a zapora windowsa jest wyłączona 
Skan z GMERA:
- Kod: Zaznacz wszystko
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-24 15:02:56
Windows 5.1.2600 Dodatek Service Pack 3
Running: g9rkt20g.exe; Driver: C:\DOCUME~1\Ja\USTAWI~1\Temp\pxtdypow.sys
---- System - GMER 1.0.15 ----
SSDT spxp.sys ZwCreateKey [0xB9EB50E0]
SSDT spxp.sys ZwEnumerateKey [0xB9ECDDA4]
SSDT spxp.sys ZwEnumerateValueKey [0xB9ECE132]
SSDT spxp.sys ZwOpenKey [0xB9EB50C0]
SSDT spxp.sys ZwQueryKey [0xB9ECE20A]
SSDT spxp.sys ZwQueryValueKey [0xB9ECE08A]
SSDT spxp.sys ZwSetValueKey [0xB9ECE29C]
INT 0x62 ? 89C93BF8
INT 0x63 ? 89A9BF00
INT 0x73 ? 89A9BF00
INT 0x73 ? 89A9BF00
INT 0x83 ? 89C93BF8
INT 0xA4 ? 89A9BF00
INT 0xB4 ? 89A9BF00
---- Kernel code sections - GMER 1.0.15 ----
? spxp.sys Nie można odnaleźć określonego pliku. !
.text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xB9437000, 0x187662, 0xE8000020]
.text USBPORT.SYS!DllUnload B93CD8AC 5 Bytes JMP 89A9B4E0
C:\Program Files\CyberLink\PowerDVD\000.fcl entry point in "" section [0xA3FB4000]
.clc C:\Program Files\CyberLink\PowerDVD\000.fcl unknown last section [0xA3FB5000, 0x1000, 0x00000000]
---- User code sections - GMER 1.0.15 ----
.text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[904] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 4 Bytes [C2, 04, 00, 00]
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [B9EB6042] spxp.sys
IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [B9EB613E] spxp.sys
IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [B9EB60C0] spxp.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [B9EB6800] spxp.sys
IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [B9EB66D6] spxp.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [B9EC5B90] spxp.sys
---- Devices - GMER 1.0.15 ----
Device \FileSystem\Ntfs \Ntfs 89C921F8
AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET)
Device \Driver\NetBT \Device\NetBT_Tcpip_{F3BE52F1-59E1-472D-B6A0-0FED84ADC0D1} 89A1A1F8
Device \Driver\usbohci \Device\USBPDO-0 8996E1F8
Device \Driver\dmio \Device\DmControl\DmIoDaemon 89C231F8
Device \Driver\dmio \Device\DmControl\DmConfig 89C231F8
Device \Driver\dmio \Device\DmControl\DmPnP 89C231F8
Device \Driver\dmio \Device\DmControl\DmInfo 89C231F8
Device \Driver\usbohci \Device\USBPDO-1 8996E1F8
Device \Driver\usbohci \Device\USBPDO-2 8996E1F8
Device \Driver\usbehci \Device\USBPDO-3 899471F8
Device \Driver\usbohci \Device\USBPDO-4 8996E1F8
AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys (ESET Antivirus Network Redirector/ESET)
Device \Driver\usbohci \Device\USBPDO-5 8996E1F8
Device \Driver\NetBT \Device\NetBT_Tcpip_{936F4ADB-E69F-4D68-823C-A25E04F0013B} 89A1A1F8
Device \Driver\Ftdisk \Device\HarddiskVolume1 89C941F8
Device \Driver\Cdrom \Device\CdRom0 89A5F3C0
Device \Driver\Ftdisk \Device\HarddiskVolume2 89C941F8
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 [B9E08B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort0 [B9E08B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort1 [B9E08B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort2 [B9E08B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdePort3 [B9E08B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-12 [B9E08B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device \Driver\NetBT \Device\NetBt_Wins_Export 89A1A1F8
Device \Driver\usbohci \Device\USBFDO-0 8996E1F8
Device \Driver\usbohci \Device\USBFDO-1 8996E1F8
Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 8943A1F8
Device \Driver\usbohci \Device\USBFDO-2 8996E1F8
Device \FileSystem\MRxSmb \Device\LanmanRedirector 8943A1F8
Device \Driver\usbohci \Device\USBFDO-3 8996E1F8
Device \Driver\usbohci \Device\USBFDO-4 8996E1F8
Device \Driver\Ftdisk \Device\FtControl 89C941F8
Device \Driver\usbehci \Device\USBFDO-5 899471F8
Device \FileSystem\Cdfs \Cdfs 89936500
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG10.00.00.01WORKSTATION 5D08DC9561129FC7857299F5D276EFCF9EA82A844DCECEC0D93685923EBA202BC89D8FBB0026A9061819C8CE1D7BFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79338EDD5E5BE2F6E667A9C6AECB7A5D1407A6171C11EC38DE3D5E689C003AF40103BB666DF451DC1DA13DC8C12181094C39C116F5962D893AB5CD062A274BC263956FBD04269556E120B960787F54DBBAD64FF3B31BA5E8CB4BFE0BFB11696742B8ECC93930AC4199EBCA377FCF33593D0926D92BF5834FA30D412B984A8C1D0EB2FBD5565E577C499C514A7BBB49228852601B07CDF9C3460706AD481610EFBEC0883DE22E38BA783BD12BDA9CA33055A83B1CB2F99F243C3FE4EC1B683543CE92A2EFB1D15801B14376FD4D82334EE0F699D86008EE2194AB985A62EB9C4CBD4DFD72D3B1A52C06268AFD46314D1DEA9A805F8438453E613681F6B47CCE940D86F2DC9FE6EDEA09C8FE767FA02B8EB8661A51D8FDE556373F205B6B2D387AC34CFD5CB2BF683FD0856A49F3FBEAEC131E35E55982F694301A9DB224C327AFEC9E3DB0EABFAA8079A783ECE3230D52467F42E6492303FA690CC23CC3B74EB895F075ACEA1DB358A3F02968D229F7AE23B4D7B1AB6FF75D85D1004A6EB8C6F1532B8FBA1BC162C7F217DBDB8B5574C57D62B0B94B2DA9E4A89A684
---- EOF - GMER 1.0.15 ----
Skan Otl.txt
- Kod: Zaznacz wszystko
OTL logfile created on: 2010-04-24 15:05:52 - Run 1
OTL by OldTimer - Version 3.2.2.0 Folder = C:\Documents and Settings\Ja\Pulpit
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 64,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 87,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19,53 Gb Total Space | 0,93 Gb Free Space | 4,78% Space Free | Partition Type: NTFS
Drive D: | 129,51 Gb Total Space | 24,49 Gb Free Space | 18,91% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded
Computer Name: JA
Current User Name: Ja
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
[color=#E56717]========== Processes (SafeList) ==========[/color]
PRC - [2010-04-24 09:25:32 | 000,562,176 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ja\Pulpit\OTL.exe
PRC - [2010-04-02 21:22:46 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010-01-08 14:19:40 | 000,966,656 | ---- | M] (Realtek Semiconductor Corp.) -- C:\Program Files\REALTEK\RTL8187B Wireless LAN Utility\RtWLan.exe
PRC - [2009-05-14 16:47:54 | 000,731,840 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
PRC - [2009-05-14 16:47:08 | 002,029,640 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
PRC - [2008-10-28 09:32:46 | 000,611,664 | ---- | M] (Lavasoft) -- C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
PRC - [2008-05-17 14:36:34 | 001,503,232 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008-03-20 12:04:46 | 002,127,296 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\gg.exe
PRC - [2006-11-02 15:24:32 | 000,184,320 | ---- | M] (VoyagerSoft, LLC) -- C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe
[color=#E56717]========== Modules (SafeList) ==========[/color]
MOD - [2010-04-24 09:25:32 | 000,562,176 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ja\Pulpit\OTL.exe
MOD - [2006-12-21 14:30:44 | 000,102,400 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\ggwhook.dll
MOD - [2006-05-03 23:53:54 | 000,174,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\framedyn.dll
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
SRV - File not found [On_Demand | Stopped] -- -- (CiSvc)
SRV - [2009-05-14 16:54:22 | 000,020,680 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv)
SRV - [2009-05-14 16:47:54 | 000,731,840 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn)
SRV - [2008-10-28 09:32:46 | 000,611,664 | ---- | M] (Lavasoft) [Auto | Running] -- C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe -- (aawservice)
SRV - [2008-05-17 14:41:39 | 000,029,696 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\System32\regedt32.exe -- (.EsetTrialReset)
SRV - [2006-11-02 15:24:32 | 000,184,320 | ---- | M] (VoyagerSoft, LLC) [Auto | Running] -- C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe -- (ScReadSpool)
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
DRV - [2010-04-24 10:23:03 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)
DRV - [2010-04-02 11:27:33 | 000,027,632 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\seehcri.sys -- (seehcri)
DRV - [2010-02-11 14:02:15 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6)
DRV - [2009-07-25 21:33:09 | 000,025,280 | ---- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hamachi.sys -- (hamachi)
DRV - [2009-05-14 16:49:32 | 000,094,360 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\epfwtdir.sys -- (epfwtdir)
DRV - [2009-05-14 16:47:14 | 000,107,256 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv)
DRV - [2009-05-14 16:41:10 | 000,114,472 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon)
DRV - [2009-04-16 13:53:20 | 000,340,736 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RTL8187B.sys -- (RTL8187B)
DRV - [2008-04-30 22:12:46 | 000,055,424 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\VBoxDrv.sys -- (VBoxDrv)
DRV - [2008-04-30 22:12:46 | 000,042,048 | ---- | M] (Sun Microsystems, Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\VBoxUSBMon.sys -- (VBoxUSBMon)
DRV - [2008-04-14 00:26:08 | 000,088,320 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkipx.sys -- (NwlnkIpx)
DRV - [2008-04-14 00:23:10 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmnt.sys -- (nm)
DRV - [2008-04-14 00:15:14 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) Sterownik audio USB (WDM)
DRV - [2008-04-13 22:06:06 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008-04-04 10:57:00 | 000,296,320 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\yk51x86.sys -- (yukonwxp)
DRV - [2008-02-26 07:51:43 | 002,863,616 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag)
DRV - [2007-12-18 12:18:10 | 000,732,160 | ---- | M] (Conexant Systems Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\CHDAud.sys -- (HdAudAddService)
DRV - [2007-11-03 00:12:32 | 000,041,456 | ---- | M] (Cyberlink Corp.) [Kernel | Auto | Running] -- C:\Program Files\CyberLink\PowerDVD\000.fcl -- ({95808DC4-FA4A-4C74-92FE-5B863F82066B})
DRV - [2007-05-02 12:11:18 | 000,109,704 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ss_mdm.sys -- (ss_mdm)
DRV - [2007-05-02 12:11:18 | 000,015,112 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ss_mdfl.sys -- (ss_mdfl)
DRV - [2007-05-02 12:11:16 | 000,083,592 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ss_bus.sys -- (ss_bus) SAMSUNG Mobile USB Device 1.0 driver (WDM)
DRV - [2007-01-16 14:52:20 | 000,017,664 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ZDPSp50.sys -- (ZDPSp50)
DRV - [2006-07-24 17:05:00 | 000,005,632 | ---- | M] () [File_System | System | Running] -- C:\WINDOWS\system32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2004-03-24 04:12:34 | 000,017,280 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\nsndis5.sys -- (NSNDIS5)
DRV - [2001-08-23 14:00:00 | 000,063,232 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnknb.sys -- (NwlnkNb)
DRV - [2001-08-23 14:00:00 | 000,055,936 | ---- | M] (Microsoft Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\nwlnkspx.sys -- (NwlnkSpx)
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
[color=#E56717]========== Internet Explorer ==========[/color]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKU\.DEFAULT\Software\Microsoft\Internet Explorer\SearchURL\g, = http://www.google.com/search?q=%s
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Internet Explorer\SearchURL\g, = http://www.google.com/search?q=%s
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-20\Software\Microsoft\Internet Explorer\SearchURL\g, = http://www.google.com/search?q=%s
IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-796845957-57989841-1644491937-1002\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google
IE - HKU\S-1-5-21-796845957-57989841-1644491937-1002\SOFTWARE\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKU\S-1-5-21-796845957-57989841-1644491937-1002\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/
IE - HKU\S-1-5-21-796845957-57989841-1644491937-1002\Software\Microsoft\Internet Explorer\SearchURL\g, = http://www.google.com/search?q=%s
IE - HKU\S-1-5-21-796845957-57989841-1644491937-1002\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
[color=#E56717]========== FireFox ==========[/color]
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.startup.homepage: "http://www.gazeta.pl"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: illimitux@illimitux.net:3.5
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3
FF - prefs.js..network.proxy.backup.ftp: "200.30.101.75"
FF - prefs.js..network.proxy.backup.ftp_port: 8080
FF - prefs.js..network.proxy.backup.gopher: "200.30.101.75"
FF - prefs.js..network.proxy.backup.gopher_port: 8080
FF - prefs.js..network.proxy.backup.socks: "200.30.101.75"
FF - prefs.js..network.proxy.backup.socks_port: 8080
FF - prefs.js..network.proxy.backup.ssl: "200.30.101.75"
FF - prefs.js..network.proxy.backup.ssl_port: 8080
FF - prefs.js..network.proxy.ftp: "187.51.62.146"
FF - prefs.js..network.proxy.ftp_port: 8080
FF - prefs.js..network.proxy.gopher: "187.51.62.146"
FF - prefs.js..network.proxy.gopher_port: 8080
FF - prefs.js..network.proxy.http: "187.51.62.146"
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "187.51.62.146"
FF - prefs.js..network.proxy.socks_port: 8080
FF - prefs.js..network.proxy.ssl: "187.51.62.146"
FF - prefs.js..network.proxy.ssl_port: 8080
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010-04-02 21:22:57 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010-04-02 21:22:57 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010-01-12 16:49:08 | 000,000,000 | ---D | M]
[2009-12-03 17:33:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\Mozilla\Extensions
[2010-04-23 10:25:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\Mozilla\Firefox\Profiles\qrupuoqn.default\extensions
[2009-09-04 16:46:42 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Ja\Dane aplikacji\Mozilla\Firefox\Profiles\qrupuoqn.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2009-12-05 15:37:58 | 000,000,000 | ---D | M] (IE Tab) -- C:\Documents and Settings\Ja\Dane aplikacji\Mozilla\Firefox\Profiles\qrupuoqn.default\extensions\{77b819fa-95ad-4f2c-ac7c-486b356188a9}
[2010-04-21 17:42:20 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\Ja\Dane aplikacji\Mozilla\Firefox\Profiles\qrupuoqn.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2010-02-28 22:39:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\Mozilla\Firefox\Profiles\qrupuoqn.default\extensions\illimitux@illimitux.net
[2010-04-23 10:25:32 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010-02-15 11:59:14 | 000,873,976 | ---- | M] (Ganymede Technologies) -- C:\Program Files\Mozilla Firefox\plugins\NPCARDS.dll
[2007-02-12 21:30:16 | 000,164,352 | ---- | M] (Indiepath Ltd) -- C:\Program Files\Mozilla Firefox\plugins\npigl.dll
[2010-01-16 03:08:36 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml
[2010-01-16 03:08:36 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml
[2010-01-16 03:08:36 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml
[2010-01-16 03:08:36 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml
[2010-01-16 03:08:36 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml
[2010-01-16 03:08:36 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml
O1 HOSTS File: ([2009-05-29 22:04:24 | 000,000,686 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\HOSTS
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Solid Converter PDF) - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll (VoyagerSoft, LLC)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O3 - HKLM\..\Toolbar: (Solid Converter PDF) - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll (VoyagerSoft, LLC)
O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)
O4 - HKU\.DEFAULT..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (Alexander Avdonin)
O4 - HKU\.DEFAULT..\Run: [VisualTaskTips] C:\Program Files\Utilities\VisualTaskTips\VisualTaskTips.exe (VisualTaskTips.com)
O4 - HKU\S-1-5-18..\Run: [TaskSwitchXP] C:\Program Files\TaskSwitchXP\TaskSwitchXP.exe (Alexander Avdonin)
O4 - HKU\S-1-5-18..\Run: [VisualTaskTips] C:\Program Files\Utilities\VisualTaskTips\VisualTaskTips.exe (VisualTaskTips.com)
O4 - HKU\S-1-5-21-796845957-57989841-1644491937-1002..\Run: [Gadu-Gadu] C:\Program Files\Gadu-Gadu\gg.exe (Gadu-Gadu S.A.)
O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\REALTEK RTL8187B Wireless LAN Utility.lnk = C:\Program Files\REALTEK\RTL8187B Wireless LAN Utility\RtWLan.exe (Realtek Semiconductor Corp.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRemoteRecursiveEvents = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SynchronousMachineGroupPolicy = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SynchronousUserGroupPolicy = 0
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 1
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 1
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O7 - HKU\S-1-5-21-796845957-57989841-1644491937-1002\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-796845957-57989841-1644491937-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-21-796845957-57989841-1644491937-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1
O7 - HKU\S-1-5-21-796845957-57989841-1644491937-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1
O7 - HKU\S-1-5-21-796845957-57989841-1644491937-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1
O7 - HKU\S-1-5-21-796845957-57989841-1644491937-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O7 - HKU\S-1-5-21-796845957-57989841-1644491937-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1
O7 - HKU\S-1-5-21-796845957-57989841-1644491937-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-21-796845957-57989841-1644491937-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-796845957-57989841-1644491937-1002\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 0
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\WINDOWS\system32\nwprovau.dll (Microsoft Corporation)
O15 - HKU\.DEFAULT\..Trusted Domains: google.com ([mail] https in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: google.com ([mail] https in Trusted sites)
O15 - HKU\S-1-5-20\..Trusted Domains: google.com ([mail] https in Trusted sites)
O15 - HKU\S-1-5-21-796845957-57989841-1644491937-1002\..Trusted Domains: google.com ([mail] https in Trusted sites)
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} http://www.mks.com.pl/skaner/SkanerOnline.cab (MksSkanerOnline Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-0016-0000-0006-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_06-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.)
O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008-10-13 11:14:07 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O34 - HKLM BootExecute: (OODBS) - File not found
O34 - HKLM BootExecute: (lsdelete) - C:\WINDOWS\System32\lsdelete.exe ()
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
[2010-04-24 09:15:40 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Ja\Recent
[2010-04-24 08:55:43 | 000,562,176 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Ja\Pulpit\OTL.exe
[2010-04-24 08:40:55 | 000,880,624 | ---- | C] (Duplex Secure Ltd.) -- C:\Documents and Settings\Ja\Pulpit\SPTDinst-v162-x86(2).exe
[2010-04-24 07:49:52 | 000,340,736 | ---- | C] (Realtek Semiconductor Corporation ) -- C:\WINDOWS\System32\drivers\RTL8187B.sys
[2010-04-24 07:49:47 | 000,000,000 | ---D | C] -- C:\Program Files\REALTEK
[2010-04-23 10:45:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ja\Pulpit\Nowy folder
[2010-04-22 07:37:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ja\Pulpit\dpV432
[2010-04-20 17:42:07 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ja\Pulpit\przywództwo
[2010-04-19 16:31:22 | 000,000,000 | ---D | C] -- C:\Program Files\SkanerOnline
[2010-04-16 00:11:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\MetaGeek,_LLC
[2010-04-16 00:05:47 | 000,000,000 | ---D | C] -- C:\Program Files\MetaGeek
[2010-04-08 18:35:53 | 000,000,000 | ---D | C] -- C:\WINDOWS\OPTIONS
[2010-04-08 18:35:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\RtlGina
[2010-04-08 18:34:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Ja\Pulpit\RTL8187B_Drv_XP_5.1160.0415.2009_Win7_62.1181.1105.2009_UI_1.00.0145.ALL.L
[2010-04-02 11:28:16 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\ReinstallBackups
[2010-04-02 11:27:59 | 000,027,632 | ---- | C] (Sony Ericsson Mobile Communications) -- C:\WINDOWS\System32\drivers\seehcri.sys
[2010-04-02 11:27:01 | 000,000,000 | ---D | C] -- C:\Program Files\Sony Ericsson
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
[2010-04-24 11:12:08 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010-04-24 11:10:44 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010-04-24 10:23:03 | 000,691,696 | ---- | M] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2010-04-24 09:25:32 | 000,562,176 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ja\Pulpit\OTL.exe
[2010-04-24 09:15:45 | 007,077,888 | -H-- | M] () -- C:\Documents and Settings\Ja\NTUSER.DAT
[2010-04-24 09:15:45 | 000,000,188 | -HS- | M] () -- C:\Documents and Settings\Ja\ntuser.ini
[2010-04-24 09:15:37 | 009,673,006 | -H-- | M] () -- C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\IconCache.db
[2010-04-24 09:04:49 | 000,000,287 | ---- | M] () -- C:\Documents and Settings\Ja\Pulpit\Skrót do (D) Dysk lokalny.lnk
[2010-04-24 08:53:28 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\Ja\Pulpit\g9rkt20g.exe
[2010-04-24 08:43:07 | 000,012,721 | ---- | M] () -- C:\Documents and Settings\Ja\Pulpit\16 marca b.docx
[2010-04-24 08:40:58 | 000,880,624 | ---- | M] (Duplex Secure Ltd.) -- C:\Documents and Settings\Ja\Pulpit\SPTDinst-v162-x86(2).exe
[2010-04-24 08:40:21 | 000,195,328 | ---- | M] () -- C:\Documents and Settings\Ja\Pulpit\SPTDinst-v162-x86.exe
[2010-04-24 07:51:01 | 000,001,941 | ---- | M] () -- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\REALTEK RTL8187B Wireless LAN Utility.lnk
[2010-04-24 07:51:01 | 000,001,923 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\REALTEK RTL8187B Wireless LAN Utility.lnk
[2010-04-24 07:42:05 | 000,002,403 | ---- | M] () -- C:\Documents and Settings\Ja\Pulpit\inSSIDer.lnk
[2010-04-23 11:09:04 | 012,670,514 | ---- | M] () -- C:\Documents and Settings\Ja\Pulpit\Nowy folder.rar
[2010-04-22 07:37:43 | 005,506,893 | ---- | M] () -- C:\Documents and Settings\Ja\Pulpit\DziennikPoslikow.v4.32.zip
[2010-04-20 17:41:57 | 008,090,433 | ---- | M] () -- C:\Documents and Settings\Ja\Pulpit\przywództwo.zip
[2010-04-19 22:00:49 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010-04-18 17:19:10 | 000,648,735 | ---- | M] () -- C:\Documents and Settings\Ja\Moje dokumenty\POLSKI CZERWONY KRZYŻ.pptx
[2010-04-16 16:30:25 | 033,863,729 | ---- | M] () -- C:\Documents and Settings\Ja\Pulpit\Polityka_16.2010.pdf
[2010-04-13 21:50:16 | 000,012,297 | ---- | M] () -- C:\Documents and Settings\Ja\Pulpit\Co wydarzyło się 16 marca.docx
[2010-04-13 18:15:31 | 002,971,355 | ---- | M] () -- C:\Documents and Settings\Ja\Pulpit\proseminarium.pdf
[2010-04-09 18:27:59 | 000,000,694 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\MailShare.lnk
[2010-04-08 18:37:18 | 000,376,832 | ---- | M] () -- C:\WINDOWS\System32\AegisI5Installer.exe
[2010-04-02 11:30:52 | 000,000,898 | ---- | M] () -- C:\Documents and Settings\Ja\Pulpit\Update Service.lnk
[2010-04-02 11:27:33 | 000,027,632 | ---- | M] (Sony Ericsson Mobile Communications) -- C:\WINDOWS\System32\drivers\seehcri.sys
[2010-03-30 21:46:29 | 000,149,712 | ---- | M] () -- C:\Documents and Settings\Ja\Pulpit\max.jpg
[2010-03-28 10:18:06 | 000,501,172 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat
[2010-03-28 10:18:06 | 000,441,852 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010-03-28 10:18:06 | 000,088,698 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat
[2010-03-28 10:18:06 | 000,070,968 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010-03-28 10:18:05 | 001,115,334 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[color=#E56717]========== Files Created - No Company Name ==========[/color]
[2010-04-24 09:04:49 | 000,000,287 | ---- | C] () -- C:\Documents and Settings\Ja\Pulpit\Skrót do (D) Dysk lokalny.lnk
[2010-04-24 08:53:26 | 000,293,376 | ---- | C] () -- C:\Documents and Settings\Ja\Pulpit\g9rkt20g.exe
[2010-04-24 08:41:10 | 000,691,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2010-04-24 08:40:22 | 000,195,328 | ---- | C] () -- C:\Documents and Settings\Ja\Pulpit\SPTDinst-v162-x86.exe
[2010-04-24 07:51:01 | 000,001,941 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\REALTEK RTL8187B Wireless LAN Utility.lnk
[2010-04-24 07:51:01 | 000,001,923 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\REALTEK RTL8187B Wireless LAN Utility.lnk
[2010-04-23 10:48:40 | 012,670,514 | ---- | C] () -- C:\Documents and Settings\Ja\Pulpit\Nowy folder.rar
[2010-04-22 07:36:45 | 005,506,893 | ---- | C] () -- C:\Documents and Settings\Ja\Pulpit\DziennikPoslikow.v4.32.zip
[2010-04-21 12:48:36 | 000,012,721 | ---- | C] () -- C:\Documents and Settings\Ja\Pulpit\16 marca b.docx
[2010-04-20 17:41:49 | 008,090,433 | ---- | C] () -- C:\Documents and Settings\Ja\Pulpit\przywództwo.zip
[2010-04-18 14:52:46 | 000,648,735 | ---- | C] () -- C:\Documents and Settings\Ja\Moje dokumenty\POLSKI CZERWONY KRZYŻ.pptx
[2010-04-16 16:20:45 | 033,863,729 | ---- | C] () -- C:\Documents and Settings\Ja\Pulpit\Polityka_16.2010.pdf
[2010-04-16 00:54:18 | 000,002,403 | ---- | C] () -- C:\Documents and Settings\Ja\Pulpit\inSSIDer.lnk
[2010-04-13 21:28:16 | 000,012,297 | ---- | C] () -- C:\Documents and Settings\Ja\Pulpit\Co wydarzyło się 16 marca.docx
[2010-04-13 18:14:48 | 002,971,355 | ---- | C] () -- C:\Documents and Settings\Ja\Pulpit\proseminarium.pdf
[2010-04-08 18:37:14 | 000,376,832 | ---- | C] () -- C:\WINDOWS\System32\AegisI5Installer.exe
[2010-04-08 18:35:48 | 000,451,072 | ---- | C] () -- C:\WINDOWS\System32\ISSRemoveSP.exe
[2010-04-02 11:30:52 | 000,000,898 | ---- | C] () -- C:\Documents and Settings\Ja\Pulpit\Update Service.lnk
[2010-03-30 21:46:29 | 000,149,712 | ---- | C] () -- C:\Documents and Settings\Ja\Pulpit\max.jpg
[2009-09-17 10:24:03 | 000,000,167 | ---- | C] () -- C:\WINDOWS\ConverterCore.INI
[2009-05-25 22:46:27 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2009-03-25 18:07:25 | 000,001,246 | ---- | C] () -- C:\WINDOWS\kaillera.ini
[2009-03-24 15:19:01 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys
[2008-11-21 17:54:30 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\WLANUTL.dll
[2008-11-15 11:40:13 | 000,000,238 | ---- | C] () -- C:\WINDOWS\mafosav.INI
[2008-11-02 10:59:24 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.INI
[2008-10-14 20:53:26 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2008-10-13 21:56:06 | 000,000,027 | ---- | C] () -- C:\WINDOWS\SmAudio.INI
[2008-10-13 11:30:57 | 000,055,424 | ---- | C] () -- C:\WINDOWS\System32\drivers\VBoxDrv.sys
[2008-10-13 11:30:22 | 000,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2008-10-13 11:30:17 | 000,815,104 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2008-10-13 11:30:17 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2008-10-13 11:30:14 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2008-10-13 11:30:14 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2008-10-13 11:08:44 | 000,000,058 | ---- | C] () -- C:\WINDOWS\System32\Notepad2.ini
[2008-10-13 11:08:43 | 000,175,616 | ---- | C] () -- C:\WINDOWS\System32\mmm.dll
[2008-10-13 11:08:42 | 000,001,630 | ---- | C] () -- C:\WINDOWS\System32\metapath.ini
[2008-10-13 11:08:27 | 000,394,752 | ---- | C] () -- C:\WINDOWS\System32\cygwinb19.dll
[2008-09-16 02:14:24 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2008-09-16 02:12:02 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dtu100.dll.manifest
[2008-09-16 02:12:02 | 000,000,416 | ---- | C] () -- C:\WINDOWS\System32\dpl100.dll.manifest
[2008-09-16 02:11:10 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll
[2008-03-06 03:37:26 | 000,000,183 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[color=#E56717]========== LOP Check ==========[/color]
[2008-10-13 11:32:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\URSoft
[2008-10-13 11:10:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\uTorrent
[2008-10-13 11:11:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Xentient
[2009-12-10 16:11:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\AlawarWrapper
[2008-10-28 09:40:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ESET
[2009-12-10 16:11:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Farm Frenzy
[2009-12-24 22:19:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Hiro-Media
[2010-03-29 17:15:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ipla
[2009-06-15 23:42:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Karen's Power Tools
[2008-10-20 13:54:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\KONAMI
[2009-06-06 16:05:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Last.fm
[2009-09-17 10:14:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\SolidDocuments
[2009-03-04 12:09:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Sports Interactive
[2009-03-04 12:34:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP
[2008-10-13 11:32:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Dane aplikacji\URSoft
[2008-10-13 11:10:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Dane aplikacji\uTorrent
[2008-10-13 11:11:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Dane aplikacji\Xentient
[2009-03-12 13:22:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\2K Sports
[2009-01-12 23:18:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\AutoUpdate
[2010-04-23 17:14:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\foobar2000
[2008-10-14 07:14:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\Gadu-Gadu
[2010-02-19 17:43:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\GanymedeNet
[2009-08-18 13:03:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\GetRightToGo
[2010-04-21 21:49:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\ipla
[2008-11-30 16:29:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\Jasc
[2009-01-10 18:24:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\Leadertech
[2009-01-12 23:18:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\Listonosz
[2009-01-19 12:52:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\Mount&Blade
[2009-05-30 09:28:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\Mp3tag
[2009-01-12 23:18:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\Onet
[2008-10-13 19:11:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\Opera
[2008-10-16 08:56:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\Polcaster
[2010-01-17 10:46:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\RayV
[2010-04-18 13:50:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\Samsung
[2009-11-24 15:31:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\SecondLife
[2010-04-22 07:45:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\SolidDocuments
[2009-12-25 15:43:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\Sports Interactive
[2009-12-06 13:45:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\Thinstall
[2008-10-13 11:32:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\URSoft
[2010-04-18 12:49:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\uTorrent
[2008-10-13 11:11:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Ja\Dane aplikacji\Xentient
[2008-10-13 11:22:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SAPER1972\Dane aplikacji\Gadu-Gadu
[2008-10-13 11:32:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\SAPER1972\Dane aplikacji\Tlen.pl
[color=#E56717]========== Purity Check ==========[/color]
[color=#E56717]========== Alternate Data Streams ==========[/color]
@Alternate Data Stream - 65 bytes -> C:\Documents and Settings\All Users\Pulpit:$ES_DESCRIPTOR_MVPUV1PKSVXJKX69UK1CWPP0DTVNYKM1UVXPJCEPP4DMJ3K1XYE7LRJEM53EPPJCFPLP45168LPSB5PL0EM6REGXHCTVVVVVVVVVVVVV
@Alternate Data Stream - 65 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\Sports Interactive:$ES_DESCRIPTOR_MVPUV1PKSVXJKX69UK1CWPP0DTVNYKM1UVXPJCEPP4DMJ3K1XYE7LRJEM53EPPJCFPLP45168LPSB5PL0EM6REGXHCTVVVVVVVVVVVVV
@Alternate Data Stream - 150 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:B3D74A13
< End of report >
Extras:http://wklej.org/hash/e5a26b9c5a6/
