Spam.tool.agent.ndr oraz cała seria innych

**Posty:** 5 · przez **sebpla** 28 Lut 2010, 19:59

Proszę o pomoc jak usunąć te śmieci bez formatowania kompa.
Oto log z OTL:
"

Kod: Zaznacz wszystko: OTL logfile created on: 2010-02-28 18:34:48 - Run 1 OTL by OldTimer - Version 3.1.30.3 Folder = C:\Documents and Settings\User\Moje dokumenty\Pobieranie Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 69,00% Memory free 5,00 Gb Paging File | 4,00 Gb Available in Paging File | 84,00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 32,01 Gb Total Space | 4,09 Gb Free Space | 12,78% Space Free | Partition Type: NTFS Drive D: | 9,00 Gb Total Space | 2,48 Gb Free Space | 27,59% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded Drive G: | 108,03 Gb Total Space | 95,42 Gb Free Space | 88,32% Space Free | Partition Type: NTFS H: Drive not present or media not loaded Drive I: | 3,74 Gb Total Space | 1,01 Gb Free Space | 27,11% Space Free | Partition Type: FAT32 Computer Name: USER-219BBC46F1 Current User Name: User Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: On Skip Microsoft Files: On File Age = 7 Days Output = Standard [color=#E56717]========== Processes (All) ==========[/color] PRC - [2010-02-28 18:28:14 | 000,549,888 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\User\Moje dokumenty\Pobieranie\OTL.exe PRC - [2010-02-28 17:31:49 | 000,020,992 | ---- | M] () -- C:\WINDOWS\system\svchost.exe [LOCALSERVICE] PRC - [2010-02-28 17:14:58 | 000,731,136 | ---- | M] () -- I:\Usuwacz gówna\avenger.exe PRC - [2010-02-22 12:01:36 | 000,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009-08-06 19:24:06 | 000,053,472 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wuauclt.exe PRC - [2009-07-25 04:23:12 | 000,149,280 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe PRC - [2009-07-25 04:23:10 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe PRC - [2009-05-14 14:47:54 | 000,731,840 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe PRC - [2009-05-14 14:47:08 | 002,029,640 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe PRC - [2009-04-23 05:48:54 | 007,418,368 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.bin PRC - [2009-04-23 05:47:00 | 007,424,000 | ---- | M] (OpenOffice.org) -- C:\Program Files\OpenOffice.org 3\program\soffice.exe PRC - [2009-02-09 12:25:57 | 000,111,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\services.exe PRC - [2009-02-06 11:10:02 | 000,227,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\wmiprvse.exe PRC - [2008-06-02 09:57:32 | 000,238,984 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe PRC - [2008-06-02 09:32:16 | 000,018,944 | ---- | M] (Hewlett-Packard Development Company, L.P) -- C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe PRC - [2008-05-30 08:36:20 | 000,256,512 | ---- | M] (SafeBoot International) -- C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe PRC - [2008-05-21 01:47:18 | 000,065,296 | ---- | M] (Bioscrypt Inc.) -- C:\Program Files\Hewlett-Packard\IAM\Bin\asghost.exe PRC - [2008-05-15 23:06:38 | 000,540,672 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe PRC - [2008-05-14 10:26:06 | 000,177,456 | ---- | M] ( Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe PRC - [2008-05-14 09:55:14 | 000,077,824 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe PRC - [2008-05-14 09:54:36 | 010,244,096 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe PRC - [2008-05-12 13:55:10 | 001,440,384 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe PRC - [2008-05-12 13:55:10 | 000,576,104 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe PRC - [2008-05-12 13:55:08 | 000,264,800 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe PRC - [2008-05-12 05:28:12 | 000,576,024 | ---- | M] (PDF Complete Inc) -- C:\Program Files\PDF Complete\pdfsvc.exe PRC - [2008-04-16 07:18:32 | 000,165,192 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe PRC - [2008-04-15 13:51:00 | 000,488,752 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe PRC - [2008-04-14 21:51:50 | 000,510,464 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\winlogon.exe PRC - [2008-04-14 21:51:50 | 000,126,464 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\wmiapsrv.exe PRC - [2008-04-14 21:51:44 | 000,057,856 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spoolsv.exe PRC - [2008-04-14 21:51:44 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\smss.exe PRC - [2008-04-14 21:51:44 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [RPCSS] PRC - [2008-04-14 21:51:44 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [NETWORKSERVICE] PRC - [2008-04-14 21:51:44 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [NETSVCS] PRC - [2008-04-14 21:51:44 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [LOCALSERVICE] PRC - [2008-04-14 21:51:44 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [LOCALSERVICE] PRC - [2008-04-14 21:51:44 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [IMGSVC] PRC - [2008-04-14 21:51:44 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [DCOMLAUNCH] PRC - [2008-04-14 21:51:44 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [COGNIZANCE] PRC - [2008-04-14 21:51:40 | 000,098,304 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\scardsvr.exe PRC - [2008-04-14 21:51:32 | 000,070,144 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\notepad.exe PRC - [2008-04-14 21:51:24 | 000,013,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\lsass.exe PRC - [2008-04-14 21:51:18 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2008-04-14 21:51:12 | 000,015,360 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ctfmon.exe PRC - [2008-04-14 21:51:12 | 000,006,144 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\csrss.exe PRC - [2008-04-14 21:51:04 | 000,044,544 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\alg.exe PRC - [2008-04-11 08:04:54 | 000,685,360 | ---- | M] () -- C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe PRC - [2008-04-04 16:09:56 | 001,044,480 | R--- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\Core\smax4pnp.exe PRC - [2008-04-03 10:33:26 | 000,193,840 | ---- | M] (Hewlett-Packard Development Company, L.P.) -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe PRC - [2008-03-27 19:28:50 | 001,040,384 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPEnh.exe PRC - [2007-12-11 11:15:04 | 000,012,800 | ---- | M] (Agere Systems) -- C:\WINDOWS\system32\agrsmsvc.exe PRC - [2007-07-17 10:13:56 | 000,049,152 | ---- | M] (Advanced Micro Devices Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe PRC - [2007-07-17 10:13:34 | 000,049,152 | ---- | M] (ATI Technologies Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe PRC - [2007-07-09 08:39:12 | 002,119,104 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\gg.exe PRC - [2007-05-15 15:08:40 | 000,182,576 | ---- | M] (ActivIdentity) -- C:\Program Files\ActivIdentity\ActivClient\accoca.exe PRC - [2007-05-15 15:08:38 | 000,095,024 | ---- | M] (ActivIdentity) -- C:\Program Files\ActivIdentity\ActivClient\acevents.exe PRC - [2007-05-15 15:08:08 | 000,293,168 | ---- | M] (ActivIdentity) -- C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe PRC - [2007-05-08 15:24:20 | 000,054,840 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe PRC - [2005-02-16 15:15:20 | 000,081,920 | ---- | M] (InstallShield Software Corporation) -- C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe PRC - [2005-01-28 12:44:28 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe [color=#E56717]========== Modules (All) ==========[/color] MOD - [2010-02-28 18:28:14 | 000,549,888 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\User\Moje dokumenty\Pobieranie\OTL.exe MOD - [2009-12-22 06:10:08 | 000,669,696 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wininet.dll MOD - [2009-12-22 06:10:07 | 000,627,712 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\urlmon.dll MOD - [2009-12-22 06:10:06 | 001,509,888 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\shdocvw.dll MOD - [2009-12-08 10:25:45 | 000,474,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\shlwapi.dll MOD - [2009-09-04 22:05:35 | 000,058,880 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msasn1.dll MOD - [2009-07-17 20:04:02 | 000,058,880 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\atl.dll MOD - [2009-06-25 09:27:54 | 000,056,832 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\secur32.dll MOD - [2009-04-15 15:54:38 | 000,585,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\rpcrt4.dll MOD - [2009-03-21 15:08:59 | 001,018,368 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\kernel32.dll MOD - [2009-02-09 11:53:44 | 000,686,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\advapi32.dll MOD - [2009-02-09 11:53:43 | 000,722,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ntdll.dll MOD - [2008-10-23 13:42:41 | 000,286,720 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\gdi32.dll MOD - [2008-10-15 17:36:55 | 000,337,408 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\netapi32.dll MOD - [2008-06-20 18:48:53 | 000,147,968 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\dnsapi.dll MOD - [2008-06-17 20:03:15 | 008,489,984 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\shell32.dll MOD - [2008-05-12 13:51:24 | 000,073,728 | ---- | M] (Broadcom Corporation.) -- C:\WINDOWS\system32\BtMmHook.dll MOD - [2008-05-12 13:49:02 | 000,040,960 | ---- | M] () -- C:\Program Files\WIDCOMM\Bluetooth Software\BTKeyInd.dll MOD - [2008-04-14 21:51:58 | 000,146,432 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\winspool.drv MOD - [2008-04-14 21:51:00 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ws2_32.dll MOD - [2008-04-14 21:51:00 | 000,019,968 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ws2help.dll MOD - [2008-04-14 21:50:58 | 000,732,672 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\userenv.dll MOD - [2008-04-14 21:50:58 | 000,580,096 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\user32.dll MOD - [2008-04-14 21:50:58 | 000,219,648 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\uxtheme.dll MOD - [2008-04-14 21:50:58 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wintrust.dll MOD - [2008-04-14 21:50:58 | 000,172,544 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wldap32.dll MOD - [2008-04-14 21:50:58 | 000,067,584 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\srclient.dll MOD - [2008-04-14 21:50:58 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\version.dll MOD - [2008-04-14 21:50:48 | 000,997,888 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\setupapi.dll MOD - [2008-04-14 21:50:46 | 001,287,168 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ole32.dll MOD - [2008-04-14 21:50:46 | 000,551,936 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\oleaut32.dll MOD - [2008-04-14 21:50:46 | 000,084,992 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\olepro32.dll MOD - [2008-04-14 21:50:46 | 000,064,000 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\samlib.dll MOD - [2008-04-14 21:50:46 | 000,023,040 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\psapi.dll MOD - [2008-04-14 21:50:44 | 000,144,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ntshrui.dll MOD - [2008-04-14 21:50:42 | 000,119,808 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ntmarta.dll MOD - [2008-04-14 21:50:42 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ntdsapi.dll MOD - [2008-04-14 21:50:40 | 000,343,040 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msvcrt.dll MOD - [2008-04-14 21:50:40 | 000,278,528 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\mstask.dll MOD - [2008-04-14 21:50:38 | 000,297,984 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msctf.dll MOD - [2008-04-14 21:50:36 | 000,059,904 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\mpr.dll MOD - [2008-04-14 21:50:36 | 000,019,968 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\linkinfo.dll MOD - [2008-04-14 21:50:34 | 000,144,384 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\imagehlp.dll MOD - [2008-04-14 21:50:32 | 000,185,344 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\framedyn.dll MOD - [2008-04-14 21:50:18 | 000,602,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\crypt32.dll MOD - [2008-04-14 21:50:18 | 000,520,192 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\cryptui.dll MOD - [2008-04-14 21:50:16 | 000,822,272 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\comres.dll MOD - [2008-04-14 21:50:14 | 000,280,064 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\comdlg32.dll MOD - [2008-04-14 21:50:12 | 000,498,688 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\clbcatq.dll MOD - [2008-04-14 21:50:00 | 000,125,952 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\apphelp.dll MOD - [2008-04-14 21:29:10 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll MOD - [2008-03-25 13:17:04 | 000,076,048 | ---- | M] (Bioscrypt Inc.) -- C:\WINDOWS\system32\APSHook.dll MOD - [2006-12-21 13:30:44 | 000,102,400 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\ggwhook.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2010-02-28 17:31:49 | 000,020,992 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system\svchost.exe -- (darkness) SRV - [2009-07-25 04:23:10 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) [Auto | Running] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2009-05-14 14:54:22 | 000,020,680 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv) SRV - [2009-05-14 14:47:54 | 000,731,840 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn) SRV - [2008-11-04 01:06:28 | 000,441,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2008-06-02 09:32:16 | 000,018,944 | ---- | M] (Hewlett-Packard Development Company, L.P) [Auto | Running] -- C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe -- (HP ProtectTools Service) SRV - [2008-05-30 08:36:20 | 000,256,512 | ---- | M] (SafeBoot International) [Auto | Running] -- C:\Program Files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe -- (HpFkCryptService) SRV - [2008-05-21 01:42:40 | 000,111,888 | ---- | M] (Bioscrypt Inc.) [Auto | Running] -- C:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll -- (ASBroker) SRV - [2008-05-21 01:42:34 | 000,137,488 | ---- | M] (Bioscrypt Inc.) [Auto | Running] -- C:\Program Files\Hewlett-Packard\IAM\Bin\ASChnl.dll -- (ASChannel) SRV - [2008-05-15 23:06:38 | 000,540,672 | ---- | M] (ATI Technologies Inc.) [Auto | Running] -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller) SRV - [2008-05-14 09:55:14 | 000,077,824 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\Program Files\Hewlett-Packard\File Sanitizer\HPFSService.exe -- (HPFSService) SRV - [2008-05-12 13:55:08 | 000,264,800 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe -- (btwdins) SRV - [2008-05-12 05:28:12 | 000,576,024 | ---- | M] (PDF Complete Inc) [Auto | Running] -- C:\Program Files\PDF Complete\pdfsvc.exe -- (pdfcDispatcher) SRV - [2008-04-16 07:18:32 | 000,165,192 | ---- | M] (Hewlett-Packard Development Company, L.P.) [On_Demand | Running] -- C:\Program Files\Hewlett-Packard\Shared\hpqWmiEx.exe -- (hpqwmiex) SRV - [2008-04-08 13:12:50 | 001,112,560 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe -- (RoxMediaDB10) SRV - [2008-04-03 10:33:26 | 000,193,840 | ---- | M] (Hewlett-Packard Development Company, L.P.) [On_Demand | Running] -- C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe -- (Com4QLBEx) SRV - [2008-03-24 06:35:22 | 000,074,384 | R--- | M] (MicroVision Development, Inc.) [On_Demand | Stopped] -- C:\Program Files\Common Files\SureThing Shared\stllssvr.exe -- (stllssvr) SRV - [2007-12-11 11:15:04 | 000,012,800 | ---- | M] (Agere Systems) [Auto | Running] -- C:\WINDOWS\system32\agrsmsvc.exe -- (AgereModemAudio) SRV - [2007-05-15 15:08:40 | 000,182,576 | ---- | M] (ActivIdentity) [Auto | Running] -- C:\Program Files\ActivIdentity\ActivClient\accoca.exe -- (accoca) SRV - [2006-10-26 12:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose) SRV - [2005-11-14 00:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-10-06 11:17:33 | 001,287,552 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\bcmwl5.sys -- (BCM43XX) DRV - [2009-05-14 14:49:32 | 000,094,360 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\epfwtdir.sys -- (epfwtdir) DRV - [2009-05-14 14:47:14 | 000,107,256 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv) DRV - [2009-05-14 14:41:10 | 000,114,472 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon) DRV - [2008-05-30 08:37:06 | 000,051,376 | ---- | M] (SafeBoot N.V.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\SbAlg.sys -- (SbAlg) DRV - [2008-05-30 08:37:02 | 000,012,928 | ---- | M] (SafeBoot International) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\SbFsLock.sys -- (SbFsLock) DRV - [2008-05-30 08:37:00 | 000,012,496 | ---- | M] (SafeBoot International) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\rsvlock.sys -- (RsvLock) DRV - [2008-05-30 08:36:58 | 000,108,752 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\SafeBoot.sys -- (SafeBoot) DRV - [2008-05-27 19:55:48 | 000,174,600 | R--- | M] (AMD Technologies Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\ahcix86.sys -- (ahcix86) DRV - [2008-05-23 12:51:02 | 000,024,624 | ---- | M] (Hewlett-Packard Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\hpdskflt.sys -- (hpdskflt) DRV - [2008-05-23 12:50:16 | 000,028,592 | ---- | M] (Hewlett-Packard Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Accelerometer.sys -- (Accelerometer) DRV - [2008-05-16 01:33:44 | 002,881,536 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2008-05-14 09:08:16 | 000,074,688 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB) DRV - [2008-05-14 09:08:14 | 000,879,624 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btkrnl.sys -- (BTKRNL) DRV - [2008-04-28 14:22:10 | 000,009,344 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CPQBttn.sys -- (HBtnKey) DRV - [2008-04-14 00:11:00 | 000,008,192 | ---- | M] (Microsoft Corporation) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\Changer.sys -- (Changer) DRV - [2008-04-14 00:10:28 | 000,034,688 | ---- | M] (Toshiba Corp.) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\lbrtfdc.sys -- (lbrtfdc) DRV - [2008-04-13 21:09:18 | 000,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv) DRV - [2008-04-13 21:06:06 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus) DRV - [2008-04-11 17:19:42 | 000,338,944 | R--- | M] (Analog Devices, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ADIHdAud.sys -- (ADIHdAudAddService) DRV - [2008-04-10 16:27:34 | 001,804,160 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\snp2uvc.sys -- (SNP2UVC) USB2.0 PC Camera (SNP2UVC) DRV - [2008-04-08 04:00:00 | 000,044,944 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20) DRV - [2008-04-04 09:57:00 | 000,296,320 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp) DRV - [2008-03-28 11:14:02 | 000,024,064 | R--- | M] (Sonic Focus, Inc) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sfaudio.sys -- (SFAUDIO) DRV - [2008-03-27 19:14:06 | 000,224,672 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SynTP.sys -- (SynTP) DRV - [2008-03-12 21:43:26 | 000,015,416 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\Amddfltr.sys -- (Amddfltr) DRV - [2008-02-29 15:13:38 | 001,202,560 | ---- | M] (Agere Systems) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2007-07-13 11:26:12 | 000,094,976 | R--- | M] (Andrea Electronics Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aeaudio.sys -- (AEAudio) DRV - [2007-06-21 03:40:02 | 000,056,448 | ---- | M] (SCM Microsystems Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\scr3xx2k.sys.bak -- (SCR3XX2K) DRV - [2007-06-18 16:12:04 | 000,016,768 | ---- | M] (Hewlett-Packard Development Company, L.P.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\HpqKbFiltr.sys -- (HpqKbFiltr) DRV - [2007-04-16 15:46:34 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM) DRV - [2006-03-02 13:00:00 | 000,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-746137067-1957994488-725345543-1003\S-1-5-21-746137067-1957994488-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.startup.homepage: "http://www.onet.pl/" FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010-02-22 12:01:45 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010-02-22 12:01:45 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2009-10-06 13:37:39 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2009-10-06 13:45:53 | 000,000,000 | ---D | M] [2009-10-06 13:39:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Mozilla\Extensions [2010-02-28 02:00:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Mozilla\Firefox\Profiles\6hz1v332.default\extensions [2010-02-28 02:00:19 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2009-07-30 23:44:16 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2009-07-30 23:44:16 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2009-07-30 23:44:16 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2009-07-30 23:44:16 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2009-07-30 23:44:16 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2009-07-30 23:44:16 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2006-03-02 13:00:00 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (BHO_Startup Class) - {3134413B-49B4-425C-98A5-893C1F195601} - C:\Program Files\Hewlett-Packard\File Sanitizer\IEBHO.dll (Hewlett-Packard) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Credential Manager for HP ProtectTools) - {DF21F1DB-80C6-11D3-9483-B03D0EC10000} - C:\Program Files\Hewlett-Packard\IAM\Bin\ItIEAddIn.dll (Bioscrypt Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [accrdsub] C:\Program Files\ActivIdentity\ActivClient\accrdsub.exe (ActivIdentity) O4 - HKLM..\Run: [CognizanceTS] C:\Program Files\Hewlett-Packard\IAM\Bin\ASTSVCC.dll (Bioscrypt Inc.) O4 - HKLM..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\Cpqset.exe () O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET) O4 - HKLM..\Run: [File Sanitizer] C:\Program Files\Hewlett-Packard\File Sanitizer\CoreShredder.exe (Hewlett-Packard) O4 - HKLM..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe (Hewlett-Packard) O4 - HKLM..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe (Hewlett-Packard Development Company, L.P.) O4 - HKLM..\Run: [ISUSPM Startup] C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe (InstallShield Software Corporation) O4 - HKLM..\Run: [ISUSScheduler] C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation) O4 - HKLM..\Run: [PDF Complete] C:\Program Files\PDF Complete\pdfsty.exe (PDF Complete Inc) O4 - HKLM..\Run: [PTHOSTTR] C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE (Hewlett-Packard Development Company, L.P.) O4 - HKLM..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe ( Hewlett-Packard Development Company, L.P.) O4 - HKLM..\Run: [SoundMAX] C:\Program Files\Analog Devices\SoundMAX\Smax4.exe (Analog Devices, Inc.) O4 - HKLM..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe (Analog Devices, Inc.) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics, Inc.) O4 - HKLM..\Run: [WatchDog] C:\Program Files\InterVideo\DVD Check\DVDCheck.exe File not found O4 - HKU\S-1-5-21-746137067-1957994488-725345543-1003..\Run: [AdobeUpdater] C:\Program Files\Common Files\Adobe\Updater5\AdobeUpdater.exe (Adobe Systems Incorporated) O4 - HKU\S-1-5-21-746137067-1957994488-725345543-1003..\Run: [Gadu-Gadu] C:\Program Files\Gadu-Gadu\gg.exe (Gadu-Gadu S.A.) O4 - HKU\S-1-5-21-746137067-1957994488-725345543-1003..\Run: [TOY5KNQ8OC] C:\DOCUME~1\User\USTAWI~1\Temp\Egi.exe File not found O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe (Adobe Systems Incorporated) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe () O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\BTTray.lnk = C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.) O4 - Startup: C:\Documents and Settings\User\Menu Start\Programy\Autostart\ihaupd32.exe (TWX Corp.) O4 - Startup: C:\Documents and Settings\User\Menu Start\Programy\Autostart\OpenOffice.org 3.1.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe () O4 - Startup: C:\Documents and Settings\User\Menu Start\Programy\Autostart\Skrót do Ability Server.lnk = C:\Documents and Settings\User\Pulpit\Ability Server.exe (Code-Crafters) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-746137067-1957994488-725345543-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-746137067-1957994488-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 36 O7 - HKU\S-1-5-21-746137067-1957994488-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF FF [binary data] O7 - HKU\S-1-5-21-746137067-1957994488-725345543-1003_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Wyślij do interfejsu Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O8 - Extra context menu item: Wyślij do urządzenia &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O16 - DPF: {2ADE19BB-1E79-4EC4-976E-AC74339ADD76} http://78.157.175.19/ActiveViewGUI.cab (ActiveViewGUI Control) O16 - DPF: {66F7F252-3FE1-4650-B1E5-94B2A38271C5} http://78.157.175.19/ActiveView.cab (ActiveView Control) O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} http://www.mks.com.pl/skaner/SkanerOnline.cab (MksSkanerOnline Class) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1254902447906 (MUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (APSHook.dll) - C:\WINDOWS\System32\APSHook.dll (Bioscrypt Inc.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: TaskMan - (C:\RECYCLER\S-1-5-21-3427743134-3735161534-494211187-2635\wnzip32.exe) - C:\RECYCLER\S-1-5-21-3427743134-3735161534-494211187-2635\wnzip32.exe () O20 - Winlogon\Notify\ackpbsc: DllName - C:\WINDOWS\system32\ackpbsc.dll - C:\WINDOWS\system32\ackpbsc.dll (ActivIdentity) O20 - Winlogon\Notify\acunlock: DllName - C:\Program Files\ActivIdentity\ActivClient\acunlock.dll - C:\Program Files\ActivIdentity\ActivClient\acunlock.dll (ActivIdentity) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O20 - Winlogon\Notify\OneCard: DllName - C:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll - C:\Program Files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll (Bioscrypt Inc.) O21 - SSODL: GootkitSSO - {B674F191-ECF7-4A5D-B396-F59615C03CAB} - C:\WINDOWS\System32\msxsltsso.dll File not found O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-10-06 10:48:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2010-02-28 17:55:33 | 000,000,000 | RHSD | M] - C:\autorun.inf -- [ NTFS ] O32 - AutoRun File - [2010-02-28 17:55:33 | 000,000,000 | RHSD | M] - D:\autorun.inf -- [ NTFS ] O32 - AutoRun File - [2010-02-28 17:55:33 | 000,000,000 | RHSD | M] - G:\autorun.inf -- [ NTFS ] O32 - AutoRun File - [2010-02-28 18:01:00 | 000,000,000 | RHSD | M] - I:\autorun.inf -- [ FAT32 ] O33 - MountPoints2\{a32a71ea-b26b-11de-906c-806d6172696f}\Shell - "" = AutoRun O33 - MountPoints2\{a32a71ea-b26b-11de-906c-806d6172696f}\Shell\AutoRun\command - "" = E:\SWSETUP\APPINSTL\setup.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* NetSvcs: 6to4 - File not found NetSvcs: Ias - C:\WINDOWS\system32\ias [2009-10-06 12:32:06 | 000,000,000 | ---D | M] NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found [color=#E56717]========== Files/Folders - Created Within 7 Days ==========[/color] [2010-02-28 17:55:33 | 000,000,000 | RHSD | C] -- C:\autorun.inf [2010-02-28 01:49:36 | 000,000,000 | ---D | C] -- C:\Program Files\SkanerOnline [2010-02-25 14:56:33 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun [2010-02-25 10:22:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Pulpit\logs [2010-02-25 10:22:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Pulpit\http [2010-02-25 10:22:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Pulpit\ftp [2010-02-25 10:22:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Pulpit\email [2010-02-25 10:22:05 | 000,172,032 | ---- | C] (Code-Crafters) -- C:\Documents and Settings\User\Pulpit\Ability Server.exe [2010-02-25 10:22:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Pulpit\abilitywebserver [2010-02-25 10:21:16 | 000,000,000 | ---D | C] -- C:\skaner [2010-02-25 10:01:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\User\Dane aplikacji\KONICA MINOLTA [2010-01-23 22:42:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\ESET [2009-12-10 13:52:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Roxio [2009-10-07 09:59:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft [2009-10-06 11:16:00 | 000,176,128 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp2uvc.dll [2009-10-06 11:15:58 | 000,180,224 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp2uvc.dll [2009-10-06 10:51:40 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft [2009-10-06 10:51:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft [2009-10-06 10:48:05 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 7 Days ==========[/color] [2010-02-28 18:03:03 | 000,000,163 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\fix.reg [2010-02-28 18:01:00 | 000,000,278 | -H-- | M] () -- C:\WINDOWS\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job [2010-02-28 17:59:00 | 000,000,238 | -H-- | M] () -- C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job [2010-02-28 17:58:57 | 000,001,240 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\email.dat [2010-02-28 17:58:57 | 000,001,228 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\emailmapper.dat [2010-02-28 17:58:57 | 000,000,008 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\emailaccounts.dat [2010-02-28 17:58:56 | 000,002,165 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\http.dat [2010-02-28 17:58:56 | 000,000,976 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\ftp.dat [2010-02-28 17:58:56 | 000,000,932 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\general.dat [2010-02-28 17:58:56 | 000,000,316 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\ftpaccounts.dat [2010-02-28 17:58:56 | 000,000,008 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\httpdomains.dat [2010-02-28 17:58:24 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010-02-28 17:57:45 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010-02-28 17:57:37 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010-02-28 17:57:27 | 2949,500,928 | -HS- | M] () -- C:\hiberfil.sys [2010-02-28 17:56:37 | 003,407,872 | -H-- | M] () -- C:\Documents and Settings\User\NTUSER.DAT [2010-02-28 17:56:37 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\User\ntuser.ini [2010-02-28 17:31:49 | 000,020,992 | ---- | M] () -- C:\WINDOWS\System\svchost.exe [2010-02-28 10:28:44 | 000,500,078 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2010-02-28 10:28:44 | 000,441,018 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010-02-28 10:28:44 | 000,089,218 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2010-02-28 10:28:44 | 000,071,336 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010-02-28 10:28:43 | 001,114,778 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010-02-28 02:06:24 | 009,192,448 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\OFERTA LIBURNIA HOTEL.doc [2010-02-27 21:56:07 | 000,000,552 | ---- | M] () -- C:\WINDOWS\System32\d3d8caps.dat [2010-02-26 16:19:44 | 000,010,280 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\usługi dodatkowe.ods [2010-02-26 14:50:58 | 000,009,832 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\KONSUMPCJA.ods [2010-02-26 14:42:59 | 000,011,807 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\zakwaterowanie.ods [2010-02-25 10:23:58 | 000,000,517 | ---- | M] () -- C:\Documents and Settings\User\Menu Start\Programy\Autostart\Skrót do Ability Server.lnk [2010-02-24 09:25:17 | 011,924,936 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\wesele a-z.cdr [2010-02-23 09:29:25 | 000,165,811 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\6mrcv6hwiq5e07w.jpg [2010-02-22 21:57:01 | 000,018,432 | ---- | M] () -- C:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-02-28 18:03:03 | 000,000,163 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\fix.reg [2010-02-28 17:31:59 | 000,020,992 | ---- | C] () -- C:\WINDOWS\System\svchost.exe [2010-02-28 17:27:26 | 2949,500,928 | -HS- | C] () -- C:\hiberfil.sys [2010-02-27 21:56:07 | 000,000,552 | ---- | C] () -- C:\WINDOWS\System32\d3d8caps.dat [2010-02-26 16:19:44 | 000,010,280 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\usługi dodatkowe.ods [2010-02-26 14:50:58 | 000,009,832 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\KONSUMPCJA.ods [2010-02-26 14:42:59 | 000,011,807 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\zakwaterowanie.ods [2010-02-26 13:21:21 | 000,000,278 | -H-- | C] () -- C:\WINDOWS\tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job [2010-02-26 08:21:22 | 000,002,165 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\http.dat [2010-02-26 08:21:22 | 000,000,008 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\httpdomains.dat [2010-02-26 08:17:29 | 000,000,238 | -H-- | C] () -- C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job [2010-02-26 08:17:18 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\User\Dane aplikacji\wiaservg.log [2010-02-25 10:23:58 | 000,000,517 | ---- | C] () -- C:\Documents and Settings\User\Menu Start\Programy\Autostart\Skrót do Ability Server.lnk [2010-02-25 10:23:32 | 000,001,240 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\email.dat [2010-02-25 10:23:32 | 000,001,228 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\emailmapper.dat [2010-02-25 10:23:32 | 000,000,932 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\general.dat [2010-02-25 10:23:32 | 000,000,008 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\emailaccounts.dat [2010-02-25 10:23:06 | 000,000,976 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\ftp.dat [2010-02-25 10:23:06 | 000,000,316 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\ftpaccounts.dat [2010-02-24 09:25:12 | 011,924,936 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\wesele a-z.cdr [2010-02-23 09:29:24 | 000,165,811 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\6mrcv6hwiq5e07w.jpg [2010-01-14 17:45:38 | 000,000,048 | ---- | C] () -- C:\WINDOWS\picture2avi.ini [2009-12-31 14:48:22 | 000,000,000 | ---- | C] () -- C:\WINDOWS\cdplayer.ini [2009-10-14 21:34:33 | 000,018,432 | ---- | C] () -- C:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-10-12 15:15:47 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\FnF4.txt [2009-10-06 11:39:25 | 000,028,600 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2009-10-06 11:30:56 | 000,000,129 | ---- | C] () -- C:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\fusioncache.dat [2009-10-06 11:25:34 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\AtStart.txt [2009-10-06 11:16:00 | 001,804,160 | ---- | C] () -- C:\WINDOWS\System32\drivers\snp2uvc.sys [2009-10-06 11:16:00 | 000,028,160 | ---- | C] () -- C:\WINDOWS\System32\drivers\sncduvc.sys [2009-10-06 11:16:00 | 000,015,497 | ---- | C] () -- C:\WINDOWS\snp2uvc.ini [2009-10-06 11:15:29 | 000,000,571 | ---- | C] () -- C:\WINDOWS\HBCIKRNL.INI [2008-05-30 08:36:58 | 000,108,752 | ---- | C] () -- C:\WINDOWS\System32\drivers\SafeBoot.sys [2008-05-12 13:51:50 | 002,842,624 | ---- | C] () -- C:\WINDOWS\System32\btwicons.dll [2008-01-09 06:39:08 | 000,147,456 | ---- | C] () -- C:\WINDOWS\System32\DvsNDKEx.dll [2007-09-11 12:50:14 | 000,015,200 | ---- | C] () -- C:\WINDOWS\DVRWebGUI.ini [2007-08-24 04:39:10 | 000,434,270 | ---- | C] () -- C:\WINDOWS\System32\Mp4ADecoder.dll [2006-01-31 21:30:32 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\TextOverlayEx.dll [2005-11-16 00:57:48 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\Audio.dll [2005-04-03 23:30:00 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\scardsyn.dll [2005-02-17 11:41:32 | 000,000,603 | ---- | C] () -- C:\WINDOWS\System32\BTNeighborhood.dll.manifest [2005-02-17 11:41:30 | 000,000,593 | ---- | C] () -- C:\WINDOWS\System32\btcss.dll.manifest [2004-08-04 09:30:56 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\decompress.dll [2004-07-07 05:18:40 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\CreateAvi.dll [2004-05-05 03:22:40 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\AudioACM.dll [2002-09-14 10:14:16 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\netdecdll.dll [2002-09-12 17:09:08 | 001,089,536 | ---- | C] () -- C:\WINDOWS\System32\decoderdll.dll [2001-11-14 12:56:00 | 001,802,240 | ---- | C] () -- C:\WINDOWS\System32\lcppn21.dll [1999-02-01 07:59:10 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\Cpuinf32.dll [1998-05-07 04:10:00 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\ODMA32.dll [1997-10-18 09:00:00 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\CSCC.DLL [color=#E56717]========== LOP Check ==========[/color] [2009-10-06 13:45:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ESET [2010-01-20 13:15:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP [2009-10-06 11:48:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Uninstall [2009-10-06 16:24:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Gadu-Gadu [2009-11-10 23:27:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\InterVideo [2010-02-25 10:01:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\KONICA MINOLTA [2009-10-06 16:20:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Nowe Gadu-Gadu [2009-10-06 16:28:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\OpenOffice.org [2009-10-15 19:47:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\PhotoFrameShow [2009-10-06 13:37:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Thunderbird [2010-02-28 17:59:00 | 000,000,238 | -H-- | M] () -- C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job [2010-02-28 18:01:00 | 000,000,278 | -H-- | M] () -- C:\WINDOWS\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Custom Scans ==========[/color] [color=#A23BEC]< %systemdrive%\*.* >[/color] [2009-10-06 11:14:32 | 000,194,956 | ---- | M] () -- C:\amd_filter.log [2009-10-06 11:15:15 | 000,000,086 | ---- | M] () -- C:\amd_sata.log [2009-10-06 10:48:08 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT [2010-02-28 18:22:50 | 000,005,112 | ---- | M] () -- C:\avenger.txt [2009-10-06 11:17:51 | 000,000,086 | ---- | M] () -- C:\bcmwl5.log [2009-10-06 11:14:48 | 000,000,223 | -HS- | M] () -- C:\boot.ini [2006-03-02 13:00:00 | 000,004,952 | RHS- | M] () -- C:\Bootfont.bin [2009-12-31 14:46:12 | 000,000,108 | ---- | M] () -- C:\cdrlog.txt [2009-10-06 11:16:13 | 000,000,164 | ---- | M] () -- C:\chicony.log [2009-10-06 10:48:08 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS [2009-10-06 11:06:18 | 000,000,161 | ---- | M] () -- C:\esuinst.log [2009-10-06 10:58:32 | 000,000,198 | ---- | M] () -- C:\esu_xpsp2.log [2010-02-28 17:57:27 | 2949,500,928 | -HS- | M] () -- C:\hiberfil.sys [2009-10-06 11:40:26 | 000,000,197 | ---- | M] () -- C:\HPFSSetup.log [2009-10-06 11:39:27 | 000,000,169 | ---- | M] () -- C:\HSC.log [2009-10-06 10:48:08 | 000,000,000 | RHS- | M] () -- C:\IO.SYS [2003-08-21 14:11:42 | 000,002,736 | ---- | M] () -- C:\LANG.INI [2010-02-28 09:09:02 | 000,007,532 | ---- | M] () -- C:\mksbasel.cpp.log [2009-10-06 10:48:08 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2010-02-21 19:27:54 | 000,193,920 | ---- | M] () -- C:\NET_Agnieszka.log [2006-03-02 13:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM [2009-10-07 09:39:34 | 000,251,152 | RHS- | M] () -- C:\ntldr [2009-10-24 18:59:19 | 002,699,585 | ---- | M] () -- C:\P10_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,005,652 | ---- | M] () -- C:\P10_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,005,397 | ---- | M] () -- C:\P10_20091121_034831.mp4 [2009-10-24 18:59:19 | 002,361,417 | ---- | M] () -- C:\P11_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,007,418 | ---- | M] () -- C:\P11_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,007,072 | ---- | M] () -- C:\P11_20091121_034831.mp4 [2009-10-24 18:59:19 | 024,367,059 | ---- | M] () -- C:\P12_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,021,164 | ---- | M] () -- C:\P12_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,021,115 | ---- | M] () -- C:\P12_20091121_034831.mp4 [2009-10-24 18:59:19 | 030,275,447 | ---- | M] () -- C:\P13_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,024,023 | ---- | M] () -- C:\P13_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,011,056 | ---- | M] () -- C:\P13_20091121_034831.mp4 [2009-10-24 18:59:19 | 037,793,828 | ---- | M] () -- C:\P14_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,017,428 | ---- | M] () -- C:\P14_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,016,036 | ---- | M] () -- C:\P14_20091121_034831.mp4 [2009-10-24 18:59:19 | 027,779,459 | ---- | M] () -- C:\P15_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,018,260 | ---- | M] () -- C:\P15_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,016,515 | ---- | M] () -- C:\P15_20091121_034831.mp4 [2009-10-24 18:59:19 | 012,726,160 | ---- | M] () -- C:\P16_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,023,579 | ---- | M] () -- C:\P16_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,020,900 | ---- | M] () -- C:\P16_20091121_034831.mp4 [2009-10-24 18:59:19 | 001,154,401 | ---- | M] () -- C:\P17_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,009,055 | ---- | M] () -- C:\P17_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,008,851 | ---- | M] () -- C:\P17_20091121_034831.mp4 [2009-10-24 18:59:19 | 000,181,896 | ---- | M] () -- C:\P18_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,005,022 | ---- | M] () -- C:\P18_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,004,672 | ---- | M] () -- C:\P18_20091121_034831.mp4 [2009-10-24 18:59:19 | 000,437,843 | ---- | M] () -- C:\P19_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,047,062 | ---- | M] () -- C:\P19_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,043,066 | ---- | M] () -- C:\P19_20091121_034831.mp4 [2009-10-24 18:59:19 | 027,588,466 | ---- | M] () -- C:\P1_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,021,750 | ---- | M] () -- C:\P1_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,024,027 | ---- | M] () -- C:\P1_20091121_034831.mp4 [2009-10-24 18:59:19 | 001,641,781 | ---- | M] () -- C:\P20_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,034,875 | ---- | M] () -- C:\P20_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,028,714 | ---- | M] () -- C:\P20_20091121_034831.mp4 [2009-10-24 18:59:19 | 000,504,915 | ---- | M] () -- C:\P21_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,032,521 | ---- | M] () -- C:\P21_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,014,882 | ---- | M] () -- C:\P21_20091121_034831.mp4 [2009-10-24 18:59:19 | 000,791,890 | ---- | M] () -- C:\P22_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,033,922 | ---- | M] () -- C:\P22_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,014,715 | ---- | M] () -- C:\P22_20091121_034831.mp4 [2009-10-24 18:59:19 | 000,618,675 | ---- | M] () -- C:\P23_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,023,692 | ---- | M] () -- C:\P23_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,011,322 | ---- | M] () -- C:\P23_20091121_034831.mp4 [2009-10-24 18:59:19 | 001,254,367 | ---- | M] () -- C:\P24_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,021,090 | ---- | M] () -- C:\P24_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,019,329 | ---- | M] () -- C:\P24_20091121_034831.mp4 [2009-10-24 18:59:19 | 000,950,853 | ---- | M] () -- C:\P25_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,045,985 | ---- | M] () -- C:\P25_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,039,362 | ---- | M] () -- C:\P25_20091121_034831.mp4 [2009-10-24 18:59:19 | 000,877,687 | ---- | M] () -- C:\P26_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,044,034 | ---- | M] () -- C:\P26_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,037,666 | ---- | M] () -- C:\P26_20091121_034831.mp4 [2009-10-24 18:59:19 | 004,777,107 | ---- | M] () -- C:\P2_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,007,525 | ---- | M] () -- C:\P2_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,007,228 | ---- | M] () -- C:\P2_20091121_034831.mp4 [2009-10-24 18:59:19 | 002,680,316 | ---- | M] () -- C:\P3_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,006,157 | ---- | M] () -- C:\P3_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,005,908 | ---- | M] () -- C:\P3_20091121_034831.mp4 [2009-10-24 18:59:19 | 002,655,606 | ---- | M] () -- C:\P4_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,006,229 | ---- | M] () -- C:\P4_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,005,899 | ---- | M] () -- C:\P4_20091121_034831.mp4 [2009-10-24 18:59:19 | 009,284,259 | ---- | M] () -- C:\P5_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,014,732 | ---- | M] () -- C:\P5_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,014,869 | ---- | M] () -- C:\P5_20091121_034831.mp4 [2009-10-24 18:59:19 | 009,832,639 | ---- | M] () -- C:\P6_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,015,949 | ---- | M] () -- C:\P6_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,014,923 | ---- | M] () -- C:\P6_20091121_034831.mp4 [2009-10-24 18:59:19 | 009,259,787 | ---- | M] () -- C:\P7_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,015,168 | ---- | M] () -- C:\P7_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,015,120 | ---- | M] () -- C:\P7_20091121_034831.mp4 [2009-10-24 18:59:19 | 008,658,852 | ---- | M] () -- C:\P8_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,017,540 | ---- | M] () -- C:\P8_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,016,224 | ---- | M] () -- C:\P8_20091121_034831.mp4 [2009-10-24 18:59:19 | 002,779,273 | ---- | M] () -- C:\P9_20091024_115614.mp4 [2009-11-21 03:48:29 | 000,004,709 | ---- | M] () -- C:\P9_20091121_034827.mp4 [2009-11-21 03:48:32 | 000,004,184 | ---- | M] () -- C:\P9_20091121_034831.mp4 [2010-02-28 17:57:25 | 2145,386,496 | -HS- | M] () -- C:\pagefile.sys [2009-10-06 11:38:37 | 000,002,279 | ---- | M] () -- C:\pdfco.log [2009-10-06 11:06:17 | 000,000,227 | ---- | M] () -- C:\sedinst2.log [2009-10-06 11:39:08 | 000,000,200 | ---- | M] () -- C:\Setup.log [2009-10-06 11:17:23 | 000,000,198 | ---- | M] () -- C:\syntpad.log [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 76 bytes -> C:\Documents and Settings\User\Pulpit\reklama majówka.jpg:Roxio EMC Stream @Alternate Data Stream - 64 bytes -> C:\Documents and Settings\User\Pulpit\muzyka.wav:TOC.WMV @Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:242231A9 @Alternate Data Stream - 118 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:0B9D8E22 < End of report >

Proszę o pomoc.

**Posty:** 18165 · przez **wojtas** 28 Lut 2010, 20:04

Daj loga z combofixa ale przed jego użyciem wykasuj jeśli masz programy emulujące napędy

**Posty:** 5 · przez **sebpla** 28 Lut 2010, 20:30

Oto log z Combofixa:

Kod: Zaznacz wszystko: ComboFix 10-02-27.04 - User 2010-02-28 19:17:46.1.2 - x86 Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.2813.1914 [GMT 1:00] Uruchomiony z: c:\documents and settings\User\Moje dokumenty\Pobieranie\ComboFix.exe AV: ESET NOD32 Antivirus 4.0 *On-access scanning enabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0} * Rezydentny antywirus jest aktywny . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\docume~1\User\USTAWI~1\Temp\tmp1.tmp c:\documents and settings\User\Dane aplikacji\wiaservg.log c:\documents and settings\User\Menu Start\Programy\Autostart\ihaupd32.exe c:\recycler\S-1-5-21-0160199895-4634002850-835693469-0964 c:\recycler\S-1-5-21-0243936033-3052116371-381863308-1811 c:\recycler\S-1-5-21-0359792233-0780757750-164763438-2586 c:\recycler\S-1-5-21-0960473877-5912733252-197777367-3348 c:\recycler\S-1-5-21-3427743134-3735161534-494211187-2635 c:\recycler\S-1-5-21-3427743134-3735161534-494211187-2635\Desktop.ini c:\recycler\S-1-5-21-3427743134-3735161534-494211187-2635\wnzip32.exe c:\recycler\S-1-5-21-5395487207-3158246648-700227535-6763 c:\recycler\S-1-5-21-6018143145-6335901464-315722745-4169 c:\recycler\S-1-5-21-6087499142-1504134578-169617426-9284 c:\recycler\S-1-5-21-6346630347-5705536599-525056042-4780 c:\recycler\S-1-5-21-8813492763-1611943223-858460196-9064 c:\windows\system\svchost.exe c:\windows\system32\ieuinit.inf c:\windows\system32\Ijl11.dll c:\windows\system32\oem24.inf c:\windows\system32\VB6KO.DLL c:\windows\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job c:\windows\Tasks\{66BA574B-1E11-49b8-909C-8CC9E0E8E015}.job . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_ASYNCMACQ -------\Legacy_SSHNAS -------\Service_AsyncMacq -------\Service_SSHNAS -------\Legacy_darkness -------\Service_darkness ((((((((((((((((((((((((( Pliki utworzone od 2010-01-28 do 2010-02-28 ))))))))))))))))))))))))))))))) . 2010-02-28 00:49 . 2010-02-28 01:07 -------- d-----w- c:\program files\SkanerOnline 2010-02-27 20:56 . 2010-02-27 20:56 552 ----a-w- c:\windows\system32\d3d8caps.dat 2010-02-26 07:30 . 2008-04-13 23:10 34688 -c--a-w- c:\windows\system32\dllcache\lbrtfdc.sys 2010-02-26 07:30 . 2008-04-13 23:10 34688 ----a-w- c:\windows\system32\drivers\lbrtfdc.sys 2010-02-26 07:30 . 2008-04-13 23:11 8576 -c--a-w- c:\windows\system32\dllcache\i2omgmt.sys 2010-02-26 07:30 . 2008-04-13 23:11 8576 ----a-w- c:\windows\system32\drivers\i2omgmt.sys 2010-02-26 07:30 . 2008-04-13 23:11 8192 -c--a-w- c:\windows\system32\dllcache\changer.sys 2010-02-26 07:30 . 2008-04-13 23:11 8192 ----a-w- c:\windows\system32\drivers\Changer.sys 2010-02-25 13:56 . 2010-02-25 13:56 -------- d-----w- c:\windows\Sun 2010-02-25 09:21 . 2010-02-25 09:32 -------- d-----w- C:\skaner 2010-02-25 09:01 . 2010-02-25 09:01 -------- d-----w- c:\documents and settings\User\Dane aplikacji\KONICA MINOLTA . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2010-02-28 09:28 . 2006-03-02 12:00 89218 ----a-w- c:\windows\system32\perfc015.dat 2010-02-28 09:28 . 2006-03-02 12:00 500078 ----a-w- c:\windows\system32\perfh015.dat 2010-02-27 21:35 . 2009-10-06 15:28 1 ----a-w- c:\documents and settings\User\Dane aplikacji\OpenOffice.org\3\user\uno_packages\cache\stamp.sys 2010-02-26 19:58 . 2009-10-06 11:03 -------- d-----w- c:\program files\Mozilla Thunderbird 2010-02-14 09:18 . 2009-10-07 07:53 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Microsoft Help 2010-02-02 13:46 . 2009-10-06 09:58 -------- d--h--w- c:\program files\InstallShield Installation Information 2010-02-02 13:45 . 2009-11-05 11:32 -------- d-----w- c:\program files\IrfanView 2010-01-20 12:15 . 2010-01-20 10:30 -------- d---a-w- c:\documents and settings\All Users\Dane aplikacji\TEMP 2010-01-20 12:12 . 2010-01-20 12:12 -------- d-----w- c:\program files\Common Files\DeskShare Shared 2010-01-20 12:12 . 2010-01-20 12:12 -------- d-----w- c:\program files\Deskshare 2010-01-20 10:30 . 2010-01-20 10:30 356352 ----a-w- c:\windows\eSellerateEngine.dll 2010-01-20 10:27 . 2010-01-14 16:45 -------- d-----w- c:\program files\Picture2avi 2010-01-06 11:39 . 2009-12-31 13:48 -------- d-----w- c:\program files\Feurio 2010-01-04 07:57 . 2010-01-04 07:57 79488 ----a-w- c:\documents and settings\User\Dane aplikacji\Sun\Java\jre1.6.0_17\gtapi.dll 2009-12-31 16:50 . 2006-03-02 12:00 353792 ----a-w- c:\windows\system32\drivers\srv.sys 2009-12-31 13:46 . 2009-12-31 13:38 -------- d-----w- c:\program files\mp3cd 2009-12-22 05:10 . 2006-03-02 12:00 669696 ----a-w- c:\windows\system32\wininet.dll 2009-12-22 05:10 . 2006-03-02 12:00 81920 ----a-w- c:\windows\system32\ieencode.dll 2009-12-17 07:42 . 2009-10-06 09:43 345088 ----a-w- c:\windows\system32\mspaint.exe 2009-12-14 07:10 . 2006-03-02 12:00 33280 ----a-w- c:\windows\system32\csrsrv.dll 2009-12-09 10:11 . 2006-03-02 12:00 2146816 ----a-w- c:\windows\system32\ntoskrnl.exe 2009-12-09 10:11 . 2004-08-04 00:39 2025472 ----a-w- c:\windows\system32\ntkrnlpa.exe 2009-12-04 18:22 . 2006-03-02 12:00 455424 ----a-w- c:\windows\system32\drivers\mrxsmb.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-07-09 2119104] "AdobeUpdater"="c:\program files\Common Files\Adobe\Updater5\AdobeUpdater.exe" [2009-10-07 2356088] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2008-04-04 1044480] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2008-01-21 61440] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-27 1040384] "accrdsub"="c:\program files\ActivIdentity\ActivClient\accrdsub.exe" [2007-05-15 293168] "PTHOSTTR"="c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2008-06-02 238984] "CognizanceTS"="c:\progra~1\HEWLET~1\IAM\Bin\ASTSVCC.dll" [2008-05-21 24848] "QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-05-14 177456] "Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2008-05-14 61440] "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] "PDF Complete"="c:\program files\PDF Complete\pdfsty.exe" [2008-05-12 318488] "hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2008-04-15 488752] "File Sanitizer"="c:\program files\Hewlett-Packard\File Sanitizer\CoreShredder.exe" [2008-05-14 10244096] "ISUSPM Startup"="c:\progra~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2005-02-16 221184] "ISUSScheduler"="c:\program files\Common Files\InstallShield\UpdateService\issch.exe" [2005-02-16 81920] "egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-05-14 2029640] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-07-25 149280] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\User\Menu Start\Programy\Autostart\ OpenOffice.org 3.1.lnk - c:\program files\OpenOffice.org 3\program\quickstart.exe [2009-4-16 384000] Skr˘t do Ability Server.lnk - c:\documents and settings\User\Pulpit\Ability Server.exe [2010-2-25 172032] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048] Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872] BTTray.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-5-12 576104] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ackpbsc] 2007-05-15 14:08 112640 ----a-w- c:\windows\system32\ackpbsc.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\acunlock] 2007-05-15 14:08 281088 ----a-w- c:\program files\ActivIdentity\ActivClient\acunlock.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OneCard] 2008-05-21 00:42 111888 ----a-w- c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=c:\windows\system32\APSHook.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\DVR Net\\MultiNet.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Documents and Settings\\User\\Pulpit\\Ability Server.exe"= R0 ahcix86;ahcix86;c:\windows\system32\drivers\ahcix86.sys [2007-10-26 174600] R0 Amddfltr;Amd Disk Lower Filter Driver;c:\windows\system32\drivers\Amddfltr.sys [2009-10-06 15416] R0 SafeBoot;SafeBoot;c:\windows\system32\drivers\SafeBoot.sys [2008-05-30 108752] R0 SbAlg;SbAlg;c:\windows\system32\drivers\SbAlg.sys [2008-05-30 51376] R0 SbFsLock;SbFsLock;c:\windows\system32\drivers\SbFsLock.sys [2008-05-30 12928] R0 SFAUDIO;Sonic Focus DSP Driver;c:\windows\system32\drivers\sfaudio.sys [2009-10-06 24064] R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-05-14 107256] R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-05-14 94360] R1 RsvLock;RsvLock;c:\windows\system32\drivers\rsvlock.sys [2008-05-30 12496] R2 accoca;ActivClient Middleware Service;c:\program files\ActivIdentity\ActivClient\accoca.exe [2007-05-15 182576] R2 ASBroker;Logon Session Broker;c:\windows\System32\svchost.exe -k Cognizance [2006-03-02 14336] R2 ASChannel;Local Communication Channel;c:\windows\System32\svchost.exe -k Cognizance [2006-03-02 14336] R2 ekrn;ESET Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-05-14 731840] R2 HP ProtectTools Service;HP ProtectTools Service;c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTChangeFilterService.exe [2008-06-02 18944] R2 HpFkCryptService;Drive Encryption Service;c:\program files\Hewlett-Packard\Drive Encryption\HpFkCrypt.exe [2008-05-30 256512] R2 HPFSService;File Sanitizer for HP ProtectTools;c:\program files\Hewlett-Packard\File Sanitizer\HPFSService.exe [2009-10-06 77824] R2 pdfcDispatcher;PDF Document Manager;c:\program files\PDF Complete\pdfsvc.exe [2009-10-06 576024] R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2009-10-06 193840] S2 HidUsbq;HidUsbq;\??\c:\windows\System32\DRIVERS\HidUsbq.sys --> c:\windows\System32\DRIVERS\HidUsbq.sys [?] S3 RoxMediaDB10;RoxMediaDB10;c:\program files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe [2008-04-08 1112560] S3 SCR3XX2K;SCR3xx USB SmartCardReader;c:\windows\system32\DRIVERS\SCR3XX2K.sys --> c:\windows\system32\DRIVERS\SCR3XX2K.sys [?] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] Cognizance REG_MULTI_SZ ASBroker ASChannel . . ------- Skan uzupełniający ------- . IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000 IE: Wyślij do interfejsu Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm IE: Wyślij do urządzenia &Bluetooth... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm TCP: {956F2CD1-6FF0-4CB7-A3CB-5FC471766D5A} = 78.157.167.7,78.157.167.57 TCP: {E0523061-BF41-40C7-8CCA-CAB7DF97EDE5} = 217.30.129.149,217.30.137.200 DPF: {2ADE19BB-1E79-4EC4-976E-AC74339ADD76} - hxxp://78.157.175.19/ActiveViewGUI.cab DPF: {66F7F252-3FE1-4650-B1E5-94B2A38271C5} - hxxp://78.157.175.19/ActiveView.cab FF - ProfilePath - c:\documents and settings\User\Dane aplikacji\Mozilla\Firefox\Profiles\6hz1v332.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.onet.pl/ FF - plugin: c:\documents and settings\User\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npgg.1.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-WatchDog - c:\program files\InterVideo\DVD Check\DVDCheck.exe SSODL-GootkitSSO-{B674F191-ECF7-4A5D-B396-F59615C03CAB} - c:\windows\System32\msxsltsso.dll AddRemove-_{7C5123A9-30A8-4C44-89CA-A8C87A1FCC91} - c:\program files\Corel\CorelDRAW Graphics Suite 13\Programs\MSILauncher {7C5123A9-30A8-4C44-89CA-A8C87A1FCC91} ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2010-02-28 19:24 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe???????????????????????|?M?|?????M?|??@ skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\pdfcDispatcher] "ImagePath"="c:\program files\PDF Complete\pdfsvc.exe /startedbyscm:66B66708-40E2BE4D-pdfcService" . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_USERS\S-1-5-21-746137067-1957994488-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{5CEAB527-21E7-E381-BE23-DD07C829FB03}*] @Allowed: (Read) (RestrictedCode) @Allowed: (Read) (RestrictedCode) "oappccfekhpofffcjoiiicmdnilpik"=hex:61,69,62,6c,6d,6d,67,61,6a,69,70,69,6c,70, 67,63,6e,6a,63,6c,66,61,65,6e,6e,67,6a,70,63,6d,62,64,65,6a,62,6d,66,6f,6c,\ "iakpgbdklfgcdigbkf"=hex:6b,61,68,6d,65,6d,61,69,6c,62,6e,6e,69,6b,6b,69,63,6a, 6b,63,63,65,00,00 "haeaaccojikbgbnp"=hex:6b,61,68,6d,65,6d,61,69,6c,62,6e,6e,69,6b,6b,69,63,6a, 6b,63,63,65,00,00 . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1016) c:\windows\system32\ackpbsc.dll c:\windows\system32\aclog.dll c:\windows\system32\ACLIBEAY.dll c:\windows\system32\acevtsub.dll c:\windows\system32\asphat32.dll c:\windows\system32\acerrmes.dll c:\windows\system32\aspcom.dll c:\program files\ActivIdentity\ActivClient\Resources\Merged\acerrmrc.dll c:\program files\ActivIdentity\ActivClient\Resources\Merged\asphatrc.dll c:\windows\system32\Ati2evxx.dll c:\program files\Hewlett-Packard\IAM\Bin\ASWLNPkg.dll c:\program files\Hewlett-Packard\IAM\bin\ItMsg.dll c:\program files\Hewlett-Packard\IAM\Bin\TrayIcon.dll c:\program files\Hewlett-Packard\IAM\bin\brand.dll c:\program files\Hewlett-Packard\IAM\Bin\AsChnl.dll c:\program files\Hewlett-Packard\IAM\Bin\HPPlugIn.dll c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHostServices.dll c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\Interop.HPQWMIEXLib.dll c:\program files\ActivIdentity\ActivClient\acunlock.dll c:\windows\system32\aipingui.dll c:\program files\ActivIdentity\ActivClient\Resources\Merged\aipinguirc.dll c:\program files\ActivIdentity\ActivClient\resources\acCobAPIrc.dll c:\program files\ActivIdentity\ActivClient\Resources\Merged\acunlockrc.dll c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\Interop.PTHstServsLib.dll c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTHstServs.dll c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\BIOSDomain.dll c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\Interop.PTPluginLib.dll c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\PTStrings.dll c:\program files\Hewlett-Packard\HP ProtectTools Security Manager\HPjCard.dll c:\windows\system32\acomx.dll c:\windows\system32\acbsi21.dll c:\program files\Hewlett-Packard\IAM\Bin\ItVCClient.dll c:\program files\Hewlett-Packard\IAM\Bin\ItReports.DLL c:\program files\Hewlett-Packard\IAM\Bin\ItVCard.dll c:\program files\Hewlett-Packard\IAM\Bin\NetAdmin.dll c:\program files\Hewlett-Packard\IAM\Bin\BioAuth.dll c:\program files\Hewlett-Packard\IAM\Bin\ItClient.dll c:\program files\Hewlett-Packard\IAM\Bin\ittal.dll c:\program files\Hewlett-Packard\IAM\Bin\STEngine.dll - - - - - - - > 'explorer.exe'(7924) c:\windows\system32\APSHook.dll c:\program files\Gadu-Gadu\ggwhook.dll c:\windows\system32\btmmhook.dll c:\program files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\Ati2evxx.exe c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe c:\windows\System32\SCardSvr.exe c:\program files\ActivIdentity\ActivClient\acevents.exe c:\windows\system32\agrsmsvc.exe c:\windows\system32\Ati2evxx.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\wdfmgr.exe c:\program files\Hewlett-Packard\Shared\hpqWmiEx.exe c:\program files\Hewlett-Packard\IAM\Bin\AsGHost.exe c:\program files\ActivIdentity\ActivClient\acevents.exe c:\windows\system32\wbem\wmiapsrv.exe c:\program files\Hewlett-Packard\Shared\HpqToaster.exe c:\progra~1\WIDCOMM\BLUETO~1\BTSTAC~1.EXE c:\program files\OpenOffice.org 3\program\soffice.exe c:\program files\OpenOffice.org 3\program\soffice.bin c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe c:\windows\system32\taskmgr.exe . ************************************************************************** . Czas ukończenia: 2010-02-28 19:27:42 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2010-02-28 18:27 Przed: 4 415 164 416 bajtów wolnych Po: 4 338 208 768 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer - - End Of File - - D743533AFF65F9CB5DC4182AF113DDA1

Dodano Dzisiaj, 19:51:
Ma ktoś pomysł?

**Posty:** 18165 · przez **wojtas** 28 Lut 2010, 21:02

. zrób skan Malwarebytes Anti-Malware (zaktualizuj, usuń co znajdzie ) i pokaż raport

**Posty:** 5 · przez **sebpla** 28 Lut 2010, 22:22

Oto co znalazł - logi przed:

Kod: Zaznacz wszystko: Malwarebytes' Anti-Malware 1.44 Wersja bazy definicji: 3807 Windows 5.1.2600 Dodatek Service Pack 3 Internet Explorer 6.0.2900.5512 2010-02-28 21:16:27 mbam-log-2010-02-28 (21-16-27).txt Typ skanowania: Pełne skanowanie (C:\|D:\|G:\|I:\|) Przeskanowane obiekty: 206994 Upłynęło: 40 minute(s), 59 second(s) Zainfekowane procesy w pamięci: 0 Zainfekowane moduły pamięci: 0 Zainfekowane klucze rejestru: 0 Zainfekowane wartości rejestru: 0 Zainfekowane pliki rejestru: 0 Zainfekowane foldery: 0 Zainfekowane pliki: 6 Zainfekowane procesy w pamięci: (Nie wykryto groźnych plików) Zainfekowane moduły pamięci: (Nie wykryto groźnych plików) Zainfekowane klucze rejestru: (Nie wykryto groźnych plików) Zainfekowane wartości rejestru: (Nie wykryto groźnych plików) Zainfekowane pliki rejestru: (Nie wykryto groźnych plików) Zainfekowane foldery: (Nie wykryto groźnych plików) Zainfekowane pliki: C:\Qoobox\Quarantine\C\Documents and Settings\User\Menu Start\Programy\Autostart\ihaupd32.exe.vir (Malware.Packer.Gen) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\RECYCLER\S-1-5-21-3427743134-3735161534-494211187-2635\wnzip32.exe.vir (Worm.Autorun.B) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{F95A2456-94A8-40FF-96B2-0765F50B2C90}\RP136\A0018909.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{F95A2456-94A8-40FF-96B2-0765F50B2C90}\RP136\A0020020.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{F95A2456-94A8-40FF-96B2-0765F50B2C90}\RP136\A0020121.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{F95A2456-94A8-40FF-96B2-0765F50B2C90}\RP136\A0020245.exe (Malware.Packer.Gen) -> Quarantined and deleted successfully.

co dalej?

**Posty:** 18165 · przez **wojtas** 28 Lut 2010, 22:24

napisz jak sytuacja bo nic nie widać

**Posty:** 5 · przez **sebpla** 28 Lut 2010, 22:29

nie widzisz powyżej loga?

Dodano Dzisiaj, 21:34:
Na razie wygląda jakby się ustabilizował, jednak pytanie co jeszcze sprawdzić i ewentualnie usunąć bo jakoś nie do końca jestem przekonany, że już jest czysty. W kwarantannie NODA mam 172 pliki, wcześniej wyskakiwały mi co kilka sekund okna z info, że dany plik został przeniesiony do kwarantanny, kolejne informacje dotyczyły blokowania poszczególnych adresów internetowych (jak nietrudno się domyśleć zupełnie mi nieznanych i nie wywoływanych przeze mnie), a jak już napisałem na razie cisza... o niczym nie informuje

**Posty:** 18165 · przez **wojtas** 28 Lut 2010, 22:35

widzę

zrób jeszcze skan: http://www.programosy.pl/program,dr-web-cureit.html

Autor postu otrzymał pochwałę

Kto jest na forum