Samo otwierające się okno ie, niedziałające aplikacje

[Wojtaz]

Witam.
Od pewnego czasu, gdy podłączyłem pendrive do kompa (był tam jakiś wirus, lecz nie dawałem autoodwarzanie, bo mam to wyłączone) zauwazyłem, że PC nie działa tak jak powinien.
Po pierwsze otwiera mi się okno z IE i wpisane jest localhost i tak co godzinę.
dodatkowo nie działa mi IVT Bluesoleil...

log z hijackthis:

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:17:07, on 2009-10-02
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.darkw0rld.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: IDM Helper - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: IEPluginBHO - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\Wojtaz\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [MPKrnl] rundll32 "C:\WINDOWS\MPKrnl.dll",KrnlMsgProc
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKLM\..\Policies\Explorer\Run: [MPMKrnl] rundll32 "C:\WINDOWS\MKMKrnl.dll",KMainProc
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O8 - Extra context menu item: Download all links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm
O8 - Extra context menu item: Download FLV video content with IDM - D:\Program Files\Internet Download Manager\IEGetVL.htm
O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{06811B39-465A-4497-AD43-673E30CD067A}: NameServer = 192.168.1.13,192.168.1.1
O17 - HKLM\System\CS1\Services\Tcpip\..\{06811B39-465A-4497-AD43-673E30CD067A}: NameServer = 192.168.1.13,192.168.1.1
O17 - HKLM\System\CS2\Services\Tcpip\..\{06811B39-465A-4497-AD43-673E30CD067A}: NameServer = 192.168.1.13,192.168.1.1
O20 - AppInit_DLLs: C:\WINDOWS\Tasks\CgbYR44s5jCmgAd6ar.inf,
O21 - SSODL: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: BlueSoleil Hid Service - Unknown owner - D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 5513 bytes


[NieWiem]

Pokaż logi z OTL, instrukcja w przyklejonym.

[Wojtaz]

Kod: Zaznacz wszystko

OTL logfile created on: 2009-10-03 12:35:10 - Run 1
OTL by OldTimer - Version 3.0.18.0     Folder = C:\Documents and Settings\Wojtaz\Pulpit
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

511,30 Mb Total Physical Memory | 155,16 Mb Available Physical Memory | 30,35% Memory free
2,42 Gb Paging File | 2,11 Gb Available in Paging File | 87,12% Paging File free
Paging file location(s): C:\pagefile.sys 2000 3000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19,53 Gb Total Space | 7,26 Gb Free Space | 37,17% Space Free | Partition Type: NTFS
Drive D: | 74,51 Gb Total Space | 12,24 Gb Free Space | 16,42% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: WOJTAZ
Current User Name: Wojtaz
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2008-04-14 22:51:18 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2005-04-06 16:03:28 | 00,110,592 | ---- | M] () -- D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
PRC - [2009-07-17 18:10:28 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2003-06-19 23:25:00 | 00,322,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
PRC - [2005-06-15 11:20:00 | 00,127,043 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvsvc32.exe
PRC - [2005-05-20 19:11:06 | 00,925,696 | R--- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe
PRC - [2009-08-13 14:56:59 | 03,114,416 | ---- | M] (Tonec Inc.) -- D:\Program Files\Internet Download Manager\IDMan.exe
PRC - [2008-04-14 22:51:52 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wscntfy.exe
PRC - [2008-12-18 02:26:25 | 07,678,568 | ---- | M] (Mozilla Corporation) -- D:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009-07-27 17:42:10 | 10,719,848 | ---- | M] (GG Network S.A.) -- D:\Program Files\Nowe Gadu-Gadu\gg.exe
PRC - [2009-07-27 16:39:44 | 00,118,784 | ---- | M] () -- D:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe
PRC - [2009-10-03 12:31:27 | 00,519,168 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Wojtaz\Pulpit\OTL.exe

[color=#E56717]========== Win32 Services (SafeList) ==========[/color]

SRV - [2009-07-27 13:45:38 | 00,072,704 | ---- | M] (Adobe Systems) -- C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service [On_Demand | Stopped])
SRV - [2005-09-23 07:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2005-04-06 16:03:28 | 00,110,592 | ---- | M] () -- D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe -- (BlueSoleil Hid Service [Auto | Running])
SRV - [2005-09-23 07:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2008-04-14 22:50:46 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2009-07-17 18:10:28 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running])
SRV - [2003-06-19 23:25:00 | 00,322,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM [Auto | Running])
SRV - [2005-06-15 11:20:00 | 00,127,043 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvsvc32.exe -- (NVSvc [Auto | Running])
SRV - [2003-07-28 12:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2009-06-02 10:10:08 | 00,637,952 | ---- | M] (Nokia.) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer [On_Demand | Stopped])
SRV - [2006-12-01 11:46:28 | 00,918,016 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])

[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV - [2005-10-06 03:21:10 | 00,141,312 | R--- | M] (Analog Devices, Inc.) -- C:\WINDOWS\System32\drivers\ADIHdAud.sys -- (ADIHdAudAddService [On_Demand | Running])
DRV - [2005-03-05 06:53:00 | 00,127,872 | R--- | M] (Andrea Electronics Corporation) -- C:\WINDOWS\System32\drivers\AEAudio.sys -- (AEAudioService [On_Demand | Running])
DRV - [2005-03-09 15:53:00 | 00,043,008 | ---- | M] (Advanced Micro Devices) -- C:\WINDOWS\System32\DRIVERS\AmdK8.sys -- (AmdK8 [System | Running])
DRV - [2006-06-23 16:00:26 | 00,031,488 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\DRIVERS\blueletaudio.sys -- (BlueletAudio [On_Demand | Running])
DRV - [2005-08-31 10:34:52 | 00,020,480 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\DRIVERS\BlueletSCOAudio.sys -- (BlueletSCOAudio [On_Demand | Running])
DRV - [2006-01-19 13:31:34 | 00,010,068 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\DRIVERS\btnetdrv.sys -- (BT [On_Demand | Stopped])
DRV - [2006-07-16 16:06:16 | 00,023,040 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\Drivers\btcusb.sys -- (Btcsrusb [On_Demand | Running])
DRV - [2005-07-30 07:21:32 | 00,011,988 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\vbtenum.sys -- (BTHidEnum [On_Demand | Running])
DRV - [2005-05-01 05:50:10 | 00,028,271 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\Drivers\BTHidMgr.sys -- (BTHidMgr [Boot | Running])
DRV - [2009-07-24 12:45:08 | 00,013,224 | ---- | M] (Sony Ericsson Mobile Communications) -- C:\WINDOWS\System32\DRIVERS\ggflt.sys -- (ggflt [On_Demand | Stopped])
DRV - [2009-07-24 12:45:08 | 00,025,512 | ---- | M] (Sony Ericsson Mobile Communications) -- C:\WINDOWS\System32\DRIVERS\ggsemc.sys -- (ggsemc [On_Demand | Stopped])
DRV - [2004-05-02 10:47:08 | 00,023,040 | R--- | M] () -- C:\WINDOWS\System32\drivers\GVCplDrv.sys -- (GVCplDrv [On_Demand | Stopped])
DRV - [2009-07-15 18:32:29 | 00,017,480 | ---- | M] (LogMeIn, Inc.) -- C:\WINDOWS\System32\DRIVERS\hamachi.sys -- (hamachi [On_Demand | Stopped])
DRV - [2008-04-13 22:06:06 | 00,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\System32\DRIVERS\HDAudBus.sys -- (HDAudBus [On_Demand | Running])
DRV - [2008-05-24 21:09:10 | 00,073,728 | ---- | M] (EZB Systems, Inc.) -- D:\Program Files\UltraISO\drivers\ISODrive.sys -- (ISODrive [System | Running])
DRV - [2008-08-21 18:49:22 | 00,018,688 | ---- | M] (Motorola) -- C:\WINDOWS\System32\DRIVERS\motccgp.sys -- (motccgp [On_Demand | Stopped])
DRV - [2008-08-21 18:49:56 | 00,008,320 | ---- | M] (Motorola) -- C:\WINDOWS\System32\DRIVERS\motccgpfl.sys -- (motccgpfl [On_Demand | Stopped])
DRV - [2007-10-10 17:41:50 | 00,042,112 | ---- | M] (Motorola Inc) -- C:\WINDOWS\System32\DRIVERS\motodrv.sys -- (MotDev [On_Demand | Stopped])
DRV - [2007-06-18 15:18:26 | 00,023,680 | ---- | M] (Motorola) -- C:\WINDOWS\System32\DRIVERS\motmodem.sys -- (motmodem [On_Demand | Stopped])
DRV - [2004-08-14 12:56:20 | 00,005,810 | R--- | M] () -- C:\WINDOWS\System32\DRIVERS\ASACPI.sys -- (MTsensor [On_Demand | Running])
DRV - [2009-02-09 08:37:46 | 00,017,664 | ---- | M] (Nokia) -- C:\WINDOWS\System32\drivers\ccdcmb.sys -- (nmwcd [On_Demand | Stopped])
DRV - [2009-02-09 08:37:46 | 00,022,016 | ---- | M] (Nokia) -- C:\WINDOWS\System32\drivers\ccdcmbo.sys -- (nmwcdc [On_Demand | Stopped])
DRV - [2005-06-15 11:20:00 | 03,200,256 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Running])
DRV - [2005-07-30 11:11:02 | 00,034,048 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\DRIVERS\NVENETFD.sys -- (NVENETFD [On_Demand | Running])
DRV - [2005-07-30 11:11:04 | 00,012,928 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\DRIVERS\nvnetbus.sys -- (nvnetbus [On_Demand | Running])
DRV - [2003-01-17 03:59:56 | 00,001,984 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\papycpu2.sys -- (papycpu2 [System | Running])
DRV - [2003-01-17 03:59:56 | 00,001,856 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\papyjoy.sys -- (papyjoy [System | Running])
DRV - [2008-08-26 10:26:12 | 00,018,816 | ---- | M] (Nokia) -- C:\WINDOWS\System32\DRIVERS\pccsmcfd.sys -- (pccsmcfd [On_Demand | Stopped])
DRV - [2001-08-17 23:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2001-08-17 23:57:36 | 00,005,888 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\Drivers\RootMdm.sys -- (ROOTMODEM [On_Demand | Running])
DRV - [2008-04-13 22:09:18 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped])
DRV - [2005-08-11 23:49:28 | 00,393,088 | R--- | M] (Sensaura) -- C:\WINDOWS\System32\drivers\Senfilt.sys -- (SenFiltService [On_Demand | Running])
DRV - [2009-07-08 20:53:40 | 00,721,904 | ---- | M] () -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd [Boot | Running])
DRV - [2009-02-09 08:37:48 | 00,007,808 | ---- | M] (Nokia) -- C:\WINDOWS\System32\DRIVERS\usbser_lowerflt.sys -- (upperdev [On_Demand | Stopped])
DRV - [2008-04-14 00:15:38 | 00,026,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usbser.sys -- (usbser [On_Demand | Stopped])
DRV - [2009-02-09 08:37:56 | 00,007,808 | ---- | M] (Nokia) -- C:\WINDOWS\System32\DRIVERS\usbser_lowerfltj.sys -- (UsbserFilt [On_Demand | Stopped])
DRV - [2004-10-19 13:37:38 | 00,061,312 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\DRIVERS\VComm.sys -- (VComm [On_Demand | Running])
DRV - [2006-02-28 16:57:22 | 00,084,836 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\Drivers\VcommMgr.sys -- (VcommMgr [On_Demand | Running])
DRV - [2009-07-24 12:43:35 | 00,083,200 | ---- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\zebrbus.sys -- (zebrbus [On_Demand | Stopped])
DRV - [2009-07-24 12:43:35 | 00,014,848 | ---- | M] (MCCI Corporation) -- C:\WINDOWS\System32\DRIVERS\zebrmdfl.sys -- (zebrmdfl [On_Demand | Stopped])
DRV - [2009-07-24 12:43:35 | 00,109,568 | ---- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\zebrmdm.sys -- (zebrmdm [On_Demand | Stopped])
DRV - [2009-07-24 12:43:35 | 00,109,568 | ---- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\zebrmdmc.sys -- (zebrmdmc [On_Demand | Stopped])

[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =  [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-583907252-776561741-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-583907252-776561741-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\S-1-5-21-583907252-776561741-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.darkw0rld.com
IE - HKU\S-1-5-21-583907252-776561741-1417001333-1003\S-1-5-21-583907252-776561741-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "www.google.pl"
FF - prefs.js..extensions.enabledItems: copylinkurl@bluelightdev.com:1.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}:6.0.14
FF - prefs.js..extensions.enabledItems: {FFA36170-80B1-4535-B0E3-A4569E497DD0}:2.0.3
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.5
FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.1
FF - prefs.js..extensions.enabledItems: dmanugm@gmail.com:1.0
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.12

FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009-07-17 18:10:28 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\bkmrksync@nokia.com: D:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2009-08-04 21:34:25 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2009-08-18 11:52:15 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins [2009-08-18 11:52:15 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Components: D:\Program Files\Mozilla Thunderbird\components [2009-08-24 10:49:45 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Plugins: D:\Program Files\Mozilla Thunderbird\plugins

[2009-07-08 21:10:03 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Extensions
[2009-07-08 21:10:03 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009-08-28 14:15:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\asu07ayp.default\extensions
[2009-08-20 14:27:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\asu07ayp.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2009-07-09 11:16:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\asu07ayp.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2009-08-18 12:00:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\asu07ayp.default\extensions\{FFA36170-80B1-4535-B0E3-A4569E497DD0}
[2009-08-16 14:24:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\asu07ayp.default\extensions\copylinkurl@bluelightdev.com
[2009-08-28 14:15:16 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\asu07ayp.default\extensions\imgkkupload@imgkk.com

O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (IDMIEHlprObj Class) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll (Tonec Inc.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (ThunderHlpObj Class) - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll ()
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\Wojtaz\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll (GG Network S.A.)
O4 - HKLM..\Run: [MPKrnl] C:\WINDOWS\MPKrnl.DLL ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKU\.DEFAULT..\RunOnce: [nltide_2]  File not found
O4 - HKU\S-1-5-18..\RunOnce: [nltide_2]  File not found
O4 - Startup: C:\Documents and Settings\Wojtaz\Menu Start\Programy\Autostart\Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-583907252-776561741-1417001333-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-583907252-776561741-1417001333-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-583907252-776561741-1417001333-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-583907252-776561741-1417001333-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-583907252-776561741-1417001333-1003_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Download all links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm ()
O8 - Extra context menu item: Download FLV video content with IDM - D:\Program Files\Internet Download Manager\IEGetVL.htm ()
O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm ()
O9 - Extra Button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter:  - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\WINDOWS\Tasks\CgbYR44s5jCmgAd6ar.inf) - C:\WINDOWS\Tasks\CgbYR44s5jCmgAd6ar.inf ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O21 - SSODL: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll ()
O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home
O28 - HKLM ShellExecuteHooks: {08223B03-1B38-4A33-A83A-A4D3CC1D6E4E} - C:\WINDOWS\System32\08223B03.dll ()
O28 - HKLM ShellExecuteHooks: {11FDB6D4-166A-47BF-A0F8-A09DABA75FC1} - C:\WINDOWS\Tasks\CgbYR44s5jCmgAd6ar.inf ()
O28 - HKLM ShellExecuteHooks: {122B901E-493F-4AD9-BC69-7DE8C3E52FCC} - C:\WINDOWS\System32\122B901E.dll ()
O28 - HKLM ShellExecuteHooks: {1719B301-B494-4185-9379-242461F9CF02} - C:\WINDOWS\System32\BtmBAnd89jc9PsPq5EKNj.inf ()
O28 - HKLM ShellExecuteHooks: {23DA65D2-C696-4EE4-BEE8-B4841DEC3E30} - C:\WINDOWS\System32\ndxq9awMc.dll ()
O28 - HKLM ShellExecuteHooks: {24144CB8-10ED-4BFC-843F-68A9F3369947} - C:\WINDOWS\fonts\SD78dgC7hD2sktQHyAu.fon ()
O28 - HKLM ShellExecuteHooks: {36AC68E6-0C26-4D39-B98E-54B49DAB6BAA} - C:\WINDOWS\System32\dhDhwS7fFW.dll ()
O28 - HKLM ShellExecuteHooks: {3F86C1E9-E95A-41AF-AD72-7D9A1742232D} - C:\WINDOWS\System32\aR5azFSWstNWktJjswK5.inf ()
O28 - HKLM ShellExecuteHooks: {4F5EEDE5-1687-49D2-8A17-FF0B454FB37B} - C:\WINDOWS\System32\qzp3jTZCSfSh.dll ()
O28 - HKLM ShellExecuteHooks: {51716C09-6B08-4CCF-B526-718E912C0573} - C:\WINDOWS\System32\PERrGx5DkqSbQdwauCRQH.dll ()
O28 - HKLM ShellExecuteHooks: {6049BC02-7EDA-4C41-B4AB-D5398607C39E} - C:\WINDOWS\Tasks\yGfdVUegEQm9fhY5rnN.inf ()
O28 - HKLM ShellExecuteHooks: {704C3595-DB85-40F6-A601-8D6F346907BD} - C:\WINDOWS\System32\704C3595.dll ()
O28 - HKLM ShellExecuteHooks: {7488E47D-E8F3-41C0-B2DA-9B2BD8803A80} - C:\WINDOWS\Tasks\EfEPEaD4ZpVMUXrDbS.inf ()
O28 - HKLM ShellExecuteHooks: {74DA2FEC-F68F-4DC7-9A45-9174AC044427} - C:\WINDOWS\System32\z6FVkEF47huPzgaXee.inf ()
O28 - HKLM ShellExecuteHooks: {827E2FB4-1047-43DE-848D-E12BB0C97AAB} - C:\WINDOWS\Tasks\SbrmpxjdCrgRAFhz4gHh.inf ()
O28 - HKLM ShellExecuteHooks: {84639C2D-CD75-4081-B515-329AFCECBF19} - C:\WINDOWS\Downloaded Program Files\SjRjQgREDp3P8B4rEEg.cur ()
O28 - HKLM ShellExecuteHooks: {8708994F-1758-4C2C-9A3F-FA22D6CCCB41} - C:\WINDOWS\fonts\A97CRaCB.fon ()
O28 - HKLM ShellExecuteHooks: {87DE8A1A-96C5-4420-B222-EF998F697CE7} - C:\WINDOWS\System32\2exJW3dsaTgWrf5uAPadmHN.dll ()
O28 - HKLM ShellExecuteHooks: {8A6A5B34-D995-4C5D-9338-B5E264B4A87} - C:\WINDOWS\System32\nXe2grrKNzF9dxYKmqg.inf ()
O28 - HKLM ShellExecuteHooks: {93DA1E7D-7C46-4F90-8674-EC90511FCA72} - C:\WINDOWS\System32\CDuAUVkGy9.dll ()
O28 - HKLM ShellExecuteHooks: {9C20D654-5AF8-4DB7-A125-1A17D7065C73} - C:\WINDOWS\System32\uV4kFmSjPK7eKfenjpv9Ct.inf ()
O28 - HKLM ShellExecuteHooks: {A2BCFCEE-C939-433F-A32A-7353A6E720DB} - C:\WINDOWS\Tasks\JJX5r8wnsqUnNxGwpwn.inf ()
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {B59F0A61-EF3E-4A2B-9E3A-4A84EDDF2308} - C:\WINDOWS\Downloaded Program Files\AnXnubyMnv58c9vaECWX.cur ()
O28 - HKLM ShellExecuteHooks: {B6C3510F-2666-496B-A46F-6EEFD6328C2B} - C:\WINDOWS\Tasks\txPsQUxAThX8QTR6s6Yn.inf ()
O28 - HKLM ShellExecuteHooks: {B7F1BFDC-4B6C-4E2F-AF7A-638D2D47802C} - C:\WINDOWS\System32\FsmBY3kmWnAG5gRbwGgU.inf ()
O28 - HKLM ShellExecuteHooks: {B9D0F4D7-C809-4C27-9CB4-63201DFB3D05} - C:\WINDOWS\Tasks\c2nH4numz9knY5zqnC.inf ()
O28 - HKLM ShellExecuteHooks: {C07B914B-C164-42D2-9838-1422C3F70D99} - C:\WINDOWS\System32\BPRBASgvesMzHRfu3AfB.inf ()
O28 - HKLM ShellExecuteHooks: {C1B34818-3883-4A0A-9665-189A8A39EAB0} - C:\WINDOWS\System32\B4yNKrEEhEerKFeeA4.inf ()
O28 - HKLM ShellExecuteHooks: {C20C5A13-4DD7-40D9-90B4-700BAB0BBBE9} - C:\WINDOWS\System32\S5kSrtwDf35EW9f2kBDF.inf ()
O28 - HKLM ShellExecuteHooks: {CB661471-055A-4C5B-9ED0-497B9908FEF5} - C:\WINDOWS\System32\CWcQnWxHjWqtE6PsYyEe.inf ()
O28 - HKLM ShellExecuteHooks: {CD478099-014D-4B3A-A4BB-B518F1019BC7} - C:\WINDOWS\System32\SCEVFJRCmaB7.dll ()
O28 - HKLM ShellExecuteHooks: {F181F067-7046-4DCB-993F-200990736305} - C:\WINDOWS\Downloaded Program Files\sZaeAC74EzXJeVeJu6p.cur ()
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009-07-08 14:47:10 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{a3840963-adb5-11de-8650-0015f2bb93a0}\Shell\explore\Command - "" = G:\boot.exe -- File not found
O33 - MountPoints2\{a3840963-adb5-11de-8650-0015f2bb93a0}\Shell\open\Command - "" = G:\boot.exe -- File not found
O34 - HKLM BootExecute: (autocheck) -  File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) -  File not found
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2009-09-14 14:23:26 | 00,000,000 | -HSD | C] -- C:\Documents and Settings\All Users\Dane aplikacji\System Restore
[2009-09-24 15:23:23 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\HEXelon
[2009-09-22 15:47:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Thinstall
[2009-09-12 14:15:46 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\WMTools Downloaded Files
[2009-10-01 21:07:22 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2009-10-01 21:08:20 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Thunder Network
[2009-09-23 15:06:42 | 00,000,000 | ---D | C] -- C:\Program Files\FDRLab
[2009-09-21 20:58:30 | 00,000,000 | ---D | C] -- C:\Program Files\URUSoft
[2009-10-01 21:07:30 | 00,000,000 | ---D | C] -- C:\Program Files\WinRar
[2009-09-23 15:06:44 | 00,000,000 | ---D | C] -- C:\Program Files\Xvid
[2009-10-03 12:30:16 | 00,519,168 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Wojtaz\Pulpit\OTL.exe
[2009-10-01 21:08:14 | 00,024,625 | ---- | C] (Matrix) -- C:\WINDOWS\MSVB50CHS.dll
[2009-10-01 17:22:05 | 00,040,448 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSGSCR.TLB
[2009-10-01 17:18:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\psp
[2009-09-30 16:17:01 | 01,213,952 | ---- | C] (Karol Winnicki) -- C:\Documents and Settings\Wojtaz\Pulpit\BESTplayer.exe
[2009-09-30 15:52:59 | 00,000,000 | R--D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\
[2009-09-30 15:16:57 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\picture
[2009-09-30 15:15:41 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\DCIM
[2009-09-30 15:14:40 | 00,032,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usbccgp.sys
[2009-09-30 15:14:40 | 00,032,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbccgp.sys
[2009-09-30 13:46:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Moje dokumenty\GTA3 User Files
[2009-09-27 18:39:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\Nowy folder
[2009-09-27 14:47:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\Transformers Revenge Of The Fallen 2009 BRRip XviD AC3-SANTi
[2009-09-26 09:56:12 | 00,000,000 | ---D | C] -- C:\FreeFSWP_v1.01.1_freeware_by_junnikokuki@opda.net.cn_unsigned
[2009-09-26 08:40:38 | 00,000,000 | -HSD | C] -- C:\Config.Msi
[2009-09-22 21:41:26 | 00,000,000 | ---D | C] -- C:\Cannibal.Holocaust.Uncut.1980.DVDRip.XviD-QiX
[2009-09-21 16:40:20 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusb.dll
[2009-09-21 16:40:18 | 00,159,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusd.dll
[2009-09-21 16:40:17 | 00,015,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usbscan.sys
[2009-09-21 16:40:17 | 00,015,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbscan.sys
[2009-09-12 22:08:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Super Screen Recorder
[2009-09-12 19:31:16 | 00,194,048 | ---- | C] (THU-404) -- C:\WINDOWS\System32\PlayGif.ocx
[2009-09-11 08:00:41 | 00,012,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\Dot4Prt.sys
[2009-09-11 08:00:41 | 00,012,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dot4prt.sys
[2009-09-11 08:00:04 | 00,023,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\Dot4usb.sys
[2009-09-11 08:00:04 | 00,023,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dot4usb.sys
[2009-09-11 08:00:03 | 00,206,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\Dot4.sys
[2009-09-11 08:00:03 | 00,206,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dot4.sys

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[1 C:\WINDOWS\System32\*.tmp files]
[4 C:\WINDOWS\*.tmp files]
[2009-10-03 12:31:27 | 00,519,168 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Wojtaz\Pulpit\OTL.exe
[2009-10-03 11:51:18 | 00,021,101 | -HS- | M] () -- C:\WINDOWS\System32\FsmBY3kmWnAG5gRbwGgU.inf
[2009-10-03 11:46:22 | 00,001,182 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Gtkplus.plist
[2009-10-03 11:46:12 | 00,026,682 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2009-10-03 11:45:52 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009-10-03 11:45:48 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009-10-03 11:45:43 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009-10-02 07:23:55 | 00,012,180 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\sony-ericsson-k550-big.jpg
[2009-10-02 07:21:51 | 00,022,603 | -HS- | M] () -- C:\WINDOWS\System32\aR5azFSWstNWktJjswK5.inf
[2009-10-01 21:11:37 | 04,175,830 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\dr. dre with snoop dogg - still dre [www.musicishere.fora.pl].mp3
[2009-10-01 21:09:43 | 00,022,097 | -HS- | M] () -- C:\WINDOWS\System32\nXe2grrKNzF9dxYKmqg.inf
[2009-10-01 21:08:14 | 00,024,625 | ---- | M] (Matrix) -- C:\WINDOWS\MSVB50CHS.dll
[2009-10-01 21:08:12 | 00,020,480 | ---- | M] () -- C:\WINDOWS\MPKrnl.dll
[2009-10-01 21:08:04 | 00,017,920 | ---- | M] () -- C:\WINDOWS\System32\qt-dx3.dll
[2009-10-01 21:07:38 | 00,010,240 | ---- | M] () -- C:\WINDOWS\MKMKrnl.dll
[2009-10-01 21:04:56 | 00,045,138 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\aa.mp3
[2009-10-01 20:27:29 | 00,118,282 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\achmed martwy terorysta - silence i kill you.mp3
[2009-10-01 17:23:39 | 00,580,944 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\aaa (1) (1).mp4
[2009-10-01 17:23:19 | 00,049,152 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009-10-01 17:23:16 | 02,935,896 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\aaa (1) (1).avi
[2009-10-01 17:22:51 | 21,302,650 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\aaa (1).avi
[2009-10-01 17:22:05 | 00,231,424 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\webcheck.dll
[2009-10-01 17:22:05 | 00,040,448 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MSGSCR.TLB
[2009-10-01 17:21:20 | 01,488,895 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\Bez tytułu.wmv
[2009-10-01 17:18:28 | 00,331,858 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\aaa.mp3
[2009-10-01 17:17:39 | 42,716,160 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\aaa.avi
[2009-09-30 18:51:37 | 03,701,720 | -H-- | M] () -- C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\IconCache.db
[2009-09-30 16:17:04 | 01,213,952 | ---- | M] (Karol Winnicki) -- C:\Documents and Settings\Wojtaz\Pulpit\BESTplayer.exe
[2009-09-30 15:30:39 | 00,014,848 | -HS- | M] () -- C:\WINDOWS\tasks\SbrmpxjdCrgRAFhz4gHh.inf
[2009-09-30 15:30:39 | 00,001,750 | ---- | M] () -- C:\WINDOWS\tasks\EkKXXTKa2TVmc6XM.ico
[2009-09-30 15:30:38 | 00,225,868 | -HS- | M] () -- C:\WINDOWS\System32\qzp3jTZCSfSh.dll
[2009-09-30 15:30:38 | 00,016,980 | -HS- | M] () -- C:\WINDOWS\System32\BPRBASgvesMzHRfu3AfB.inf
[2009-09-30 15:30:37 | 00,221,271 | -HS- | M] () -- C:\WINDOWS\System32\BtmBAnd89jc9PsPq5EKNj.inf
[2009-09-30 15:30:37 | 00,017,488 | -HS- | M] () -- C:\WINDOWS\System32\SCEVFJRCmaB7.dll
[2009-09-30 15:30:36 | 00,018,944 | -HS- | M] () -- C:\WINDOWS\tasks\CgbYR44s5jCmgAd6ar.inf
[2009-09-30 15:30:36 | 00,001,750 | ---- | M] () -- C:\WINDOWS\tasks\x7j7yet9WK9FdYSD.ico
[2009-09-30 15:30:35 | 00,017,920 | -HS- | M] () -- C:\WINDOWS\tasks\c2nH4numz9knY5zqnC.inf
[2009-09-30 15:30:35 | 00,014,435 | -HS- | M] () -- C:\WINDOWS\System32\CDuAUVkGy9.dll
[2009-09-30 15:30:35 | 00,001,750 | ---- | M] () -- C:\WINDOWS\tasks\kTS4JJGUYtVagxPs.ico
[2009-09-30 15:30:33 | 00,022,603 | -HS- | M] () -- C:\WINDOWS\System32\B4yNKrEEhEerKFeeA4.inf
[2009-09-30 15:30:33 | 00,018,523 | -HS- | M] () -- C:\WINDOWS\System32\122B901E.dll
[2009-09-30 15:30:32 | 00,225,900 | -HS- | M] () -- C:\WINDOWS\System32\2exJW3dsaTgWrf5uAPadmHN.dll
[2009-09-30 15:30:31 | 00,017,998 | -HS- | M] () -- C:\WINDOWS\System32\ndxq9awMc.dll
[2009-09-30 15:30:31 | 00,016,983 | -HS- | M] () -- C:\WINDOWS\System32\CWcQnWxHjWqtE6PsYyEe.inf
[2009-09-30 15:30:30 | 00,020,589 | -HS- | M] () -- C:\WINDOWS\System32\704C3595.dll
[2009-09-30 15:30:30 | 00,018,533 | -HS- | M] () -- C:\WINDOWS\System32\z6FVkEF47huPzgaXee.inf
[2009-09-30 15:30:28 | 00,018,514 | -HS- | M] () -- C:\WINDOWS\System32\dhDhwS7fFW.dll
[2009-09-30 15:30:27 | 00,020,055 | -HS- | M] () -- C:\WINDOWS\System32\08223B03.dll
[2009-09-30 15:30:26 | 00,020,480 | -HS- | M] () -- C:\WINDOWS\tasks\EfEPEaD4ZpVMUXrDbS.inf
[2009-09-30 15:30:26 | 00,019,052 | -HS- | M] () -- C:\WINDOWS\System32\S5kSrtwDf35EW9f2kBDF.inf
[2009-09-30 15:30:26 | 00,001,750 | ---- | M] () -- C:\WINDOWS\tasks\vC6ykXbjUGCVeCJa.ico
[2009-09-30 15:30:25 | 00,019,564 | -HS- | M] () -- C:\WINDOWS\System32\uV4kFmSjPK7eKfenjpv9Ct.inf
[2009-09-30 15:30:24 | 00,023,552 | -HS- | M] () -- C:\WINDOWS\tasks\yGfdVUegEQm9fhY5rnN.inf
[2009-09-30 15:30:24 | 00,018,944 | -HS- | M] () -- C:\WINDOWS\System32\PERrGx5DkqSbQdwauCRQH.dll
[2009-09-30 15:30:24 | 00,001,750 | ---- | M] () -- C:\WINDOWS\tasks\ThGkkhVnR6Dhf3eN.ico
[2009-09-30 15:30:23 | 00,022,016 | -HS- | M] () -- C:\WINDOWS\tasks\JJX5r8wnsqUnNxGwpwn.inf
[2009-09-30 15:30:23 | 00,022,016 | -HS- | M] () -- C:\WINDOWS\System32\e863f72a04b6.dll
[2009-09-30 15:30:23 | 00,022,016 | -HS- | M] () -- C:\WINDOWS\System32\comres.dll
[2009-09-30 15:30:23 | 00,001,750 | ---- | M] () -- C:\WINDOWS\tasks\kZdWDEpQcNC2NwDe.ico
[2009-09-30 15:30:22 | 00,023,552 | -HS- | M] () -- C:\WINDOWS\tasks\txPsQUxAThX8QTR6s6Yn.inf
[2009-09-30 15:30:22 | 00,001,750 | ---- | M] () -- C:\WINDOWS\tasks\gBuDCU6XjBAEHzzrg.ico
[2009-09-30 14:04:51 | 36,044,0399 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\fh18-izy.wmv
[2009-09-30 13:38:31 | 00,014,018 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\fh18-izy.wmv.torrent
[2009-09-29 22:17:41 | 00,917,313 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\DSC00792.jpg
[2009-09-29 22:13:07 | 00,335,946 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\DSC00791.JPG
[2009-09-29 22:12:56 | 00,299,967 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\DSC00790.JPG
[2009-09-27 20:59:02 | 01,668,165 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\Zdj.088.jpg
[2009-09-27 20:58:52 | 01,695,727 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\Zdj.087.jpg
[2009-09-27 19:02:06 | 00,000,718 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\Skrót do BlueSoleil.exe.lnk
[2009-09-27 18:39:50 | 10,168,946 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\dupa.rar
[2009-09-27 16:38:22 | 05,048,978 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\11 brozas & buczer (ptp) - born whit it feat. caddy pack , kaczor , zeloP.mp31254061870_[mp3.teledyski.info].mp3
[2009-09-27 16:37:35 | 04,864,658 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\caddy pack- don't fuck with me.mp31254062349_[mp3.teledyski.info].mp3
[2009-09-27 14:45:33 | 00,011,583 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\Transformers Revenge Of The Fallen 2009 BRRip XviD AC3-SANTi.torrent
[2009-09-27 13:45:11 | 00,096,385 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\1254051944_by_Xanker_500.jpg
[2009-09-27 12:18:00 | 00,053,881 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\3275d8fff2.jpeg
[2009-09-27 11:29:42 | 00,001,612 | ---- | M] () -- C:\WINDOWS\wincmd.ini
[2009-09-27 10:42:40 | 01,233,011 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\dj yanek - naplet.mp31254040929_[mp3.teledyski.info].mp3
[2009-09-26 21:19:31 | 02,451,968 | -HS- | M] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Kia55b_cfdg.exe
[2009-09-26 21:19:30 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\YouTube - Nowa Heyah - Nie tolerujemy kruczkw.avi_
[2009-09-26 09:50:15 | 00,055,941 | ---- | M] () -- C:\FreeFSWP_v1.01.1_freeware_by_junnikokuki@opda.net.cn_unsigned.rar
[2009-09-22 07:18:57 | 03,862,778 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\dj lysy - ale cyrk.mp3
[2009-09-20 13:40:26 | 07,409,611 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\d - rock star (nevins classic club blaster).mp3
[2009-09-20 11:51:12 | 00,000,689 | ---- | M] () -- C:\WINDOWS\win.ini
[2009-09-19 12:33:29 | 03,600,332 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\dj pirat - kupujecie piraty.mp3
[2009-09-12 13:43:19 | 00,000,310 | ---- | M] () -- C:\WINDOWS\wcx_ftp.ini

[color=#E56717]========== Files - No Company Name ==========[/color]
[2009-10-03 11:51:18 | 00,021,101 | -HS- | C] () -- C:\WINDOWS\System32\FsmBY3kmWnAG5gRbwGgU.inf
[2009-10-02 07:21:51 | 00,022,603 | -HS- | C] () -- C:\WINDOWS\System32\aR5azFSWstNWktJjswK5.inf
[2009-10-02 07:12:53 | 00,012,180 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\sony-ericsson-k550-big.jpg
[2009-10-01 21:08:12 | 00,020,480 | ---- | C] () -- C:\WINDOWS\MPKrnl.dll
[2009-10-01 21:08:08 | 04,175,830 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\dr. dre with snoop dogg - still dre [www.musicishere.fora.pl].mp3
[2009-10-01 21:08:04 | 00,017,920 | ---- | C] () -- C:\WINDOWS\System32\qt-dx3.dll
[2009-10-01 21:07:38 | 00,010,240 | ---- | C] () -- C:\WINDOWS\MKMKrnl.dll
[2009-10-01 21:07:33 | 00,001,182 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Gtkplus.plist
[2009-10-01 21:04:56 | 00,045,138 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\aa.mp3
[2009-10-01 21:00:54 | 00,118,282 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\achmed martwy terorysta - silence i kill you.mp3
[2009-10-01 17:23:35 | 00,580,944 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\aaa (1) (1).mp4
[2009-10-01 17:23:07 | 02,935,896 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\aaa (1) (1).avi
[2009-10-01 17:22:49 | 21,302,650 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\aaa (1).avi
[2009-10-01 17:20:43 | 01,488,895 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\Bez tytułu.wmv
[2009-10-01 17:18:26 | 00,331,858 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\aaa.mp3
[2009-10-01 17:18:04 | 42,716,160 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\aaa.avi
[2009-09-30 15:30:39 | 00,014,848 | -HS- | C] () -- C:\WINDOWS\tasks\SbrmpxjdCrgRAFhz4gHh.inf
[2009-09-30 15:30:39 | 00,001,750 | ---- | C] () -- C:\WINDOWS\tasks\EkKXXTKa2TVmc6XM.ico
[2009-09-30 15:30:38 | 00,225,868 | -HS- | C] () -- C:\WINDOWS\System32\qzp3jTZCSfSh.dll
[2009-09-30 15:30:38 | 00,016,980 | -HS- | C] () -- C:\WINDOWS\System32\BPRBASgvesMzHRfu3AfB.inf
[2009-09-30 15:30:37 | 00,221,271 | -HS- | C] () -- C:\WINDOWS\System32\BtmBAnd89jc9PsPq5EKNj.inf
[2009-09-30 15:30:37 | 00,017,488 | -HS- | C] () -- C:\WINDOWS\System32\SCEVFJRCmaB7.dll
[2009-09-30 15:30:36 | 00,018,944 | -HS- | C] () -- C:\WINDOWS\tasks\CgbYR44s5jCmgAd6ar.inf
[2009-09-30 15:30:36 | 00,001,750 | ---- | C] () -- C:\WINDOWS\tasks\x7j7yet9WK9FdYSD.ico
[2009-09-30 15:30:35 | 00,017,920 | -HS- | C] () -- C:\WINDOWS\tasks\c2nH4numz9knY5zqnC.inf
[2009-09-30 15:30:35 | 00,014,435 | -HS- | C] () -- C:\WINDOWS\System32\CDuAUVkGy9.dll
[2009-09-30 15:30:35 | 00,001,750 | ---- | C] () -- C:\WINDOWS\tasks\kTS4JJGUYtVagxPs.ico
[2009-09-30 15:30:33 | 00,022,603 | -HS- | C] () -- C:\WINDOWS\System32\B4yNKrEEhEerKFeeA4.inf
[2009-09-30 15:30:33 | 00,018,523 | -HS- | C] () -- C:\WINDOWS\System32\122B901E.dll
[2009-09-30 15:30:32 | 00,225,900 | -HS- | C] () -- C:\WINDOWS\System32\2exJW3dsaTgWrf5uAPadmHN.dll
[2009-09-30 15:30:31 | 00,017,998 | -HS- | C] () -- C:\WINDOWS\System32\ndxq9awMc.dll
[2009-09-30 15:30:31 | 00,016,983 | -HS- | C] () -- C:\WINDOWS\System32\CWcQnWxHjWqtE6PsYyEe.inf
[2009-09-30 15:30:30 | 00,018,533 | -HS- | C] () -- C:\WINDOWS\System32\z6FVkEF47huPzgaXee.inf
[2009-09-30 15:30:29 | 00,020,589 | -HS- | C] () -- C:\WINDOWS\System32\704C3595.dll
[2009-09-30 15:30:28 | 00,022,097 | -HS- | C] () -- C:\WINDOWS\System32\nXe2grrKNzF9dxYKmqg.inf
[2009-09-30 15:30:28 | 00,018,514 | -HS- | C] () -- C:\WINDOWS\System32\dhDhwS7fFW.dll
[2009-09-30 15:30:27 | 00,020,055 | -HS- | C] () -- C:\WINDOWS\System32\08223B03.dll
[2009-09-30 15:30:26 | 00,020,480 | -HS- | C] () -- C:\WINDOWS\tasks\EfEPEaD4ZpVMUXrDbS.inf
[2009-09-30 15:30:26 | 00,019,052 | -HS- | C] () -- C:\WINDOWS\System32\S5kSrtwDf35EW9f2kBDF.inf
[2009-09-30 15:30:26 | 00,001,750 | ---- | C] () -- C:\WINDOWS\tasks\vC6ykXbjUGCVeCJa.ico
[2009-09-30 15:30:25 | 00,019,564 | -HS- | C] () -- C:\WINDOWS\System32\uV4kFmSjPK7eKfenjpv9Ct.inf
[2009-09-30 15:30:24 | 00,023,552 | -HS- | C] () -- C:\WINDOWS\tasks\yGfdVUegEQm9fhY5rnN.inf
[2009-09-30 15:30:24 | 00,018,944 | -HS- | C] () -- C:\WINDOWS\System32\PERrGx5DkqSbQdwauCRQH.dll
[2009-09-30 15:30:24 | 00,001,750 | ---- | C] () -- C:\WINDOWS\tasks\ThGkkhVnR6Dhf3eN.ico
[2009-09-30 15:30:23 | 00,022,016 | -HS- | C] () -- C:\WINDOWS\tasks\JJX5r8wnsqUnNxGwpwn.inf
[2009-09-30 15:30:23 | 00,001,750 | ---- | C] () -- C:\WINDOWS\tasks\kZdWDEpQcNC2NwDe.ico
[2009-09-30 15:30:22 | 00,023,552 | -HS- | C] () -- C:\WINDOWS\tasks\txPsQUxAThX8QTR6s6Yn.inf
[2009-09-30 15:30:22 | 00,001,750 | ---- | C] () -- C:\WINDOWS\tasks\gBuDCU6XjBAEHzzrg.ico
[2009-09-30 15:17:04 | 07,409,611 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\d - rock star (nevins classic club blaster).mp3
[2009-09-30 13:39:08 | 36,044,0399 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\fh18-izy.wmv
[2009-09-30 13:38:31 | 00,014,018 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\fh18-izy.wmv.torrent
[2009-09-30 00:10:22 | 00,335,946 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\DSC00791.JPG
[2009-09-30 00:10:04 | 00,299,967 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\DSC00790.JPG
[2009-09-29 22:17:38 | 00,917,313 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\DSC00792.jpg
[2009-09-27 19:03:51 | 01,695,727 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\Zdj.087.jpg
[2009-09-27 19:03:12 | 01,668,165 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\Zdj.088.jpg
[2009-09-27 19:02:05 | 00,000,718 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\Skrót do BlueSoleil.exe.lnk
[2009-09-27 18:39:50 | 10,168,946 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\dupa.rar
[2009-09-27 16:32:23 | 04,864,658 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\caddy pack- don't fuck with me.mp31254062349_[mp3.teledyski.info].mp3
[2009-09-27 16:32:16 | 05,048,978 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\11 brozas & buczer (ptp) - born whit it feat. caddy pack , kaczor , zeloP.mp31254061870_[mp3.teledyski.info].mp3
[2009-09-27 14:45:33 | 00,011,583 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\Transformers Revenge Of The Fallen 2009 BRRip XviD AC3-SANTi.torrent
[2009-09-27 13:45:11 | 00,096,385 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\1254051944_by_Xanker_500.jpg
[2009-09-27 12:18:00 | 00,053,881 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\3275d8fff2.jpeg
[2009-09-27 10:41:31 | 01,233,011 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\dj yanek - naplet.mp31254040929_[mp3.teledyski.info].mp3
[2009-09-26 21:19:31 | 02,451,968 | -HS- | C] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Kia55b_cfdg.exe
[2009-09-26 21:19:30 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\YouTube - Nowa Heyah - Nie tolerujemy kruczkw.avi_
[2009-09-26 09:50:37 | 00,055,941 | ---- | C] () -- C:\FreeFSWP_v1.01.1_freeware_by_junnikokuki@opda.net.cn_unsigned.rar
[2009-09-23 15:06:44 | 00,815,104 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009-09-23 15:06:44 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009-09-23 15:06:44 | 00,077,824 | ---- | C] () -- C:\WINDOWS\System32\xvid.ax
[2009-09-22 07:15:45 | 03,862,778 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\dj lysy - ale cyrk.mp3
[2009-09-19 12:30:29 | 03,600,332 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\dj pirat - kupujecie piraty.mp3
[2009-08-26 21:08:53 | 00,000,310 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini
[2009-08-20 14:56:34 | 00,000,002 | ---- | C] () -- C:\Program Files\mshexc.bmp
[2009-08-13 21:48:24 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009-08-09 17:31:05 | 00,013,312 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2009-08-06 15:59:23 | 00,001,612 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2009-07-13 16:50:52 | 00,001,984 | ---- | C] () -- C:\WINDOWS\System32\drivers\papycpu2.sys
[2009-07-13 16:50:52 | 00,001,856 | ---- | C] () -- C:\WINDOWS\System32\drivers\papyjoy.sys
[2009-07-13 16:48:41 | 00,000,019 | ---- | C] () -- C:\WINDOWS\Sierra.ini
[2009-07-11 19:35:44 | 00,000,193 | ---- | C] () -- C:\WINDOWS\MBMTool.INI
[2009-07-09 12:25:18 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009-07-09 12:25:18 | 00,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2009-07-09 12:25:16 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2009-07-09 12:25:14 | 00,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009-07-09 12:25:14 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009-07-09 12:22:57 | 00,049,152 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009-07-09 11:51:26 | 00,033,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\oreans32.sys
[2009-07-08 21:13:42 | 00,272,056 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
[2009-07-08 20:53:40 | 00,721,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2009-07-08 20:48:02 | 00,023,040 | R--- | C] () -- C:\WINDOWS\System32\drivers\GVCplDrv.sys
[2009-07-08 18:42:44 | 00,014,595 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2009-07-08 18:42:44 | 00,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2009-07-08 18:42:35 | 00,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2009-07-08 16:38:31 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\desktop.ini
[2009-07-08 14:59:49 | 03,701,720 | -H-- | C] () -- C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\IconCache.db
[2009-07-08 14:59:18 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\Wojtaz\Dane aplikacji\desktop.ini
[2008-04-14 22:50:16 | 00,022,016 | -HS- | C] () -- C:\WINDOWS\System32\e863f72a04b6.dll
[2008-04-14 22:50:16 | 00,022,016 | -HS- | C] () -- C:\WINDOWS\System32\comres.dll
[2006-04-14 09:14:12 | 00,014,312 | ---- | C] () -- C:\WINDOWS\System32\drivers\BTNetFilter.sys
[2005-07-30 07:21:32 | 00,011,988 | ---- | C] () -- C:\WINDOWS\System32\drivers\vbtenum.sys
[2005-06-15 11:20:00 | 00,540,672 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2001-10-26 17:45:34 | 00,028,672 | ---- | C] () -- C:\WINDOWS\System32\NSREG.DLL
[2001-07-22 00:16:20 | 00,000,689 | ---- | C] () -- C:\WINDOWS\win.ini
[2001-07-22 00:15:52 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini

[color=#E56717]========== LOP Check ==========[/color]

[2009-09-29 22:17:50 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Dane aplikacji
[2009-07-28 21:15:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo
[2009-08-09 17:32:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Bluetooth
[2009-07-08 20:55:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Pro
[2009-08-04 21:32:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Installations
[2009-08-04 12:55:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\OpenFM
[2009-08-04 21:37:30 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
[2009-09-14 14:23:26 | 00,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\Dane aplikacji\System Restore
[2009-08-30 00:04:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Trymedia
[2009-07-08 16:38:30 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Default User\Dane aplikacji
[2009-07-08 14:58:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Dane aplikacji
[2009-07-08 14:50:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji
[2009-10-01 21:07:33 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji
[2009-07-24 13:00:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\aerix
[2009-07-28 21:16:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Ashampoo
[2009-10-02 07:47:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Audacity
[2009-09-21 14:54:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\BESTplayer
[2009-08-29 11:23:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Bioshock
[2009-07-08 20:53:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\DAEMON Tools Pro
[2009-10-03 11:46:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\DMCache
[2009-08-05 12:46:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Download Manager
[2009-08-20 14:29:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\FireShot
[2009-10-03 12:33:55 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\foobar2000
[2009-07-11 12:38:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\gtk-2.0
[2009-08-01 16:03:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Hamachi
[2009-09-24 15:23:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\HEXelon
[2009-08-13 14:59:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\IDM
[2009-07-11 12:37:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Inkscape
[2009-07-29 18:44:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Mael
[2009-08-24 17:49:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\NationRed
[2009-08-04 21:37:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Nokia
[2009-07-08 21:35:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Nowe Gadu-Gadu
[2009-08-04 12:55:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\OpenFM
[2009-09-26 12:30:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\PC Suite
[2009-07-11 15:38:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Pionek
[2009-09-22 16:08:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Thinstall
[2009-08-30 00:44:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\THQ
[2009-07-10 09:04:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Thunderbird
[2009-07-09 11:27:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\UltraVNC
[2009-09-30 14:04:56 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\uTorrent
[2009-09-30 15:30:35 | 00,017,920 | -HS- | M] () -- C:\WINDOWS\Tasks\c2nH4numz9knY5zqnC.inf
[2009-09-30 15:30:36 | 00,018,944 | -HS- | M] () -- C:\WINDOWS\Tasks\CgbYR44s5jCmgAd6ar.inf
[2001-07-22 00:17:50 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini
[2009-09-30 15:30:26 | 00,020,480 | -HS- | M] () -- C:\WINDOWS\Tasks\EfEPEaD4ZpVMUXrDbS.inf
[2009-09-30 15:30:39 | 00,001,750 | ---- | M] () -- C:\WINDOWS\Tasks\EkKXXTKa2TVmc6XM.ico
[2009-09-30 15:30:22 | 00,001,750 | ---- | M] () -- C:\WINDOWS\Tasks\gBuDCU6XjBAEHzzrg.ico
[2009-09-30 15:30:23 | 00,022,016 | -HS- | M] () -- C:\WINDOWS\Tasks\JJX5r8wnsqUnNxGwpwn.inf
[2009-09-30 15:30:35 | 00,001,750 | ---- | M] () -- C:\WINDOWS\Tasks\kTS4JJGUYtVagxPs.ico
[2009-09-30 15:30:23 | 00,001,750 | ---- | M] () -- C:\WINDOWS\Tasks\kZdWDEpQcNC2NwDe.ico
[2009-10-03 11:45:52 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT
[2009-09-30 15:30:39 | 00,014,848 | -HS- | M] () -- C:\WINDOWS\Tasks\SbrmpxjdCrgRAFhz4gHh.inf
[2009-09-30 15:30:24 | 00,001,750 | ---- | M] () -- C:\WINDOWS\Tasks\ThGkkhVnR6Dhf3eN.ico
[2009-09-30 15:30:22 | 00,023,552 | -HS- | M] () -- C:\WINDOWS\Tasks\txPsQUxAThX8QTR6s6Yn.inf
[2009-09-30 15:30:26 | 00,001,750 | ---- | M] () -- C:\WINDOWS\Tasks\vC6ykXbjUGCVeCJa.ico
[2009-09-30 15:30:36 | 00,001,750 | ---- | M] () -- C:\WINDOWS\Tasks\x7j7yet9WK9FdYSD.ico
[2009-09-30 15:30:24 | 00,023,552 | -HS- | M] () -- C:\WINDOWS\Tasks\yGfdVUegEQm9fhY5rnN.inf

[color=#E56717]========== Purity Check ==========[/color]


< End of report >


podczas skanowania wyskoczyło mi okienko, że OTL.EXE jest błędnym plikiem i trzeba uruchomić program CHDSK

[wojtas]

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {84639C2D-CD75-4081-B515-329AFCECBF19} - C:\WINDOWS\Downloaded Program Files\SjRjQgREDp3P8B4rEEg.cur ()
O28 - HKLM ShellExecuteHooks: {8708994F-1758-4C2C-9A3F-FA22D6CCCB41} - C:\WINDOWS\fonts\A97CRaCB.fon ()
O28 - HKLM ShellExecuteHooks: {87DE8A1A-96C5-4420-B222-EF998F697CE7} - C:\WINDOWS\System32\2exJW3dsaTgWrf5uAPadmHN.dll ()
O28 - HKLM ShellExecuteHooks: {8A6A5B34-D995-4C5D-9338-B5E264B4A87} - C:\WINDOWS\System32\nXe2grrKNzF9dxYKmqg.inf ()
O28 - HKLM ShellExecuteHooks: {93DA1E7D-7C46-4F90-8674-EC90511FCA72} - C:\WINDOWS\System32\CDuAUVkGy9.dll ()
O28 - HKLM ShellExecuteHooks: {9C20D654-5AF8-4DB7-A125-1A17D7065C73} - C:\WINDOWS\System32\uV4kFmSjPK7eKfenjpv9Ct.inf ()
O28 - HKLM ShellExecuteHooks: {A2BCFCEE-C939-433F-A32A-7353A6E720DB} - C:\WINDOWS\Tasks\JJX5r8wnsqUnNxGwpwn.inf ()
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {B59F0A61-EF3E-4A2B-9E3A-4A84EDDF2308} - C:\WINDOWS\Downloaded Program Files\AnXnubyMnv58c9vaECWX.cur ()
O28 - HKLM ShellExecuteHooks: {B6C3510F-2666-496B-A46F-6EEFD6328C2B} - C:\WINDOWS\Tasks\txPsQUxAThX8QTR6s6Yn.inf ()
O28 - HKLM ShellExecuteHooks: {B7F1BFDC-4B6C-4E2F-AF7A-638D2D47802C} - C:\WINDOWS\System32\FsmBY3kmWnAG5gRbwGgU.inf ()
O28 - HKLM ShellExecuteHooks: {B9D0F4D7-C809-4C27-9CB4-63201DFB3D05} - C:\WINDOWS\Tasks\c2nH4numz9knY5zqnC.inf ()
O28 - HKLM ShellExecuteHooks: {C07B914B-C164-42D2-9838-1422C3F70D99} - C:\WINDOWS\System32\BPRBASgvesMzHRfu3AfB.inf ()
O28 - HKLM ShellExecuteHooks: {C1B34818-3883-4A0A-9665-189A8A39EAB0} - C:\WINDOWS\System32\B4yNKrEEhEerKFeeA4.inf ()
O28 - HKLM ShellExecuteHooks: {C20C5A13-4DD7-40D9-90B4-700BAB0BBBE9} - C:\WINDOWS\System32\S5kSrtwDf35EW9f2kBDF.inf ()
O28 - HKLM ShellExecuteHooks: {CB661471-055A-4C5B-9ED0-497B9908FEF5} - C:\WINDOWS\System32\CWcQnWxHjWqtE6PsYyEe.inf ()
O28 - HKLM ShellExecuteHooks: {CD478099-014D-4B3A-A4BB-B518F1019BC7} - C:\WINDOWS\System32\SCEVFJRCmaB7.dll ()
O28 - HKLM ShellExecuteHooks: {F181F067-7046-4DCB-993F-200990736305} - C:\WINDOWS\Downloaded Program Files\sZaeAC74EzXJeVeJu6p.cur ()

:Files
C:\WINDOWS\MKMKrnl.dll

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .

Następnie uruchamiasz OTL z opcją Run Scan. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia kompa



Daj loga z OTL


1.Uruchom OTL z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware (usuń co znajdzie )



Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

[Wojtaz]

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

Kod: Zaznacz wszystko

All processes killed
Error: Unable to interpret <[emptytemp]> in the current context!
Error: Unable to interpret <[start explorer]> in the current context!
Error: Unable to interpret <[Reboot]> in the current context!
Error: Unable to interpret <[reboot]> in the current context!

OTL by OldTimer - Version 3.0.18.0 log created on 10032009_201949

Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_298.dat not found!

Registry entries deleted on Reboot...


Daj loga z OTL

Kod: Zaznacz wszystko

OTL logfile created on: 2009-10-04 08:23:41 - Run 2
OTL by OldTimer - Version 3.0.18.2     Folder = C:\Documents and Settings\Wojtaz\Pulpit
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

511,30 Mb Total Physical Memory | 240,44 Mb Available Physical Memory | 47,03% Memory free
2,42 Gb Paging File | 2,19 Gb Available in Paging File | 90,58% Paging File free
Paging file location(s): C:\pagefile.sys 2000 3000 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19,53 Gb Total Space | 8,17 Gb Free Space | 41,83% Space Free | Partition Type: NTFS
Drive D: | 74,51 Gb Total Space | 18,29 Gb Free Space | 24,55% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: WOJTAZ
Current User Name: Wojtaz
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2008-04-14 22:51:18 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2005-05-20 19:11:06 | 00,925,696 | R--- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe
PRC - [2005-04-06 16:03:28 | 00,110,592 | ---- | M] () -- D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe
PRC - [2009-07-17 18:10:28 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2003-06-19 23:25:00 | 00,322,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
PRC - [2005-06-15 11:20:00 | 00,127,043 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvsvc32.exe
PRC - [2008-04-14 22:51:52 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wscntfy.exe
PRC - [2008-12-18 02:26:25 | 07,678,568 | ---- | M] (Mozilla Corporation) -- D:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009-10-04 08:21:18 | 00,519,168 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Wojtaz\Pulpit\OTL.exe

[color=#E56717]========== Win32 Services (SafeList) ==========[/color]

SRV - [2009-07-27 13:45:38 | 00,072,704 | ---- | M] (Adobe Systems) -- C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe -- (Adobe LM Service [On_Demand | Stopped])
SRV - [2005-09-23 07:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2005-04-06 16:03:28 | 00,110,592 | ---- | M] () -- D:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe -- (BlueSoleil Hid Service [Auto | Running])
SRV - [2005-09-23 07:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2008-04-14 22:50:46 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2009-07-17 18:10:28 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running])
SRV - [2003-06-19 23:25:00 | 00,322,120 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE -- (MDM [Auto | Running])
SRV - [2005-06-15 11:20:00 | 00,127,043 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\nvsvc32.exe -- (NVSvc [Auto | Running])
SRV - [2003-07-28 12:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2009-06-02 10:10:08 | 00,637,952 | ---- | M] (Nokia.) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer [On_Demand | Stopped])
SRV - [2006-12-01 11:46:28 | 00,918,016 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])

[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV - [2005-10-06 03:21:10 | 00,141,312 | R--- | M] (Analog Devices, Inc.) -- C:\WINDOWS\System32\drivers\ADIHdAud.sys -- (ADIHdAudAddService [On_Demand | Running])
DRV - [2005-03-05 06:53:00 | 00,127,872 | R--- | M] (Andrea Electronics Corporation) -- C:\WINDOWS\System32\drivers\AEAudio.sys -- (AEAudioService [On_Demand | Running])
DRV - [2005-03-09 15:53:00 | 00,043,008 | ---- | M] (Advanced Micro Devices) -- C:\WINDOWS\System32\DRIVERS\AmdK8.sys -- (AmdK8 [System | Running])
DRV - [2006-06-23 16:00:26 | 00,031,488 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\DRIVERS\blueletaudio.sys -- (BlueletAudio [On_Demand | Running])
DRV - [2005-08-31 10:34:52 | 00,020,480 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\DRIVERS\BlueletSCOAudio.sys -- (BlueletSCOAudio [On_Demand | Running])
DRV - [2006-01-19 13:31:34 | 00,010,068 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\DRIVERS\btnetdrv.sys -- (BT [On_Demand | Stopped])
DRV - [2006-07-16 16:06:16 | 00,023,040 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\Drivers\btcusb.sys -- (Btcsrusb [On_Demand | Stopped])
DRV - [2005-07-30 07:21:32 | 00,011,988 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\vbtenum.sys -- (BTHidEnum [On_Demand | Running])
DRV - [2005-05-01 05:50:10 | 00,028,271 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\Drivers\BTHidMgr.sys -- (BTHidMgr [Boot | Running])
DRV - [2009-07-24 12:45:08 | 00,013,224 | ---- | M] (Sony Ericsson Mobile Communications) -- C:\WINDOWS\System32\DRIVERS\ggflt.sys -- (ggflt [On_Demand | Stopped])
DRV - [2009-07-24 12:45:08 | 00,025,512 | ---- | M] (Sony Ericsson Mobile Communications) -- C:\WINDOWS\System32\DRIVERS\ggsemc.sys -- (ggsemc [On_Demand | Stopped])
DRV - [2004-05-02 10:47:08 | 00,023,040 | R--- | M] () -- C:\WINDOWS\System32\drivers\GVCplDrv.sys -- (GVCplDrv [On_Demand | Stopped])
DRV - [2009-07-15 18:32:29 | 00,017,480 | ---- | M] (LogMeIn, Inc.) -- C:\WINDOWS\System32\DRIVERS\hamachi.sys -- (hamachi [On_Demand | Stopped])
DRV - [2008-04-13 22:06:06 | 00,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\System32\DRIVERS\HDAudBus.sys -- (HDAudBus [On_Demand | Running])
DRV - [2008-05-24 21:09:10 | 00,073,728 | ---- | M] (EZB Systems, Inc.) -- D:\Program Files\UltraISO\drivers\ISODrive.sys -- (ISODrive [System | Running])
DRV - [2008-08-21 18:49:22 | 00,018,688 | ---- | M] (Motorola) -- C:\WINDOWS\System32\DRIVERS\motccgp.sys -- (motccgp [On_Demand | Stopped])
DRV - [2008-08-21 18:49:56 | 00,008,320 | ---- | M] (Motorola) -- C:\WINDOWS\System32\DRIVERS\motccgpfl.sys -- (motccgpfl [On_Demand | Stopped])
DRV - [2007-10-10 17:41:50 | 00,042,112 | ---- | M] (Motorola Inc) -- C:\WINDOWS\System32\DRIVERS\motodrv.sys -- (MotDev [On_Demand | Stopped])
DRV - [2007-06-18 15:18:26 | 00,023,680 | ---- | M] (Motorola) -- C:\WINDOWS\System32\DRIVERS\motmodem.sys -- (motmodem [On_Demand | Stopped])
DRV - [2004-08-14 12:56:20 | 00,005,810 | R--- | M] () -- C:\WINDOWS\System32\DRIVERS\ASACPI.sys -- (MTsensor [On_Demand | Running])
DRV - [2009-02-09 08:37:46 | 00,017,664 | ---- | M] (Nokia) -- C:\WINDOWS\System32\drivers\ccdcmb.sys -- (nmwcd [On_Demand | Stopped])
DRV - [2009-02-09 08:37:46 | 00,022,016 | ---- | M] (Nokia) -- C:\WINDOWS\System32\drivers\ccdcmbo.sys -- (nmwcdc [On_Demand | Stopped])
DRV - [2005-06-15 11:20:00 | 03,200,256 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Running])
DRV - [2005-07-30 11:11:02 | 00,034,048 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\DRIVERS\NVENETFD.sys -- (NVENETFD [On_Demand | Running])
DRV - [2005-07-30 11:11:04 | 00,012,928 | R--- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\DRIVERS\nvnetbus.sys -- (nvnetbus [On_Demand | Running])
DRV - [2003-01-17 03:59:56 | 00,001,984 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\papycpu2.sys -- (papycpu2 [System | Running])
DRV - [2003-01-17 03:59:56 | 00,001,856 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\papyjoy.sys -- (papyjoy [System | Running])
DRV - [2008-08-26 10:26:12 | 00,018,816 | ---- | M] (Nokia) -- C:\WINDOWS\System32\DRIVERS\pccsmcfd.sys -- (pccsmcfd [On_Demand | Stopped])
DRV - [2001-08-17 23:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2001-08-17 23:57:36 | 00,005,888 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\Drivers\RootMdm.sys -- (ROOTMODEM [On_Demand | Running])
DRV - [2008-04-13 22:09:18 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped])
DRV - [2005-08-11 23:49:28 | 00,393,088 | R--- | M] (Sensaura) -- C:\WINDOWS\System32\drivers\Senfilt.sys -- (SenFiltService [On_Demand | Running])
DRV - [2009-07-08 20:53:40 | 00,721,904 | ---- | M] () -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd [Boot | Running])
DRV - [2009-02-09 08:37:48 | 00,007,808 | ---- | M] (Nokia) -- C:\WINDOWS\System32\DRIVERS\usbser_lowerflt.sys -- (upperdev [On_Demand | Stopped])
DRV - [2008-04-14 00:15:38 | 00,026,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usbser.sys -- (usbser [On_Demand | Stopped])
DRV - [2009-02-09 08:37:56 | 00,007,808 | ---- | M] (Nokia) -- C:\WINDOWS\System32\DRIVERS\usbser_lowerfltj.sys -- (UsbserFilt [On_Demand | Stopped])
DRV - [2004-10-19 13:37:38 | 00,061,312 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\DRIVERS\VComm.sys -- (VComm [On_Demand | Running])
DRV - [2006-02-28 16:57:22 | 00,084,836 | ---- | M] (IVT Corporation) -- C:\WINDOWS\System32\Drivers\VcommMgr.sys -- (VcommMgr [On_Demand | Running])
DRV - [2009-07-24 12:43:35 | 00,083,200 | ---- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\zebrbus.sys -- (zebrbus [On_Demand | Stopped])
DRV - [2009-07-24 12:43:35 | 00,014,848 | ---- | M] (MCCI Corporation) -- C:\WINDOWS\System32\DRIVERS\zebrmdfl.sys -- (zebrmdfl [On_Demand | Stopped])
DRV - [2009-07-24 12:43:35 | 00,109,568 | ---- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\zebrmdm.sys -- (zebrmdm [On_Demand | Stopped])
DRV - [2009-07-24 12:43:35 | 00,109,568 | ---- | M] (MCCI) -- C:\WINDOWS\System32\DRIVERS\zebrmdmc.sys -- (zebrmdmc [On_Demand | Stopped])

[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =  [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-583907252-776561741-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
IE - HKU\S-1-5-21-583907252-776561741-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\S-1-5-21-583907252-776561741-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.darkw0rld.com
IE - HKU\S-1-5-21-583907252-776561741-1417001333-1003\S-1-5-21-583907252-776561741-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.startup.homepage: "www.google.pl"
FF - prefs.js..extensions.enabledItems: copylinkurl@bluelightdev.com:1.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}:6.0.14
FF - prefs.js..extensions.enabledItems: {FFA36170-80B1-4535-B0E3-A4569E497DD0}:2.0.3
FF - prefs.js..extensions.enabledItems: {73a6fe31-595d-460b-a920-fcc0f8843232}:1.9.5
FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.1
FF - prefs.js..extensions.enabledItems: dmanugm@gmail.com:1.0
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.12

FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009-07-17 18:10:28 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\extensions\\bkmrksync@nokia.com: D:\Program Files\Nokia\Nokia PC Suite 7\bkmrksync\ [2009-08-04 21:34:25 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Components: D:\Program Files\Mozilla Firefox\components [2009-08-18 11:52:15 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 2.0.0.20\extensions\\Plugins: D:\Program Files\Mozilla Firefox\plugins [2009-08-18 11:52:15 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Components: D:\Program Files\Mozilla Thunderbird\components [2009-08-24 10:49:45 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Plugins: D:\Program Files\Mozilla Thunderbird\plugins

[2009-07-08 21:10:03 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Extensions
[2009-07-08 21:10:03 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009-08-28 14:15:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\asu07ayp.default\extensions
[2009-08-20 14:27:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\asu07ayp.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}
[2009-07-09 11:16:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\asu07ayp.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2009-08-18 12:00:15 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\asu07ayp.default\extensions\{FFA36170-80B1-4535-B0E3-A4569E497DD0}
[2009-08-16 14:24:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\asu07ayp.default\extensions\copylinkurl@bluelightdev.com
[2009-08-28 14:15:16 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\mozilla\Firefox\Profiles\asu07ayp.default\extensions\imgkkupload@imgkk.com

O1 HOSTS File: (27 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (IDMIEHlprObj Class) - {0055C089-8582-441B-A0BF-17B458C2A3A8} - D:\Program Files\Internet Download Manager\IDMIECC.dll (Tonec Inc.)
O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
O2 - BHO: (ThunderHlpObj Class) - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll ()
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\Wojtaz\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll (GG Network S.A.)
O4 - HKLM..\Run: [MPKrnl] C:\WINDOWS\MPKrnl.DLL ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.)
O4 - HKU\.DEFAULT..\RunOnce: [nltide_2]  File not found
O4 - HKU\S-1-5-18..\RunOnce: [nltide_2]  File not found
O4 - Startup: C:\Documents and Settings\Wojtaz\Menu Start\Programy\Autostart\Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-583907252-776561741-1417001333-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-583907252-776561741-1417001333-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-583907252-776561741-1417001333-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-583907252-776561741-1417001333-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-583907252-776561741-1417001333-1003_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Download all links with IDM - D:\Program Files\Internet Download Manager\IEGetAll.htm ()
O8 - Extra context menu item: Download FLV video content with IDM - D:\Program Files\Internet Download Manager\IEGetVL.htm ()
O8 - Extra context menu item: Download with IDM - D:\Program Files\Internet Download Manager\IEExt.htm ()
O9 - Extra Button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\MSITSS.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter:  - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\WINDOWS\Tasks\CgbYR44s5jCmgAd6ar.inf) - C:\WINDOWS\Tasks\CgbYR44s5jCmgAd6ar.inf ()
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O21 - SSODL: ThunderAdvise - {97421D0D-E07F-40DF-8F07-99597B9585AD} - C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll ()
O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home
O28 - HKLM ShellExecuteHooks: {08223B03-1B38-4A33-A83A-A4D3CC1D6E4E} - C:\WINDOWS\System32\08223B03.dll ()
O28 - HKLM ShellExecuteHooks: {11FDB6D4-166A-47BF-A0F8-A09DABA75FC1} - C:\WINDOWS\Tasks\CgbYR44s5jCmgAd6ar.inf ()
O28 - HKLM ShellExecuteHooks: {122B901E-493F-4AD9-BC69-7DE8C3E52FCC} - C:\WINDOWS\System32\122B901E.dll ()
O28 - HKLM ShellExecuteHooks: {1719B301-B494-4185-9379-242461F9CF02} - C:\WINDOWS\System32\BtmBAnd89jc9PsPq5EKNj.inf ()
O28 - HKLM ShellExecuteHooks: {23DA65D2-C696-4EE4-BEE8-B4841DEC3E30} - C:\WINDOWS\System32\ndxq9awMc.dll ()
O28 - HKLM ShellExecuteHooks: {24144CB8-10ED-4BFC-843F-68A9F3369947} - C:\WINDOWS\fonts\SD78dgC7hD2sktQHyAu.fon ()
O28 - HKLM ShellExecuteHooks: {36AC68E6-0C26-4D39-B98E-54B49DAB6BAA} - C:\WINDOWS\System32\dhDhwS7fFW.dll ()
O28 - HKLM ShellExecuteHooks: {3F86C1E9-E95A-41AF-AD72-7D9A1742232D} - C:\WINDOWS\System32\aR5azFSWstNWktJjswK5.inf ()
O28 - HKLM ShellExecuteHooks: {4F5EEDE5-1687-49D2-8A17-FF0B454FB37B} - C:\WINDOWS\System32\qzp3jTZCSfSh.dll ()
O28 - HKLM ShellExecuteHooks: {51716C09-6B08-4CCF-B526-718E912C0573} - C:\WINDOWS\System32\PERrGx5DkqSbQdwauCRQH.dll ()
O28 - HKLM ShellExecuteHooks: {6049BC02-7EDA-4C41-B4AB-D5398607C39E} - C:\WINDOWS\Tasks\yGfdVUegEQm9fhY5rnN.inf ()
O28 - HKLM ShellExecuteHooks: {704C3595-DB85-40F6-A601-8D6F346907BD} - C:\WINDOWS\System32\704C3595.dll ()
O28 - HKLM ShellExecuteHooks: {7488E47D-E8F3-41C0-B2DA-9B2BD8803A80} - C:\WINDOWS\Tasks\EfEPEaD4ZpVMUXrDbS.inf ()
O28 - HKLM ShellExecuteHooks: {74DA2FEC-F68F-4DC7-9A45-9174AC044427} - C:\WINDOWS\System32\z6FVkEF47huPzgaXee.inf ()
O28 - HKLM ShellExecuteHooks: {827E2FB4-1047-43DE-848D-E12BB0C97AAB} - C:\WINDOWS\Tasks\SbrmpxjdCrgRAFhz4gHh.inf ()
O28 - HKLM ShellExecuteHooks: {A2BCFCEE-C939-433F-A32A-7353A6E720DB} - C:\WINDOWS\Tasks\JJX5r8wnsqUnNxGwpwn.inf File not found
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009-07-08 14:47:10 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{a3840963-adb5-11de-8650-0015f2bb93a0}\Shell\explore\Command - "" = G:\boot.exe -- File not found
O33 - MountPoints2\{a3840963-adb5-11de-8650-0015f2bb93a0}\Shell\open\Command - "" = G:\boot.exe -- File not found
O34 - HKLM BootExecute: (autocheck) -  File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) -  File not found
O35 - comfile [open] -- "%1" %* File not found
O35 - exefile [open] -- "%1" %* File not found

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2009-09-14 14:23:26 | 00,000,000 | -HSD | C] -- C:\Documents and Settings\All Users\Dane aplikacji\System Restore
[2009-09-24 15:23:23 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\HEXelon
[2009-09-22 15:47:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Thinstall
[2009-09-12 14:15:46 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\WMTools Downloaded Files
[2009-10-01 21:07:22 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2009-10-01 21:08:20 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Thunder Network
[2009-09-23 15:06:42 | 00,000,000 | ---D | C] -- C:\Program Files\FDRLab
[2009-09-21 20:58:30 | 00,000,000 | ---D | C] -- C:\Program Files\URUSoft
[2009-10-01 21:07:30 | 00,000,000 | ---D | C] -- C:\Program Files\WinRar
[2009-09-23 15:06:44 | 00,000,000 | ---D | C] -- C:\Program Files\Xvid
[2009-10-04 08:21:16 | 00,519,168 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Wojtaz\Pulpit\OTL.exe
[2009-10-03 20:21:16 | 00,000,000 | -HSD | C] -- C:\found.000
[2009-10-03 16:00:00 | 06,377,400 | ---- | C] (ALTAP) -- C:\Documents and Settings\Wojtaz\Pulpit\as252f.exe
[2009-10-03 13:33:20 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\Crack GTA Vice City
[2009-10-01 21:08:14 | 00,024,625 | ---- | C] (Matrix) -- C:\WINDOWS\MSVB50CHS.dll
[2009-10-01 17:22:05 | 00,040,448 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSGSCR.TLB
[2009-10-01 17:18:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\psp
[2009-09-30 16:17:01 | 01,213,952 | ---- | C] (Karol Winnicki) -- C:\Documents and Settings\Wojtaz\Pulpit\BESTplayer.exe
[2009-09-30 15:52:59 | 00,000,000 | R--D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\
[2009-09-30 15:16:57 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\picture
[2009-09-30 15:15:41 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\DCIM
[2009-09-30 15:14:40 | 00,032,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usbccgp.sys
[2009-09-30 15:14:40 | 00,032,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbccgp.sys
[2009-09-30 13:46:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Moje dokumenty\GTA3 User Files
[2009-09-27 18:39:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\Nowy folder
[2009-09-27 14:47:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Pulpit\Transformers Revenge Of The Fallen 2009 BRRip XviD AC3-SANTi
[2009-09-26 09:56:12 | 00,000,000 | ---D | C] -- C:\FreeFSWP_v1.01.1_freeware_by_junnikokuki@opda.net.cn_unsigned
[2009-09-26 08:40:38 | 00,000,000 | -HSD | C] -- C:\Config.Msi
[2009-09-22 21:41:26 | 00,000,000 | ---D | C] -- C:\Cannibal.Holocaust.Uncut.1980.DVDRip.XviD-QiX
[2009-09-21 16:40:20 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusb.dll
[2009-09-21 16:40:18 | 00,159,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusd.dll
[2009-09-21 16:40:17 | 00,015,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usbscan.sys
[2009-09-21 16:40:17 | 00,015,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbscan.sys
[2009-09-12 22:08:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Super Screen Recorder
[2009-09-12 19:31:16 | 00,194,048 | ---- | C] (THU-404) -- C:\WINDOWS\System32\PlayGif.ocx
[2009-09-11 08:00:41 | 00,012,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\Dot4Prt.sys
[2009-09-11 08:00:41 | 00,012,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dot4prt.sys
[2009-09-11 08:00:04 | 00,023,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\Dot4usb.sys
[2009-09-11 08:00:04 | 00,023,936 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dot4usb.sys
[2009-09-11 08:00:03 | 00,206,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\Dot4.sys
[2009-09-11 08:00:03 | 00,206,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dot4.sys

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2009-10-04 08:21:18 | 00,519,168 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Wojtaz\Pulpit\OTL.exe
[2009-10-04 08:17:52 | 00,004,311 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\bez tytułu1.PNG
[2009-10-04 08:17:31 | 00,015,397 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\bez tytułu.PNG
[2009-10-04 08:17:09 | 00,001,182 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Gtkplus.plist
[2009-10-04 08:16:55 | 00,026,682 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2009-10-04 08:16:49 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009-10-04 08:16:45 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009-10-03 16:01:04 | 00,049,664 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009-10-03 16:00:25 | 06,377,400 | ---- | M] (ALTAP) -- C:\Documents and Settings\Wojtaz\Pulpit\as252f.exe
[2009-10-03 13:33:19 | 01,061,261 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\Crack GTA Vice City.rar
[2009-10-03 13:03:15 | 00,059,320 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\48952075.jpg
[2009-10-03 12:44:25 | 03,516,740 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\parodia ich troje ;d.mp3
[2009-10-03 12:42:23 | 01,848,265 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\mietek zul.mp3
[2009-10-03 11:45:48 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009-10-02 07:23:55 | 00,012,180 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\sony-ericsson-k550-big.jpg
[2009-10-02 07:21:51 | 00,022,603 | -HS- | M] () -- C:\WINDOWS\System32\aR5azFSWstNWktJjswK5.inf
[2009-10-01 21:11:37 | 04,175,830 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\dr. dre with snoop dogg - still dre [www.musicishere.fora.pl].mp3
[2009-10-01 21:08:14 | 00,024,625 | ---- | M] (Matrix) -- C:\WINDOWS\MSVB50CHS.dll
[2009-10-01 21:08:12 | 00,020,480 | ---- | M] () -- C:\WINDOWS\MPKrnl.dll
[2009-10-01 21:08:04 | 00,017,920 | ---- | M] () -- C:\WINDOWS\System32\qt-dx3.dll
[2009-10-01 21:04:56 | 00,045,138 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\aa.mp3
[2009-10-01 20:27:29 | 00,118,282 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\achmed martwy terorysta - silence i kill you.mp3
[2009-10-01 17:23:39 | 00,580,944 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\aaa (1) (1).mp4
[2009-10-01 17:23:16 | 02,935,896 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\aaa (1) (1).avi
[2009-10-01 17:22:51 | 21,302,650 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\aaa (1).avi
[2009-10-01 17:22:05 | 00,231,424 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\webcheck.dll
[2009-10-01 17:22:05 | 00,040,448 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MSGSCR.TLB
[2009-10-01 17:21:20 | 01,488,895 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\Bez tytułu.wmv
[2009-10-01 17:18:28 | 00,331,858 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\aaa.mp3
[2009-10-01 17:17:39 | 42,716,160 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\aaa.avi
[2009-09-30 18:51:37 | 03,701,720 | -H-- | M] () -- C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\IconCache.db
[2009-09-30 16:17:04 | 01,213,952 | ---- | M] (Karol Winnicki) -- C:\Documents and Settings\Wojtaz\Pulpit\BESTplayer.exe
[2009-09-30 15:30:39 | 00,014,848 | -HS- | M] () -- C:\WINDOWS\tasks\SbrmpxjdCrgRAFhz4gHh.inf
[2009-09-30 15:30:39 | 00,001,750 | ---- | M] () -- C:\WINDOWS\tasks\EkKXXTKa2TVmc6XM.ico
[2009-09-30 15:30:38 | 00,225,868 | -HS- | M] () -- C:\WINDOWS\System32\qzp3jTZCSfSh.dll
[2009-09-30 15:30:37 | 00,221,271 | -HS- | M] () -- C:\WINDOWS\System32\BtmBAnd89jc9PsPq5EKNj.inf
[2009-09-30 15:30:36 | 00,018,944 | -HS- | M] () -- C:\WINDOWS\tasks\CgbYR44s5jCmgAd6ar.inf
[2009-09-30 15:30:36 | 00,001,750 | ---- | M] () -- C:\WINDOWS\tasks\x7j7yet9WK9FdYSD.ico
[2009-09-30 15:30:35 | 00,001,750 | ---- | M] () -- C:\WINDOWS\tasks\kTS4JJGUYtVagxPs.ico
[2009-09-30 15:30:33 | 00,018,523 | -HS- | M] () -- C:\WINDOWS\System32\122B901E.dll
[2009-09-30 15:30:31 | 00,017,998 | -HS- | M] () -- C:\WINDOWS\System32\ndxq9awMc.dll
[2009-09-30 15:30:30 | 00,020,589 | -HS- | M] () -- C:\WINDOWS\System32\704C3595.dll
[2009-09-30 15:30:30 | 00,018,533 | -HS- | M] () -- C:\WINDOWS\System32\z6FVkEF47huPzgaXee.inf
[2009-09-30 15:30:28 | 00,018,514 | -HS- | M] () -- C:\WINDOWS\System32\dhDhwS7fFW.dll
[2009-09-30 15:30:27 | 00,020,055 | -HS- | M] () -- C:\WINDOWS\System32\08223B03.dll
[2009-09-30 15:30:26 | 00,020,480 | -HS- | M] () -- C:\WINDOWS\tasks\EfEPEaD4ZpVMUXrDbS.inf
[2009-09-30 15:30:26 | 00,001,750 | ---- | M] () -- C:\WINDOWS\tasks\vC6ykXbjUGCVeCJa.ico
[2009-09-30 15:30:24 | 00,023,552 | -HS- | M] () -- C:\WINDOWS\tasks\yGfdVUegEQm9fhY5rnN.inf
[2009-09-30 15:30:24 | 00,018,944 | -HS- | M] () -- C:\WINDOWS\System32\PERrGx5DkqSbQdwauCRQH.dll
[2009-09-30 15:30:24 | 00,001,750 | ---- | M] () -- C:\WINDOWS\tasks\ThGkkhVnR6Dhf3eN.ico
[2009-09-30 15:30:23 | 00,022,016 | -HS- | M] () -- C:\WINDOWS\System32\e863f72a04b6.dll
[2009-09-30 15:30:23 | 00,022,016 | -HS- | M] () -- C:\WINDOWS\System32\comres.dll
[2009-09-30 15:30:23 | 00,001,750 | ---- | M] () -- C:\WINDOWS\tasks\kZdWDEpQcNC2NwDe.ico
[2009-09-30 15:30:22 | 00,001,750 | ---- | M] () -- C:\WINDOWS\tasks\gBuDCU6XjBAEHzzrg.ico
[2009-09-30 14:04:51 | 36,044,0399 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\fh18-izy.wmv
[2009-09-29 22:17:41 | 00,917,313 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\DSC00792.jpg
[2009-09-29 22:13:07 | 00,335,946 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\DSC00791.JPG
[2009-09-29 22:12:56 | 00,299,967 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\DSC00790.JPG
[2009-09-27 20:59:02 | 01,668,165 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\Zdj.088.jpg
[2009-09-27 20:58:52 | 01,695,727 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\Zdj.087.jpg
[2009-09-27 19:02:06 | 00,000,718 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\Skrót do BlueSoleil.exe.lnk
[2009-09-27 18:39:50 | 10,168,946 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\dupa.rar
[2009-09-27 16:38:22 | 05,048,978 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\11 brozas & buczer (ptp) - born whit it feat. caddy pack , kaczor , zeloP.mp31254061870_[mp3.teledyski.info].mp3
[2009-09-27 16:37:35 | 04,864,658 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\caddy pack- don't fuck with me.mp31254062349_[mp3.teledyski.info].mp3
[2009-09-27 13:45:11 | 00,096,385 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\1254051944_by_Xanker_500.jpg
[2009-09-27 12:18:00 | 00,053,881 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\3275d8fff2.jpeg
[2009-09-27 11:29:42 | 00,001,612 | ---- | M] () -- C:\WINDOWS\wincmd.ini
[2009-09-26 21:19:31 | 02,451,968 | -HS- | M] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Kia55b_cfdg.exe
[2009-09-26 21:19:30 | 00,000,000 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\YouTube - Nowa Heyah - Nie tolerujemy kruczkw.avi_
[2009-09-26 09:50:15 | 00,055,941 | ---- | M] () -- C:\FreeFSWP_v1.01.1_freeware_by_junnikokuki@opda.net.cn_unsigned.rar
[2009-09-20 13:40:26 | 07,409,611 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\d - rock star (nevins classic club blaster).mp3
[2009-09-20 11:51:12 | 00,000,689 | ---- | M] () -- C:\WINDOWS\win.ini
[2009-09-17 15:51:17 | 36,495,2148 | ---- | M] () -- C:\Documents and Settings\Wojtaz\Pulpit\ff6025500k.wmv
[2009-09-12 13:43:19 | 00,000,310 | ---- | M] () -- C:\WINDOWS\wcx_ftp.ini

[color=#E56717]========== Files - No Company Name ==========[/color]
[2009-10-04 08:17:52 | 00,004,311 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\bez tytułu1.PNG
[2009-10-03 18:00:12 | 00,015,397 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\bez tytułu.PNG
[2009-10-03 13:32:50 | 01,061,261 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\Crack GTA Vice City.rar
[2009-10-03 13:03:15 | 00,059,320 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\48952075.jpg
[2009-10-03 12:40:01 | 03,516,740 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\parodia ich troje ;d.mp3
[2009-10-03 12:39:46 | 01,848,265 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\mietek zul.mp3
[2009-10-02 07:21:51 | 00,022,603 | -HS- | C] () -- C:\WINDOWS\System32\aR5azFSWstNWktJjswK5.inf
[2009-10-02 07:12:53 | 00,012,180 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\sony-ericsson-k550-big.jpg
[2009-10-01 21:08:12 | 00,020,480 | ---- | C] () -- C:\WINDOWS\MPKrnl.dll
[2009-10-01 21:08:08 | 04,175,830 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\dr. dre with snoop dogg - still dre [www.musicishere.fora.pl].mp3
[2009-10-01 21:08:04 | 00,017,920 | ---- | C] () -- C:\WINDOWS\System32\qt-dx3.dll
[2009-10-01 21:07:33 | 00,001,182 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Gtkplus.plist
[2009-10-01 21:04:56 | 00,045,138 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\aa.mp3
[2009-10-01 21:00:54 | 00,118,282 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\achmed martwy terorysta - silence i kill you.mp3
[2009-10-01 17:23:35 | 00,580,944 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\aaa (1) (1).mp4
[2009-10-01 17:23:07 | 02,935,896 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\aaa (1) (1).avi
[2009-10-01 17:22:49 | 21,302,650 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\aaa (1).avi
[2009-10-01 17:20:43 | 01,488,895 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\Bez tytułu.wmv
[2009-10-01 17:18:26 | 00,331,858 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\aaa.mp3
[2009-10-01 17:18:04 | 42,716,160 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\aaa.avi
[2009-09-30 15:30:39 | 00,014,848 | -HS- | C] () -- C:\WINDOWS\tasks\SbrmpxjdCrgRAFhz4gHh.inf
[2009-09-30 15:30:39 | 00,001,750 | ---- | C] () -- C:\WINDOWS\tasks\EkKXXTKa2TVmc6XM.ico
[2009-09-30 15:30:38 | 00,225,868 | -HS- | C] () -- C:\WINDOWS\System32\qzp3jTZCSfSh.dll
[2009-09-30 15:30:37 | 00,221,271 | -HS- | C] () -- C:\WINDOWS\System32\BtmBAnd89jc9PsPq5EKNj.inf
[2009-09-30 15:30:36 | 00,018,944 | -HS- | C] () -- C:\WINDOWS\tasks\CgbYR44s5jCmgAd6ar.inf
[2009-09-30 15:30:36 | 00,001,750 | ---- | C] () -- C:\WINDOWS\tasks\x7j7yet9WK9FdYSD.ico
[2009-09-30 15:30:35 | 00,001,750 | ---- | C] () -- C:\WINDOWS\tasks\kTS4JJGUYtVagxPs.ico
[2009-09-30 15:30:33 | 00,018,523 | -HS- | C] () -- C:\WINDOWS\System32\122B901E.dll
[2009-09-30 15:30:31 | 00,017,998 | -HS- | C] () -- C:\WINDOWS\System32\ndxq9awMc.dll
[2009-09-30 15:30:30 | 00,018,533 | -HS- | C] () -- C:\WINDOWS\System32\z6FVkEF47huPzgaXee.inf
[2009-09-30 15:30:29 | 00,020,589 | -HS- | C] () -- C:\WINDOWS\System32\704C3595.dll
[2009-09-30 15:30:28 | 00,018,514 | -HS- | C] () -- C:\WINDOWS\System32\dhDhwS7fFW.dll
[2009-09-30 15:30:27 | 00,020,055 | -HS- | C] () -- C:\WINDOWS\System32\08223B03.dll
[2009-09-30 15:30:26 | 00,020,480 | -HS- | C] () -- C:\WINDOWS\tasks\EfEPEaD4ZpVMUXrDbS.inf
[2009-09-30 15:30:26 | 00,001,750 | ---- | C] () -- C:\WINDOWS\tasks\vC6ykXbjUGCVeCJa.ico
[2009-09-30 15:30:24 | 00,023,552 | -HS- | C] () -- C:\WINDOWS\tasks\yGfdVUegEQm9fhY5rnN.inf
[2009-09-30 15:30:24 | 00,018,944 | -HS- | C] () -- C:\WINDOWS\System32\PERrGx5DkqSbQdwauCRQH.dll
[2009-09-30 15:30:24 | 00,001,750 | ---- | C] () -- C:\WINDOWS\tasks\ThGkkhVnR6Dhf3eN.ico
[2009-09-30 15:30:23 | 00,001,750 | ---- | C] () -- C:\WINDOWS\tasks\kZdWDEpQcNC2NwDe.ico
[2009-09-30 15:30:22 | 00,001,750 | ---- | C] () -- C:\WINDOWS\tasks\gBuDCU6XjBAEHzzrg.ico
[2009-09-30 15:17:04 | 07,409,611 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\d - rock star (nevins classic club blaster).mp3
[2009-09-30 13:39:08 | 36,044,0399 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\fh18-izy.wmv
[2009-09-30 00:10:22 | 00,335,946 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\DSC00791.JPG
[2009-09-30 00:10:04 | 00,299,967 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\DSC00790.JPG
[2009-09-29 22:17:38 | 00,917,313 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\DSC00792.jpg
[2009-09-27 19:03:51 | 01,695,727 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\Zdj.087.jpg
[2009-09-27 19:03:12 | 01,668,165 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\Zdj.088.jpg
[2009-09-27 19:02:05 | 00,000,718 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\Skrót do BlueSoleil.exe.lnk
[2009-09-27 18:39:50 | 10,168,946 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\dupa.rar
[2009-09-27 16:32:23 | 04,864,658 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\caddy pack- don't fuck with me.mp31254062349_[mp3.teledyski.info].mp3
[2009-09-27 16:32:16 | 05,048,978 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\11 brozas & buczer (ptp) - born whit it feat. caddy pack , kaczor , zeloP.mp31254061870_[mp3.teledyski.info].mp3
[2009-09-27 13:45:11 | 00,096,385 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\1254051944_by_Xanker_500.jpg
[2009-09-27 12:18:00 | 00,053,881 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\3275d8fff2.jpeg
[2009-09-26 21:19:31 | 02,451,968 | -HS- | C] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\Kia55b_cfdg.exe
[2009-09-26 21:19:30 | 00,000,000 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Moje dokumenty\YouTube - Nowa Heyah - Nie tolerujemy kruczkw.avi_
[2009-09-26 09:50:37 | 00,055,941 | ---- | C] () -- C:\FreeFSWP_v1.01.1_freeware_by_junnikokuki@opda.net.cn_unsigned.rar
[2009-09-23 15:06:44 | 00,815,104 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009-09-23 15:06:44 | 00,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009-09-23 15:06:44 | 00,077,824 | ---- | C] () -- C:\WINDOWS\System32\xvid.ax
[2009-09-17 15:25:47 | 36,495,2148 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Pulpit\ff6025500k.wmv
[2009-08-26 21:08:53 | 00,000,310 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini
[2009-08-20 14:56:34 | 00,000,002 | ---- | C] () -- C:\Program Files\mshexc.bmp
[2009-08-13 21:48:24 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009-08-09 17:31:05 | 00,013,312 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2009-08-06 15:59:23 | 00,001,612 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2009-07-13 16:50:52 | 00,001,984 | ---- | C] () -- C:\WINDOWS\System32\drivers\papycpu2.sys
[2009-07-13 16:50:52 | 00,001,856 | ---- | C] () -- C:\WINDOWS\System32\drivers\papyjoy.sys
[2009-07-13 16:48:41 | 00,000,019 | ---- | C] () -- C:\WINDOWS\Sierra.ini
[2009-07-11 19:35:44 | 00,000,193 | ---- | C] () -- C:\WINDOWS\MBMTool.INI
[2009-07-09 12:25:18 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009-07-09 12:25:18 | 00,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2009-07-09 12:25:16 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2009-07-09 12:25:14 | 00,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009-07-09 12:25:14 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009-07-09 12:22:57 | 00,049,664 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009-07-09 11:51:26 | 00,033,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\oreans32.sys
[2009-07-08 21:13:42 | 00,272,056 | ---- | C] () -- C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
[2009-07-08 20:53:40 | 00,721,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2009-07-08 20:48:02 | 00,023,040 | R--- | C] () -- C:\WINDOWS\System32\drivers\GVCplDrv.sys
[2009-07-08 18:42:44 | 00,014,595 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2009-07-08 18:42:44 | 00,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2009-07-08 18:42:35 | 00,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2009-07-08 16:38:31 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\desktop.ini
[2009-07-08 14:59:49 | 03,701,720 | -H-- | C] () -- C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\IconCache.db
[2009-07-08 14:59:18 | 00,000,062 | -HS- | C] () -- C:\Documents and Settings\Wojtaz\Dane aplikacji\desktop.ini
[2008-04-14 22:50:16 | 00,022,016 | -HS- | C] () -- C:\WINDOWS\System32\e863f72a04b6.dll
[2008-04-14 22:50:16 | 00,022,016 | -HS- | C] () -- C:\WINDOWS\System32\comres.dll
[2006-04-14 09:14:12 | 00,014,312 | ---- | C] () -- C:\WINDOWS\System32\drivers\BTNetFilter.sys
[2005-07-30 07:21:32 | 00,011,988 | ---- | C] () -- C:\WINDOWS\System32\drivers\vbtenum.sys
[2005-06-15 11:20:00 | 00,540,672 | ---- | C] () -- C:\WINDOWS\System32\nvhwvid.dll
[2001-10-26 17:45:34 | 00,028,672 | ---- | C] () -- C:\WINDOWS\System32\NSREG.DLL
[2001-07-22 00:16:20 | 00,000,689 | ---- | C] () -- C:\WINDOWS\win.ini
[2001-07-22 00:15:52 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini

[color=#E56717]========== LOP Check ==========[/color]

[2009-10-03 14:40:12 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Dane aplikacji
[2009-07-28 21:15:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo
[2009-08-09 17:32:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Bluetooth
[2009-07-08 20:55:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Pro
[2009-08-04 21:32:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Installations
[2009-08-04 12:55:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\OpenFM
[2009-08-04 21:37:30 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite
[2009-09-14 14:23:26 | 00,000,000 | -HSD | M] -- C:\Documents and Settings\All Users\Dane aplikacji\System Restore
[2009-08-30 00:04:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Trymedia
[2009-07-08 16:38:30 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Default User\Dane aplikacji
[2009-07-08 14:58:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Dane aplikacji
[2009-07-08 14:50:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji
[2009-10-03 14:40:12 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji
[2009-07-24 13:00:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\aerix
[2009-07-28 21:16:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Ashampoo
[2009-10-02 07:47:29 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Audacity
[2009-09-21 14:54:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\BESTplayer
[2009-08-29 11:23:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Bioshock
[2009-07-08 20:53:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\DAEMON Tools Pro
[2009-10-03 20:46:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\DMCache
[2009-08-05 12:46:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Download Manager
[2009-08-20 14:29:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\FireShot
[2009-10-03 21:19:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\foobar2000
[2009-07-11 12:38:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\gtk-2.0
[2009-08-01 16:03:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Hamachi
[2009-09-24 15:23:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\HEXelon
[2009-08-13 14:59:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\IDM
[2009-07-11 12:37:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Inkscape
[2009-07-29 18:44:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Mael
[2009-08-24 17:49:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\NationRed
[2009-08-04 21:37:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Nokia
[2009-07-08 21:35:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Nowe Gadu-Gadu
[2009-08-04 12:55:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\OpenFM
[2009-09-26 12:30:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\PC Suite
[2009-07-11 15:38:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Pionek
[2009-09-22 16:08:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Thinstall
[2009-08-30 00:44:28 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\THQ
[2009-07-10 09:04:48 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\Thunderbird
[2009-07-09 11:27:49 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\UltraVNC
[2009-09-30 14:04:56 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Wojtaz\Dane aplikacji\uTorrent
[2009-09-30 15:30:36 | 00,018,944 | -HS- | M] () -- C:\WINDOWS\Tasks\CgbYR44s5jCmgAd6ar.inf
[2001-07-22 00:17:50 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini
[2009-09-30 15:30:26 | 00,020,480 | -HS- | M] () -- C:\WINDOWS\Tasks\EfEPEaD4ZpVMUXrDbS.inf
[2009-09-30 15:30:39 | 00,001,750 | ---- | M] () -- C:\WINDOWS\Tasks\EkKXXTKa2TVmc6XM.ico
[2009-09-30 15:30:22 | 00,001,750 | ---- | M] () -- C:\WINDOWS\Tasks\gBuDCU6XjBAEHzzrg.ico
[2009-09-30 15:30:35 | 00,001,750 | ---- | M] () -- C:\WINDOWS\Tasks\kTS4JJGUYtVagxPs.ico
[2009-09-30 15:30:23 | 00,001,750 | ---- | M] () -- C:\WINDOWS\Tasks\kZdWDEpQcNC2NwDe.ico
[2009-10-04 08:16:49 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT
[2009-09-30 15:30:39 | 00,014,848 | -HS- | M] () -- C:\WINDOWS\Tasks\SbrmpxjdCrgRAFhz4gHh.inf
[2009-09-30 15:30:24 | 00,001,750 | ---- | M] () -- C:\WINDOWS\Tasks\ThGkkhVnR6Dhf3eN.ico
[2009-09-30 15:30:26 | 00,001,750 | ---- | M] () -- C:\WINDOWS\Tasks\vC6ykXbjUGCVeCJa.ico
[2009-09-30 15:30:36 | 00,001,750 | ---- | M] () -- C:\WINDOWS\Tasks\x7j7yet9WK9FdYSD.ico
[2009-09-30 15:30:24 | 00,023,552 | -HS- | M] () -- C:\WINDOWS\Tasks\yGfdVUegEQm9fhY5rnN.inf

[color=#E56717]========== Purity Check ==========[/color]


< End of report >


teraz przy włączaniu kompa wyskakuje mi:

oraz cały czas:

[wojtas]

Daj loga z combofixa ale zainstaluj wraz z nim konsolę odzyskiwania ( instrukcja programu )

[Wojtaz]

Kod: Zaznacz wszystko

ComboFix 09-10-04.01 - Wojtaz 2009-10-05 14:38.2.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1250.48.1045.18.511.246 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Wojtaz\Moje dokumenty\Downloads\ComboFix.exe

UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Wojtaz\Dane aplikacji\Microsoft\Clip Organizer\mstore10.mgc
c:\documents and settings\Wojtaz\Dane aplikacji\Microsoft\Clip Organizer\Offic10.MGC
c:\windows\Downloaded Program Files\AnXnubyMnv58c9vaECWX.cur
c:\windows\Downloaded Program Files\BcHCMJEEXFxaCm3q.Ttf
c:\windows\Downloaded Program Files\DdrDVWV49HPgHP9kh.Ttf
c:\windows\Downloaded Program Files\dGRbFvvXexA8MsPnW.Ttf
c:\windows\Downloaded Program Files\fZKkTmDAwTdKqXn8.Ttf
c:\windows\Downloaded Program Files\jEDR2jykhSujaMqF.Ttf
c:\windows\Downloaded Program Files\PRKUkXR8NQ8ydQmw.Ttf
c:\windows\Downloaded Program Files\SjRjQgREDp3P8B4rEEg.cur
c:\windows\Downloaded Program Files\skF72DppdVCUzqhF.Ttf
c:\windows\Downloaded Program Files\SvS2DJAqqTvtTYEU.Ttf
c:\windows\Downloaded Program Files\sZaeAC74EzXJeVeJu6p.cur
c:\windows\Downloaded Program Files\ThunderAdvise.dll
c:\windows\Downloaded Program Files\u8w23uRSuevxt2VP.Ttf
c:\windows\Downloaded Program Files\uMub3WCE6aZ3nFgrYRX.Ttf
c:\windows\Downloaded Program Files\vyUD66dJ999myu4W.Ttf
c:\windows\Downloaded Program Files\WD2B9pAnWGBjB2sz.Ttf
c:\windows\Downloaded Program Files\WQKrDGnXQQb3Mgjk.Ttf
c:\windows\Fonts\2knxWtVjbWXmUdGG.Ttf
c:\windows\Fonts\A97CRaCB.fon
c:\windows\Fonts\cD9KArZZUHxCqnyM.Ttf
c:\windows\Fonts\cFDPmh3MDPjcHMPd.Ttf
c:\windows\Fonts\CRp3uYCmcxMp3qQn9.Ttf
c:\windows\Fonts\eCgMhGRkPUcdutd0.Ttf
c:\windows\Fonts\eSEWZRdrSK3NeEJVy4.Ttf
c:\windows\Fonts\G8qZ5hBX7H.Ttf
c:\windows\Fonts\HXxfduw9KeQTCeP6Z.Ttf
c:\windows\Fonts\qWskzsQA6.Ttf
c:\windows\Fonts\RCZbVbjCY6wYszD3.Ttf
c:\windows\Fonts\S8a8cnEuaydPJGg8.Ttf
c:\windows\Fonts\SD78dgC7hD2sktQHyAu.fon
c:\windows\Fonts\tBeuadwPppCBnDUPgJH7P6.Ttf
c:\windows\MPKrnl.dll
c:\windows\MSVB50CHS.dll
c:\windows\system32\08223b03.dll
c:\windows\system32\122B901e.dll
c:\windows\system32\2eXJw3dsatgwrf5uapadmhn.dll
c:\windows\system32\704C3595.dll
c:\windows\system32\aR5azFSWstNWktJjswK5.inf
c:\windows\system32\BPRBASgvesMzHRfu3AfB.inf
c:\windows\system32\BtMBand89jc9pspq5eknj.inf
c:\windows\system32\CDuAUVkGy9.dll
c:\windows\system32\CWcQnWxHjWqtE6PsYyEe.inf
c:\windows\system32\dhDhwS7fFW.dll
c:\windows\system32\drivers\IsDrv118.sys
c:\windows\system32\e863f72a04b6.dll
c:\windows\system32\FsmBY3kmWnAG5gRbwGgU.inf
c:\windows\system32\Jmansz.dat
c:\windows\system32\myInsDll.exe
c:\windows\system32\ndXQ9awmc.dll
c:\windows\system32\nXe2grrKNzF9dxYKmqg.inf
c:\windows\system32\PERRgx5dkqsbqdwaucrqh.dll
c:\windows\system32\Processa.dll
c:\windows\system32\qzP3jtzcsfsh.dll
c:\windows\system32\S5kSrtwDf35EW9f2kBDF.inf
c:\windows\system32\SCEVfjrcmab7.dll
c:\windows\system32\sfc32.dll
c:\windows\system32\uV4kFmSjPK7eKfenjpv9Ct.inf
c:\windows\system32\z6FVkEF47huPzgaXee.inf
c:\windows\Tasks\c2nH4numz9knY5zqnC.inf
c:\windows\Tasks\CgBYr44s5jcmgad6ar.inf
c:\windows\Tasks\EfEPEaD4ZpVMUXrDbS.inf
c:\windows\Tasks\EkKXXTKa2TVmc6XM.ico
c:\windows\Tasks\gBuDCU6XjBAEHzzrg.ico
c:\windows\Tasks\JJX5r8wnsqunnxgwpwn.inf
c:\windows\Tasks\kTS4JJGUYtVagxPs.ico
c:\windows\Tasks\kZdWDEpQcNC2NwDe.ico
c:\windows\Tasks\SbrmpxjdCrgRAFhz4gHh.inf
c:\windows\Tasks\ThGkkhVnR6Dhf3eN.ico
c:\windows\Tasks\txPsQUxAThX8QTR6s6Yn.inf
c:\windows\Tasks\vC6ykXbjUGCVeCJa.ico
c:\windows\Tasks\x7j7yet9WK9FdYSD.ico
c:\windows\Tasks\yGFDvuegeqm9fhy5rnn.inf
c:\windows\temp\wmsetup.dll

Zainfekowana kopia c:\windows\system32\comres.dll została znaleziona. Problem naprawiono
Plik odzyskano z - c:\windows\system32\dllcache\cache\comres.dll

.
(((((((((((((((((((((((((((((((((((((((   Sterowniki/Usługi   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NVMINI
-------\Service_IsDrv118


(((((((((((((((((((((((((   Pliki utworzone od 2009-09-05 do 2009-10-05  )))))))))))))))))))))))))))))))
.

2009-10-05 12:44 . 2009-10-05 12:44   --------   d-----w-   C:\found.001
2009-10-05 12:28 . 2009-10-05 12:29   --------   d-----w-   c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Temp
2009-10-05 12:28 . 2009-10-05 12:29   --------   d-----w-   c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Google
2009-10-04 09:55 . 2008-09-25 15:35   181120   ----a-w-   c:\windows\system32\drivers\ext2fs.sys
2009-10-04 09:55 . 2008-08-28 20:45   51072   ----a-w-   c:\windows\system32\drivers\ifsmount.sys
2009-10-04 09:55 . 2008-07-26 21:56   210432   ----a-w-   c:\windows\system32\ifsdrives.dll
2009-10-04 07:33 . 2009-10-04 07:33   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Nero
2009-10-04 07:32 . 2009-10-04 07:32   --------   d-----w-   c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Xenocode
2009-10-03 18:21 . 2009-10-03 18:21   --------   d-----w-   C:\found.000
2009-10-01 19:08 . 2009-10-01 19:08   --------   d-----w-   c:\program files\Common Files\Thunder Network
2009-10-01 19:08 . 2009-10-01 19:08   17920   ----a-w-   c:\windows\system32\qt-dx3.dll
2009-10-01 19:07 . 2009-10-01 19:07   --------   d-----w-   c:\program files\Common Files\Java
2009-09-30 13:14 . 2008-04-13 22:15   32128   -c--a-w-   c:\windows\system32\dllcache\usbccgp.sys
2009-09-30 13:14 . 2008-04-13 22:15   32128   ----a-w-   c:\windows\system32\drivers\usbccgp.sys
2009-09-26 19:21 . 2009-09-26 19:21   3156992   --sh--w-   c:\documents and settings\Wojtaz\PulpitFkx6I5_save2pc.exe
2009-09-24 13:23 . 2009-09-24 13:23   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\HEXelon
2009-09-23 13:06 . 2009-09-23 13:06   --------   d-----w-   c:\program files\Xvid
2009-09-23 13:06 . 2008-12-04 19:46   180224   ----a-w-   c:\windows\system32\xvidvfw.dll
2009-09-23 13:06 . 2008-12-04 19:42   815104   ----a-w-   c:\windows\system32\xvidcore.dll
2009-09-23 13:06 . 2009-09-23 13:06   --------   d-----w-   c:\program files\FDRLab
2009-09-22 19:41 . 2009-09-22 19:41   --------   d-----w-   C:\Cannibal.Holocaust.Uncut.1980.DVDRip.XviD-QiX
2009-09-22 13:47 . 2009-09-22 14:08   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Thinstall
2009-09-21 18:58 . 2009-09-21 18:58   --------   d-----w-   c:\program files\URUSoft
2009-09-21 14:40 . 2001-10-26 15:29   5632   ----a-w-   c:\windows\system32\ptpusb.dll
2009-09-21 14:40 . 2008-04-14 20:50   159232   ----a-w-   c:\windows\system32\ptpusd.dll
2009-09-21 14:40 . 2008-04-13 22:15   15104   -c--a-w-   c:\windows\system32\dllcache\usbscan.sys
2009-09-21 14:40 . 2008-04-13 22:15   15104   ----a-w-   c:\windows\system32\drivers\usbscan.sys
2009-09-14 12:23 . 2009-09-14 12:23   --------   d-sh--w-   c:\documents and settings\All Users\Dane aplikacji\System Restore
2009-09-12 12:15 . 2009-10-01 15:21   --------   d-----w-   c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\WMTools Downloaded Files
2009-09-11 06:00 . 2001-08-17 19:47   12928   -c--a-w-   c:\windows\system32\dllcache\dot4prt.sys
2009-09-11 06:00 . 2001-08-17 19:47   12928   ----a-w-   c:\windows\system32\drivers\Dot4Prt.sys
2009-09-11 06:00 . 2001-10-26 14:46   23936   -c--a-w-   c:\windows\system32\dllcache\dot4usb.sys
2009-09-11 06:00 . 2001-10-26 14:46   23936   ----a-w-   c:\windows\system32\drivers\Dot4usb.sys
2009-09-11 06:00 . 2008-04-13 22:09   206976   -c--a-w-   c:\windows\system32\dllcache\dot4.sys
2009-09-11 06:00 . 2008-04-13 22:09   206976   ----a-w-   c:\windows\system32\drivers\Dot4.sys

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-05 12:37 . 2009-07-11 05:08   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\foobar2000
2009-10-05 12:32 . 2009-08-13 12:56   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\DMCache
2009-10-04 09:26 . 2008-04-14 20:50   22016   --sha-w-   c:\windows\system32\SysComs.dll
2009-10-03 15:51 . 2009-07-15 15:25   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Skype
2009-10-03 11:23 . 2009-07-08 16:43   --------   d--h--w-   c:\program files\InstallShield Installation Information
2009-10-02 05:47 . 2009-07-28 11:01   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Audacity
2009-09-30 12:04 . 2009-07-14 11:21   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\uTorrent
2009-09-26 10:30 . 2009-08-04 19:36   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\PC Suite
2009-09-21 12:54 . 2009-08-17 13:17   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\BESTplayer
2009-08-29 22:44 . 2009-08-29 22:44   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\THQ
2009-08-29 22:04 . 2009-08-29 22:04   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Trymedia
2009-08-29 09:23 . 2009-08-27 09:34   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Bioshock
2009-08-25 21:16 . 2009-07-08 19:13   272056   ----a-w-   c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-08-24 15:49 . 2009-08-24 15:36   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\NationRed
2009-08-24 15:35 . 2009-08-24 15:35   413696   ----a-w-   c:\windows\system32\wrap_oal.dll
2009-08-24 15:35 . 2009-08-24 15:35   110592   ----a-w-   c:\windows\system32\OpenAL32.dll
2009-08-24 15:35 . 2009-08-24 15:35   --------   d-----w-   c:\program files\OpenAL
2009-08-20 12:56 . 2009-08-20 12:56   2   ----a-w-   c:\program files\mshexc.bmp
2009-08-20 12:29 . 2009-08-20 12:29   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\FireShot
2009-08-13 19:45 . 2009-08-13 19:45   --------   d-----w-   c:\program files\Microsoft Works
2009-08-13 19:45 . 2009-08-13 19:45   --------   d-----w-   c:\program files\Microsoft.NET
2009-08-13 12:59 . 2009-08-13 12:56   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\IDM
2009-08-09 15:32 . 2009-08-09 15:31   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Bluetooth
2009-08-07 16:26 . 2009-07-13 10:54   --------   d-----w-   c:\program files\Common Files\Adobe
2009-08-06 13:31 . 2009-08-06 13:31   126976   ----a-w-   c:\windows\system32\kentut.exe
2009-08-04 19:38 . 2001-10-26 16:15   74230   ----a-w-   c:\windows\system32\perfc015.dat
2009-08-04 19:38 . 2001-10-26 16:15   448004   ----a-w-   c:\windows\system32\perfh015.dat
2009-07-28 19:20 . 2008-04-14 20:50   219648   ----a-w-   c:\windows\system32\uxtheme.dll
2009-07-24 10:45 . 2009-07-24 10:45   25512   ----a-w-   c:\windows\system32\drivers\ggsemc.sys
2009-07-24 10:45 . 2009-07-24 10:45   13224   ----a-w-   c:\windows\system32\drivers\ggflt.sys
2009-07-24 10:45 . 2009-07-24 10:45   1112288   ----a-w-   c:\windows\system32\WdfCoInstaller01007.dll
2009-07-24 10:43 . 2009-07-24 10:43   12160   ----a-w-   c:\windows\system32\drivers\zebrcmnt.sys
2009-07-24 10:43 . 2009-07-24 10:43   12160   ----a-w-   c:\windows\system32\drivers\zebrcm.sys
2009-07-24 10:43 . 2009-07-24 10:43   109568   ----a-w-   c:\windows\system32\drivers\zebrmdmc.sys
2009-07-24 10:43 . 2009-07-24 10:43   14848   ----a-w-   c:\windows\system32\drivers\zebrmdfl.sys
2009-07-24 10:43 . 2009-07-24 10:43   109568   ----a-w-   c:\windows\system32\drivers\zebrmdm.sys
2009-07-24 10:43 . 2009-07-24 10:43   83200   ----a-w-   c:\windows\system32\drivers\zebrbus.sys
2009-07-24 10:43 . 2009-07-24 10:43   12160   ----a-w-   c:\windows\system32\drivers\zebrwhnt.sys
2009-07-24 10:43 . 2009-07-24 10:43   12160   ----a-w-   c:\windows\system32\drivers\zebrwh.sys
2009-07-17 16:10 . 2009-07-17 16:10   410984   ----a-w-   c:\windows\system32\deploytk.dll
2009-07-15 16:32 . 2009-07-15 15:18   17480   ----a-w-   c:\windows\system32\drivers\hamachi.sys
2009-07-09 09:51 . 2009-07-09 09:51   33824   ----a-w-   c:\windows\system32\drivers\oreans32.sys
2009-07-08 19:10 . 2009-07-08 19:10   0   ----a-w-   c:\windows\nsreg.dat
2009-07-08 18:53 . 2009-07-08 18:53   721904   ----a-w-   c:\windows\system32\drivers\sptd.sys
2009-07-08 12:43 . 2009-07-08 12:43   21856   ----a-w-   c:\windows\system32\emptyregdb.dat
.

------- Sigcheck -------

[-] 2008-05-08 . ACCF5A9A1FFAA490F33DBA1C632B95E1 . 361344 . . [5.1.2600.5512] . . c:\windows\system32\drivers\tcpip.sys

[-] 2008-04-14 . 66A53012DABC19D99748D3EDA74BC06E . 246784 . . [5.1.2600.5512] . . c:\windows\system32\mswsock.dll
[7] 2008-04-14 . 612E31FCAC1040EDD78ECAC81C9F859F . 246784 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\mswsock.dll

[-] 2008-05-08 . 9F02C1CF7C3100E4AEA7DD8B6A86A01B . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

c:\windows\system32\linkinfo.dll ...  - brak elementu !!
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" [2009-10-05 133104]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-06-15 6803456]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\UltraVNC\\vncviewer.exe"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"d:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:vnc5900
"5800:TCP"= 5800:TCP:vnc5800

R1 Ext2fs;Ext2fs;c:\windows\system32\drivers\ext2fs.sys [2009-10-04 181120]
R1 IfsMount;IfsMount;c:\windows\system32\drivers\ifsmount.sys [2009-10-04 51072]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2009-07-24 13224]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2009-07-09 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2009-07-09 8320]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [2009-07-09 42112]

--- Inne Usługi/Sterowniki w Pamięci ---

*NewlyCreated* - NVMINI
*Deregistered* - nvmini
.
Zawartość folderu 'Zaplanowane zadania'

2009-10-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-583907252-776561741-1417001333-1003Core.job
- c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2009-10-05 12:28]

2009-10-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-583907252-776561741-1417001333-1003UA.job
- c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2009-10-05 12:28]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.darkw0rld.com
IE: Download all links with IDM - d:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - d:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - d:\program files\Internet Download Manager\IEExt.htm
TCP: {06811B39-465A-4497-AD43-673E30CD067A} = 192.168.1.13,192.168.1.1
FF - ProfilePath - c:\documents and settings\Wojtaz\Dane aplikacji\Mozilla\Firefox\Profiles\asu07ayp.default\
FF - component: c:\documents and settings\Wojtaz\Dane aplikacji\Mozilla\Firefox\Profiles\asu07ayp.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\platform\WINNT_x86-msvc\components\SSSLauncher.dll
FF - component: d:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: d:\program files\Mozilla Firefox\extensions\talkback@mozilla.org\components\qfaservices.dll
FF - plugin: c:\documents and settings\Wojtaz\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npgg.1.dll
FF - plugin: d:\program files\Adobe\Reader 9.0\Reader\browser\nppdf32.dll
.
- - - - USUNIĘTO PUSTE WPISY - - - -

HKLM-Run-MPKrnl - c:\windows\MPKrnl.dll
HKLM-Explorer_Run-MPMKrnl - c:\windows\MKMKrnl.dll
ShellExecuteHooks-{74DA2FEC-F68F-4DC7-9A45-9174AC044427} - c:\windows\system32\z6FVkEF47huPzgaXee.inf
ShellExecuteHooks-{827E2FB4-1047-43DE-848D-E12BB0C97AAB} - c:\windows\Tasks\SbrmpxjdCrgRAFhz4gHh.inf
ShellExecuteHooks-{3F86C1E9-E95A-41AF-AD72-7D9A1742232D} - c:\windows\system32\aR5azFSWstNWktJjswK5.inf
ShellExecuteHooks-{B6C3510F-2666-496B-A46F-6EEFD6328C2B} - c:\windows\Tasks\txPsQUxAThX8QTR6s6Yn.inf
ShellExecuteHooks-{8A6A5B34-D995-4C5D-9338-B5E264B4A87} - c:\windows\system32\nXe2grrKNzF9dxYKmqg.inf
ShellExecuteHooks-{F181F067-7046-4DCB-993F-200990736305} - c:\windows\Downloaded Program Files\sZaeAC74EzXJeVeJu6p.cur
ShellExecuteHooks-{B7F1BFDC-4B6C-4E2F-AF7A-638D2D47802C} - c:\windows\system32\FsmBY3kmWnAG5gRbwGgU.inf
ShellExecuteHooks-{9C20D654-5AF8-4DB7-A125-1A17D7065C73} - c:\windows\system32\uV4kFmSjPK7eKfenjpv9Ct.inf
ShellExecuteHooks-{84639C2D-CD75-4081-B515-329AFCECBF19} - c:\windows\Downloaded Program Files\SjRjQgREDp3P8B4rEEg.cur
ShellExecuteHooks-{C20C5A13-4DD7-40D9-90B4-700BAB0BBBE9} - c:\windows\system32\S5kSrtwDf35EW9f2kBDF.inf
ShellExecuteHooks-{CB661471-055A-4C5B-9ED0-497B9908FEF5} - c:\windows\system32\CWcQnWxHjWqtE6PsYyEe.inf
ShellExecuteHooks-{B59F0A61-EF3E-4A2B-9E3A-4A84EDDF2308} - c:\windows\Downloaded Program Files\AnXnubyMnv58c9vaECWX.cur
ShellExecuteHooks-{C07B914B-C164-42D2-9838-1422C3F70D99} - c:\windows\system32\BPRBASgvesMzHRfu3AfB.inf
AddRemove-Inkscape - d:\program files\Inkscape\Uninstall.exe
AddRemove-S.T.A.L.K.E.R. - Shadow of Chernobyl_is1 - d:\program files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\unins000.exe
AddRemove-{E2BA588C-AF22-4C59-96A8-A6C6E782CB9C}_is1 - d:\program files\Pionek\unins000.exe



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-05 14:45
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 


c:\windows\linkinfo.dll 46592 bytes executable
c:\windows\system32\drivers\nvmini.sys 17152 bytes executable
c:\windows\system32\linkinfo.dll 19968 bytes executable

skanowanie pomyślnie ukończone
ukryte pliki: 3

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nvmini]
"ImagePath"="system32\DRIVERS\nvmini.sys"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'lsass.exe'(796)
c:\windows\system32\qt-dx3.dll

- - - - - - - > 'explorer.exe'(2728)
c:\windows\system32\ieframe.dll
c:\program files\Messenger\h323cc.dll
c:\windows\system32\wpdshserviceobj.dll
c:\program files\Common Files\Java\bin\eula.dll
c:\program files\Internet Explorer\iedw.dll
c:\program files\Common Files\Thunder Network\KanKan\DapCtrl.dll
c:\program files\WinRar\ZipExt.dll
d:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
d:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
d:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_pol.nlr
d:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wscntfy.exe
c:\program files\Internet Explorer\IEXPLORE.EXE
.
**************************************************************************
.
Czas ukończenia: 2009-10-05 14:48 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2009-10-05 12:48

Przed: 8 064 258 048 bajtów wolnych
Po: 8 065 052 672 bajtów wolnych

309


fajnie, że mam w FF zresetowane wszystkie ustawienia... Przez głupi CHDSK, bo przed uruchomieniem FF nie działał - jest już aktywny BLABLABLA

[wojtas]

Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\kentut.exe
c:\windows\linkinfo.dl
c:\windows\system32\drivers\nvmini.sys
c:\windows\system32\linkinfo.dll

Driver::
NVMINI

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->
Rozpocznie się usuwanie i powstanie log daj go.

[Wojtaz]

Kod: Zaznacz wszystko

ComboFix 09-10-05.01 - Wojtaz 2009-10-06 16:46.3.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1250.48.1045.18.511.318 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Wojtaz\Pulpit\ComboFix.exe
Użyto następujących komend :: c:\documents and settings\Wojtaz\Pulpit\CFScript.txt

UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!

FILE ::
"c:\windows\linkinfo.dl"
"c:\windows\system32\drivers\nvmini.sys"
"c:\windows\system32\kentut.exe"
"c:\windows\system32\linkinfo.dll"
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\kentut.exe
c:\windows\temp\wmsetup.dll

.
(((((((((((((((((((((((((((((((((((((((   Sterowniki/Usługi   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NVMINI


(((((((((((((((((((((((((   Pliki utworzone od 2009-09-06 do 2009-10-06  )))))))))))))))))))))))))))))))
.

2009-10-06 14:50 . 2009-10-06 14:50   17152   ----a-w-   c:\windows\system32\drivers\IsDrv118.sys
2009-10-05 12:44 . 2009-10-05 12:44   --------   d-----w-   C:\found.001
2009-10-05 12:28 . 2009-10-05 12:29   --------   d-----w-   c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Temp
2009-10-05 12:28 . 2009-10-05 12:29   --------   d-----w-   c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Google
2009-10-04 09:55 . 2008-09-25 15:35   181120   ----a-w-   c:\windows\system32\drivers\ext2fs.sys
2009-10-04 09:55 . 2008-08-28 20:45   51072   ----a-w-   c:\windows\system32\drivers\ifsmount.sys
2009-10-04 09:55 . 2008-07-26 21:56   210432   ----a-w-   c:\windows\system32\ifsdrives.dll
2009-10-04 07:33 . 2009-10-04 07:33   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Nero
2009-10-04 07:32 . 2009-10-04 07:32   --------   d-----w-   c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Xenocode
2009-10-03 18:21 . 2009-10-03 18:21   --------   d-----w-   C:\found.000
2009-10-01 19:08 . 2009-10-01 19:08   --------   d-----w-   c:\program files\Common Files\Thunder Network
2009-10-01 19:08 . 2009-10-01 19:08   17920   ----a-w-   c:\windows\system32\qt-dx3.dll
2009-10-01 19:07 . 2009-10-01 19:07   --------   d-----w-   c:\program files\Common Files\Java
2009-09-30 13:14 . 2008-04-13 22:15   32128   -c--a-w-   c:\windows\system32\dllcache\usbccgp.sys
2009-09-30 13:14 . 2008-04-13 22:15   32128   ----a-w-   c:\windows\system32\drivers\usbccgp.sys
2009-09-26 19:21 . 2009-09-26 19:21   3156992   --sh--w-   c:\documents and settings\Wojtaz\PulpitFkx6I5_save2pc.exe
2009-09-24 13:23 . 2009-09-24 13:23   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\HEXelon
2009-09-23 13:06 . 2009-09-23 13:06   --------   d-----w-   c:\program files\Xvid
2009-09-23 13:06 . 2008-12-04 19:46   180224   ----a-w-   c:\windows\system32\xvidvfw.dll
2009-09-23 13:06 . 2008-12-04 19:42   815104   ----a-w-   c:\windows\system32\xvidcore.dll
2009-09-23 13:06 . 2009-09-23 13:06   --------   d-----w-   c:\program files\FDRLab
2009-09-22 19:41 . 2009-09-22 19:41   --------   d-----w-   C:\Cannibal.Holocaust.Uncut.1980.DVDRip.XviD-QiX
2009-09-22 13:47 . 2009-09-22 14:08   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Thinstall
2009-09-21 18:58 . 2009-09-21 18:58   --------   d-----w-   c:\program files\URUSoft
2009-09-21 14:40 . 2001-10-26 15:29   5632   ----a-w-   c:\windows\system32\ptpusb.dll
2009-09-21 14:40 . 2008-04-14 20:50   159232   ----a-w-   c:\windows\system32\ptpusd.dll
2009-09-21 14:40 . 2008-04-13 22:15   15104   -c--a-w-   c:\windows\system32\dllcache\usbscan.sys
2009-09-21 14:40 . 2008-04-13 22:15   15104   ----a-w-   c:\windows\system32\drivers\usbscan.sys
2009-09-14 12:23 . 2009-09-14 12:23   --------   d-sh--w-   c:\documents and settings\All Users\Dane aplikacji\System Restore
2009-09-12 12:15 . 2009-10-01 15:21   --------   d-----w-   c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\WMTools Downloaded Files
2009-09-11 06:00 . 2001-08-17 19:47   12928   -c--a-w-   c:\windows\system32\dllcache\dot4prt.sys
2009-09-11 06:00 . 2001-08-17 19:47   12928   ----a-w-   c:\windows\system32\drivers\Dot4Prt.sys
2009-09-11 06:00 . 2001-10-26 14:46   23936   -c--a-w-   c:\windows\system32\dllcache\dot4usb.sys
2009-09-11 06:00 . 2001-10-26 14:46   23936   ----a-w-   c:\windows\system32\drivers\Dot4usb.sys
2009-09-11 06:00 . 2008-04-13 22:09   206976   -c--a-w-   c:\windows\system32\dllcache\dot4.sys
2009-09-11 06:00 . 2008-04-13 22:09   206976   ----a-w-   c:\windows\system32\drivers\Dot4.sys

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-06 14:44 . 2009-08-13 12:56   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\DMCache
2009-10-05 13:00 . 2009-07-11 05:08   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\foobar2000
2009-10-04 09:26 . 2008-04-14 20:50   22016   --sha-w-   c:\windows\system32\SysComs.dll
2009-10-03 15:51 . 2009-07-15 15:25   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Skype
2009-10-03 11:23 . 2009-07-08 16:43   --------   d--h--w-   c:\program files\InstallShield Installation Information
2009-10-02 05:47 . 2009-07-28 11:01   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Audacity
2009-09-30 12:04 . 2009-07-14 11:21   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\uTorrent
2009-09-26 10:30 . 2009-08-04 19:36   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\PC Suite
2009-09-21 12:54 . 2009-08-17 13:17   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\BESTplayer
2009-08-29 22:44 . 2009-08-29 22:44   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\THQ
2009-08-29 22:04 . 2009-08-29 22:04   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Trymedia
2009-08-29 09:23 . 2009-08-27 09:34   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Bioshock
2009-08-25 21:16 . 2009-07-08 19:13   272056   ----a-w-   c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-08-24 15:49 . 2009-08-24 15:36   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\NationRed
2009-08-24 15:35 . 2009-08-24 15:35   413696   ----a-w-   c:\windows\system32\wrap_oal.dll
2009-08-24 15:35 . 2009-08-24 15:35   110592   ----a-w-   c:\windows\system32\OpenAL32.dll
2009-08-24 15:35 . 2009-08-24 15:35   --------   d-----w-   c:\program files\OpenAL
2009-08-20 12:56 . 2009-08-20 12:56   2   ----a-w-   c:\program files\mshexc.bmp
2009-08-20 12:29 . 2009-08-20 12:29   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\FireShot
2009-08-13 19:45 . 2009-08-13 19:45   --------   d-----w-   c:\program files\Microsoft Works
2009-08-13 19:45 . 2009-08-13 19:45   --------   d-----w-   c:\program files\Microsoft.NET
2009-08-13 12:59 . 2009-08-13 12:56   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\IDM
2009-08-09 15:32 . 2009-08-09 15:31   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Bluetooth
2009-08-07 16:26 . 2009-07-13 10:54   --------   d-----w-   c:\program files\Common Files\Adobe
2009-08-04 19:38 . 2001-10-26 16:15   74230   ----a-w-   c:\windows\system32\perfc015.dat
2009-08-04 19:38 . 2001-10-26 16:15   448004   ----a-w-   c:\windows\system32\perfh015.dat
2009-07-28 19:20 . 2008-04-14 20:50   219648   ----a-w-   c:\windows\system32\uxtheme.dll
2009-07-24 10:45 . 2009-07-24 10:45   25512   ----a-w-   c:\windows\system32\drivers\ggsemc.sys
2009-07-24 10:45 . 2009-07-24 10:45   13224   ----a-w-   c:\windows\system32\drivers\ggflt.sys
2009-07-24 10:45 . 2009-07-24 10:45   1112288   ----a-w-   c:\windows\system32\WdfCoInstaller01007.dll
2009-07-24 10:43 . 2009-07-24 10:43   12160   ----a-w-   c:\windows\system32\drivers\zebrcmnt.sys
2009-07-24 10:43 . 2009-07-24 10:43   12160   ----a-w-   c:\windows\system32\drivers\zebrcm.sys
2009-07-24 10:43 . 2009-07-24 10:43   109568   ----a-w-   c:\windows\system32\drivers\zebrmdmc.sys
2009-07-24 10:43 . 2009-07-24 10:43   14848   ----a-w-   c:\windows\system32\drivers\zebrmdfl.sys
2009-07-24 10:43 . 2009-07-24 10:43   109568   ----a-w-   c:\windows\system32\drivers\zebrmdm.sys
2009-07-24 10:43 . 2009-07-24 10:43   83200   ----a-w-   c:\windows\system32\drivers\zebrbus.sys
2009-07-24 10:43 . 2009-07-24 10:43   12160   ----a-w-   c:\windows\system32\drivers\zebrwhnt.sys
2009-07-24 10:43 . 2009-07-24 10:43   12160   ----a-w-   c:\windows\system32\drivers\zebrwh.sys
2009-07-17 16:10 . 2009-07-17 16:10   410984   ----a-w-   c:\windows\system32\deploytk.dll
2009-07-15 16:32 . 2009-07-15 15:18   17480   ----a-w-   c:\windows\system32\drivers\hamachi.sys
2009-07-09 09:51 . 2009-07-09 09:51   33824   ----a-w-   c:\windows\system32\drivers\oreans32.sys
2009-07-08 19:10 . 2009-07-08 19:10   0   ----a-w-   c:\windows\nsreg.dat
2009-07-08 18:53 . 2009-07-08 18:53   721904   ----a-w-   c:\windows\system32\drivers\sptd.sys
.

------- Sigcheck -------

[-] 2008-05-08 . ACCF5A9A1FFAA490F33DBA1C632B95E1 . 361344 . . [5.1.2600.5512] . . c:\windows\system32\drivers\tcpip.sys


[-] 2008-04-14 . 66A53012DABC19D99748D3EDA74BC06E . 246784 . . [5.1.2600.5512] . . c:\windows\system32\mswsock.dll
[7] 2008-04-14 . 612E31FCAC1040EDD78ECAC81C9F859F . 246784 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\mswsock.dll

[-] 2008-05-08 . 9F02C1CF7C3100E4AEA7DD8B6A86A01B . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

c:\windows\system32\linkinfo.dll ...  - brak elementu !!
.
(((((((((((((((((((((((((((((   SnapShot@2009-10-05_12.45.33   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-10-06 14:50 . 2009-10-06 14:50   16384              c:\windows\temp\Perflib_Perfdata_4f4.dat
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" [2009-10-05 133104]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-06-15 6803456]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\UltraVNC\\vncviewer.exe"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"d:\\Program Files\\Skype\\Phone\\Skype.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:vnc5900
"5800:TCP"= 5800:TCP:vnc5800

R1 Ext2fs;Ext2fs;c:\windows\system32\drivers\ext2fs.sys [2009-10-04 181120]
R1 IfsMount;IfsMount;c:\windows\system32\drivers\ifsmount.sys [2009-10-04 51072]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2009-07-24 13224]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2009-07-09 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2009-07-09 8320]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [2009-07-09 42112]

--- Inne Usługi/Sterowniki w Pamięci ---

*NewlyCreated* - NVMINI
*Deregistered* - nvmini
.
Zawartość folderu 'Zaplanowane zadania'

2009-10-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-583907252-776561741-1417001333-1003Core.job
- c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2009-10-05 12:28]

2009-10-05 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-583907252-776561741-1417001333-1003UA.job
- c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2009-10-05 12:28]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.darkw0rld.com
IE: Download all links with IDM - d:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - d:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - d:\program files\Internet Download Manager\IEExt.htm
TCP: {06811B39-465A-4497-AD43-673E30CD067A} = 192.168.1.13,192.168.1.1
FF - ProfilePath - c:\documents and settings\Wojtaz\Dane aplikacji\Mozilla\Firefox\Profiles\asu07ayp.default\
FF - component: c:\documents and settings\Wojtaz\Dane aplikacji\Mozilla\Firefox\Profiles\asu07ayp.default\extensions\{0b457cAA-602d-484a-8fe7-c1d894a011ba}\platform\WINNT_x86-msvc\components\SSSLauncher.dll
FF - component: d:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: d:\program files\Mozilla Firefox\extensions\talkback@mozilla.org\components\qfaservices.dll
FF - plugin: c:\documents and settings\Wojtaz\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npgg.1.dll
FF - plugin: d:\program files\Adobe\Reader 9.0\Reader\browser\nppdf32.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-06 16:50
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 


c:\windows\linkinfo.dll 46592 bytes executable
c:\windows\system32\drivers\nvmini.sys 17152 bytes executable
c:\windows\system32\linkinfo.dll 19968 bytes executable

skanowanie pomyślnie ukończone
ukryte pliki: 3

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nvmini]
"ImagePath"="system32\DRIVERS\nvmini.sys"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'lsass.exe'(796)
c:\windows\system32\qt-dx3.dll

- - - - - - - > 'explorer.exe'(4072)
c:\windows\system32\linkinfo.dll
c:\windows\system32\ieframe.dll
c:\program files\Messenger\h323cc.dll
c:\windows\system32\wpdshserviceobj.dll
c:\program files\Common Files\Java\bin\eula.dll
c:\program files\Internet Explorer\iedw.dll
c:\program files\Common Files\Thunder Network\KanKan\DapCtrl.dll
c:\program files\WinRar\ZipExt.dll
d:\program files\Nokia\Nokia PC Suite 7\PhoneBrowser.dll
d:\program files\Nokia\Nokia PC Suite 7\NGSCM.DLL
d:\program files\Nokia\Nokia PC Suite 7\Lang\PhoneBrowser_pol.nlr
d:\program files\Nokia\Nokia PC Suite 7\Resource\PhoneBrowser_Nokia.ngr
c:\windows\system32\portabledevicetypes.dll
c:\windows\system32\portabledeviceapi.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wscntfy.exe
.
**************************************************************************
.
Czas ukończenia: 2009-10-06 16:53 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2009-10-06 14:53
ComboFix2.txt  2009-10-05 12:48

Przed: 8 099 790 848 bajtów wolnych
Po: 8 065 404 928 bajtów wolnych

224


co do konsoli odzyskiwania - nie chciała się w ogóle ściągnąć, błąd wyskakuje

[wojtas]

sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

c:\windows\system32\SysComs.dll

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)

zrób skan Malwarebytes Anti-Malware (usuń co znajdzie ) i pokaż raport

[Wojtaz]

po włączeniu kompa wyskakiwał mi komunikat, że system windows zamknie explorer.exe i znikał pasek itd, ale w procesach explorer.exe był :|
przed usunięciem plików:

Kod: Zaznacz wszystko

Malwarebytes' Anti-Malware 1.41
Wersja bazy definicji: 2775
Windows 5.1.2600 Dodatek Service Pack 3

2009-10-07 20:51:11
mbam-log-2009-10-07 (20-51-07).txt

Typ skanowania: Pełne skanowanie (C:\|D:\|)
Przeskanowane obiekty: 196302
Upłynęło: 37 minute(s), 59 second(s)

Zainfekowane procesy w pamięci: 0
Zainfekowane moduły pamięci: 19
Zainfekowane klucze rejestru: 27
Zainfekowane wartości rejestru: 17
Zainfekowane pliki rejestru: 1
Zainfekowane foldery: 0
Zainfekowane pliki: 96

Zainfekowane procesy w pamięci:
(Nie wykryto groźnych plików)

Zainfekowane moduły pamięci:
C:\WINDOWS\Tasks\CgbYR44s5jCmgAd6ar.inf (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\Tasks\c2nH4numz9knY5zqnC.inf (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\2exJW3dsaTgWrf5uAPadmHN.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\Fonts\A97CRaCB.fon (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\08223B03.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\PERrGx5DkqSbQdwauCRQH.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\qzp3jTZCSfSh.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\dhDhwS7fFW.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\ndxq9awMc.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\122B901E.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\Fonts\SD78dgC7hD2sktQHyAu.fon (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\CDuAUVkGy9.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\SCEVFJRCmaB7.dll (Spyware.OnlineGames) -> No action taken.
C:\Program Files\WinRar\ZipExt.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll (Trojan.BHO) -> No action taken.
C:\WINDOWS\Tasks\EfEPEaD4ZpVMUXrDbS.inf (Trojan.GamesThief) -> No action taken.
C:\WINDOWS\system32\BtmBAnd89jc9PsPq5EKNj.inf (Spyware.OnlineGames) -> No action taken.
C:\Program Files\Messenger\h323cc.dll (Trojan.KillAV) -> No action taken.
C:\WINDOWS\system32\qt-dx3.dll (Spyware.OnlineGames) -> No action taken.

Zainfekowane klucze rejestru:
HKEY_CLASSES_ROOT\CLSID\{11fdb6d4-166a-47bf-a0f8-a09daba75fc1} (Spyware.OnlineGames) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{b9d0f4d7-c809-4c27-9cb4-63201dfb3d05} (Spyware.OnlineGames) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{87de8a1a-96c5-4420-b222-ef998f697ce7} (Spyware.OnlineGames) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{8708994f-1758-4c2c-9a3f-fa22d6cccb41} (Spyware.OnlineGames) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{08223b03-1b38-4a33-a83a-a4d3cc1d6e4e} (Spyware.OnlineGames) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{51716c09-6b08-4ccf-b526-718e912c0573} (Spyware.OnlineGames) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{4f5eede5-1687-49d2-8a17-ff0b454fb37b} (Spyware.OnlineGames) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{36ac68e6-0c26-4d39-b98e-54b49dab6baa} (Spyware.OnlineGames) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{23da65d2-c696-4ee4-bee8-b4841dec3e30} (Spyware.OnlineGames) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{122b901e-493f-4ad9-bc69-7de8c3e52fcc} (Spyware.OnlineGames) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{24144cb8-10ed-4bfc-843f-68a9f3369947} (Spyware.OnlineGames) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{93da1e7d-7c46-4f90-8674-ec90511fca72} (Spyware.OnlineGames) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{cd478099-014d-4b3a-a4bb-b518f1019bc7} (Spyware.OnlineGames) -> No action taken.
HKEY_CLASSES_ROOT\thunderadvise.thunderhlpobj (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\TypeLib\{6d4c7e08-e021-414c-a42d-ab15a2302196} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{deef6582-9927-4cbd-897c-6a1f9e8c47de} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{97421d0d-e07f-40df-8f07-99597b9585ad} (Trojan.BHO) -> No action taken.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{97421d0d-e07f-40df-8f07-99597b9585ad} (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{97421d0d-e07f-40df-8f07-99597b9585ad} (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\thunderadvise.thunderhlpobj.1 (Trojan.BHO) -> No action taken.
HKEY_CLASSES_ROOT\wmilib.services (Spyware.OnlineGames) -> No action taken.
HKEY_CLASSES_ROOT\Interface\{bf5c81c0-416d-487c-a4ad-07cc1f8e6e71} (Spyware.OnlineGames) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{7488e47d-e8f3-41c0-b2da-9b2bd8803a80} (Trojan.GamesThief) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{1719b301-b494-4185-9379-242461f9cf02} (Spyware.OnlineGames) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{6c3db97b-69d4-46da-87cd-4e323bff2c3c} (Spyware.OnlineGames) -> No action taken.
HKEY_CLASSES_ROOT\Typelib\{43893dfb-e095-42eb-ab67-784853fdfa58} (Spyware.OnlineGames) -> No action taken.
HKEY_CLASSES_ROOT\CLSID\{8a6a5b34-d995-4c5d-9338-b5e264b4a87} (Spyware.OnlineGames) -> No action taken.

Zainfekowane wartości rejestru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{11fdb6d4-166a-47bf-a0f8-a09daba75fc1} (Spyware.OnlineGames) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{b9d0f4d7-c809-4c27-9cb4-63201dfb3d05} (Spyware.OnlineGames) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{87de8a1a-96c5-4420-b222-ef998f697ce7} (Spyware.OnlineGames) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{8708994f-1758-4c2c-9a3f-fa22d6cccb41} (Spyware.OnlineGames) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{08223b03-1b38-4a33-a83a-a4d3cc1d6e4e} (Spyware.OnlineGames) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{51716c09-6b08-4ccf-b526-718e912c0573} (Spyware.OnlineGames) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{4f5eede5-1687-49d2-8a17-ff0b454fb37b} (Spyware.OnlineGames) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{36ac68e6-0c26-4d39-b98e-54b49dab6baa} (Spyware.OnlineGames) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{23da65d2-c696-4ee4-bee8-b4841dec3e30} (Spyware.OnlineGames) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{122b901e-493f-4ad9-bc69-7de8c3e52fcc} (Spyware.OnlineGames) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{24144cb8-10ed-4bfc-843f-68a9f3369947} (Spyware.OnlineGames) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{93da1e7d-7c46-4f90-8674-ec90511fca72} (Spyware.OnlineGames) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{cd478099-014d-4b3a-a4bb-b518f1019bc7} (Spyware.OnlineGames) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\thunderadvise (Trojan.BHO) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{7488e47d-e8f3-41c0-b2da-9b2bd8803a80} (Trojan.GamesThief) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{1719b301-b494-4185-9379-242461f9cf02} (Spyware.OnlineGames) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{8a6a5b34-d995-4c5d-9338-b5e264b4a87} (Spyware.OnlineGames) -> No action taken.

Zainfekowane pliki rejestru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Spyware.OnlineGames) -> Data: c:\windows\tasks\cgbyr44s5jcmgad6ar.inf -> No action taken.

Zainfekowane foldery:
(Nie wykryto groźnych plików)

Zainfekowane pliki:
C:\WINDOWS\Tasks\CgbYR44s5jCmgAd6ar.inf (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\Tasks\c2nH4numz9knY5zqnC.inf (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\2exJW3dsaTgWrf5uAPadmHN.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\Fonts\A97CRaCB.fon (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\08223B03.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\PERrGx5DkqSbQdwauCRQH.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\qzp3jTZCSfSh.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\dhDhwS7fFW.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\ndxq9awMc.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\122B901E.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\Fonts\SD78dgC7hD2sktQHyAu.fon (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\CDuAUVkGy9.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\SCEVFJRCmaB7.dll (Spyware.OnlineGames) -> No action taken.
C:\Program Files\WinRar\ZipExt.dll (Trojan.Agent) -> No action taken.
C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll (Trojan.BHO) -> No action taken.
C:\WINDOWS\Tasks\EfEPEaD4ZpVMUXrDbS.inf (Trojan.GamesThief) -> No action taken.
C:\WINDOWS\system32\BtmBAnd89jc9PsPq5EKNj.inf (Spyware.OnlineGames) -> No action taken.
C:\Program Files\Messenger\h323cc.dll (Trojan.KillAV) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\MPKrnl.dll.vir (Spyware.OnlineGames) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\MSVB50CHS.dll.vir (Spyware.OnlineGames) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\Fonts\A97CRaCB.fon.vir (Spyware.OnlineGames) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\Fonts\SD78dgC7hD2sktQHyAu.fon.vir (Spyware.OnlineGames) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\nXe2grrKNzF9dxYKmqg.inf.vir (Spyware.OnlineGames) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\08223B03.dll.vir (Spyware.OnlineGames) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\122B901E.dll.vir (Spyware.OnlineGames) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\2exJW3dsaTgWrf5uAPadmHN.dll.vir (Spyware.OnlineGames) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\704C3595.dll.vir (Spyware.OnlineGames) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\CDuAUVkGy9.dll.vir (Spyware.OnlineGames) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\dhDhwS7fFW.dll.vir (Spyware.OnlineGames) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\ndxq9awMc.dll.vir (Spyware.OnlineGames) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\PERrGx5DkqSbQdwauCRQH.dll.vir (Spyware.OnlineGames) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\qzp3jTZCSfSh.dll.vir (Spyware.OnlineGames) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\system32\SCEVFJRCmaB7.dll.vir (Spyware.OnlineGames) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\Tasks\c2nH4numz9knY5zqnC.inf.vir (Spyware.OnlineGames) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\Tasks\CgbYR44s5jCmgAd6ar.inf.vir (Spyware.OnlineGames) -> No action taken.
C:\Qoobox\Quarantine\C\WINDOWS\Tasks\EfEPEaD4ZpVMUXrDbS.inf.vir (Trojan.GamesThief) -> No action taken.
C:\System Volume Information\_restore{90A60198-A62A-430B-9B9B-F4590D39B865}\RP2\A0001458.dll (Trojan.KillAV) -> No action taken.
C:\System Volume Information\_restore{90A60198-A62A-430B-9B9B-F4590D39B865}\RP2\A0001822.dll (Trojan.KillAV) -> No action taken.
C:\System Volume Information\_restore{90A60198-A62A-430B-9B9B-F4590D39B865}\RP2\A0002163.inf (Spyware.OnlineGames) -> No action taken.
C:\System Volume Information\_restore{90A60198-A62A-430B-9B9B-F4590D39B865}\RP2\A0002168.dll (Trojan.KillAV) -> No action taken.
C:\System Volume Information\_restore{90A60198-A62A-430B-9B9B-F4590D39B865}\RP2\A0002174.exe (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\linkinfo.dll (Trojan.Alman) -> No action taken.
C:\WINDOWS\system32\MSGSCR.TLB (Trojan.KillAV) -> No action taken.
C:\WINDOWS\system32\nXe2grrKNzF9dxYKmqg.inf (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\temp\wmsetup.dll (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\027SRYXN\d[1].css (Trojan.Agent) -> No action taken.
C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\027SRYXN\d[2].css (Trojan.Agent) -> No action taken.
C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\ONN60MDQ\g[1].css (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\ONN60MDQ\g[2].css (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\temp\wmsetup.dll (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\1D6BJ06S\a05[1].exe (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\1D6BJ06S\a09[1].exe (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\1D6BJ06S\a13[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\1D6BJ06S\a17[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\1D6BJ06S\a21[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\1D6BJ06S\a25[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\1D6BJ06S\a29[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\1D6BJ06S\g[1].css (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\G971AWL8\a03[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\G971AWL8\a07[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\G971AWL8\a11[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\G971AWL8\a15[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\G971AWL8\a19[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\G971AWL8\a23[1].exe (Trojan.GamesThief) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\G971AWL8\a27[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\G971AWL8\mao[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\HNEUGC2K\a12[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\HNEUGC2K\a16[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\HNEUGC2K\a20[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\HNEUGC2K\a24[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\HNEUGC2K\a28[1].exe (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\N1T54FDW\a06[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\N1T54FDW\a10[1].exe (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\N1T54FDW\a14[1].exe (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\N1T54FDW\a18[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\N1T54FDW\a22[1].exe (Trojan.Dropper) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\N1T54FDW\a26[1].exe (Spyware.OnlineGames) -> No action taken.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\N1T54FDW\d[1].css (Trojan.Agent) -> No action taken.
D:\System Volume Information\_restore{90A60198-A62A-430B-9B9B-F4590D39B865}\RP2\A0001215.exe (Malware.NSPack) -> No action taken.
D:\System Volume Information\_restore{90A60198-A62A-430B-9B9B-F4590D39B865}\RP2\A0001542.exe (Malware.NSPack) -> No action taken.
D:\System Volume Information\_restore{90A60198-A62A-430B-9B9B-F4590D39B865}\RP2\A0001908.exe (Malware.NSPack) -> No action taken.
D:\System Volume Information\_restore{90A60198-A62A-430B-9B9B-F4590D39B865}\RP2\A0002257.exe (Malware.NSPack) -> No action taken.
D:\Program Files\FDRLab\save2pc\save2pc.exe (Malware.NSPack) -> No action taken.
C:\WINDOWS\Tasks\EkKXXTKa2TVmc6XM.ico (Malware.Trace) -> No action taken.
C:\WINDOWS\Tasks\gBuDCU6XjBAEHzzrg.ico (Malware.Trace) -> No action taken.
C:\WINDOWS\Tasks\kTS4JJGUYtVagxPs.ico (Malware.Trace) -> No action taken.
C:\WINDOWS\Tasks\ThGkkhVnR6Dhf3eN.ico (Malware.Trace) -> No action taken.
C:\WINDOWS\Tasks\vC6ykXbjUGCVeCJa.ico (Malware.Trace) -> No action taken.
C:\WINDOWS\Tasks\x7j7yet9WK9FdYSD.ico (Malware.Trace) -> No action taken.
C:\RECYCLER\~DF21.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\dfc8ac3ed7da.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\system32\myInsDll.exe (Trojan.Agent) -> No action taken.
C:\WINDOWS\system32\Processa.dll (Trojan.PWS) -> No action taken.
C:\WINDOWS\system32\qt-dx3.dll (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\AppPatch\AcXtrnal.xml (Spyware.OnlineGames) -> No action taken.
C:\WINDOWS\Fonts\eCgMhGRkPUcdutd0.ttf (Spyware.OnlineGames) -> No action taken.


po usunięciu:

Kod: Zaznacz wszystko

Malwarebytes' Anti-Malware 1.41
Wersja bazy definicji: 2775
Windows 5.1.2600 Dodatek Service Pack 3

2009-10-07 20:51:51
mbam-log-2009-10-07 (20-51-51).txt

Typ skanowania: Pełne skanowanie (C:\|D:\|)
Przeskanowane obiekty: 196302
Upłynęło: 37 minute(s), 59 second(s)

Zainfekowane procesy w pamięci: 0
Zainfekowane moduły pamięci: 19
Zainfekowane klucze rejestru: 27
Zainfekowane wartości rejestru: 17
Zainfekowane pliki rejestru: 1
Zainfekowane foldery: 0
Zainfekowane pliki: 96

Zainfekowane procesy w pamięci:
(Nie wykryto groźnych plików)

Zainfekowane moduły pamięci:
C:\WINDOWS\Tasks\CgbYR44s5jCmgAd6ar.inf (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\Tasks\c2nH4numz9knY5zqnC.inf (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\2exJW3dsaTgWrf5uAPadmHN.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\Fonts\A97CRaCB.fon (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\08223B03.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\PERrGx5DkqSbQdwauCRQH.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\qzp3jTZCSfSh.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\dhDhwS7fFW.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\ndxq9awMc.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\122B901E.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\Fonts\SD78dgC7hD2sktQHyAu.fon (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\CDuAUVkGy9.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\SCEVFJRCmaB7.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\Program Files\WinRar\ZipExt.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll (Trojan.BHO) -> Delete on reboot.
C:\WINDOWS\Tasks\EfEPEaD4ZpVMUXrDbS.inf (Trojan.GamesThief) -> Delete on reboot.
C:\WINDOWS\system32\BtmBAnd89jc9PsPq5EKNj.inf (Spyware.OnlineGames) -> Delete on reboot.
C:\Program Files\Messenger\h323cc.dll (Trojan.KillAV) -> Delete on reboot.
C:\WINDOWS\system32\qt-dx3.dll (Spyware.OnlineGames) -> Delete on reboot.

Zainfekowane klucze rejestru:
HKEY_CLASSES_ROOT\CLSID\{11fdb6d4-166a-47bf-a0f8-a09daba75fc1} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{b9d0f4d7-c809-4c27-9cb4-63201dfb3d05} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{87de8a1a-96c5-4420-b222-ef998f697ce7} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{8708994f-1758-4c2c-9a3f-fa22d6cccb41} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{08223b03-1b38-4a33-a83a-a4d3cc1d6e4e} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{51716c09-6b08-4ccf-b526-718e912c0573} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{4f5eede5-1687-49d2-8a17-ff0b454fb37b} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{36ac68e6-0c26-4d39-b98e-54b49dab6baa} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{23da65d2-c696-4ee4-bee8-b4841dec3e30} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{122b901e-493f-4ad9-bc69-7de8c3e52fcc} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{24144cb8-10ed-4bfc-843f-68a9f3369947} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{93da1e7d-7c46-4f90-8674-ec90511fca72} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{cd478099-014d-4b3a-a4bb-b518f1019bc7} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\thunderadvise.thunderhlpobj (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{6d4c7e08-e021-414c-a42d-ab15a2302196} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{deef6582-9927-4cbd-897c-6a1f9e8c47de} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{97421d0d-e07f-40df-8f07-99597b9585ad} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{97421d0d-e07f-40df-8f07-99597b9585ad} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{97421d0d-e07f-40df-8f07-99597b9585ad} (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\thunderadvise.thunderhlpobj.1 (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\wmilib.services (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{bf5c81c0-416d-487c-a4ad-07cc1f8e6e71} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{7488e47d-e8f3-41c0-b2da-9b2bd8803a80} (Trojan.GamesThief) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{1719b301-b494-4185-9379-242461f9cf02} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_CLASSES_ROOT\CLSID\{6c3db97b-69d4-46da-87cd-4e323bff2c3c} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Typelib\{43893dfb-e095-42eb-ab67-784853fdfa58} (Spyware.OnlineGames) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{8a6a5b34-d995-4c5d-9338-b5e264b4a87} (Spyware.OnlineGames) -> Delete on reboot.

Zainfekowane wartości rejestru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{11fdb6d4-166a-47bf-a0f8-a09daba75fc1} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{b9d0f4d7-c809-4c27-9cb4-63201dfb3d05} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{87de8a1a-96c5-4420-b222-ef998f697ce7} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{8708994f-1758-4c2c-9a3f-fa22d6cccb41} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{08223b03-1b38-4a33-a83a-a4d3cc1d6e4e} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{51716c09-6b08-4ccf-b526-718e912c0573} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{4f5eede5-1687-49d2-8a17-ff0b454fb37b} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{36ac68e6-0c26-4d39-b98e-54b49dab6baa} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{23da65d2-c696-4ee4-bee8-b4841dec3e30} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{122b901e-493f-4ad9-bc69-7de8c3e52fcc} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{24144cb8-10ed-4bfc-843f-68a9f3369947} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{93da1e7d-7c46-4f90-8674-ec90511fca72} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{cd478099-014d-4b3a-a4bb-b518f1019bc7} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\thunderadvise (Trojan.BHO) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{7488e47d-e8f3-41c0-b2da-9b2bd8803a80} (Trojan.GamesThief) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{1719b301-b494-4185-9379-242461f9cf02} (Spyware.OnlineGames) -> Delete on reboot.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{8a6a5b34-d995-4c5d-9338-b5e264b4a87} (Spyware.OnlineGames) -> Delete on reboot.

Zainfekowane pliki rejestru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs (Spyware.OnlineGames) -> Data: c:\windows\tasks\cgbyr44s5jcmgad6ar.inf -> Delete on reboot.

Zainfekowane foldery:
(Nie wykryto groźnych plików)

Zainfekowane pliki:
C:\WINDOWS\Tasks\CgbYR44s5jCmgAd6ar.inf (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\Tasks\c2nH4numz9knY5zqnC.inf (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\2exJW3dsaTgWrf5uAPadmHN.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\Fonts\A97CRaCB.fon (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\08223B03.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\PERrGx5DkqSbQdwauCRQH.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\qzp3jTZCSfSh.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\dhDhwS7fFW.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\ndxq9awMc.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\122B901E.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\Fonts\SD78dgC7hD2sktQHyAu.fon (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\CDuAUVkGy9.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\system32\SCEVFJRCmaB7.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\Program Files\WinRar\ZipExt.dll (Trojan.Agent) -> Delete on reboot.
C:\WINDOWS\Downloaded Program Files\ThunderAdvise.dll (Trojan.BHO) -> Delete on reboot.
C:\WINDOWS\Tasks\EfEPEaD4ZpVMUXrDbS.inf (Trojan.GamesThief) -> Delete on reboot.
C:\WINDOWS\system32\BtmBAnd89jc9PsPq5EKNj.inf (Spyware.OnlineGames) -> Delete on reboot.
C:\Program Files\Messenger\h323cc.dll (Trojan.KillAV) -> Delete on reboot.
C:\Qoobox\Quarantine\C\WINDOWS\MPKrnl.dll.vir (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\MSVB50CHS.dll.vir (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\Fonts\A97CRaCB.fon.vir (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\Fonts\SD78dgC7hD2sktQHyAu.fon.vir (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\nXe2grrKNzF9dxYKmqg.inf.vir (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\08223B03.dll.vir (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\122B901E.dll.vir (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\2exJW3dsaTgWrf5uAPadmHN.dll.vir (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\704C3595.dll.vir (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\CDuAUVkGy9.dll.vir (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\dhDhwS7fFW.dll.vir (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\ndxq9awMc.dll.vir (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\PERrGx5DkqSbQdwauCRQH.dll.vir (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\qzp3jTZCSfSh.dll.vir (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\system32\SCEVFJRCmaB7.dll.vir (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\Tasks\c2nH4numz9knY5zqnC.inf.vir (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\Tasks\CgbYR44s5jCmgAd6ar.inf.vir (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Qoobox\Quarantine\C\WINDOWS\Tasks\EfEPEaD4ZpVMUXrDbS.inf.vir (Trojan.GamesThief) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{90A60198-A62A-430B-9B9B-F4590D39B865}\RP2\A0001458.dll (Trojan.KillAV) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{90A60198-A62A-430B-9B9B-F4590D39B865}\RP2\A0001822.dll (Trojan.KillAV) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{90A60198-A62A-430B-9B9B-F4590D39B865}\RP2\A0002163.inf (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{90A60198-A62A-430B-9B9B-F4590D39B865}\RP2\A0002168.dll (Trojan.KillAV) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{90A60198-A62A-430B-9B9B-F4590D39B865}\RP2\A0002174.exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\linkinfo.dll (Trojan.Alman) -> Delete on reboot.
C:\WINDOWS\system32\MSGSCR.TLB (Trojan.KillAV) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nXe2grrKNzF9dxYKmqg.inf (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\temp\wmsetup.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\027SRYXN\d[1].css (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\027SRYXN\d[2].css (Trojan.Agent) -> Quarantined and deleted successfully.
C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\ONN60MDQ\g[1].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\ONN60MDQ\g[2].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\temp\wmsetup.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\1D6BJ06S\a05[1].exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\1D6BJ06S\a09[1].exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\1D6BJ06S\a13[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\1D6BJ06S\a17[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\1D6BJ06S\a21[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\1D6BJ06S\a25[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\1D6BJ06S\a29[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\1D6BJ06S\g[1].css (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\G971AWL8\a03[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\G971AWL8\a07[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\G971AWL8\a11[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\G971AWL8\a15[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\G971AWL8\a19[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\G971AWL8\a23[1].exe (Trojan.GamesThief) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\G971AWL8\a27[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\G971AWL8\mao[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\HNEUGC2K\a12[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\HNEUGC2K\a16[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\HNEUGC2K\a20[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\HNEUGC2K\a24[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\HNEUGC2K\a28[1].exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\N1T54FDW\a06[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\N1T54FDW\a10[1].exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\N1T54FDW\a14[1].exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\N1T54FDW\a18[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\N1T54FDW\a22[1].exe (Trojan.Dropper) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\N1T54FDW\a26[1].exe (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wojtaz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\N1T54FDW\d[1].css (Trojan.Agent) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{90A60198-A62A-430B-9B9B-F4590D39B865}\RP2\A0001215.exe (Malware.NSPack) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{90A60198-A62A-430B-9B9B-F4590D39B865}\RP2\A0001542.exe (Malware.NSPack) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{90A60198-A62A-430B-9B9B-F4590D39B865}\RP2\A0001908.exe (Malware.NSPack) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{90A60198-A62A-430B-9B9B-F4590D39B865}\RP2\A0002257.exe (Malware.NSPack) -> Quarantined and deleted successfully.
D:\Program Files\FDRLab\save2pc\save2pc.exe (Malware.NSPack) -> Quarantined and deleted successfully.
C:\WINDOWS\Tasks\EkKXXTKa2TVmc6XM.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\Tasks\gBuDCU6XjBAEHzzrg.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\Tasks\kTS4JJGUYtVagxPs.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\Tasks\ThGkkhVnR6Dhf3eN.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\Tasks\vC6ykXbjUGCVeCJa.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\WINDOWS\Tasks\x7j7yet9WK9FdYSD.ico (Malware.Trace) -> Quarantined and deleted successfully.
C:\RECYCLER\~DF21.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\dfc8ac3ed7da.dll (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\myInsDll.exe (Trojan.Agent) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\Processa.dll (Trojan.PWS) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\qt-dx3.dll (Spyware.OnlineGames) -> Delete on reboot.
C:\WINDOWS\AppPatch\AcXtrnal.xml (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\Fonts\eCgMhGRkPUcdutd0.ttf (Spyware.OnlineGames) -> Quarantined and deleted successfully.


no i nie zamyka się explorer.exe, ale nadal wyskakuje, że komputer może być zagrożony

[wojtas]

daj nowego loga z Combo

[Wojtaz]

Kod: Zaznacz wszystko

ComboFix 09-10-05.01 - Wojtaz 2009-10-07 21:42.4.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1250.48.1045.18.511.360 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Wojtaz\Pulpit\ComboFix.exe

UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\Downloaded Program Files\ahJENwR5r89PA.Ttf
c:\windows\Downloaded Program Files\AnXnubyMnv58c9vaECWX.cur
c:\windows\Downloaded Program Files\BcHCMJEEXFxaCm3q.Ttf
c:\windows\Downloaded Program Files\cmE94RUgxBnd2ZWR.Ttf
c:\windows\Downloaded Program Files\DdrDVWV49HPgHP9kh.Ttf
c:\windows\Downloaded Program Files\dGRbFvvXexA8MsPnW.Ttf
c:\windows\Downloaded Program Files\fZKkTmDAwTdKqXn8.Ttf
c:\windows\Downloaded Program Files\jEDR2jykhSujaMqF.Ttf
c:\windows\Downloaded Program Files\SjRjQgREDp3P8B4rEEg.cur
c:\windows\Downloaded Program Files\SvS2DJAqqTvtTYEU.Ttf
c:\windows\Downloaded Program Files\sZaeAC74EzXJeVeJu6p.cur
c:\windows\Downloaded Program Files\u8w23uRSuevxt2VP.Ttf
c:\windows\Downloaded Program Files\uMub3WCE6aZ3nFgrYRX.Ttf
c:\windows\Downloaded Program Files\vyUD66dJ999myu4W.Ttf
c:\windows\Downloaded Program Files\WD2B9pAnWGBjB2sz.Ttf
c:\windows\Downloaded Program Files\WQKrDGnXQQb3Mgjk.Ttf
c:\windows\Fonts\2knxWtVjbWXmUdGG.Ttf
c:\windows\Fonts\cD9KArZZUHxCqnyM.Ttf
c:\windows\Fonts\cFDPmh3MDPjcHMPd.Ttf
c:\windows\Fonts\CRp3uYCmcxMp3qQn9.Ttf
c:\windows\Fonts\eSEWZRdrSK3NeEJVy4.Ttf
c:\windows\Fonts\G8qZ5hBX7H.Ttf
c:\windows\Fonts\HXxfduw9KeQTCeP6Z.Ttf
c:\windows\Fonts\qWskzsQA6.Ttf
c:\windows\Fonts\RCZbVbjCY6wYszD3.Ttf
c:\windows\Fonts\tBeuadwPppCBnDUPgJH7P6.Ttf
c:\windows\system32\aR5azFSWstNWktJjswK5.inf
c:\windows\system32\BPRBASgvesMzHRfu3AfB.inf
c:\windows\system32\CWcQnWxHjWqtE6PsYyEe.inf
c:\windows\system32\drivers\IsDrv118.sys
c:\windows\system32\FsmBY3kmWnAG5gRbwGgU.infr
c:\windows\system32\Jmansz.dat
c:\windows\system32\qfK6YS52MyExkxpwMDmHq.inf
c:\windows\system32\QQyQ7452eAVkMqdNR.inf
c:\windows\system32\S5kSrtwDf35EW9f2kBDF.inf
c:\windows\system32\sfc32.dll
c:\windows\system32\z6FVkEF47huPzgaXee.inf
c:\windows\Tasks\SbrmpxjdCrgRAFhz4gHh.inf
c:\windows\Tasks\txPsQUxAThX8QTR6s6Yn.inf
c:\windows\Tasks\yGFDvuegeqm9fhy5rnn.inf

c:\windows\system32\comres.dll . . . jest zainfekowany!!

c:\windows\system32\comres.dll . . . jest zainfekowany!!

.
(((((((((((((((((((((((((((((((((((((((   Sterowniki/Usługi   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NVMINI
-------\Service_IsDrv118


(((((((((((((((((((((((((   Pliki utworzone od 2009-09-07 do 2009-10-07  )))))))))))))))))))))))))))))))
.

2009-10-07 18:11 . 2009-10-07 18:11   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Malwarebytes
2009-10-07 18:11 . 2009-09-10 12:54   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-07 18:11 . 2009-10-07 18:11   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Malwarebytes
2009-10-07 18:11 . 2009-09-10 12:53   19160   ----a-w-   c:\windows\system32\drivers\mbam.sys
2009-10-06 17:33 . 2009-10-06 17:33   --------   d-sh--w-   c:\windows\ftpcache
2009-10-05 12:44 . 2009-10-05 12:44   --------   d-----w-   C:\found.001
2009-10-05 12:28 . 2009-10-07 05:33   --------   d-----w-   c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Temp
2009-10-05 12:28 . 2009-10-05 12:29   --------   d-----w-   c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Google
2009-10-04 09:55 . 2008-09-25 15:35   181120   ----a-w-   c:\windows\system32\drivers\ext2fs.sys
2009-10-04 09:55 . 2008-08-28 20:45   51072   ----a-w-   c:\windows\system32\drivers\ifsmount.sys
2009-10-04 09:55 . 2008-07-26 21:56   210432   ----a-w-   c:\windows\system32\ifsdrives.dll
2009-10-04 07:33 . 2009-10-04 07:33   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Nero
2009-10-04 07:32 . 2009-10-04 07:32   --------   d-----w-   c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Xenocode
2009-10-03 18:21 . 2009-10-03 18:21   --------   d-----w-   C:\found.000
2009-10-01 19:08 . 2009-10-01 19:08   --------   d-----w-   c:\program files\Common Files\Thunder Network
2009-10-01 19:07 . 2009-10-01 19:07   --------   d-----w-   c:\program files\Common Files\Java
2009-09-30 13:14 . 2008-04-13 22:15   32128   -c--a-w-   c:\windows\system32\dllcache\usbccgp.sys
2009-09-30 13:14 . 2008-04-13 22:15   32128   ----a-w-   c:\windows\system32\drivers\usbccgp.sys
2009-09-26 19:21 . 2009-09-26 19:21   3156992   --sh--w-   c:\documents and settings\Wojtaz\PulpitFkx6I5_save2pc.exe
2009-09-24 13:23 . 2009-09-24 13:23   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\HEXelon
2009-09-23 13:06 . 2009-09-23 13:06   --------   d-----w-   c:\program files\Xvid
2009-09-23 13:06 . 2008-12-04 19:46   180224   ----a-w-   c:\windows\system32\xvidvfw.dll
2009-09-23 13:06 . 2008-12-04 19:42   815104   ----a-w-   c:\windows\system32\xvidcore.dll
2009-09-23 13:06 . 2009-09-23 13:06   --------   d-----w-   c:\program files\FDRLab
2009-09-22 19:41 . 2009-09-22 19:41   --------   d-----w-   C:\Cannibal.Holocaust.Uncut.1980.DVDRip.XviD-QiX
2009-09-22 13:47 . 2009-09-22 14:08   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Thinstall
2009-09-21 18:58 . 2009-09-21 18:58   --------   d-----w-   c:\program files\URUSoft
2009-09-21 14:40 . 2001-10-26 15:29   5632   ----a-w-   c:\windows\system32\ptpusb.dll
2009-09-21 14:40 . 2008-04-14 20:50   159232   ----a-w-   c:\windows\system32\ptpusd.dll
2009-09-21 14:40 . 2008-04-13 22:15   15104   -c--a-w-   c:\windows\system32\dllcache\usbscan.sys
2009-09-21 14:40 . 2008-04-13 22:15   15104   ----a-w-   c:\windows\system32\drivers\usbscan.sys
2009-09-14 12:23 . 2009-09-14 12:23   --------   d-sh--w-   c:\documents and settings\All Users\Dane aplikacji\System Restore
2009-09-12 12:15 . 2009-10-01 15:21   --------   d-----w-   c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\WMTools Downloaded Files
2009-09-11 06:00 . 2001-08-17 19:47   12928   -c--a-w-   c:\windows\system32\dllcache\dot4prt.sys
2009-09-11 06:00 . 2001-08-17 19:47   12928   ----a-w-   c:\windows\system32\drivers\Dot4Prt.sys
2009-09-11 06:00 . 2001-10-26 14:46   23936   -c--a-w-   c:\windows\system32\dllcache\dot4usb.sys
2009-09-11 06:00 . 2001-10-26 14:46   23936   ----a-w-   c:\windows\system32\drivers\Dot4usb.sys
2009-09-11 06:00 . 2008-04-13 22:09   206976   -c--a-w-   c:\windows\system32\dllcache\dot4.sys
2009-09-11 06:00 . 2008-04-13 22:09   206976   ----a-w-   c:\windows\system32\drivers\Dot4.sys

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-07 19:10 . 2009-07-11 05:08   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\foobar2000
2009-10-07 05:11 . 2009-07-28 11:01   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Audacity
2009-10-06 17:33 . 2009-07-08 16:43   --------   d--h--w-   c:\program files\InstallShield Installation Information
2009-10-06 16:59 . 2009-08-13 12:56   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\DMCache
2009-10-06 15:08 . 2008-04-14 20:50   11264   ----a-w-   c:\windows\system32\comres.dll
2009-10-04 09:26 . 2008-04-14 20:50   22016   --sha-w-   c:\windows\system32\SysComs.dll
2009-10-03 15:51 . 2009-07-15 15:25   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Skype
2009-09-30 12:04 . 2009-07-14 11:21   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\uTorrent
2009-09-26 10:30 . 2009-08-04 19:36   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\PC Suite
2009-09-21 12:54 . 2009-08-17 13:17   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\BESTplayer
2009-08-29 22:44 . 2009-08-29 22:44   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\THQ
2009-08-29 22:04 . 2009-08-29 22:04   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Trymedia
2009-08-29 09:23 . 2009-08-27 09:34   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Bioshock
2009-08-25 21:16 . 2009-07-08 19:13   272056   ----a-w-   c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-08-24 15:49 . 2009-08-24 15:36   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\NationRed
2009-08-24 15:35 . 2009-08-24 15:35   413696   ----a-w-   c:\windows\system32\wrap_oal.dll
2009-08-24 15:35 . 2009-08-24 15:35   110592   ----a-w-   c:\windows\system32\OpenAL32.dll
2009-08-24 15:35 . 2009-08-24 15:35   --------   d-----w-   c:\program files\OpenAL
2009-08-20 12:56 . 2009-08-20 12:56   2   ----a-w-   c:\program files\mshexc.bmp
2009-08-20 12:29 . 2009-08-20 12:29   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\FireShot
2009-08-13 19:45 . 2009-08-13 19:45   --------   d-----w-   c:\program files\Microsoft Works
2009-08-13 19:45 . 2009-08-13 19:45   --------   d-----w-   c:\program files\Microsoft.NET
2009-08-13 12:59 . 2009-08-13 12:56   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\IDM
2009-08-09 15:32 . 2009-08-09 15:31   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Bluetooth
2009-08-04 19:38 . 2001-10-26 16:15   74230   ----a-w-   c:\windows\system32\perfc015.dat
2009-08-04 19:38 . 2001-10-26 16:15   448004   ----a-w-   c:\windows\system32\perfh015.dat
2009-07-28 19:20 . 2008-04-14 20:50   219648   ----a-w-   c:\windows\system32\uxtheme.dll
2009-07-24 10:45 . 2009-07-24 10:45   25512   ----a-w-   c:\windows\system32\drivers\ggsemc.sys
2009-07-24 10:45 . 2009-07-24 10:45   13224   ----a-w-   c:\windows\system32\drivers\ggflt.sys
2009-07-24 10:45 . 2009-07-24 10:45   1112288   ----a-w-   c:\windows\system32\WdfCoInstaller01007.dll
2009-07-24 10:43 . 2009-07-24 10:43   12160   ----a-w-   c:\windows\system32\drivers\zebrcmnt.sys
2009-07-24 10:43 . 2009-07-24 10:43   12160   ----a-w-   c:\windows\system32\drivers\zebrcm.sys
2009-07-24 10:43 . 2009-07-24 10:43   109568   ----a-w-   c:\windows\system32\drivers\zebrmdmc.sys
2009-07-24 10:43 . 2009-07-24 10:43   14848   ----a-w-   c:\windows\system32\drivers\zebrmdfl.sys
2009-07-24 10:43 . 2009-07-24 10:43   109568   ----a-w-   c:\windows\system32\drivers\zebrmdm.sys
2009-07-24 10:43 . 2009-07-24 10:43   83200   ----a-w-   c:\windows\system32\drivers\zebrbus.sys
2009-07-24 10:43 . 2009-07-24 10:43   12160   ----a-w-   c:\windows\system32\drivers\zebrwhnt.sys
2009-07-24 10:43 . 2009-07-24 10:43   12160   ----a-w-   c:\windows\system32\drivers\zebrwh.sys
2009-07-17 16:10 . 2009-07-17 16:10   410984   ----a-w-   c:\windows\system32\deploytk.dll
2009-07-15 16:32 . 2009-07-15 15:18   17480   ----a-w-   c:\windows\system32\drivers\hamachi.sys
.

------- Sigcheck -------

[-] 2008-05-08 . ACCF5A9A1FFAA490F33DBA1C632B95E1 . 361344 . . [5.1.2600.5512] . . c:\windows\system32\drivers\tcpip.sys


[-] 2008-04-14 . 66A53012DABC19D99748D3EDA74BC06E . 246784 . . [5.1.2600.5512] . . c:\windows\system32\mswsock.dll
[7] 2008-04-14 . 612E31FCAC1040EDD78ECAC81C9F859F . 246784 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\mswsock.dll

[-] 2008-05-08 . 9F02C1CF7C3100E4AEA7DD8B6A86A01B . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

c:\windows\system32\linkinfo.dll ...  - brak elementu !!
.
(((((((((((((((((((((((((((((   SnapShot@2009-10-05_12.45.33   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-10-07 19:46 . 2009-10-07 19:46   16384              c:\windows\temp\Perflib_Perfdata_548.dat
+ 2009-08-09 15:31 . 2009-10-07 12:26   13312              c:\windows\system32\BASSMOD.dll
- 2009-08-09 15:31 . 2009-08-09 15:31   13312              c:\windows\system32\BASSMOD.dll
+ 2008-05-08 18:01 . 2009-10-07 19:03   231424              c:\windows\system32\webcheck.dll
- 2008-05-08 18:01 . 2009-10-01 15:22   231424              c:\windows\system32\webcheck.dll
+ 2009-10-06 17:33 . 2009-10-06 17:33   216358              c:\windows\Installer\{E48469CC-635E-4FD5-A122-1497C286D217}\ARPPRODUCTICON.exe
+ 2009-10-06 17:33 . 2009-10-06 17:33   8735232              c:\windows\Installer\892ab2.msi
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" [2009-10-05 133104]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-06-15 6803456]
"Malwarebytes Anti-Malware (reboot)"="d:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{9C20D654-5AF8-4DB7-A125-1A17D7065C73}"= "c:\windows\system32\QQyQ7452eAVkMqdNR.inf" [BU]
"{B6C3510F-2666-496B-A46F-6EEFD6328C2B}"= "c:\windows\Tasks\txPsQUxAThX8QTR6s6Yn.inf" [BU]
"{84639C2D-CD75-4081-B515-329AFCECBF19}"= "c:\windows\Downloaded Program Files\SjRjQgREDp3P8B4rEEg.cur" [BU]
"{C20C5A13-4DD7-40D9-90B4-700BAB0BBBE9}"= "c:\windows\system32\S5kSrtwDf35EW9f2kBDF.inf" [BU]
"{B59F0A61-EF3E-4A2B-9E3A-4A84EDDF2308}"= "c:\windows\Downloaded Program Files\AnXnubyMnv58c9vaECWX.cur" [BU]
"{B7F1BFDC-4B6C-4E2F-AF7A-638D2D47802C}"= "c:\windows\system32\FsmBY3kmWnAG5gRbwGgU.inf" [BU]
"{74DA2FEC-F68F-4DC7-9A45-9174AC044427}"= "c:\windows\system32\z6FVkEF47huPzgaXee.inf" [BU]
"{CB661471-055A-4C5B-9ED0-497B9908FEF5}"= "c:\windows\system32\CWcQnWxHjWqtE6PsYyEe.inf" [BU]
"{F181F067-7046-4DCB-993F-200990736305}"= "c:\windows\Downloaded Program Files\sZaeAC74EzXJeVeJu6p.cur" [BU]
"{C07B914B-C164-42D2-9838-1422C3F70D99}"= "c:\windows\system32\BPRBASgvesMzHRfu3AfB.inf" [BU]
"{827E2FB4-1047-43DE-848D-E12BB0C97AAB}"= "c:\windows\Tasks\SbrmpxjdCrgRAFhz4gHh.inf" [BU]
"{3F86C1E9-E95A-41AF-AD72-7D9A1742232D}"= "c:\windows\system32\aR5azFSWstNWktJjswK5.inf" [BU]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\UltraVNC\\vncviewer.exe"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"d:\\Program Files\\Skype\\Phone\\Skype.exe"=
"d:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:vnc5900
"5800:TCP"= 5800:TCP:vnc5800

R1 Ext2fs;Ext2fs;c:\windows\system32\drivers\ext2fs.sys [2009-10-04 181120]
R1 IfsMount;IfsMount;c:\windows\system32\drivers\ifsmount.sys [2009-10-04 51072]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2009-07-24 13224]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2009-07-09 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2009-07-09 8320]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [2009-07-09 42112]

--- Inne Usługi/Sterowniki w Pamięci ---

*NewlyCreated* - NVMINI
*Deregistered* - nvmini
.
Zawartość folderu 'Zaplanowane zadania'

2009-10-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-583907252-776561741-1417001333-1003Core.job
- c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2009-10-05 12:28]

2009-10-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-583907252-776561741-1417001333-1003UA.job
- c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2009-10-05 12:28]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.darkw0rld.com
IE: Download all links with IDM - d:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - d:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - d:\program files\Internet Download Manager\IEExt.htm
TCP: {06811B39-465A-4497-AD43-673E30CD067A} = 192.168.1.13,192.168.1.1
FF - ProfilePath - c:\documents and settings\Wojtaz\Dane aplikacji\Mozilla\Firefox\Profiles\asu07ayp.default\
FF - component: d:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: d:\program files\Mozilla Firefox\extensions\talkback@mozilla.org\components\qfaservices.dll
FF - plugin: c:\documents and settings\Wojtaz\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npgg.1.dll
FF - plugin: d:\program files\Adobe\Reader 9.0\Reader\browser\nppdf32.dll
.
- - - - USUNIĘTO PUSTE WPISY - - - -

ShellExecuteHooks-{335A9BAE-19FA-42F2-AFD2-20C3275EF392} - c:\windows\system32\qfK6YS52MyExkxpwMDmHq.inf



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-07 21:46
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 


c:\windows\linkinfo.dll 46592 bytes executable
c:\windows\system32\drivers\nvmini.sys 17152 bytes executable
c:\windows\system32\linkinfo.dll 19968 bytes executable

skanowanie pomyślnie ukończone
ukryte pliki: 3

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nvmini]
"ImagePath"="system32\DRIVERS\nvmini.sys"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(740)
c:\windows\system32\COMRes.dll

- - - - - - - > 'explorer.exe'(3816)
c:\windows\system32\COMRes.dll
c:\windows\system32\linkinfo.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
.
**************************************************************************
.
Czas ukończenia: 2009-10-07 21:49 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2009-10-07 19:49
ComboFix2.txt  2009-10-06 14:53
ComboFix3.txt  2009-10-05 12:48

Przed: 7 986 630 656 bajtów wolnych
Po: 7 956 029 440 bajtów wolnych

271


[wojtas]

1. Pobierz http://www.sendspace.com/file/6lhk3w Wypakuj je i bezpośrednio na dysku C;

Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\comres.dll
c:\windows\system32\SysComs.dll
c:\windows\system32\drivers\nvmini.sys
c:\windows\linkinfo.dll

FCopy::
c:\comres.dll | c:\windows\system32\comres.dll
c:\linkinfo.dll | c:\windows\system32\linkinfo.dll

Registry::
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{9C20D654-5AF8-4DB7-A125-1A17D7065C73}"=-
"{B6C3510F-2666-496B-A46F-6EEFD6328C2B}"=-
"{84639C2D-CD75-4081-B515-329AFCECBF19}"=-
"{C20C5A13-4DD7-40D9-90B4-700BAB0BBBE9}"=-
"{B59F0A61-EF3E-4A2B-9E3A-4A84EDDF2308}"=-
"{B7F1BFDC-4B6C-4E2F-AF7A-638D2D47802C}"=-
"{74DA2FEC-F68F-4DC7-9A45-9174AC044427}"=-
"{CB661471-055A-4C5B-9ED0-497B9908FEF5}"=-
"{F181F067-7046-4DCB-993F-200990736305}"=-
"{C07B914B-C164-42D2-9838-1422C3F70D99}"=-
"{827E2FB4-1047-43DE-848D-E12BB0C97AAB}"=-
"{3F86C1E9-E95A-41AF-AD72-7D9A1742232D}"=-
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nvmini]

Driver::
NVMINI

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->
Rozpocznie się usuwanie i powstanie log daj go.

[Wojtaz]

Kod: Zaznacz wszystko

ComboFix 09-10-05.01 - Wojtaz 2009-10-07 22:09.5.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1250.48.1045.18.511.205 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Wojtaz\Pulpit\ComboFix.exe
Użyto następujących komend :: c:\documents and settings\Wojtaz\Pulpit\CFscript.txt

UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!

FILE ::
"c:\windows\system32\comres.dll"
"c:\windows\system32\SysComs.dll"
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\TEMP\wmsetup.dll

c:\windows\system32\comres.dll . . . jest zainfekowany!!

.
--------------- FCopy ---------------

c:\comres.dll --> c:\windows\system32\comres.dll
.
(((((((((((((((((((((((((((((((((((((((   Sterowniki/Usługi   )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_NVMINI


(((((((((((((((((((((((((   Pliki utworzone od 2009-09-07 do 2009-10-07  )))))))))))))))))))))))))))))))
.

2009-10-07 20:14 . 2009-10-07 20:14   17152   ----a-w-   c:\windows\system32\drivers\IsDrv118.sys
2009-10-07 20:07 . 2008-04-14 20:50   822272   ------w-   C:\comres.dll
2009-10-07 19:53 . 2009-10-07 19:53   --------   d-----w-   C:\!KillBox
2009-10-07 18:11 . 2009-10-07 18:11   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Malwarebytes
2009-10-07 18:11 . 2009-09-10 12:54   38224   ----a-w-   c:\windows\system32\drivers\mbamswissarmy.sys
2009-10-07 18:11 . 2009-10-07 18:11   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Malwarebytes
2009-10-07 18:11 . 2009-09-10 12:53   19160   ----a-w-   c:\windows\system32\drivers\mbam.sys
2009-10-06 17:33 . 2009-10-06 17:33   --------   d-sh--w-   c:\windows\ftpcache
2009-10-05 12:44 . 2009-10-05 12:44   --------   d-----w-   C:\found.001
2009-10-05 12:28 . 2009-10-07 05:33   --------   d-----w-   c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Temp
2009-10-05 12:28 . 2009-10-05 12:29   --------   d-----w-   c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Google
2009-10-04 09:55 . 2008-09-25 15:35   181120   ----a-w-   c:\windows\system32\drivers\ext2fs.sys
2009-10-04 09:55 . 2008-08-28 20:45   51072   ----a-w-   c:\windows\system32\drivers\ifsmount.sys
2009-10-04 09:55 . 2008-07-26 21:56   210432   ----a-w-   c:\windows\system32\ifsdrives.dll
2009-10-04 07:33 . 2009-10-04 07:33   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Nero
2009-10-04 07:32 . 2009-10-04 07:32   --------   d-----w-   c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Xenocode
2009-10-03 18:21 . 2009-10-03 18:21   --------   d-----w-   C:\found.000
2009-10-01 19:08 . 2009-10-01 19:08   --------   d-----w-   c:\program files\Common Files\Thunder Network
2009-10-01 19:07 . 2009-10-01 19:07   --------   d-----w-   c:\program files\Common Files\Java
2009-09-30 13:14 . 2008-04-13 22:15   32128   -c--a-w-   c:\windows\system32\dllcache\usbccgp.sys
2009-09-30 13:14 . 2008-04-13 22:15   32128   ----a-w-   c:\windows\system32\drivers\usbccgp.sys
2009-09-26 19:21 . 2009-09-26 19:21   3156992   --sh--w-   c:\documents and settings\Wojtaz\PulpitFkx6I5_save2pc.exe
2009-09-24 13:23 . 2009-09-24 13:23   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\HEXelon
2009-09-23 13:06 . 2009-09-23 13:06   --------   d-----w-   c:\program files\Xvid
2009-09-23 13:06 . 2008-12-04 19:46   180224   ----a-w-   c:\windows\system32\xvidvfw.dll
2009-09-23 13:06 . 2008-12-04 19:42   815104   ----a-w-   c:\windows\system32\xvidcore.dll
2009-09-23 13:06 . 2009-09-23 13:06   --------   d-----w-   c:\program files\FDRLab
2009-09-22 19:41 . 2009-09-22 19:41   --------   d-----w-   C:\Cannibal.Holocaust.Uncut.1980.DVDRip.XviD-QiX
2009-09-22 13:47 . 2009-09-22 14:08   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Thinstall
2009-09-21 18:58 . 2009-09-21 18:58   --------   d-----w-   c:\program files\URUSoft
2009-09-21 14:40 . 2001-10-26 15:29   5632   ----a-w-   c:\windows\system32\ptpusb.dll
2009-09-21 14:40 . 2008-04-14 20:50   159232   ----a-w-   c:\windows\system32\ptpusd.dll
2009-09-21 14:40 . 2008-04-13 22:15   15104   -c--a-w-   c:\windows\system32\dllcache\usbscan.sys
2009-09-21 14:40 . 2008-04-13 22:15   15104   ----a-w-   c:\windows\system32\drivers\usbscan.sys
2009-09-14 12:23 . 2009-09-14 12:23   --------   d-sh--w-   c:\documents and settings\All Users\Dane aplikacji\System Restore
2009-09-12 12:15 . 2009-10-01 15:21   --------   d-----w-   c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\WMTools Downloaded Files
2009-09-11 06:00 . 2001-08-17 19:47   12928   -c--a-w-   c:\windows\system32\dllcache\dot4prt.sys
2009-09-11 06:00 . 2001-08-17 19:47   12928   ----a-w-   c:\windows\system32\drivers\Dot4Prt.sys
2009-09-11 06:00 . 2001-10-26 14:46   23936   -c--a-w-   c:\windows\system32\dllcache\dot4usb.sys
2009-09-11 06:00 . 2001-10-26 14:46   23936   ----a-w-   c:\windows\system32\drivers\Dot4usb.sys
2009-09-11 06:00 . 2008-04-13 22:09   206976   -c--a-w-   c:\windows\system32\dllcache\dot4.sys
2009-09-11 06:00 . 2008-04-13 22:09   206976   ----a-w-   c:\windows\system32\drivers\Dot4.sys

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-10-07 20:01 . 2009-07-11 05:08   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\foobar2000
2009-10-07 05:11 . 2009-07-28 11:01   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Audacity
2009-10-06 17:33 . 2009-07-08 16:43   --------   d--h--w-   c:\program files\InstallShield Installation Information
2009-10-06 16:59 . 2009-08-13 12:56   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\DMCache
2009-10-03 15:51 . 2009-07-15 15:25   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Skype
2009-09-30 12:04 . 2009-07-14 11:21   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\uTorrent
2009-09-26 10:30 . 2009-08-04 19:36   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\PC Suite
2009-09-21 12:54 . 2009-08-17 13:17   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\BESTplayer
2009-08-29 22:44 . 2009-08-29 22:44   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\THQ
2009-08-29 22:04 . 2009-08-29 22:04   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Trymedia
2009-08-29 09:23 . 2009-08-27 09:34   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\Bioshock
2009-08-25 21:16 . 2009-07-08 19:13   272056   ----a-w-   c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-08-24 15:49 . 2009-08-24 15:36   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\NationRed
2009-08-24 15:35 . 2009-08-24 15:35   413696   ----a-w-   c:\windows\system32\wrap_oal.dll
2009-08-24 15:35 . 2009-08-24 15:35   110592   ----a-w-   c:\windows\system32\OpenAL32.dll
2009-08-24 15:35 . 2009-08-24 15:35   --------   d-----w-   c:\program files\OpenAL
2009-08-20 12:56 . 2009-08-20 12:56   2   ----a-w-   c:\program files\mshexc.bmp
2009-08-20 12:29 . 2009-08-20 12:29   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\FireShot
2009-08-13 19:45 . 2009-08-13 19:45   --------   d-----w-   c:\program files\Microsoft Works
2009-08-13 19:45 . 2009-08-13 19:45   --------   d-----w-   c:\program files\Microsoft.NET
2009-08-13 12:59 . 2009-08-13 12:56   --------   d-----w-   c:\documents and settings\Wojtaz\Dane aplikacji\IDM
2009-08-09 15:32 . 2009-08-09 15:31   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Bluetooth
2009-08-04 19:38 . 2001-10-26 16:15   74230   ----a-w-   c:\windows\system32\perfc015.dat
2009-08-04 19:38 . 2001-10-26 16:15   448004   ----a-w-   c:\windows\system32\perfh015.dat
2009-07-28 19:20 . 2008-04-14 20:50   219648   ----a-w-   c:\windows\system32\uxtheme.dll
2009-07-24 10:45 . 2009-07-24 10:45   25512   ----a-w-   c:\windows\system32\drivers\ggsemc.sys
2009-07-24 10:45 . 2009-07-24 10:45   13224   ----a-w-   c:\windows\system32\drivers\ggflt.sys
2009-07-24 10:45 . 2009-07-24 10:45   1112288   ----a-w-   c:\windows\system32\WdfCoInstaller01007.dll
2009-07-24 10:43 . 2009-07-24 10:43   12160   ----a-w-   c:\windows\system32\drivers\zebrcmnt.sys
2009-07-24 10:43 . 2009-07-24 10:43   12160   ----a-w-   c:\windows\system32\drivers\zebrcm.sys
2009-07-24 10:43 . 2009-07-24 10:43   109568   ----a-w-   c:\windows\system32\drivers\zebrmdmc.sys
2009-07-24 10:43 . 2009-07-24 10:43   14848   ----a-w-   c:\windows\system32\drivers\zebrmdfl.sys
2009-07-24 10:43 . 2009-07-24 10:43   109568   ----a-w-   c:\windows\system32\drivers\zebrmdm.sys
2009-07-24 10:43 . 2009-07-24 10:43   83200   ----a-w-   c:\windows\system32\drivers\zebrbus.sys
2009-07-24 10:43 . 2009-07-24 10:43   12160   ----a-w-   c:\windows\system32\drivers\zebrwhnt.sys
2009-07-24 10:43 . 2009-07-24 10:43   12160   ----a-w-   c:\windows\system32\drivers\zebrwh.sys
2009-07-17 16:10 . 2009-07-17 16:10   410984   ----a-w-   c:\windows\system32\deploytk.dll
2009-07-15 16:32 . 2009-07-15 15:18   17480   ----a-w-   c:\windows\system32\drivers\hamachi.sys
.

------- Sigcheck -------

[-] 2008-05-08 . ACCF5A9A1FFAA490F33DBA1C632B95E1 . 361344 . . [5.1.2600.5512] . . c:\windows\system32\drivers\tcpip.sys


[-] 2008-04-14 . 66A53012DABC19D99748D3EDA74BC06E . 246784 . . [5.1.2600.5512] . . c:\windows\system32\mswsock.dll
[7] 2008-04-14 . 612E31FCAC1040EDD78ECAC81C9F859F . 246784 . . [5.1.2600.5512] . . c:\windows\system32\dllcache\mswsock.dll

[-] 2008-05-08 . 9F02C1CF7C3100E4AEA7DD8B6A86A01B . 1571840 . . [5.1.2600.5512] . . c:\windows\system32\sfcfiles.dll

c:\windows\system32\linkinfo.dll ...  - brak elementu !!
.
(((((((((((((((((((((((((((((   SnapShot@2009-10-05_12.45.33   )))))))))))))))))))))))))))))))))))))))))
.
+ 2009-10-07 20:14 . 2009-10-07 20:14   16384              c:\windows\temp\Perflib_Perfdata_4fc.dat
+ 2009-08-09 15:31 . 2009-10-07 12:26   13312              c:\windows\system32\BASSMOD.dll
- 2009-08-09 15:31 . 2009-08-09 15:31   13312              c:\windows\system32\BASSMOD.dll
+ 2008-05-08 18:01 . 2009-10-07 19:03   231424              c:\windows\system32\webcheck.dll
- 2008-05-08 18:01 . 2009-10-01 15:22   231424              c:\windows\system32\webcheck.dll
+ 2009-10-06 17:33 . 2009-10-06 17:33   216358              c:\windows\Installer\{E48469CC-635E-4FD5-A122-1497C286D217}\ARPPRODUCTICON.exe
+ 2009-10-06 17:33 . 2009-10-06 17:33   8735232              c:\windows\Installer\892ab2.msi
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Google Update"="c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe" [2009-10-05 133104]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2005-05-20 925696]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2005-06-15 6803456]
"Malwarebytes Anti-Malware (reboot)"="d:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2009-09-10 1312080]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"nltide_2"="shell32" [X]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"d:\\Program Files\\UltraVNC\\vncviewer.exe"=
"d:\\Program Files\\uTorrent\\uTorrent.exe"=
"d:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"=
"d:\\Program Files\\Skype\\Phone\\Skype.exe"=
"d:\\Program Files\\Activision\\Call of Duty 4 - Modern Warfare\\iw3mp.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5900:TCP"= 5900:TCP:vnc5900
"5800:TCP"= 5800:TCP:vnc5800

R1 Ext2fs;Ext2fs;c:\windows\system32\drivers\ext2fs.sys [2009-10-04 181120]
R1 IfsMount;IfsMount;c:\windows\system32\drivers\ifsmount.sys [2009-10-04 51072]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2009-07-24 13224]
S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2009-07-09 18688]
S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2009-07-09 8320]
S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys [2009-07-09 42112]

--- Inne Usługi/Sterowniki w Pamięci ---

*NewlyCreated* - NVMINI
*Deregistered* - nvmini
.
Zawartość folderu 'Zaplanowane zadania'

2009-10-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-583907252-776561741-1417001333-1003Core.job
- c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2009-10-05 12:28]

2009-10-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-583907252-776561741-1417001333-1003UA.job
- c:\documents and settings\Wojtaz\Ustawienia lokalne\Dane aplikacji\Google\Update\GoogleUpdate.exe [2009-10-05 12:28]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.darkw0rld.com
IE: Download all links with IDM - d:\program files\Internet Download Manager\IEGetAll.htm
IE: Download FLV video content with IDM - d:\program files\Internet Download Manager\IEGetVL.htm
IE: Download with IDM - d:\program files\Internet Download Manager\IEExt.htm
TCP: {06811B39-465A-4497-AD43-673E30CD067A} = 192.168.1.13,192.168.1.1
FF - ProfilePath - c:\documents and settings\Wojtaz\Dane aplikacji\Mozilla\Firefox\Profiles\asu07ayp.default\
FF - component: d:\program files\Mozilla Firefox\components\xpinstal.dll
FF - component: d:\program files\Mozilla Firefox\extensions\talkback@mozilla.org\components\qfaservices.dll
FF - plugin: c:\documents and settings\Wojtaz\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npgg.1.dll
FF - plugin: d:\program files\Adobe\Reader 9.0\Reader\browser\nppdf32.dll
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-10-07 22:14
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 


c:\windows\linkinfo.dll 46592 bytes executable
c:\windows\system32\drivers\nvmini.sys 17152 bytes executable
c:\windows\system32\linkinfo.dll 19968 bytes executable

skanowanie pomyślnie ukończone
ukryte pliki: 3

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nvmini]
"ImagePath"="system32\DRIVERS\nvmini.sys"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'explorer.exe'(3264)
c:\windows\system32\linkinfo.dll
c:\windows\system32\ieframe.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Java\jre6\bin\jqs.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\nvsvc32.exe
c:\windows\system32\wscntfy.exe
d:\program files\Nowe Gadu-Gadu\gg.exe
.
**************************************************************************
.
Czas ukończenia: 2009-10-07 22:17 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2009-10-07 20:17
ComboFix2.txt  2009-10-07 19:49
ComboFix3.txt  2009-10-06 14:53
ComboFix4.txt  2009-10-05 12:48

Przed: 7 993 286 656 bajtów wolnych
Po: 7 958 376 448 bajtów wolnych

222


[wojtas]

wklej:

File::
c:\windows\system32\drivers\nvmini.sys
c:\windows\linkinfo.dll
c:\windows\system32\drivers\IsDrv118.sys

FCopy::
c:\comres.dll | c:\windows\system32\comres.dll
c:\linkinfo.dll | c:\windows\system32\linkinfo.dll

Registry::
[-HKEY_LOCAL_MACHINE\System\ControlSet001\Services\nvmini]

Driver::
NVMINI

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combo
.