\drivers\zebrmdfl.sys
2007-12-31 18:24 . 2007-04-13 08:50 12,424 -ra------ C:\WINDOWS\system32\drivers\zebrcmnt.sys
2007-12-31 18:24 . 2007-04-13 08:50 12,424 -ra------ C:\WINDOWS\system32\drivers\zebrcm.sys
2007-12-31 18:20 . 2007-04-13 08:50 62,984 -ra------ C:\WINDOWS\system32\drivers\zebrceb.sys
2007-12-31 18:20 . 2007-04-13 08:50 12,424 -ra------ C:\WINDOWS\system32\drivers\zebrwhnt.sys
2007-12-31 18:20 . 2007-04-13 08:50 12,424 -ra------ C:\WINDOWS\system32\drivers\zebrwh.sys
2007-12-31 18:19 . 2007-12-31 18:19 <DIR> d-------- C:\Program Files\Symbian
2007-12-31 18:19 . 2007-12-31 18:19 <DIR> d-------- C:\Program Files\Intuwave
2007-12-31 18:19 . 2005-06-08 15:53 288 --a------ C:\WINDOWS\mrinstu.iss
2007-12-31 18:18 . 2007-12-31 18:20 <DIR> d-------- C:\Program Files\Sony Ericsson
2007-12-31 18:18 . 2007-12-31 18:18 <DIR> d-------- C:\Program Files\Common Files\Teleca Shared
2007-12-31 18:18 . 2007-12-31 18:18 <DIR> d-------- C:\Program Files\Common Files\Sony Ericsson Shared
2007-12-31 18:17 . 2007-12-31 18:17 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-12-28 17:12 . 2007-12-28 17:12 <DIR> d-------- C:\Program Files\Common Files\Skype
2007-12-25 22:57 . 2007-12-26 14:01 <DIR> d-------- C:\Program Files\Replay Converter
2007-12-25 22:57 . 2007-03-04 13:55 1,936,528 --a------ C:\WINDOWS\system32\ltmm15.dll
2007-12-25 22:57 . 2007-03-04 13:55 135,168 --a------ C:\WINDOWS\system32\DSKernel2.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-23 20:59 191,197,472 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-23 20:58 2,874,144 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-01-22 20:11 270,284 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-01-22 20:11 2,560,748 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-22 18:01 --------- d-----w C:\Program Files\Neostrada TP
2008-01-07 21:03 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-01-07 19:26 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-03 18:59 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-01-02 19:34 --------- d-----w C:\Program Files\Motorola Phone Tools
2007-12-26 13:52 737,280 ----a-w C:\WINDOWS\iun6002.exe
2007-12-20 18:36 91,492 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2007-12-12 20:51 85,860 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2007-12-05 00:41 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-12-05 00:41 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-12-05 00:41 8,523,776 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-12-05 00:41 753,664 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-12-05 00:41 7,435,392 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-12-05 00:41 6,901,760 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-12-05 00:41 6,549,504 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-12-05 00:41 5,773,568 ----a-w C:\WINDOWS\system32\nv4_disp.dll
2007-12-05 00:41 5,611,520 ----a-w C:\WINDOWS\system32\nvdispsr.dll
2007-12-05 00:41 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-12-05 00:41 458,752 ----a-w C:\WINDOWS\system32\nvmccssr.dll
2007-12-05 00:41 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-12-05 00:41 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-12-05 00:41 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-12-05 00:41 385,024 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-12-05 00:41 35,328 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-12-05 00:41 35,328 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-12-05 00:41 335,872 ----a-w C:\WINDOWS\system32\nvwrses.dll
2007-12-05 00:41 335,872 ----a-w C:\WINDOWS\system32\nvwrsel.dll
2007-12-05 00:41 327,680 ----a-w C:\WINDOWS\system32\nvwrsfr.dll
2007-12-05 00:41 327,680 ----a-w C:\WINDOWS\system32\nvwrsesm.dll
2007-12-05 00:41 327,680 ----a-w C:\WINDOWS\system32\nvrshe.dll
2007-12-05 00:41 327,680 ----a-w C:\WINDOWS\system32\nvrsar.dll
2007-12-05 00:41 323,584 ----a-w C:\WINDOWS\system32\nvwrspt.dll
2007-12-05 00:41 323,584 ----a-w C:\WINDOWS\system32\nvwrsit.dll
2007-12-05 00:41 319,488 ----a-w C:\WINDOWS\system32\nvwrsptb.dll
2007-12-05 00:41 319,488 ----a-w C:\WINDOWS\system32\nvwrsnl.dll
2007-12-05 00:41 315,392 ----a-w C:\WINDOWS\system32\nvwrsru.dll
2007-12-05 00:41 315,392 ----a-w C:\WINDOWS\system32\nvwrshu.dll
2007-12-05 00:41 311,296 ----a-w C:\WINDOWS\system32\nvwrsde.dll
2007-12-05 00:41 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-12-05 00:41 303,104 ----a-w C:\WINDOWS\system32\nvwrstr.dll
2007-12-05 00:41 303,104 ----a-w C:\WINDOWS\system32\nvwrssl.dll
2007-12-05 00:41 303,104 ----a-w C:\WINDOWS\system32\nvwrsfi.dll
2007-12-05 00:41 3,715,072 ----a-w C:\WINDOWS\system32\nvvitvsr.dll
2007-12-05 00:41 3,710,976 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-12-05 00:41 3,420,160 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-12-05 00:41 3,334,144 ----a-w C:\WINDOWS\system32\nvgamesr.dll
2007-12-05 00:41 299,008 ----a-w C:\WINDOWS\system32\nvwrssk.dll
2007-12-05 00:41 299,008 ----a-w C:\WINDOWS\system32\nvwrsno.dll
2007-12-05 00:41 294,912 ----a-w C:\WINDOWS\system32\nvwrssv.dll
2007-12-05 00:41 294,912 ----a-w C:\WINDOWS\system32\nvwrspl.dll
2007-12-05 00:41 294,912 ----a-w C:\WINDOWS\system32\nvwrsda.dll
2007-12-05 00:41 290,816 ----a-w C:\WINDOWS\system32\nvwrsth.dll
2007-12-05 00:41 286,720 ----a-w C:\WINDOWS\system32\nvwrseng.dll
2007-12-05 00:41 286,720 ----a-w C:\WINDOWS\system32\nvwrscs.dll
2007-12-05 00:41 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-12-05 00:41 282,624 ----a-w C:\WINDOWS\system32\nvwrsar.dll
2007-12-05 00:41 282,624 ----a-w C:\WINDOWS\system32\nvrsfr.dll
2007-12-05 00:41 282,624 ----a-w C:\WINDOWS\system32\nvrses.dll
2007-12-05 00:41 282,624 ----a-w C:\WINDOWS\system32\nvrsel.dll
2007-12-05 00:41 278,528 ----a-w C:\WINDOWS\system32\nvwrshe.dll
2007-12-05 00:41 278,528 ----a-w C:\WINDOWS\system32\nvrsit.dll
2007-12-05 00:41 278,528 ----a-w C:\WINDOWS\system32\nvrsde.dll
2007-12-05 00:41 274,432 ----a-w C:\WINDOWS\system32\nvrspt.dll
2007-12-05 00:41 274,432 ----a-w C:\WINDOWS\system32\nvrsnl.dll
2007-12-05 00:41 274,432 ----a-w C:\WINDOWS\system32\nvrsesm.dll
2007-12-05 00:41 270,336 ----a-w C:\WINDOWS\system32\nvrsru.dll
2007-12-05 00:41 266,240 ----a-w C:\WINDOWS\system32\nvrsptb.dll
2007-12-05 00:41 266,240 ----a-w C:\WINDOWS\system32\nvrsja.dll
2007-12-05 00:41 258,048 ----a-w C:\WINDOWS\system32\nvrstr.dll
2007-12-05 00:41 258,048 ----a-w C:\WINDOWS\system32\nvrssl.dll
2007-12-05 00:41 258,048 ----a-w C:\WINDOWS\system32\nvrssk.dll
2007-12-05 00:41 258,048 ----a-w C:\WINDOWS\system32\nvrsko.dll
2007-12-05 00:41 258,048 ----a-w C:\WINDOWS\system32\nvrshu.dll
2007-12-05 00:41 253,952 ----a-w C:\WINDOWS\system32\nvrsth.dll
2007-12-05 00:41 253,952 ----a-w C:\WINDOWS\system32\nvrssv.dll
2007-12-05 00:41 253,952 ----a-w C:\WINDOWS\system32\nvrspl.dll
2007-12-05 00:41 253,952 ----a-w C:\WINDOWS\system32\nvrsno.dll
2007-12-05 00:41 253,952 ----a-w C:\WINDOWS\system32\nvrsda.dll
2007-12-05 00:41 249,856 ----a-w C:\WINDOWS\system32\nvrsfi.dll
2007-12-05 00:41 249,856 ----a-w C:\WINDOWS\system32\nvrscs.dll
2007-12-05 00:41 245,760 ----a-w C:\WINDOWS\system32\nvrseng.dll
2007-12-05 00:41 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll
2007-12-05 00:41 225,280 ----a-w C:\WINDOWS\system32\nvrszhc.dll
2007-12-05 00:41 212,992 ----a-w C:\WINDOWS\system32\nvwrsja.dll
2007-12-05 00:41 2,854,912 ----a-w C:\WINDOWS\system32\nvmoblsr.dll
2007-12-05 00:41 2,519,040 ----a-w C:\WINDOWS\system32\nvwssr.dll
2007-12-05 00:41 2,498,560 ----a-w C:\WINDOWS\system32\nvwss.dll
2007-12-05 00:41 196,608 ----a-w C:\WINDOWS\system32\nvwrsko.dll
2007-12-05 00:41 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll
2007-12-05 00:41 167,936 ----a-w C:\WINDOWS\system32\nvwrszht.dll
2007-12-05 00:41 163,840 ----a-w C:\WINDOWS\system32\nvwrszhc.dll
2007-12-05 00:41 155,716 ----a-w C:\WINDOWS\system32\nvsvc32.exe
2007-12-05 00:41 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe
2007-12-05 00:41 126,976 ----a-w C:\WINDOWS\system32\nvrszht.dll
2007-12-05 00:41 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll
2007-12-05 00:41 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe
2007-03-09 08:12 27,648 --sha-w C:\WINDOWS\system32\AVSredirect.dll
2005-06-26 23:32 616,448 --sha-r C:\WINDOWS\system32\cygwin1.dll
2005-06-22 06:37 45,568 --sha-r C:\WINDOWS\system32\cygz.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]
"AutoConnect"="C:\Programy\AutoConnect\AutoConnect.exe" [2004-08-28 19:27 295424]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"NETIANET"="C:\Program Files\Netia\Net\netianet.exe" [2007-02-23 13:40 474112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-10-21 13:20 77824 C:\WINDOWS\SOUNDMAN.EXE]
"QuickTime Task"="C:\Programy\QuickTime\qttask.exe" [2007-02-16 10:54 282624]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 06:03 221184]
"SmartSync - ScheduleSync"="C:\PROGRA~1\MOBILE~1\SMARTS~1\SCHEDU~1.EXE" [2006-08-31 07:41 45056]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-05-28 01:27 180269]
"AVP"="C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2007-03-09 19:50 200768]
"PC Suite for Smartphones"="C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" [2007-05-28 10:14 528384]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]
"NETIANET"="C:\Program Files\Netia\Net\netianet.exe" [2007-02-23 13:40 474112]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pagecnt32]
pagecnt32.dll 2004-05-05 05:27 8192 C:\WINDOWS\system32\pagecnt32.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DSLMON.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\DSLMON.lnk
backup=C:\WINDOWS\pss\DSLMON.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^GetRight - Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\GetRight - Tray Icon.lnk
backup=C:\WINDOWS\pss\GetRight - Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd]
--a------ 2004-10-21 16:44 2744832 C:\WINDOWS\ALCWZRD.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 13:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSyncU.exe]
--------- 2006-08-07 10:06 700416 C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox]
--a------ 2004-01-14 12:10 409600 C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--------- 2004-08-12 16:45 61952 C:\WINDOWS\system32\Hdaudpropshortcut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2004-06-16 06:03 221184 C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2004-06-16 06:03 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVRTCLK]
-ra------ 2003-12-30 10:44 24576 C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWN_EncyStarter]
--------- 2003-01-23 15:40 40960 C:\Programy\PWN\EncyPraktyczna\EncyStarter.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
--a------ 2006-03-18 03:24 184320 C:\Programy\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-02-16 10:54 282624 C:\Programy\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 2003-10-31 18:42 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Gry\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2006-05-28 01:27 180269 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VGAUtil]
--a------ 2004-09-09 11:04 552960 C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.EXE

R0 AFPAnsi;G-DATA Ukrywacz Ansi;C:\WINDOWS\system32\Drivers\AFPAnsi.sys [2002-10-09 12:53]
R0 FO_PAnt;FotoOffice VirtualDisc Driver;C:\WINDOWS\system32\Drivers\FO_PAnt.sys [2003-07-17 11:56]
R0 ps6agqwb;Loki Synchronization Driver (ps6agqwb);C:\WINDOWS\system32\drivers\ps6agqwb.sys [2007-07-04 17:06]
R3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 13:00]
R3 zebrceb;Sony Ericsson Cable Emulation Bus (WDM);C:\WINDOWS\system32\DRIVERS\zebrceb.sys [2007-04-13 08:50]
S0 ps6agqwc;Loki Synchronization Driver (ps6agqwc);C:\WINDOWS\system32\drivers\ps6agqwc.sys []
S2 pr2agqwb;Loki Drivers Auto Removal (pr2agqwb);C:\WINDOWS\system32\pr2agqwb.exe svc []
S2 pr2agqwc;Loki Drivers Auto Removal (pr2agqwc);C:\WINDOWS\system32\pr2agqwc.exe svc []
S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys [2004-05-02 09:47]
S3 GVTDrv;GVTDrv;C:\WINDOWS\system32\drivers\GVTDrv.sys [2007-04-09 10:29]
S3 hamachi_oem;PlayLinc Adapter;C:\WINDOWS\system32\DRIVERS\gan_adapter.sys [2006-08-28 22:54]
S3 mamotou;mamotou;C:\WINDOWS\system32\DRIVERS\mamotou.sys [2005-11-07 17:50]
S3 motmodem;Motorola USB CDC ACM Driver;C:\WINDOWS\system32\DRIVERS\motmodem.sys [2007-02-27 14:31]
S3 siusbmod;siusbmod;C:\WINDOWS\system32\DRIVERS\siusbmod.sys [2005-09-12 15:40]
S3 zebrbus;Sony Ericsson Composite Device driver;C:\WINDOWS\system32\DRIVERS\zebrbus.sys [2007-04-13 08:50]
S3 zebrmdfl;Sony Ericsson Modem Filter;C:\WINDOWS\system32\DRIVERS\zebrmdfl.sys [2007-04-13 08:50]
S3 zebrmdm;Sony Ericsson Port (WDM);C:\WINDOWS\system32\DRIVERS\zebrmdm.sys [2007-04-13 08:50]
S3 zebrmdmc;Sony Ericsson mRouter Port (WDM);C:\WINDOWS\system32\DRIVERS\zebrmdmc.sys [2007-04-13 08:50]
S3 zebrsce;Sony Ericsson PC-Connect Port;C:\WINDOWS\system32\DRIVERS\zebrsce.sys [2007-04-13 08:50]

*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
"2008-01-18 20:27:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-23 21:59:03
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-01-23 22:00:39
ComboFix-quarantined-files.txt 2008-01-23 21:00:34
.
2008-01-10 09:01:40 --- E O F ---

[wojtas]

ten plik:

C:\WINDOWS\system32\pagecnt32.dll

przeskanuj tu :

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty

[rafi9-92]

Stary miales racje full virusow w tym gow**e trzymaj raport :

Antywirus Wersja Ostatnia aktualizacja Wynik
AhnLab-V3 2008.1.23.10 2008.01.22 -
AntiVir 7.6.0.48 2008.01.22 TR/Hijacker.Gen
Authentium 4.93.8 2008.01.22 -
Avast 4.7.1098.0 2008.01.22 Win32:Small-IKB
AVG 7.5.0.516 2008.01.22 Downloader.Small.60.AO
BitDefender 7.2 2008.01.22 -
CAT-QuickHeal 9.00 2008.01.22 -
ClamAV 0.91.2 2008.01.22 -
DrWeb 4.44.0.09170 2008.01.22 -
eSafe 7.0.15.0 2008.01.16 -
eTrust-Vet 31.3.5477 2008.01.22 -
Ewido 4.0 2008.01.22 -
FileAdvisor 1 2008.01.22 -
Fortinet 3.14.0.0 2008.01.22 -
F-Prot 4.4.2.54 2008.01.22 -
F-Secure 6.70.13260.0 2008.01.22 -
Ikarus T3.1.1.20 2008.01.22 Virus.Win32.Small.IKB
Kaspersky 7.0.0.125 2008.01.22 -
McAfee 5213 2008.01.22 -
Microsoft 1.3109 2008.01.22 VirTool:Win32/Obfuscator!Mal
NOD32v2 2815 2008.01.22 -
Norman 5.80.02 2008.01.22 -
Panda 9.0.0.4 2008.01.22 -
Prevx1 V2 2008.01.22 -
Rising 20.28.12.00 2008.01.22 -
Sophos 4.24.0 2008.01.22 Sus/Behav-1021
Sunbelt 2.2.907.0 2008.01.17 -
Symantec 10 2008.01.22 -
TheHacker 6.2.9.194 2008.01.22 -
VBA32 3.12.2.5 2008.01.21 -
VirusBuster 4.3.26:9 2008.01.22 -
Webwasher-Gateway 6.6.2 2008.01.22 Trojan.Hijacker.Gen
Dodatkowe informacje
File size: 8192 bytes
MD5: 1a23721105353b03edd3b06850334425
SHA1: 909cc56e6873162bdf57531c7be5a733995dc31b
PEiD: -
packers: UPX
packers: UPX
packers: UPX
packers: PE_Patch.UPX, UPX

[wojtas]

sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

C:\WINDOWS\system32\pagecnt32.dll

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

skasuj wpis:

O20 - Winlogon Notify: pagecnt32 - C:\WINDOWS\SYSTEM32\pagecnt32.dll

i daj nowy log z combo i hijacka

[rafi9-92]

Prosze logi :

Combo

ComboFix 08-01-23.1 - Krzysztof 2008-01-23 22:50:58.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.640 [GMT 1:00]
Running from: C:\Gry\skan kompa\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2007-12-23 to 2008-01-23 )))))))))))))))))))))))))))))))
.

2008-01-22 21:44 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\Nircmd.exe
2008-01-22 21:13 . 2008-01-22 21:13 <DIR> d-------- C:\WINDOWS\ERUNT
2008-01-19 18:55 . 2008-01-19 18:55 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-19 18:55 . 2008-01-19 18:55 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-05 14:45 . 2008-01-06 10:38 23 --a------ C:\WINDOWS\popcinfot.dat
2008-01-04 14:08 . 2008-01-04 14:09 <DIR> d-------- C:\AVOneExport
2008-01-04 14:08 . 2007-07-28 20:56 3,889,728 --a------ C:\WINDOWS\system32\avcodec.dll
2008-01-04 14:08 . 2007-07-28 20:56 1,143,989 --a------ C:\WINDOWS\system32\avformat.dll
2008-01-04 14:08 . 2007-07-28 20:56 64,512 --a------ C:\WINDOWS\system32\ffmpeg.exe
2008-01-04 14:07 . 2008-01-04 14:16 76 --a------ C:\WINDOWS\system32\buyurl0502.dat
2008-01-03 20:14 . 2008-01-03 20:14 <DIR> d-------- C:\WINDOWS\nview
2008-01-03 20:14 . 2007-12-05 01:41 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-01-03 20:14 . 2008-01-03 20:15 163,353 --a------ C:\WINDOWS\system32\nvapps.xml
2008-01-03 20:14 . 2007-12-05 01:41 17,737 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-01-03 20:07 . 2007-12-05 02:53 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2008-01-02 21:03 . 2008-01-02 21:03 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-01-02 21:03 . 2008-01-02 21:03 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_motmodem_01005.Wdf
2008-01-02 20:33 . 2008-01-02 20:33 <DIR> d-------- C:\Program Files\Common Files\Motorola Shared
2008-01-02 20:33 . 2006-11-13 14:45 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll
2008-01-02 20:33 . 2007-02-27 14:31 21,504 --a------ C:\WINDOWS\system32\drivers\motmodem.sys
2007-12-31 21:35 . 2007-12-31 21:35 <DIR> d-------- C:\WINDOWS\system32\URTTEMP
2007-12-31 18:24 . 2007-04-13 08:50 108,424 -ra------ C:\WINDOWS\system32\drivers\zebrmdmc.sys
2007-12-31 18:24 . 2007-04-13 08:50 108,296 -ra------ C:\WINDOWS\system32\drivers\zebrmdm.sys
2007-12-31 18:24 . 2007-04-13 08:50 90,888 -ra------ C:\WINDOWS\system32\drivers\zebrsce.sys
2007-12-31 18:24 . 2007-04-13 08:50 83,080 -ra------ C:\WINDOWS\system32\drivers\zebrbus.sys
2007-12-31 18:24 . 2007-04-13 08:50 15,112 -ra------ C:\WINDOWS\system32\drivers\zebrmdfl.sys
2007-12-31 18:24 . 2007-04-13 08:50 12,424 -ra------ C:\WINDOWS\system32\drivers\zebrcmnt.sys
2007-12-31 18:24 . 2007-04-13 08:50 12,424 -ra------ C:\WINDOWS\system32\drivers\zebrcm.sys
2007-12-31 18:20 . 2007-04-13 08:50 62,984 -ra------ C:\WINDOWS\system32\drivers\zebrceb.sys
2007-12-31 18:20 . 2007-04-13 08:50 12,424 -ra------ C:\WINDOWS\system32\drivers\zebrwhnt.sys
2007-12-31 18:20 . 2007-04-13 08:50 12,424 -ra------ C:\WINDOWS\system32\drivers\zebrwh.sys
2007-12-31 18:19 . 2007-12-31 18:19 <DIR> d-------- C:\Program Files\Symbian
2007-12-31 18:19 . 2007-12-31 18:19 <DIR> d-------- C:\Program Files\Intuwave
2007-12-31 18:19 . 2005-06-08 15:53 288 --a------ C:\WINDOWS\mrinstu.iss
2007-12-31 18:18 . 2007-12-31 18:20 <DIR> d-------- C:\Program Files\Sony Ericsson
2007-12-31 18:18 . 2007-12-31 18:18 <DIR> d-------- C:\Program Files\Common Files\Teleca Shared
2007-12-31 18:18 . 2007-12-31 18:18 <DIR> d-------- C:\Program Files\Common Files\Sony Ericsson Shared
2007-12-31 18:17 . 2007-12-31 18:17 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2007-12-28 17:12 . 2007-12-28 17:12 <DIR> d-------- C:\Program Files\Common Files\Skype
2007-12-25 22:57 . 2007-12-26 14:01 <DIR> d-------- C:\Program Files\Replay Converter
2007-12-25 22:57 . 2007-03-04 13:55 1,936,528 --a------ C:\WINDOWS\system32\ltmm15.dll
2007-12-25 22:57 . 2007-03-04 13:55 135,168 --a------ C:\WINDOWS\system32\DSKernel2.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-23 22:07 2,879,264 --sha-w C:\WINDOWS\system32\drivers\fidbox2.dat
2008-01-23 22:07 191,412,512 --sha-w C:\WINDOWS\system32\drivers\fidbox.dat
2008-01-23 21:42 270,812 --sha-w C:\WINDOWS\system32\drivers\fidbox2.idx
2008-01-23 21:42 2,564,036 --sha-w C:\WINDOWS\system32\drivers\fidbox.idx
2008-01-23 21:10 --------- d-----w C:\Program Files\Neostrada TP
2008-01-07 21:03 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-01-07 19:26 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-03 18:59 --------- d-----w C:\Program Files\SystemRequirementsLab
2008-01-02 19:34 --------- d-----w C:\Program Files\Motorola Phone Tools
2007-12-26 13:52 737,280 ----a-w C:\WINDOWS\iun6002.exe
2007-12-20 18:36 91,492 ----a-w C:\WINDOWS\system32\drivers\klin.dat
2007-12-12 20:51 85,860 ----a-w C:\WINDOWS\system32\drivers\klick.dat
2007-12-05 00:41 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
2007-12-05 00:41 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll
2007-12-05 00:41 8,523,776 ----a-w C:\WINDOWS\system32\nvcpl.dll
2007-12-05 00:41 753,664 ----a-w C:\WINDOWS\system32\nvcplui.exe
2007-12-05 00:41 7,435,392 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-12-05 00:41 6,901,760 ----a-w C:\WINDOWS\system32\nvoglnt.dll
2007-12-05 00:41 6,549,504 ----a-w C:\WINDOWS\system32\nvdisps.dll
2007-12-05 00:41 5,773,568 ----a-w C:\WINDOWS\system32\nv4_disp.dll
2007-12-05 00:41 5,611,520 ----a-w C:\WINDOWS\system32\nvdispsr.dll
2007-12-05 00:41 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
2007-12-05 00:41 458,752 ----a-w C:\WINDOWS\system32\nvmccssr.dll
2007-12-05 00:41 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
2007-12-05 00:41 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
2007-12-05 00:41 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
2007-12-05 00:41 385,024 ----a-w C:\WINDOWS\system32\nvapi.dll
2007-12-05 00:41 35,328 ----a-w C:\WINDOWS\system32\nvcodins.dll
2007-12-05 00:41 35,328 ----a-w C:\WINDOWS\system32\nvcod.dll
2007-12-05 00:41 335,872 ----a-w C:\WINDOWS\system32\nvwrses.dll
2007-12-05 00:41 335,872 ----a-w C:\WINDOWS\system32\nvwrsel.dll
2007-12-05 00:41 327,680 ----a-w C:\WINDOWS\system32\nvwrsfr.dll
2007-12-05 00:41 327,680 ----a-w C:\WINDOWS\system32\nvwrsesm.dll
2007-12-05 00:41 327,680 ----a-w C:\WINDOWS\system32\nvrshe.dll
2007-12-05 00:41 327,680 ----a-w C:\WINDOWS\system32\nvrsar.dll
2007-12-05 00:41 323,584 ----a-w C:\WINDOWS\system32\nvwrspt.dll
2007-12-05 00:41 323,584 ----a-w C:\WINDOWS\system32\nvwrsit.dll
2007-12-05 00:41 319,488 ----a-w C:\WINDOWS\system32\nvwrsptb.dll
2007-12-05 00:41 319,488 ----a-w C:\WINDOWS\system32\nvwrsnl.dll
2007-12-05 00:41 315,392 ----a-w C:\WINDOWS\system32\nvwrsru.dll
2007-12-05 00:41 315,392 ----a-w C:\WINDOWS\system32\nvwrshu.dll
2007-12-05 00:41 311,296 ----a-w C:\WINDOWS\system32\nvwrsde.dll
2007-12-05 00:41 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll
2007-12-05 00:41 303,104 ----a-w C:\WINDOWS\system32\nvwrstr.dll
2007-12-05 00:41 303,104 ----a-w C:\WINDOWS\system32\nvwrssl.dll
2007-12-05 00:41 303,104 ----a-w C:\WINDOWS\system32\nvwrsfi.dll
2007-12-05 00:41 3,715,072 ----a-w C:\WINDOWS\system32\nvvitvsr.dll
2007-12-05 00:41 3,710,976 ----a-w C:\WINDOWS\system32\nvvitvs.dll
2007-12-05 00:41 3,420,160 ----a-w C:\WINDOWS\system32\nvgames.dll
2007-12-05 00:41 3,334,144 ----a-w C:\WINDOWS\system32\nvgamesr.dll
2007-12-05 00:41 299,008 ----a-w C:\WINDOWS\system32\nvwrssk.dll
2007-12-05 00:41 299,008 ----a-w C:\WINDOWS\system32\nvwrsno.dll
2007-12-05 00:41 294,912 ----a-w C:\WINDOWS\system32\nvwrssv.dll
2007-12-05 00:41 294,912 ----a-w C:\WINDOWS\system32\nvwrspl.dll
2007-12-05 00:41 294,912 ----a-w C:\WINDOWS\system32\nvwrsda.dll
2007-12-05 00:41 290,816 ----a-w C:\WINDOWS\system32\nvwrsth.dll
2007-12-05 00:41 286,720 ----a-w C:\WINDOWS\system32\nvwrseng.dll
2007-12-05 00:41 286,720 ----a-w C:\WINDOWS\system32\nvwrscs.dll
2007-12-05 00:41 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
2007-12-05 00:41 282,624 ----a-w C:\WINDOWS\system32\nvwrsar.dll
2007-12-05 00:41 282,624 ----a-w C:\WINDOWS\system32\nvrsfr.dll
2007-12-05 00:41 282,624 ----a-w C:\WINDOWS\system32\nvrses.dll
2007-12-05 00:41 282,624 ----a-w C:\WINDOWS\system32\nvrsel.dll
2007-12-05 00:41 278,528 ----a-w C:\WINDOWS\system32\nvwrshe.dll
2007-12-05 00:41 278,528 ----a-w C:\WINDOWS\system32\nvrsit.dll
2007-12-05 00:41 278,528 ----a-w C:\WINDOWS\system32\nvrsde.dll
2007-12-05 00:41 274,432 ----a-w C:\WINDOWS\system32\nvrspt.dll
2007-12-05 00:41 274,432 ----a-w C:\WINDOWS\system32\nvrsnl.dll
2007-12-05 00:41 274,432 ----a-w C:\WINDOWS\system32\nvrsesm.dll
2007-12-05 00:41 270,336 ----a-w C:\WINDOWS\system32\nvrsru.dll
2007-12-05 00:41 266,240 ----a-w C:\WINDOWS\system32\nvrsptb.dll
2007-12-05 00:41 266,240 ----a-w C:\WINDOWS\system32\nvrsja.dll
2007-12-05 00:41 258,048 ----a-w C:\WINDOWS\system32\nvrstr.dll
2007-12-05 00:41 258,048 ----a-w C:\WINDOWS\system32\nvrssl.dll
2007-12-05 00:41 258,048 ----a-w C:\WINDOWS\system32\nvrssk.dll
2007-12-05 00:41 258,048 ----a-w C:\WINDOWS\system32\nvrsko.dll
2007-12-05 00:41 258,048 ----a-w C:\WINDOWS\system32\nvrshu.dll
2007-12-05 00:41 253,952 ----a-w C:\WINDOWS\system32\nvrsth.dll
2007-12-05 00:41 253,952 ----a-w C:\WINDOWS\system32\nvrssv.dll
2007-12-05 00:41 253,952 ----a-w C:\WINDOWS\system32\nvrspl.dll
2007-12-05 00:41 253,952 ----a-w C:\WINDOWS\system32\nvrsno.dll
2007-12-05 00:41 253,952 ----a-w C:\WINDOWS\system32\nvrsda.dll
2007-12-05 00:41 249,856 ----a-w C:\WINDOWS\system32\nvrsfi.dll
2007-12-05 00:41 249,856 ----a-w C:\WINDOWS\system32\nvrscs.dll
2007-12-05 00:41 245,760 ----a-w C:\WINDOWS\system32\nvrseng.dll
2007-12-05 00:41 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll
2007-12-05 00:41 225,280 ----a-w C:\WINDOWS\system32\nvrszhc.dll
2007-12-05 00:41 212,992 ----a-w C:\WINDOWS\system32\nvwrsja.dll
2007-12-05 00:41 2,854,912 ----a-w C:\WINDOWS\system32\nvmoblsr.dll
2007-12-05 00:41 2,519,040 ----a-w C:\WINDOWS\system32\nvwssr.dll
2007-12-05 00:41 2,498,560 ----a-w C:\WINDOWS\system32\nvwss.dll
2007-12-05 00:41 196,608 ----a-w C:\WINDOWS\system32\nvwrsko.dll
2007-12-05 00:41 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll
2007-12-05 00:41 167,936 ----a-w C:\WINDOWS\system32\nvwrszht.dll
2007-12-05 00:41 163,840 ----a-w C:\WINDOWS\system32\nvwrszhc.dll
2007-12-05 00:41 155,716 ----a-w C:\WINDOWS\system32\nvsvc32.exe
2007-12-05 00:41 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe
2007-12-05 00:41 126,976 ----a-w C:\WINDOWS\system32\nvrszht.dll
2007-12-05 00:41 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll
2007-12-05 00:41 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe
2007-03-09 08:12 27,648 --sha-w C:\WINDOWS\system32\AVSredirect.dll
2005-06-26 23:32 616,448 --sha-r C:\WINDOWS\system32\cygwin1.dll
2005-06-22 06:37 45,568 --sha-r C:\WINDOWS\system32\cygz.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 13:00 15360]
"AutoConnect"="C:\Programy\AutoConnect\AutoConnect.exe" [2004-08-28 19:27 295424]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 17:24 1694208]
"NETIANET"="C:\Program Files\Netia\Net\netianet.exe" [2007-02-23 13:40 474112]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2004-10-21 13:20 77824 C:\WINDOWS\SOUNDMAN.EXE]
"QuickTime Task"="C:\Programy\QuickTime\qttask.exe" [2007-02-16 10:54 282624]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 06:03 221184]
"SmartSync - ScheduleSync"="C:\PROGRA~1\MOBILE~1\SMARTS~1\SCHEDU~1.EXE" [2006-08-31 07:41 45056]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-05-28 01:27 180269]
"AVP"="C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" [2007-03-09 19:50 200768]
"PC Suite for Smartphones"="C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" [2007-05-28 10:14 528384]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-12-05 01:41 8523776]
"nwiz"="nwiz.exe" [2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-12-05 01:41 81920]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 13:00 15360]
"NETIANET"="C:\Program Files\Netia\Net\netianet.exe" [2007-02-23 13:40 474112]

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^DSLMON.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\DSLMON.lnk
backup=C:\WINDOWS\pss\DSLMON.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^GetRight - Tray Icon.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\GetRight - Tray Icon.lnk
backup=C:\WINDOWS\pss\GetRight - Tray Icon.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd]
--a------ 2004-10-21 16:44 2744832 C:\WINDOWS\ALCWZRD.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a------ 2004-08-04 13:00 15360 C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSyncU.exe]
--------- 2006-08-07 10:06 700416 C:\Program Files\Creative\Sync Manager Unicode\CTSyncU.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Easy-PrintToolBox]
--a------ 2004-01-14 12:10 409600 C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
--------- 2004-08-12 16:45 61952 C:\WINDOWS\system32\Hdaudpropshortcut.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2004-06-16 06:03 221184 C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2004-06-16 06:03 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NVRTCLK]
-ra------ 2003-12-30 10:44 24576 C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
--a------ 2007-12-05 01:41 1626112 C:\WINDOWS\system32\nwiz.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWN_EncyStarter]
--------- 2003-01-23 15:40 40960 C:\Programy\PWN\EncyPraktyczna\EncyStarter.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
--a------ 2006-03-18 03:24 184320 C:\Programy\PowerISO\PWRISOVM.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2007-02-16 10:54 282624 C:\Programy\QuickTime\qttask.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
--a------ 2003-10-31 18:42 32768 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Steam]
C:\Gry\Steam\Steam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2006-05-28 01:27 180269 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VGAUtil]
--a------ 2004-09-09 11:04 552960 C:\Program Files\GigaByte\VGA Utility Manager\G-VGA.EXE

R0 AFPAnsi;G-DATA Ukrywacz Ansi;C:\WINDOWS\system32\Drivers\AFPAnsi.sys [2002-10-09 12:53]
R0 FO_PAnt;FotoOffice VirtualDisc Driver;C:\WINDOWS\system32\Drivers\FO_PAnt.sys [2003-07-17 11:56]
R0 ps6agqwb;Loki Synchronization Driver (ps6agqwb);C:\WINDOWS\system32\drivers\ps6agqwb.sys [2007-07-04 17:06]
R3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 13:00]
R3 zebrceb;Sony Ericsson Cable Emulation Bus (WDM);C:\WINDOWS\system32\DRIVERS\zebrceb.sys [2007-04-13 08:50]
S0 ps6agqwc;Loki Synchronization Driver (ps6agqwc);C:\WINDOWS\system32\drivers\ps6agqwc.sys []
S2 pr2agqwb;Loki Drivers Auto Removal (pr2agqwb);C:\WINDOWS\system32\pr2agqwb.exe svc []
S2 pr2agqwc;Loki Drivers Auto Removal (pr2agqwc);C:\WINDOWS\system32\pr2agqwc.exe svc []
S3 GVCplDrv;GVCplDrv;C:\WINDOWS\system32\drivers\GVCplDrv.sys [2004-05-02 09:47]
S3 GVTDrv;GVTDrv;C:\WINDOWS\system32\drivers\GVTDrv.sys [2007-04-09 10:29]
S3 hamachi_oem;PlayLinc Adapter;C:\WINDOWS\system32\DRIVERS\gan_adapter.sys [2006-08-28 22:54]
S3 mamotou;mamotou;C:\WINDOWS\system32\DRIVERS\mamotou.sys [2005-11-07 17:50]
S3 motmodem;Motorola USB CDC ACM Driver;C:\WINDOWS\system32\DRIVERS\motmodem.sys [2007-02-27 14:31]
S3 siusbmod;siusbmod;C:\WINDOWS\system32\DRIVERS\siusbmod.sys [2005-09-12 15:40]
S3 zebrbus;Sony Ericsson Composite Device driver;C:\WINDOWS\system32\DRIVERS\zebrbus.sys [2007-04-13 08:50]
S3 zebrmdfl;Sony Ericsson Modem Filter;C:\WINDOWS\system32\DRIVERS\zebrmdfl.sys [2007-04-13 08:50]
S3 zebrmdm;Sony Ericsson Port (WDM);C:\WINDOWS\system32\DRIVERS\zebrmdm.sys [2007-04-13 08:50]
S3 zebrmdmc;Sony Ericsson mRouter Port (WDM);C:\WINDOWS\system32\DRIVERS\zebrmdmc.sys [2007-04-13 08:50]
S3 zebrsce;Sony Ericsson PC-Connect Port;C:\WINDOWS\system32\DRIVERS\zebrsce.sys [2007-04-13 08:50]

.
Contents of the 'Scheduled Tasks' folder
"2008-01-18 20:27:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-23 23:10:18
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\explorer.exe [6.00.2900.3156]
-> C:\Programy\Gadu-Gadu\ggwhook.dll
.
Completion time: 2008-01-23 23:11:17
ComboFix-quarantined-files.txt 2008-01-23 22:11:12
.
2008-01-10 09:01:40 --- E O F ---

HJ

Logfile of HijackThis v1.99.1
Scan saved at 23:13:12, on 2008-01-23
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programy\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programy\AutoConnect\AutoConnect.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Netia\Net\netianet.exe
C:\Program Files\Common Files\Teleca Shared\Generic.exe
C:\PROGRA~1\Symbian\Shared\SYMBIA~1\SYMBIA~1.EXE
C:\PROGRA~1\Symbian\Shared\SYMBIA~1\SCBAL.exe
C:\PROGRA~1\Intuwave\Shared\MROUTE~1\MROUTE~2.EXE
C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\Gry\skan kompa\hijack\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.allegro.pl/?mm=1
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programy\Acrobat Reader 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\Programy\FlashFXP\IEFlash.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programy\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup
O4 - HKLM\..\Run: [SmartSync - ScheduleSync] C:\PROGRA~1\MOBILE~1\SMARTS~1\SCHEDU~1.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [AVP] "C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [PC Suite for Smartphones] "C:\Program Files\Sony Ericsson\Mobile4\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AutoConnect] C:\Programy\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [NETIANET] C:\Program Files\Netia\Net\netianet.exe
O8 - Extra context menu item: Add to AMV Convert Tool... - C:\Documents and Settings\Krzysztof\Pulpit\amv converter\AMVConverter\grab.html
O8 - Extra context menu item: Add to AMV Converter... - C:\Documents and Settings\Krzysztof\Pulpit\amv converter\AMVConverter\grab.html
O8 - Extra context menu item: Download with GetRight - C:\Programy\GetRight\GRdownload.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\Programy\MICROS~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Documents and Settings\Krzysztof\Pulpit\amv converter\MediaManager\grab.html
O8 - Extra context menu item: Open with GetRight Browser - C:\Programy\GetRight\GRbrowse.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programy\MICROS~1\OFFICE11\REFIEBAR.DLL
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_71.cab
O16 - DPF: {2A781DED-C22D-4153-9812-CEA98A32981C} (GameDesire Makao) - http://67.15.101.3/g_bin/pl/cardsmakao_2_0_0_24.cab
O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/webplayer/stage6/windows/DivXBrowserPlugin.cab
O16 - DPF: {83AFB5CA-ED35-11D4-A452-0080C8D85045} (GameDesire Poker Games) - http://67.15.101.3/g_bin/pl/poker_2_0_0_43.cab
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://cf.sobotka.net/activex/AxisCamControl.cab
O16 - DPF: {AC120B1D-9411-4111-AF52-118052D85D45} (GameDesire Darts Games) - http://67.15.101.3/g_bin/pl/darts_2_0_0_35.cab
O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} (GameDesire Pool - http://67.15.101.3/g_bin/pl/billard8_2_0_0_28.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{36750057-CD22-4033-81EC-4C1BAD06E012}: NameServer = 213.241.79.37 83.238.255.76
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: klogon - C:\WINDOWS\system32\klogon.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Unknown owner - C:\Programy\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe" -r (file missing)
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Loki Drivers Auto Removal (pr2agqwb) (pr2agqwb) - Cyanide - C:\WINDOWS\system32\pr2agqwb.exe
O23 - Service: Loki Drivers Auto Removal (pr2agqwc) (pr2agqwc) - Cyanide - C:\WINDOWS\system32\pr2agqwc.exe

[wojtas]

wg mnie czysto

[rafi9-92]

ok dzieki komputer sie lepiej wylacza ale nadal nie mam napisow w windows media player nie wiem czemu