Szkodliwa www z oprogr.mixmediadirect.cn

[maci]

Witam.

Włączyłem rano komputer i zaczęły się jaja pańskie dziać.Od razu avast zaczął krzyczeć i krzyczy cały czas że


Po czym otwiera mi się w zakładce taka oto strona:


Aha jeszcze podczas samego właczenia ,wyskakiwał komunikat ,że powinienem wsadzić płytę z Windowsem,bo nie ma jakigoś drivera ,lub cdrom nie działa poprawnie i system windows przez to może nie działać tak jak powinien.

Kod: Zaznacz wszystko

Logfile of random's system information tool 1.06 (written by random/random)
Run by Xp at 2009-06-02 09:35:48
Microsoft Windows XP Professional Dodatek Service Pack 3
System drive C: has 37 GB (74%) free of 50 GB
Total RAM: 511 MB (37% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:36:10, on 2009-06-02
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\totalcmd\TOTALCMD.EXE
C:\Program Files\Maxthon2\Maxthon.exe
G:\MACIEK\OCHRONA KOMPA\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Xp.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.21.0\gears.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Internet Connection Wizard Setup Tool] C:\Program Files\Internet Explorer\Connection Wizard\icwsetup.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Startup: rncsys32.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.21.0\gears.dll
O9 - Extra 'Tools' menuitem: Ustawienia wtyczki &Gears - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.21.0\gears.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Usługa administracyjna Menedżera dysków logicznych dmadminBITS (dmadminBITS) - Unknown owner - C:\WINDOWS\system32\AgCPanelGermant.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c98d19bbddcc46) (gupdate1c98d19bbddcc46) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 6767 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53}]
Google Gears Helper - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.21.0\gears.dll [2009-05-19 2097152]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-02-05 81000]
"BluetoothAuthenticationAgent"=bthprops.cpl,,BluetoothAuthenticationAgent []
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-03 13529088]
"Internet Connection Wizard Setup Tool"=C:\Program Files\Internet Explorer\Connection Wizard\icwsetup.exe [2009-06-02 19968]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Gadu-Gadu"=C:\Program Files\Gadu-Gadu\gg.exe [2007-04-17 2113536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter2.0]
C:\Program Files\Brother\ControlCenter2\brctrcen.exe [2005-05-17 933888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray]
C:\Program Files\Creative\Shared Files\CamTray.exe [2005-10-27 299008]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
C:\Program Files\D-Tools\daemon.exe [2004-08-22 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DXDllRegExe]
C:\WINDOWS\system32\dxdllreg.exe [2002-12-12 46592]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
C:\Program Files\Gadu-Gadu\gg.exe [2007-04-17 2113536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [2005-03-17 40960]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [2007-03-14 54832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe [2008-03-26 1232896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nowe Gadu-Gadu]
C:\Program Files\Nowe Gadu-Gadu\gg.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\WINDOWS\system32\NvCpl.dll [2008-05-03 13529088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
C:\WINDOWS\system32\NvMcTray.dll [2008-05-03 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [2005-03-17 57393]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe [2008-04-16 1079808]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe [2008-03-26 1232896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2007-03-14 71216]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefPrt]
C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe [2005-01-26 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe [2009-03-06 24095528]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2004-08-06 860160]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2004-07-27 1388544]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2003-10-14 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
C:\Program Files\Unlocker\UnlockerAssistant.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Status Monitor.lnk]
C:\PROGRA~1\Brother\Brmfcmon\BrMfcWnd.exe [2005-04-23 802816]

C:\Documents and Settings\Xp\Menu Start\Programy\Autostart
rncsys32.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
WgaLogon.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2008-05-02 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"H:\DC++\DCPlusPlus.exe"="H:\DC++\DCPlusPlus.exe:*:Disabled:DC++"
"C:\WINDOWS\Network Diagnostic\xpnetdiag.exe"="C:\WINDOWS\Network Diagnostic\xpnetdiag.exe:*:Disabled:@xpsp3res.dll,-20000"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"G:\MACIEK\GRY\CS\hl.exe"="G:\MACIEK\GRY\CS\hl.exe:*:Enabled:Half-Life Launcher"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Program Files\Gadu-Gadu\gg.exe"="C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program główny"
"C:\Program Files\Maxthon2\Maxthon.exe"="C:\Program Files\Maxthon2\Maxthon.exe:*:Enabled:Maxthon Browser"
"C:\Program Files\SopCast\adv\SopAdver.exe"="C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver"
"H:\SCIAGANE Z DC\Pro Evolution Soccer 2008\PES2008.exe"="H:\SCIAGANE Z DC\Pro Evolution Soccer 2008\PES2008.exe:*:Enabled:Pro Evolution Soccer 2008"
"E:\RÓŻNE\GRY\Footballmanager 2009\fm.exe"="E:\RÓŻNE\GRY\Footballmanager 2009\fm.exe:*:Disabled:Football Manager 2009"
"C:\WINDOWS\system32\dpnsvr.exe"="C:\WINDOWS\system32\dpnsvr.exe:*:Disabled:Microsoft DirectPlay8 Server"
"C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe"="C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Enabled:BlueSoleil"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{48245c40-4c19-11dd-b826-00e07dddfe23}]
shell\AutoRun\command - I:\LaunchU3.exe -a


======List of files/folders created in the last 1 months======

2009-06-02 09:20:10 ----RSH---- C:\WINDOWS\system32\AgCPanelGermant.exe
2009-05-31 17:56:59 ----D---- C:\WINDOWS\system32\NtmsData
2009-05-28 20:41:24 ----D---- C:\Program Files\jv16 PowerTools
2009-05-26 16:47:36 ----D---- C:\rsit
2009-05-22 19:21:10 ----D---- C:\Program Files\Audacity
2009-05-22 15:52:43 ----D---- C:\Program Files\mp3DirectCut
2009-05-22 15:47:53 ----D---- C:\Program Files\ToniArts
2009-05-21 18:17:43 ----A---- C:\WINDOWS\system32\rmoc3260.dll
2009-05-21 18:17:43 ----A---- C:\WINDOWS\system32\pndx5032.dll
2009-05-21 18:17:43 ----A---- C:\WINDOWS\system32\pndx5016.dll
2009-05-21 18:17:43 ----A---- C:\WINDOWS\system32\pncrt.dll
2009-05-21 18:17:42 ----D---- C:\Program Files\Real Alternative
2009-05-21 18:17:42 ----D---- C:\Documents and Settings\Xp\Dane aplikacji\Real
2009-05-21 18:17:42 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Real
2009-05-21 18:17:11 ----A---- C:\WINDOWS\system32\unrar.dll
2009-05-21 18:17:09 ----A---- C:\WINDOWS\system32\yv12vfw.dll
2009-05-21 18:17:09 ----A---- C:\WINDOWS\system32\xvidvfw.dll
2009-05-21 18:17:09 ----A---- C:\WINDOWS\system32\xvidcore.dll
2009-05-21 18:17:08 ----A---- C:\WINDOWS\system32\qt-dx331.dll
2009-05-21 18:17:08 ----A---- C:\WINDOWS\system32\dpl100.dll
2009-05-21 18:17:08 ----A---- C:\WINDOWS\system32\divx.dll
2009-05-21 18:17:06 ----A---- C:\WINDOWS\system32\ff_vfw.dll.manifest
2009-05-21 18:17:06 ----A---- C:\WINDOWS\system32\ff_vfw.dll
2009-05-21 18:17:04 ----D---- C:\Program Files\K-Lite Codec Pack
2009-05-21 15:16:03 ----D---- C:\WINDOWS\system32\IOSUBSYS
2009-05-19 16:30:44 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Bluetooth
2009-05-19 16:07:15 ----A---- C:\WINDOWS\system32\irmon.dll
2009-05-19 16:07:15 ----A---- C:\WINDOWS\system32\irftp.exe
2009-05-19 16:07:14 ----A---- C:\WINDOWS\system32\wshirda.dll
2009-05-08 17:32:01 ----D---- C:\Documents and Settings\Xp\Dane aplikacji\Publish Providers
2009-05-08 17:31:31 ----D---- C:\Documents and Settings\Xp\Dane aplikacji\Sony
2009-05-08 17:30:03 ----D---- C:\Program Files\Sony
2009-05-08 17:26:33 ----RSD---- C:\WINDOWS\assembly
2009-05-08 17:25:41 ----D---- C:\WINDOWS\Microsoft.NET
2009-05-08 17:23:09 ----D---- C:\Documents and Settings\Xp\Dane aplikacji\Sony Setup

======List of files/folders modified in the last 1 months======

2009-06-02 09:35:59 ----D---- C:\WINDOWS\Prefetch
2009-06-02 09:34:49 ----D---- C:\WINDOWS\Temp
2009-06-02 09:30:12 ----D---- C:\Documents and Settings\Xp\Dane aplikacji\MxBoost
2009-06-02 09:23:31 ----A---- C:\WINDOWS\wincmd.ini
2009-06-02 09:23:06 ----D---- C:\WINDOWS\system32
2009-06-02 09:23:06 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-06-02 09:21:41 ----D---- C:\WINDOWS\system32\drivers
2009-06-02 09:21:30 ----D---- C:\WINDOWS\system32\dllcache
2009-06-02 09:20:18 ----D---- C:\WINDOWS\system32\CatRoot2
2009-06-02 00:44:11 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-06-01 18:29:01 ----D---- C:\WINDOWS\security
2009-06-01 18:27:06 ----SHD---- C:\WINDOWS\Installer
2009-06-01 18:26:57 ----RD---- C:\Program Files
2009-06-01 18:26:53 ----HD---- C:\WINDOWS\inf
2009-06-01 18:23:06 ----SH---- C:\boot.ini
2009-06-01 18:23:06 ----A---- C:\WINDOWS\win.ini
2009-06-01 18:23:06 ----A---- C:\WINDOWS\system.ini
2009-06-01 07:54:25 ----D---- C:\Documents and Settings\Xp\Dane aplikacji\Nokia
2009-05-31 21:48:53 ----D---- C:\Documents and Settings\Xp\Dane aplikacji\Skype
2009-05-30 13:19:52 ----D---- C:\Program Files\Outlook Express
2009-05-29 10:37:02 ----D---- C:\Program Files\VirtualDub-1.8.8
2009-05-29 10:03:26 ----D---- C:\Program Files\Google
2009-05-28 21:12:55 ----D---- C:\WINDOWS
2009-05-28 21:12:55 ----D---- C:\Program Files\Common Files
2009-05-26 20:54:34 ----A---- C:\WINDOWS\wcx_ftp.ini
2009-05-26 16:31:47 ----D---- C:\WINDOWS\Minidump
2009-05-24 18:40:37 ----SD---- C:\Documents and Settings\Xp\Dane aplikacji\Microsoft
2009-05-22 15:47:53 ----HD---- C:\Program Files\InstallShield Installation Information
2009-05-21 18:13:38 ----D---- C:\WINDOWS\system
2009-05-19 21:01:03 ----D---- C:\WINDOWS\system32\wbem
2009-05-18 17:19:43 ----D---- C:\Documents and Settings\Xp\Dane aplikacji\Creative
2009-05-14 17:25:59 ----D---- C:\Program Files\SkanerOnline
2009-05-14 17:25:12 ----RSD---- C:\WINDOWS\Fonts
2009-05-14 17:23:12 ----D---- C:\WINDOWS\system32\QuickTime
2009-05-09 12:33:25 ----AD---- C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2009-05-08 17:26:35 ----D---- C:\WINDOWS\WinSxS
2009-05-08 17:25:46 ----D---- C:\WINDOWS\system32\mui
2009-05-08 17:25:46 ----D---- C:\Program Files\Internet Explorer
2009-05-07 09:16:29 ----A---- C:\WINDOWS\system32\MRT.exe
2009-05-06 13:20:53 ----SD---- C:\WINDOWS\Tasks

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-02-05 26944]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-02-05 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-02-05 51376]
R1 intelppm;Sterownik procesora Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40448]
R1 kbdhid;Sterownik klawiatury HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
R1 PCLEPCI;PCLEPCI; \??\C:\WINDOWS\system32\drivers\pclepci.sys []
R1 sf;SFI Service; C:\WINDOWS\system32\drivers\sf.sys [2004-08-28 33995]
R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B}; \??\C:\Program Files\CyberLink\PowerDVD\000.fcl []
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-02-05 94032]
R2 BT848;Conexant's BtPCI WDM Video Capture; C:\WINDOWS\system32\drivers\BT848.sys [2009-02-15 371349]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2004-05-17 133200]
R3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-02-05 23152]
R3 BrScnUsb;Brother USB Still Image driver; C:\WINDOWS\System32\Drivers\BrScnUsb.sys [2004-10-15 15295]
R3 BthEnum;Sterownik Bluetooth Request Block; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2008-04-14 17024]
R3 BTHMODEM;Sterownik komunikacyjny modemu Bluetooth; C:\WINDOWS\system32\DRIVERS\bthmodem.sys [2008-04-14 37888]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2008-04-14 101120]
R3 BTHUSB;Sterownik USB odbiornika radiowego Bluetooth; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2008-04-14 18944]
R3 HidUsb;Sterownik Microsoft klasy HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 HWIONT;HWIONT; \??\E:\RÓŻNE\MORE TV\HWIONT.sys []
R3 MarvinBus;Pinnacle Marvin Bus; C:\WINDOWS\system32\DRIVERS\MarvinBus.sys [2004-06-21 78976]
R3 mouhid;Sterownik myszy HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-26 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-03 6554496]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2009-04-21 10368]
R3 RFCOMM;Urządzenie Bluetooth (Protokół TDI RFCOMM); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2008-04-14 59136]
R3 rtl8139;Sterownik NT karty Realtek RTL8139(A/B/C)-based PCI Fast Ethernet; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2008-04-14 20992]
R3 senfilt;senfilt; C:\WINDOWS\system32\drivers\senfilt.sys [2004-04-26 381056]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2004-09-01 259648]
R3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Standardowy sterownik koncentratora USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
R3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S3 BlueletAudio;Bluetooth Audio Service; C:\WINDOWS\system32\DRIVERS\blueletaudio.sys []
S3 BlueletSCOAudio;Bluetooth SCO Audio Service; C:\WINDOWS\system32\DRIVERS\BlueletSCOAudio.sys []
S3 BT;Bluetooth PAN Network Adapter; C:\WINDOWS\system32\DRIVERS\btnetdrv.sys []
S3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:\WINDOWS\System32\Drivers\btcusb.sys []
S3 BTHPORT;Sterownik portu Bluetooth; C:\WINDOWS\System32\Drivers\BTHport.sys [2008-06-14 273024]
S3 CCDECODE;Dekoder napisów; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 mcdevice;mcdevice; C:\WINDOWS\system32\DRIVERS\mcdevice.sys [2007-12-05 15872]
S3 MidiSyn;MidiSyn; C:\WINDOWS\system32\drivers\MidiSyn.sys [2002-09-20 235100]
S3 MSTEE;Konwerter strumieni Tee/Sink-to-Sink Microsoft Streaming; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;Koder-dekoder NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Połączenie TV/wideo firmy Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2008-09-15 17664]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2008-09-15 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 21632]
S3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2001-08-17 5888]
S3 SE27bus;Sony Ericsson Device 039 Driver driver (WDM); C:\WINDOWS\system32\DRIVERS\SE27bus.sys [2006-09-18 61600]
S3 SE27mdfl;Sony Ericsson Device 039 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\SE27mdfl.sys [2006-09-18 9360]
S3 SE27mdm;Sony Ericsson Device 039 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\SE27mdm.sys [2006-09-18 97184]
S3 SE27mgmt;Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\SE27mgmt.sys [2006-09-18 88688]
S3 se27nd5;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS); C:\WINDOWS\system32\DRIVERS\se27nd5.sys [2006-09-18 18704]
S3 SE27obex;Sony Ericsson Device 039 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\SE27obex.sys [2006-09-18 86560]
S3 se27unic;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM); C:\WINDOWS\system32\DRIVERS\se27unic.sys [2006-09-18 90800]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 SONYPVU1;Sterownik filtru USB Sony (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2008-09-15 8064]
S3 usbscan;Sterownik skanera USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\DRIVERS\usbser.sys [2008-04-14 26112]
S3 V0260VID;Live! Cam Vista IM; C:\WINDOWS\system32\DRIVERS\V0260Vid.sys [2006-04-01 162176]
S3 VComm;Virtual Serial port driver; C:\WINDOWS\system32\DRIVERS\VComm.sys []
S3 VcommMgr;Bluetooth VComm Manager Service; C:\WINDOWS\System32\Drivers\VcommMgr.sys []
S3 VHidMinidrv;Bluetooth HID Device Service; C:\WINDOWS\system32\drivers\VHIDMini.sys []
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2008-03-27 503008]
S3 WSTCODEC;Kodery-dekodery teletekstu w standardzie światowym; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-02-05 18752]
R2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-02-05 138680]
R2 Brother XP spl Service;BrSplService; C:\WINDOWS\system32\brsvc01a.exe [2002-04-12 57344]
R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-03 159812]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared files\RichVideo.exe [2007-05-14 272024]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-02-05 254040]
R3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-02-05 352920]
S2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
S2 dmadminBITS;Usługa administracyjna Menedżera dysków logicznych dmadminBITS; C:\WINDOWS\system32\AgCPanelGermant.exe [2009-06-02 51712]
S2 gupdate1c98d19bbddcc46;Google Update Service (gupdate1c98d19bbddcc46); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-02-12 133104]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-04-14 654848]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-20 136120]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-04-07 430592]
S3 WMPNetworkSvc;Usługa udostępniania w sieci programu Windows Media Player; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-12-01 918016]

-----------------EOF-----------------


[wojtas]

skasuj:

O4 - Startup: rncsys32.exe

sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

C:\Documents and Settings\Xp\Menu Start\Programy\Autostart\rncsys32.exe

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)


Daj loga z combofixa ale zainstaluj wraz z nim konsolę odzyskiwania

[maci]

Będę działał ,tylko jak tą konsole odzyskiwania zainstalować

Jeszcze jak odpaliłem wwc wyskoczyło takie okno


Dodano 02.06.2009 09:29:02:
Usunąłem killboxem,i po restarcie nie uruchomił mi się avast,za to po włączeniu przeglądarki dalej wyskakuje ta strona co na ww fotce.Natomiast combofixa nie odpalałem ,z racji tego ,że nie poradzę sobie z tą konsolą odzyskiwania,a boję się ,ze jak odpale go to podem nie wstanie komputer.A musze coś dzisiaj pilnie skończyć.

Wojtas może jest jakieś inne wyjście niż użycie combofixa??

[wojtas]

Pobierz OTListIt2 i daj z niego loga

[maci]

Kod: Zaznacz wszystko

OTListIt Extras logfile created on: 2009-06-02 14:26:31 - Run 1
OTListIt2 by OldTimer - Version 2.0.15.8     Folder = G:\
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

510,68 Mb Total Physical Memory | 227,38 Mb Available Physical Memory | 44,52% Memory free
1,22 Gb Paging File | 1,01 Gb Available in Paging File | 82,80% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 48,83 Gb Total Space | 35,98 Gb Free Space | 73,70% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 124,63 Gb Total Space | 108,29 Gb Free Space | 86,89% Space Free | Partition Type: NTFS
Drive F: | 124,63 Gb Total Space | 118,88 Gb Free Space | 95,39% Space Free | Partition Type: NTFS
Drive G: | 97,65 Gb Total Space | 27,07 Gb Free Space | 27,72% Space Free | Partition Type: NTFS
Drive H: | 135,23 Gb Total Space | 15,79 Gb Free Space | 11,68% Space Free | Partition Type: NTFS
Drive I: | 3,94 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF

Computer Name: SPECIAL-XP
Current User Name: Xp
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Standard
File Age = 30 Days
Company Name Whitelist: On

[color=orange]========== File Associations ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = htmlfile] -- C:\Program Files\Maxthon2\Maxthon.exe (Maxthon International ltd.)
.url [@ = InternetShortcut] -- C:\Program Files\Maxthon2\Maxthon.exe (Maxthon International ltd.)

[color=orange]========== Security Center Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 1
"FirewallDisableNotify" = 1
"UpdatesDisableNotify" = 1
"AntiVirusOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile
"EnableFirewall" = 0
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List

[color=orange]========== Authorized Applications List ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[2008-04-14 00:23:34 | 00,558,080 | ---- | M] (Microsoft Corporation) -- %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
[2006-12-18 23:18:54 | 01,716,224 | ---- | M] () -- H:\DC++\DCPlusPlus.exe:*:Disabled:DC++
[2008-04-14 00:23:34 | 00,558,080 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Network Diagnostic\xpnetdiag.exe:*:Disabled:@xpsp3res.dll,-20000
[2006-02-28 12:42:38 | 00,229,376 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour
[2009-03-06 13:11:18 | 00,270,128 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent
File not found -- G:\MACIEK\GRY\CS\hl.exe:*:Enabled:Half-Life Launcher
[2008-04-14 22:51:14 | 00,083,456 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test
[2007-04-17 13:12:28 | 02,113,536 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program główny
[2008-06-17 07:32:24 | 03,417,344 | ---- | M] (Maxthon International ltd.) -- C:\Program Files\Maxthon2\Maxthon.exe:*:Enabled:Maxthon Browser
[2007-03-07 12:27:12 | 00,567,384 | ---- | M] (www.sopcast.com) -- C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver
File not found -- H:\SCIAGANE Z DC\Pro Evolution Soccer 2008\PES2008.exe:*:Enabled:Pro Evolution Soccer 2008
File not found -- E:\RÓŻNE\GRY\Footballmanager 2009\fm.exe:*:Disabled:Football Manager 2009
[2008-04-14 22:51:14 | 00,018,432 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\dpnsvr.exe:*:Disabled:Microsoft DirectPlay8 Server
File not found -- C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Enabled:BlueSoleil
[2009-03-06 23:54:06 | 24,095,528 | R--- | M] (Skype Technologies S.A.) -- C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype

[color=orange]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3
"{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting
"{15AC0C5D-A6FB-4CE2-8CD0-28179EEB5625}" = Nokia Connectivity Cable Driver
"{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin
"{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86
"{24D7346D-D4B4-45E8-98EA-75EC14B42DD8}" = Adobe ExtendScript Toolkit 2
"{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0
"{293D5729-7C01-4FA4-A4DE-BB6A1587BBB9}" = PDF Settings
"{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{3921A67A-5AB1-4E48-9444-C71814CF3027}" = VCRedistSetup
"{3DED3A72-61A8-4B87-98A5-EF0BC8038AA0}" = DAEMON Tools
"{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{6179A7D2-A668-4F1D-BC9A-DCC6A10C7871}" = Adobe Color NA Extra Settings
"{64C1FA9A-FA94-4B6E-B3E4-8573738E4AD1}" = Adobe Setup
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD
"{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All
"{6D12B99F-EAAA-49D8-8E2F-74FA7459CCB2}" = Adobe Asset Services CS3
"{6D4AC5A4-4CF9-4F90-8111-B9B53CE257BF}" = Adobe Color Common Settings
"{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{78EFD06D-7583-42F1-9E77-671D8782EB70}" = Adobe Photoshop CS3
"{7BB40A22-8D98-43F9-A08A-E7EFF5AB1324}" = Camtasia Studio 5
"{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3
"{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3
"{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support
"{90110415-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003
"{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3
"{95FC26FB-19FD-4A96-BBB1-B1062E8648F5}" = AGEIA PhysX v7.11.13
"{9ABFB92D-93DA-49EE-8ABF-F8195DE45CA9}" = Counter-Strike 1.6
"{9C05FA75-0337-4523-AA57-9D3511018887}" = Nokia PC Suite
"{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3
"{9FB04E44-1339-4A6C-8C50-78BA121AAED5}_is1" = Spolszczenie do PowerDVD 8
"{A11138F6-31A2-34D9-93E9-3F5BC0EB2F8C}" = Google Gears
"{A17EABB6-D0C6-44E5-820C-72DC7F495064}" = PaperPort
"{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps
"{A2D81E70-2A98-4A08-A628-94388B063C5E}" = Adobe Color - Photoshop Specific
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC599724-5755-48C1-ABE7-ABB857652930}" = PC Connectivity Solution
"{AC76BA86-7AD7-1045-7B44-A81200000003}" = Adobe Reader 8 - Polish
"{AC76BA86-7AD7-5464-3428-800000000003}" = Spelling Dictionaries Support For Adobe Reader 8
"{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0
"{B3C02EC1-A7B0-4987-9A43-8789426AAA7D}" = Adobe Setup
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3
"{BB9AC6BF-71B6-42A4-9689-C17D9F44E79A}" = Brother MFL-Pro Suite
"{BD087F50-46B2-43E4-BD73-5DB3DC20B47C}" = Adobe Color EU Recommended Settings
"{C3C9EB3D-24FA-4462-B784-0EC6AAFCD2DD}" = Fable - The Lost Chapters
"{CBF4DADD-974D-49C8-BC83-C6F31554001E}" = Adobe Setup
"{CC016F21-3970-11DE-B878-005056806466}" = Google Earth
"{d08d9f98-1c78-4704-87e6-368b0023d831}" = RelevantKnowledge
"{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client
"{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files
"{D417C96A-FCC7-4590-A1BB-FAF73F5BC98E}" = GTA San Andreas
"{D92B72E2-C854-4738-8ED6-4C3661CC17AE}" = Adobe Color JA Extra Settings
"{D99C322D-C21B-40C7-AE71-EE51AA096B6E}" = Nokia Flashing Cable Driver
"{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3
"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX
"{F5346614-B7C4-4E94-826A-E2363155233D}" = EasyCleaner
"{F99F74B4-972B-4B06-B893-6B3B0DB0128B}" = ACDSee Pro
"3A5DEFA413DDE699DBA6EBE0A63534ACA524D30F" = Pakiet sterowników systemu Windows - Nokia pccsmcfd  (10/12/2007 6.85.4.0)
"AD Sound Recorder_is1" = AD Sound Recorder 3.7.4
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11
"Adobe_3e054d2218e7aa282c2369d939e58ff" = Adobe ExtendScript Toolkit 2
"Adobe_678cd98c8365a5647f9a2e539d120a8" = Adobe Photoshop CS3
"Adobe_6c8e2cb4fd241c55406016127a6ab2e" = Adobe Color Common Settings
"Audacity_is1" = Audacity 1.2.6
"avast!" = avast! Antivirus
"Creative VF0260" = Creative Live! Cam Vista IM Driver (1.00.07.0401)
"Creative WebCam Center" = Creative WebCam Center
"CSI Kryminalne Zagadki Las Vegas - Mroczne Motywy" = CSI Kryminalne Zagadki Las Vegas - Mroczne Motywy
"CyberLink PowerDVD_is1" = PowerDVD 7
"DC++" = DC++ 0.699
"Deer Hunter 2005_is1" = Deer Hunter - The 2005 Season
"Dziobas Rar Player_is1" = Dziobas Rar Player 0.007PL
"FOTOJOKER Fotoswiat" = FOTOJOKER Fotoswiat
"Fraps" = Fraps
"FunPhotor_is1" = FunPhotor 3.0
"Gadu-Gadu" = Gadu-Gadu 7.7
"HijackThis" = HijackThis 2.0.2
"InstallShield_{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = PowerDVD Ultra
"InstallShield_{C3C9EB3D-24FA-4462-B784-0EC6AAFCD2DD}" = Fable - The Lost Chapters
"jv16 PowerTools_is1" = jv16 PowerTools 1.3
"KC Softwares PhotoToFilm_is1" = KC Softwares PhotoToFilm
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.6.2 (Full)
"Maxthon2" = Maxthon2 Browser (remove only)
"Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0
"Nokia PC Suite" = Nokia PC Suite
"NVIDIA Drivers" = NVIDIA Drivers
"OpenAL" = OpenAL
"Picasa 3" = Picasa 3
"RealAlt_is1" = Real Alternative 1.9.0 Lite
"save2pc Pro_is1" = save2pc Pro 3.25
"SopCast" = SopCast 3.0.3
"SubEdit-Player_is1" = SubEdit-Player
"SystemRequirementsLab" = System Requirements Lab
"Totalcmd" = Total Commander (Remove or Repair)
"VideoAvatar_is1" = VideoAvatar
"Virtual DJ - Atomix Productions" = Virtual DJ - Atomix Productions
"Wdf01005" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.5
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Winamp" = Winamp
"WinRAR archiver" = Archiwizator WinRAR
"Wudf01005" = Microsoft User-Mode Driver Framework Feature Pack 1.5
"ZaraRadio_is1" = ZaraRadio 1.6.1

[color=orange]========== HKEY_CURRENT_USER Uninstall List ==========[/color]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"uTorrent" = µTorrent

[color=orange]========== Last 10 Event Log Errors ==========[/color]

[ Antivirus Events ]
Error - 2008-08-13 11:58:29 | Computer Name = SPECIAL-XP | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://demo-codec.com/download/demo-codec.v.3.227.cab failed, 00000026. 

Error - 2008-08-22 03:29:15 | Computer Name = SPECIAL-XP | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://www.onet.tv/_d/swf_prem/playLista_prem_005.swf failed, 0000A413. 

Error - 2008-08-23 17:06:08 | Computer Name = SPECIAL-XP | Source = avast! | ID = 33554522
Description = AAVM - scanning error: x_AavmCheckFileDirectEx: avfilesScanReal of
http://www.onet.tv/_d/swf_prem/playLista_prem_005.swf failed, 0000A413. 

[ Application Events ]
Error - 2009-02-14 09:36:43 | Computer Name = SPECIAL-XP | Source = MsiInstaller | ID = 11931
Description = Product: MSXML 6.0 Parser -- Error 1931. The Windows Installer service
cannot update the system file C:\WINDOWS\system32\msxml6r.dll because the file
is protected by Windows.  You may need to update your operating system for this
program to work correctly. Package version: 6.0.3883.0, OS Protected version: 6.0.3883.0

Error - 2009-02-19 04:43:30 | Computer Name = SPECIAL-XP | Source = Google Update | ID = 20
Description =

Error - 2009-04-13 16:38:53 | Computer Name = SPECIAL-XP | Source = MsiInstaller | ID = 11719
Description = Product: Adobe Setup -- Error 1719.Nie można uzyskać dostępu do usługi
Instalatora Windows. Może się to zdarzyć, jeśli system Windows działa w trybie
awaryjnym lub jeśli Instalator Windows nie jest poprawnie zainstalowany. Skontaktuj
się z personelem pomocy technicznej.

Error - 2009-04-18 08:57:11 | Computer Name = SPECIAL-XP | Source = Google Update | ID = 20
Description =

Error - 2009-04-18 09:56:49 | Computer Name = SPECIAL-XP | Source = Google Update | ID = 20
Description =

Error - 2009-04-18 10:56:49 | Computer Name = SPECIAL-XP | Source = Google Update | ID = 20
Description =

Error - 2009-04-18 11:56:47 | Computer Name = SPECIAL-XP | Source = Google Update | ID = 20
Description =

Error - 2009-04-18 12:56:47 | Computer Name = SPECIAL-XP | Source = Google Update | ID = 20
Description =

Error - 2009-04-21 15:15:08 | Computer Name = SPECIAL-XP | Source = ThreadLib | ID = 0
Description =

Error - 2009-05-05 02:06:12 | Computer Name = SPECIAL-XP | Source = Google Update | ID = 20
Description =

[ System Events ]
Error - 2009-06-02 03:18:36 | Computer Name = SPECIAL-XP | Source = Disk | ID = 262151
Description = W urządzeniu \Device\Harddisk1\D wystąpił zły blok.

Error - 2009-06-02 03:20:38 | Computer Name = SPECIAL-XP | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi Beep z powodu następującego błędu:   %%2

Error - 2009-06-02 03:21:05 | Computer Name = SPECIAL-XP | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi Null z powodu następującego błędu:   %%2

Error - 2009-06-02 03:28:07 | Computer Name = SPECIAL-XP | Source = Service Control Manager | ID = 7034
Description = Usługa ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## niespodziewanie
zakończyła pracę. Wystąpiło to razy: 1.

Error - 2009-06-02 03:36:13 | Computer Name = SPECIAL-XP | Source = Service Control Manager | ID = 7016
Description = Usługa BrSplService zaraportowała nieprawidłowy stan bieżący 0.

Error - 2009-06-02 04:07:39 | Computer Name = SPECIAL-XP | Source = Service Control Manager | ID = 7009
Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się
z usługą avast! iAVS4 Control Service.

Error - 2009-06-02 04:07:39 | Computer Name = SPECIAL-XP | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi avast! iAVS4 Control Service z powodu następującego
błędu:   %%1053

Error - 2009-06-02 04:07:39 | Computer Name = SPECIAL-XP | Source = Service Control Manager | ID = 7009
Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się
z usługą avast! Antivirus.

Error - 2009-06-02 04:07:39 | Computer Name = SPECIAL-XP | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi avast! Antivirus z powodu następującego
błędu:   %%1053

Error - 2009-06-02 04:11:07 | Computer Name = SPECIAL-XP | Source = Service Control Manager | ID = 7016
Description = Usługa BrSplService zaraportowała nieprawidłowy stan bieżący 0.


< End of report >


i drugi log

Kod: Zaznacz wszystko

OTListIt logfile created on: 2009-06-02 14:26:31 - Run 1
OTListIt2 by OldTimer - Version 2.0.15.8     Folder = G:\
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

510,68 Mb Total Physical Memory | 227,38 Mb Available Physical Memory | 44,52% Memory free
1,22 Gb Paging File | 1,01 Gb Available in Paging File | 82,80% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 48,83 Gb Total Space | 35,98 Gb Free Space | 73,70% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 124,63 Gb Total Space | 108,29 Gb Free Space | 86,89% Space Free | Partition Type: NTFS
Drive F: | 124,63 Gb Total Space | 118,88 Gb Free Space | 95,39% Space Free | Partition Type: NTFS
Drive G: | 97,65 Gb Total Space | 27,07 Gb Free Space | 27,72% Space Free | Partition Type: NTFS
Drive H: | 135,23 Gb Total Space | 15,79 Gb Free Space | 11,68% Space Free | Partition Type: NTFS
Drive I: | 3,94 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF

Computer Name: SPECIAL-XP
Current User Name: Xp
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Standard
File Age = 30 Days
Company Name Whitelist: On

[color=orange]========== Processes (SafeList) ==========[/color]

PRC - [2001-12-13 02:01:00 | 00,045,056 | ---- | M] (brother Industries Ltd) -- C:\WINDOWS\system32\brss01a.exe
PRC - [2009-02-12 15:56:36 | 00,133,104 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Update\GoogleUpdate.exe
PRC - [2008-04-14 22:51:18 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2006-02-28 12:42:38 | 00,229,376 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2008-05-03 05:46:00 | 00,159,812 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe
PRC - [2007-05-14 12:54:36 | 00,272,024 | ---- | M] () -- C:\Program Files\CyberLink\Shared files\RichVideo.exe
PRC - [2002-09-20 15:50:10 | 00,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
PRC - [2008-06-17 07:32:24 | 03,417,344 | ---- | M] (Maxthon International ltd.) -- C:\Program Files\Maxthon2\Maxthon.exe
PRC - [2008-04-22 07:03:00 | 01,083,848 | ---- | M] (C. Ghisler & Co.) -- C:\totalcmd\TOTALCMD.EXE
PRC - [2009-06-02 14:25:21 | 00,501,248 | ---- | M] (OldTimer Tools) -- G:\OTListIt2.exe

[color=orange]========== Win32 Services (SafeList) ==========[/color]

SRV - [2005-09-23 07:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2009-02-05 23:01:25 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv [Auto | Stopped])
SRV - [2009-02-05 23:08:40 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus [Auto | Stopped])
SRV - [2009-02-05 23:08:26 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner [On_Demand | Stopped])
SRV - [2009-02-05 23:06:04 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner [On_Demand | Stopped])
SRV - [2006-02-28 12:42:38 | 00,229,376 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service [Auto | Running])
SRV - [2002-04-12 02:00:00 | 00,057,344 | ---- | M] (brother Industries Ltd) -- C:\WINDOWS\system32\brsvc01a.exe -- (Brother XP spl Service [Auto | Stopped])
SRV - [2005-09-23 07:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2009-06-02 09:20:09 | 00,051,712 | RHS- | M] () -- C:\WINDOWS\system32\AgCPanelGermant.exe -- (dmadminBITS [Auto | Stopped])
SRV - [2009-04-14 13:42:03 | 00,654,848 | ---- | M] (Macrovision Europe Ltd.) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service [On_Demand | Stopped])
SRV - [2009-02-12 15:56:36 | 00,133,104 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Update\GoogleUpdate.exe -- (gupdate1c98d19bbddcc46 [Auto | Stopped])
SRV - [2008-11-20 21:18:52 | 00,136,120 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc [On_Demand | Stopped])
SRV - [2008-04-14 22:50:46 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2004-10-22 03:24:18 | 00,073,728 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped])
SRV - [2008-05-03 05:46:00 | 00,159,812 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc [Auto | Running])
SRV - [2003-07-28 20:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2007-05-14 12:54:36 | 00,272,024 | ---- | M] () -- C:\Program Files\CyberLink\Shared files\RichVideo.exe -- (RichVideo [Auto | Running])
SRV - [2008-04-07 09:17:30 | 00,430,592 | ---- | M] (Nokia.) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer [On_Demand | Stopped])
SRV - [2002-09-20 15:50:10 | 00,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default) [Auto | Running])
SRV - [2006-12-01 11:46:28 | 00,918,016 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])

[color=orange]========== Driver Services (SafeList) ==========[/color]

DRV - [2009-02-05 23:05:11 | 00,026,944 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4 [System | Running])
DRV - [2004-05-17 11:23:48 | 00,133,200 | ---- | M] (Andrea Electronics Corporation) -- C:\WINDOWS\system32\drivers\aeaudio.sys -- (aeaudio [On_Demand | Running])
DRV - [2009-02-05 23:07:12 | 00,020,560 | ---- | M] (ALWIL Software) -- C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys -- (aswFsBlk [Auto | Running])
DRV - [2009-02-05 23:08:10 | 00,094,032 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2 [Auto | Running])
DRV - [2009-02-05 23:06:10 | 00,023,152 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr [On_Demand | Stopped])
DRV - [2009-02-05 23:07:23 | 00,114,768 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP [System | Running])
DRV - [2009-02-05 23:06:20 | 00,051,376 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi [System | Running])
DRV - [2004-10-15 05:50:20 | 00,015,295 | ---- | M] (Brother Industries Ltd.) -- C:\WINDOWS\System32\Drivers\BrScnUsb.sys -- (BrScnUsb [On_Demand | Running])
DRV - [2009-02-15 00:10:11 | 00,371,349 | ---- | M] (Illusion & Hope.) -- C:\WINDOWS\system32\drivers\BT848.sys -- (BT848 [Auto | Running])
DRV - [2004-08-22 16:31:10 | 00,155,136 | ---- | M] ( ) -- C:\WINDOWS\system32\DRIVERS\d347bus.sys -- (d347bus [Boot | Running])
DRV - [2004-08-22 16:31:48 | 00,005,248 | ---- | M] ( ) -- C:\WINDOWS\System32\Drivers\d347prt.sys -- (d347prt [Boot | Running])
DRV - [2002-04-14 17:23:00 | 00,016,588 | ---- | M] (The freeware company) -- E:\RÓŻNE\MORE TV\HWIONT.sys -- (HWIONT [On_Demand | Running])
DRV - [2004-06-21 16:03:22 | 00,078,976 | ---- | M] (Pinnacle Systems GmbH) -- C:\WINDOWS\system32\DRIVERS\MarvinBus.sys -- (MarvinBus [On_Demand | Running])
DRV - [2007-12-05 23:34:18 | 00,004,864 | ---- | M] (ShiningMorning Inc.) -- C:\WINDOWS\system32\drivers\mcctl.sys -- (mcctl [Boot | Running])
DRV - [2007-12-05 23:45:20 | 00,015,872 | ---- | M] (ShiningMorning Inc.) -- C:\WINDOWS\system32\DRIVERS\mcdevice.sys -- (mcdevice [On_Demand | Stopped])
DRV - [2002-09-20 11:53:34 | 00,235,100 | ---- | M] (Analog Devices Inc) -- C:\WINDOWS\system32\drivers\MidiSyn.sys -- (MidiSyn [On_Demand | Stopped])
DRV - [2008-09-15 08:56:24 | 00,017,664 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd [On_Demand | Stopped])
DRV - [2008-09-15 08:56:24 | 00,022,016 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc [On_Demand | Stopped])
DRV - [2008-05-03 05:46:00 | 06,554,496 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Running])
DRV - [2007-09-17 15:53:26 | 00,021,632 | ---- | M] (Nokia) -- C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys -- (pccsmcfd [On_Demand | Stopped])
DRV - [2002-03-19 10:29:16 | 00,014,165 | ---- | M] (Pinnacle Systems GmbH) -- C:\WINDOWS\system32\drivers\pclepci.sys -- (PCLEPCI [System | Running])
DRV - [2009-04-21 21:02:23 | 00,010,368 | ---- | M] (Padus, Inc.) -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc [On_Demand | Running])
DRV - [2001-08-17 23:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2008-11-20 21:19:06 | 00,043,872 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running])
DRV - [2001-08-17 23:57:36 | 00,005,888 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\Drivers\RootMdm.sys -- (ROOTMODEM [On_Demand | Stopped])
DRV - [2008-04-14 00:05:40 | 00,020,992 | ---- | M] (Realtek Semiconductor Corporation) -- C:\WINDOWS\system32\DRIVERS\RTL8139.SYS -- (rtl8139 [On_Demand | Running])
DRV - [2006-09-18 14:58:48 | 00,061,600 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\SE27bus.sys -- (SE27bus [On_Demand | Stopped])
DRV - [2006-09-18 14:58:52 | 00,009,360 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\SE27mdfl.sys -- (SE27mdfl [On_Demand | Stopped])
DRV - [2006-09-18 14:58:54 | 00,097,184 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\SE27mdm.sys -- (SE27mdm [On_Demand | Stopped])
DRV - [2006-09-18 14:58:58 | 00,088,688 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\SE27mgmt.sys -- (SE27mgmt [On_Demand | Stopped])
DRV - [2006-09-18 14:59:00 | 00,018,704 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\se27nd5.sys -- (se27nd5 [On_Demand | Stopped])
DRV - [2006-09-18 14:59:02 | 00,086,560 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\SE27obex.sys -- (SE27obex [On_Demand | Stopped])
DRV - [2006-09-18 14:59:08 | 00,090,800 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\se27unic.sys -- (se27unic [On_Demand | Stopped])
DRV - [2008-04-13 22:09:18 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped])
DRV - [2004-04-26 10:49:56 | 00,381,056 | ---- | M] (Sensaura) -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt [On_Demand | Running])
DRV - [2004-08-28 13:54:38 | 00,033,995 | ---- | M] (Sonic Focus, Inc) -- C:\WINDOWS\system32\drivers\sf.sys -- (sf [System | Running])
DRV - [2008-05-02 08:48:55 | 00,062,208 | ---- | M] (Silicon Image, Inc.) -- C:\WINDOWS\System32\drivers\si3112.sys -- (Si3112 [Boot | Running])
DRV - [2004-09-01 12:18:40 | 00,259,648 | ---- | M] (Analog Devices, Inc.) -- C:\WINDOWS\system32\drivers\smwdm.sys -- (smwdm [On_Demand | Running])
DRV - [2001-08-17 22:56:16 | 00,007,552 | ---- | M] (Sony Corporation) -- C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS -- (SONYPVU1 [On_Demand | Stopped])
DRV - [2008-07-07 21:53:06 | 00,685,816 | ---- | M] () -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd [Boot | Running])
DRV - [2008-09-15 08:56:24 | 00,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) -- C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys -- (upperdev [On_Demand | Stopped])
DRV - [2008-04-14 00:15:38 | 00,026,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\DRIVERS\usbser.sys -- (usbser [On_Demand | Stopped])
DRV - [2006-04-01 17:16:44 | 00,162,176 | R--- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\DRIVERS\V0260Vid.sys -- (V0260VID [On_Demand | Stopped])
DRV - [2007-09-19 22:37:48 | 00,041,456 | ---- | M] (Cyberlink Corp.) -- C:\Program Files\CyberLink\PowerDVD\000.fcl -- ({95808DC4-FA4A-4C74-92FE-5B863F82066B} [Auto | Running])

[color=orange]========== Standard Registry (SafeList) ==========[/color]


[color=orange]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =  [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Firefox\Extensions\\{000a9d1c-beef-4f90-9363-039d445309b8}: C:\PROGRAM FILES\GOOGLE\GOOGLE GEARS\FIREFOX\ [2009-05-29 10:03:27 | 00,000,000 | ---D | M]


O1 HOSTS File: (305998 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: 127.0.0.1 serial.alcohol-soft.com
O1 - Hosts: 127.0.0.1 www.alcohol-soft.com
O1 - Hosts: 127.0.0.1 images.alcohol-soft.com
O1 - Hosts: 127.0.0.1 trial.alcohol-soft.com
O1 - Hosts: 127.0.0.1 alcohol-soft.com
O1 - Hosts: 127.0.0.1   www.007guard.com
O1 - Hosts: 127.0.0.1   007guard.com
O1 - Hosts: 127.0.0.1   008i.com
O1 - Hosts: 127.0.0.1   www.008k.com
O1 - Hosts: 127.0.0.1   008k.com
O1 - Hosts: 127.0.0.1   www.00hq.com
O1 - Hosts: 127.0.0.1   00hq.com
O1 - Hosts: 127.0.0.1   010402.com
O1 - Hosts: 127.0.0.1   www.032439.com
O1 - Hosts: 127.0.0.1   032439.com
O1 - Hosts: 127.0.0.1   www.0scan.com
O1 - Hosts: 127.0.0.1   0scan.com
O1 - Hosts: 127.0.0.1   www.1000gratisproben.com
O1 - Hosts: 127.0.0.1   1000gratisproben.com
O1 - Hosts: 127.0.0.1   www.1001namen.com
O1 - Hosts: 127.0.0.1   1001namen.com
O1 - Hosts: 127.0.0.1   100888290cs.com
O1 - Hosts: 127.0.0.1   www.100888290cs.com
O1 - Hosts: 127.0.0.1   100sexlinks.com
O1 - Hosts: 10535 more lines...
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Gears Helper) - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.21.0\gears.dll (Google Inc.)
O4 - HKLM..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent File not found
O4 - HKLM..\Run: [Internet Connection Wizard Setup Tool] C:\Program Files\Internet Explorer\Connection Wizard\icwsetup.exe (http://www.softella.com/)
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation)
O4 - HKCU..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray (Gadu-Gadu S.A.)
O4 - Startup: C:\Documents and Settings\All Users\Application Data\Microsoft\Shortcuts\icwsetup.exe (http://www.softella.com/)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 (Google Inc.)
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra 'Tools' menuitem : Ustawienia wtyczki &Gears - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.21.0\gears.dll (Google Inc.)
O9 - Extra Button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [Obszar nazw Bluetooth] - C:\WINDOWS\system32\wshbth.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} http://www.mks.com.pl/skaner/SkanerOnline.cab (MksSkanerOnline Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter:  - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll -  File not found
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008-07-07 13:28:58 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2005-02-25 18:24:46 | 00,000,051 | R--- | M] () - I:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{48245c40-4c19-11dd-b826-00e07dddfe23}\Shell - "" = AutoRun
O33 - MountPoints2\{48245c40-4c19-11dd-b826-00e07dddfe23}\Shell\AutoRun\command - "" = I:\LaunchU3.exe -- File not found
O34 - HKLM BootExecute: (autocheck) -  File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - * ()

[color=orange]========== Files/Folders - Created Within 30 Days ==========[/color]

[2 C:\WINDOWS\System32\*.tmp files]
[4 C:\WINDOWS\*.tmp files]
[2009-06-02 10:04:59 | 00,000,000 | ---D | C] -- C:\!KillBox
[2009-06-02 09:21:25 | 00,002,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\null.sys
[2009-06-02 09:21:25 | 00,002,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\null.sys
[2009-06-02 09:20:58 | 00,004,224 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\beep.sys
[2009-06-02 09:20:58 | 00,004,224 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\beep.sys
[2009-06-02 09:20:44 | 00,019,968 | ---- | C] (http://www.softella.com/) -- C:\Documents and Settings\All Users\Application Data\Microsoft\Shortcuts\icwsetup.exe
[2009-06-02 09:20:17 | 00,000,032 | --S- | C] () -- C:\WINDOWS\System32\3500322332.dat
[2009-06-02 09:20:10 | 00,051,712 | RHS- | C] () -- C:\WINDOWS\System32\AgCPanelGermant.exe
[2009-05-31 17:56:59 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2009-05-28 20:41:25 | 00,000,700 | ---- | C] () -- C:\Documents and Settings\Xp\Pulpit\jv16 PowerTools.lnk
[2009-05-28 20:41:24 | 00,000,000 | ---D | C] -- C:\Program Files\jv16 PowerTools
[2009-05-26 16:47:36 | 00,000,000 | ---D | C] -- C:\rsit
[2009-05-24 18:32:33 | 00,000,750 | ---- | C] () -- C:\Documents and Settings\Xp\Pulpit\Skrót do VirtualDub.lnk
[2009-05-24 18:20:37 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Ustawienia lokalne\Apps
[2009-05-23 22:28:20 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Moje dokumenty\Eksportowanie HTML programu Picasa
[2009-05-22 21:12:29 | 02,359,350 | ---- | C] () -- C:\WINDOWS\ACD Tapeta.bmp
[2009-05-22 19:21:12 | 00,000,630 | ---- | C] () -- C:\Documents and Settings\Xp\Pulpit\Audacity.lnk
[2009-05-22 19:21:10 | 00,000,000 | ---D | C] -- C:\Program Files\Audacity
[2009-05-22 16:04:53 | 00,184,320 | ---- | C] () -- C:\Documents and Settings\Xp\Moje dokumenty\Recording.mp3
[2009-05-22 15:52:44 | 00,000,730 | ---- | C] () -- C:\Documents and Settings\Xp\Pulpit\mp3DirectCut.lnk
[2009-05-22 15:52:43 | 00,000,000 | ---D | C] -- C:\Program Files\mp3DirectCut
[2009-05-22 15:47:53 | 00,000,000 | ---D | C] -- C:\Program Files\ToniArts
[2009-05-21 18:17:43 | 00,278,528 | ---- | C] (Real Networks, Inc) -- C:\WINDOWS\System32\pncrt.dll
[2009-05-21 18:17:42 | 00,000,000 | ---D | C] -- C:\Program Files\Real Alternative
[2009-05-21 18:17:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Dane aplikacji\Real
[2009-05-21 18:17:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Real
[2009-05-21 18:17:11 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009-05-21 18:17:10 | 00,839,680 | ---- | C] (http://www.mp3dev.org/) -- C:\WINDOWS\System32\lameACM.acm
[2009-05-21 18:17:10 | 00,000,414 | ---- | C] () -- C:\WINDOWS\System32\lame_acm.xml
[2009-05-21 18:17:09 | 00,795,648 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009-05-21 18:17:09 | 00,217,088 | ---- | C] (www.helixcommunity.org) -- C:\WINDOWS\System32\yv12vfw.dll
[2009-05-21 18:17:09 | 00,130,048 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009-05-21 18:17:09 | 00,118,784 | ---- | C] (fccHandler) -- C:\WINDOWS\System32\ac3acm.acm
[2009-05-21 18:17:08 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2009-05-21 18:17:08 | 00,684,032 | ---- | C] (DivX, Inc.) -- C:\WINDOWS\System32\divx.dll
[2009-05-21 18:17:08 | 00,086,016 | ---- | C] (DivX, Inc.) -- C:\WINDOWS\System32\dpl100.dll
[2009-05-21 18:17:06 | 00,067,584 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009-05-21 18:17:06 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009-05-21 18:17:04 | 00,000,000 | ---D | C] -- C:\Program Files\K-Lite Codec Pack
[2009-05-21 18:02:32 | 00,036,928 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2009-05-21 15:16:23 | 00,000,759 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Picasa 3.lnk
[2009-05-21 15:16:03 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\IOSUBSYS
[2009-05-19 21:09:40 | 00,013,944 | ---- | C] () -- C:\WINDOWS\desctemp.dat
[2009-05-19 16:30:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Moje dokumenty\Bluetooth
[2009-05-19 16:30:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Bluetooth
[2009-05-19 16:28:28 | 00,000,032 | ---- | C] () -- C:\WINDOWS\0
[2009-05-19 16:28:28 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\0
[2009-05-19 16:09:19 | 00,037,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\bthmodem.sys
[2009-05-19 16:09:19 | 00,037,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthmodem.sys
[2009-05-19 16:07:26 | 00,101,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\bthpan.sys
[2009-05-19 16:07:26 | 00,101,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthpan.sys
[2009-05-19 16:07:16 | 00,059,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\rfcomm.sys
[2009-05-19 16:07:16 | 00,059,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rfcomm.sys
[2009-05-19 16:07:15 | 00,152,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\irftp.exe
[2009-05-19 16:07:15 | 00,152,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\irftp.exe
[2009-05-19 16:07:15 | 00,028,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\irmon.dll
[2009-05-19 16:07:15 | 00,028,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\irmon.dll
[2009-05-19 16:07:15 | 00,017,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\BthEnum.sys
[2009-05-19 16:07:15 | 00,017,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthenum.sys
[2009-05-19 16:07:14 | 00,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wshirda.dll
[2009-05-19 16:07:14 | 00,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wshirda.dll
[2009-05-19 16:07:04 | 00,018,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\BTHUSB.SYS
[2009-05-19 16:07:04 | 00,018,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthusb.sys
[2009-05-17 08:44:54 | 00,001,836 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Google Earth.lnk
[2009-05-08 17:32:03 | 00,000,156 | ---- | C] () -- C:\WINDOWS\Twunk001.MTX
[2009-05-08 17:32:03 | 00,000,003 | ---- | C] () -- C:\WINDOWS\Twain001.Mtx
[2009-05-08 17:32:03 | 00,000,000 | ---- | C] () -- C:\WINDOWS\Twunk002.MTX
[2009-05-08 17:32:01 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Dane aplikacji\Publish Providers
[2009-05-08 17:31:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Moje dokumenty\My Videos
[2009-05-08 17:31:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Dane aplikacji\Sony
[2009-05-08 17:30:03 | 00,000,000 | ---D | C] -- C:\Program Files\Sony
[2009-05-08 17:26:33 | 00,000,000 | R-SD | C] -- C:\WINDOWS\assembly
[2009-05-08 17:25:41 | 00,000,000 | ---D | C] -- C:\WINDOWS\Microsoft.NET
[2009-05-08 17:23:09 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Dane aplikacji\Sony Setup
[2008-12-28 12:02:51 | 00,069,632 | ---- | C] () -- C:\WINDOWS\System32\JVideoWindow.dll
[2008-12-28 12:02:36 | 00,118,784 | ---- | C] () -- C:\WINDOWS\System32\JVideoSession.dll
[2008-12-28 12:02:19 | 00,098,304 | ---- | C] () -- C:\WINDOWS\System32\JInstantMessaging.dll
[2008-12-28 12:01:27 | 00,040,517 | ---- | C] () -- C:\WINDOWS\System32\jRegistryKey.dll
[2008-12-07 17:14:29 | 00,000,073 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll
[2008-12-07 17:14:29 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\tmpPrst.dll
[2008-12-07 17:14:29 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll
[2008-09-24 16:58:11 | 00,000,144 | ---- | C] () -- C:\WINDOWS\Eudcedit.ini
[2008-08-23 17:18:01 | 00,000,472 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini
[2008-08-10 00:18:13 | 00,000,037 | ---- | C] () -- C:\WINDOWS\Grappler.ini
[2008-07-14 15:03:15 | 00,002,048 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
[2008-07-14 15:03:15 | 00,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll
[2008-07-14 15:03:15 | 00,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll
[2008-07-12 17:59:00 | 00,000,091 | ---- | C] () -- C:\WINDOWS\System32\logon.ini
[2008-07-12 17:53:11 | 00,000,001 | ---- | C] () -- C:\WINDOWS\System32\sav950231.sys
[2008-07-10 19:07:10 | 00,027,019 | ---- | C] () -- C:\WINDOWS\maxlink.ini
[2008-07-08 00:31:02 | 00,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2008-07-07 22:12:26 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008-07-07 22:04:59 | 00,155,136 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347bus.sys
[2008-07-07 22:04:59 | 00,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347prt.sys
[2008-07-07 21:53:06 | 00,685,816 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2008-07-07 17:57:53 | 00,000,477 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2008-07-07 17:57:53 | 00,000,030 | ---- | C] () -- C:\WINDOWS\System32\brss01a.ini
[2008-07-07 17:57:53 | 00,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2008-07-07 15:25:45 | 00,015,360 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2008-07-07 15:20:18 | 00,003,244 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2008-07-07 14:46:57 | 00,000,093 | ---- | C] () -- C:\WINDOWS\AVerTV2K.ini
[2008-05-03 09:24:01 | 00,000,082 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2008-05-03 05:46:00 | 01,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2008-05-03 05:46:00 | 01,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2008-05-03 05:46:00 | 01,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2008-05-03 05:46:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008-05-03 05:46:00 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2007-07-23 09:03:32 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2007-07-23 09:03:32 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2007-07-23 09:03:32 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2007-07-23 09:03:30 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2007-07-23 09:03:30 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2007-07-23 09:03:30 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2007-07-23 09:03:30 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2007-07-23 09:03:30 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2007-07-23 09:03:30 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2007-03-29 23:00:40 | 00,203,264 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll
[2004-08-22 17:04:56 | 00,069,120 | ---- | C] () -- C:\WINDOWS\daemon.dll
[2004-03-18 08:44:29 | 01,663,068 | ---- | C] () -- C:\WINDOWS\System32\libmmd.dll
[2003-04-08 11:40:22 | 00,005,679 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002-03-21 15:39:02 | 00,073,728 | ---- | C] () -- C:\WINDOWS\System32\UNACEV2.DLL
[2002-03-04 10:16:34 | 00,110,592 | R--- | C] () -- C:\WINDOWS\System32\Jpeg32.dll
[2001-07-22 00:16:20 | 00,000,603 | ---- | C] () -- C:\WINDOWS\win.ini
[2001-07-22 00:15:52 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini

[color=orange]========== Files - Modified Within 30 Days ==========[/color]

[2 C:\WINDOWS\System32\*.tmp files]
[4 C:\WINDOWS\*.tmp files]
[2009-06-02 14:25:12 | 00,003,244 | ---- | M] () -- C:\WINDOWS\wincmd.ini
[2009-06-02 10:11:33 | 00,993,330 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009-06-02 10:11:33 | 00,451,564 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat
[2009-06-02 10:11:33 | 00,395,336 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009-06-02 10:11:33 | 00,075,706 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat
[2009-06-02 10:11:33 | 00,059,576 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009-06-02 10:07:45 | 00,182,851 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2009-06-02 10:07:25 | 00,001,032 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job
[2009-06-02 10:07:24 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009-06-02 10:07:23 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\Xp\Ustawienia lokalne\desktop.ini
[2009-06-02 10:07:18 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009-06-02 09:34:39 | 00,001,734 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\HijackThis.lnk
[2009-06-02 09:20:17 | 00,000,032 | --S- | M] () -- C:\WINDOWS\System32\3500322332.dat
[2009-06-02 09:20:10 | 00,019,968 | ---- | M] (http://www.softella.com/) -- C:\Documents and Settings\All Users\Application Data\Microsoft\Shortcuts\icwsetup.exe
[2009-06-02 09:20:09 | 00,051,712 | RHS- | M] () -- C:\WINDOWS\System32\AgCPanelGermant.exe
[2009-06-01 18:27:00 | 00,000,032 | ---- | M] () -- C:\WINDOWS\0
[2009-06-01 18:23:06 | 00,000,603 | ---- | M] () -- C:\WINDOWS\win.ini
[2009-06-01 18:23:06 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2009-06-01 18:23:06 | 00,000,211 | -HS- | M] () -- C:\boot.ini
[2009-06-01 07:51:15 | 00,002,341 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Nokia PC Suite.lnk
[2009-05-28 20:41:25 | 00,000,700 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\jv16 PowerTools.lnk
[2009-05-27 11:25:12 | 00,027,136 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\1.doc
[2009-05-26 20:54:34 | 00,000,472 | ---- | M] () -- C:\WINDOWS\wcx_ftp.ini
[2009-05-24 18:32:33 | 00,000,750 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\Skrót do VirtualDub.lnk
[2009-05-23 10:49:35 | 00,305,998 | R--- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2009-05-22 21:12:29 | 02,359,350 | ---- | M] () -- C:\WINDOWS\ACD Tapeta.bmp
[2009-05-22 19:21:12 | 00,000,630 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\Audacity.lnk
[2009-05-22 16:05:07 | 00,184,320 | ---- | M] () -- C:\Documents and Settings\Xp\Moje dokumenty\Recording.mp3
[2009-05-22 15:52:44 | 00,000,730 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\mp3DirectCut.lnk
[2009-05-21 18:32:35 | 00,002,657 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\ACDSee Pro.lnk
[2009-05-21 18:02:32 | 00,036,928 | -H-- | M] () -- C:\WINDOWS\System32\mlfcache.dat
[2009-05-21 15:16:23 | 00,000,759 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Picasa 3.lnk
[2009-05-21 15:11:16 | 00,000,752 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\CSI Kryminalne Zagadki Las Vegas.lnk
[2009-05-20 13:40:12 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009-05-19 21:09:40 | 00,013,944 | ---- | M] () -- C:\WINDOWS\desctemp.dat
[2009-05-19 17:27:23 | 00,002,645 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2009-05-19 16:28:28 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\0
[2009-05-17 08:44:54 | 00,001,836 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Google Earth.lnk
[2009-05-15 09:59:32 | 00,000,830 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\Counter Strike 1.6 Non Steam.lnk
[2009-05-14 17:56:02 | 01,498,416 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009-05-09 12:25:15 | 00,000,003 | ---- | M] () -- C:\WINDOWS\Twain001.Mtx
[2009-05-09 12:25:10 | 00,000,156 | ---- | M] () -- C:\WINDOWS\Twunk001.MTX
[2009-05-08 17:32:03 | 00,000,000 | ---- | M] () -- C:\WINDOWS\Twunk002.MTX
[2009-05-07 09:16:29 | 24,699,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe

[color=orange]========== Alternate Data Streams ==========[/color]

@Alternate Data Stream - 138 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:05EE1EEF
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:C8B8CEBD
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:94A19129
< End of report >


[wojtas]

Wykonaj to co jest podane w tym temacie


wejdź na dysk na którym masz windows zainstalowany, tam w katalog WINDOWS -> system 32 -> drivers -> etc
i tam za pomocą notatnika otwórz plik hosts

Jeśli są jakieś wpisy pod

# 102.54.94.97 rhino.acme.com # serwer źródłowy
# 38.25.63.10 x.acme.com # komputer kliencki x
127.0.0.1 localhost

to usun tylko zostaw te pokazane przeze mnie wyzej zapisz edytowany plik


Uruchom OTListIt2 i w oknie Custom Scans/Fixes wklej :

:OTLI
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O32 - AutoRun File - [2005-02-25 18:24:46 | 00,000,051 | R--- | M] () - I:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{48245c40-4c19-11dd-b826-00e07dddfe23}\Shell - "" = AutoRun

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .


te plik/i : (moga byc ukryte)

C:\Documents and Settings\All Users\Application Data\Microsoft\Shortcuts\icwsetup.exe
C:\WINDOWS\System32\3500322332.dat
C:\WINDOWS\System32\AgCPanelGermant.exe

przesaknuj tu

http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

[maci]

to usun tylko zostaw te pokazane przeze mnie wyzej zapisz edytowany plik

Jest pod tym co piszesz od groma wpisów,jednak nie mogę tego zapisać w wersji jaka była tylko mi sie zapisuje w pliku txt.Jak to zapisać?


Z otlistem poszło gładko ,wpisałem zresetowałem-ok

Kod: Zaznacz wszystko

========== OTLISTIT ==========
Process explorer.exe killed successfully!
File move failed. I:\autorun.inf scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{48245c40-4c19-11dd-b826-00e07dddfe23}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{48245c40-4c19-11dd-b826-00e07dddfe23}\ not found.
========== COMMANDS ==========
User's Temp folder emptied.
User's Internet Explorer cache folder emptied.
Windows Temp folder emptied.
Java cache emptied.
Temp folders emptied.
Explorer started successfully

OTListIt2 by OldTimer - Version 2.0.15.8 log created on 06022009_163051

Files moved on Reboot...
File move failed. I:\autorun.inf scheduled to be moved on reboot.

Registry entries deleted on Reboot...


log z otlista

Teraz te 3 pliki i rezultaty skanowania

http://virusscan.jotti.org/en/scanresult/777326745a1cbb33f906d90bb39a9a5f49afdef2/c9d276991c498b1eee6eaa7ab460f6fd2d00cd96
http://virusscan.jotti.org/en/scanresult/daa9c499940476330b6538d596e6d903ad8009e6/1cbb6fed84ec4968f254337d34a18e68b7f15ba0

W przypadku tego ostatniego pliku Jotti jak i Virus total pokauzje że jest 0 bajtów i nie skanują nawet go.

http://www.virustotal.com/pl/analisis/e8c8ac428fe98b423e983b4251fc6fa45776407223475cc55f03e0d874a9f863-1243786320

http://www.virustotal.com/pl/analisis/e8dc55a64e2ca7d1706058d5c97163e8115b82c9857194ad792c773127e5f5dd-1243931661

Dodano 02.06.2009 15:57:15:
Dodam jeszcze ,że avast się nie uruchamia przy starcie,natomiast przegladarka się sama otwiera i wyskakuja te strony co na fotce w pierwszym poście.

Ps:wyskoczyła mi jakaś taka strona

Dodano 02.06.2009 16:24:14:
Nie działa menadzer zadań,a także nie moge wejść przez start->uruchom do niczego.Przy uruchomieniu gg (mam do niego hasło)od razu wyskakuej okno że hasło nieprawidłowe ,gdzie hasła jeszcze nawet nie wpisałem.Ale w tym przypadku jak gg uruchamiam ,menadżer zadań jeat aktywny i mozna gg wył.Jaja.....

[wojtas]

Daj loga z combofixa ale zainstaluj wraz z nim konsolę odzyskiwania

[maci]

Daj loga z combofixa ale zainstaluj wraz z nim konsolę odzyskiwania

Pisałem Ci wyżej ,że sobie nie poradzę z tą konsolą,więc się boję combofixem robić

Dodano 02.06.2009 17:57:51:
Jest jakaś szansa abyśmy sobie z tym pordadzili.A co z tym plikiem hosts gdzie nie mogłem zapisać go.Może jakaś inna jest mozliwość niż ten combofix??Wojtas ratuj

[wojtas]

jak nie mozesz zapisac ?? kasujesz wszystkie wpisy zostawiasz to co kazałem i dajesz ctrl + s i powinno sie zapisac

[maci]

jak nie mozesz zapisac ?? kasujesz wszystkie wpisy zostawiasz to co kazałem i dajesz ctrl + s i powinno sie zapisac

No właśnie nie mogę.Proszę oto dowód



A tu jeszcze ostatni log z otlista

Kod: Zaznacz wszystko

Logfile of random's system information tool 1.06 (written by random/random)
Run by Xp at 2009-06-02 19:11:16
Microsoft Windows XP Professional Dodatek Service Pack 3
System drive C: has 37 GB (74%) free of 50 GB
Total RAM: 511 MB (44% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:11:33, on 2009-06-02
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16827)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\brsvc01a.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\brss01a.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\totalcmd\TOTALCMD.EXE
C:\Program Files\Maxthon2\Maxthon.exe
G:\MACIEK\OCHRONA KOMPA\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Xp.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Gears Helper - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.21.0\gears.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [Internet Connection Wizard Setup Tool] C:\Program Files\Internet Explorer\Connection Wizard\icwsetup.exe
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-20\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: icwsetup.exe
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: (no name) - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.21.0\gears.dll
O9 - Extra 'Tools' menuitem: Ustawienia wtyczki &Gears - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.21.0\gears.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: BrSplService (Brother XP spl Service) - brother Industries Ltd - C:\WINDOWS\system32\brsvc01a.exe
O23 - Service: Usługa administracyjna Menedżera dysków logicznych dmadminBITS (dmadminBITS) - Unknown owner - C:\WINDOWS\system32\AgCPanelGermant.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Update Service (gupdate1c98d19bbddcc46) (gupdate1c98d19bbddcc46) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 6542 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53}]
Google Gears Helper - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.21.0\gears.dll [2009-05-19 2097152]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avast!"=C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe [2009-02-05 81000]
"BluetoothAuthenticationAgent"=bthprops.cpl,,BluetoothAuthenticationAgent []
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-03 13529088]
"Internet Connection Wizard Setup Tool"=C:\Program Files\Internet Explorer\Connection Wizard\icwsetup.exe [2009-06-02 19968]
"MSConfig"=C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE [2008-04-14 171520]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Gadu-Gadu"=C:\Program Files\Gadu-Gadu\gg.exe [2007-04-17 2113536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ControlCenter2.0]
C:\Program Files\Brother\ControlCenter2\brctrcen.exe [2005-05-17 933888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Creative WebCam Tray]
C:\Program Files\Creative\Shared Files\CamTray.exe [2005-10-27 299008]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
C:\Program Files\D-Tools\daemon.exe [2004-08-22 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DXDllRegExe]
C:\WINDOWS\system32\dxdllreg.exe [2002-12-12 46592]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
C:\Program Files\Gadu-Gadu\gg.exe [2007-04-17 2113536]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IndexSearch]
C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [2005-03-17 40960]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KernelFaultCheck]
C:\WINDOWS\system32\dumprep 0 -k []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [2007-03-14 54832]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe [2008-04-14 1695232]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
C:\Program Files\Nokia\Nokia PC Suite 6\PCSync2.exe [2008-03-26 1232896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nowe Gadu-Gadu]
C:\Program Files\Nowe Gadu-Gadu\gg.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\WINDOWS\system32\NvCpl.dll [2008-05-03 13529088]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
C:\WINDOWS\system32\NvMcTray.dll [2008-05-03 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
nwiz.exe /install []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PaperPort PTD]
C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [2005-03-17 57393]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe [2008-04-16 1079808]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PcSync]
C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe [2008-03-26 1232896]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PinnacleDriverCheck]
C:\WINDOWS\system32\PSDrvCheck.exe -CheckReg []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [2007-03-14 71216]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SetDefPrt]
C:\Program Files\Brother\Brmfl05a\BrStDvPt.exe [2005-01-26 49152]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Program Files\Skype\Phone\Skype.exe [2009-03-06 24095528]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAX]
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe [2004-08-06 860160]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMAXPnP]
C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe [2004-07-27 1388544]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SSBkgdUpdate]
C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe [2003-10-14 155648]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\UnlockerAssistant]
C:\Program Files\Unlocker\UnlockerAssistant.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Status Monitor.lnk]
C:\PROGRA~1\Brother\Brmfcmon\BrMfcWnd.exe [2005-04-23 802816]

C:\Documents and Settings\All Users\Application Data\Microsoft\Shortcuts
icwsetup.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
WgaLogon.dll []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2008-05-02 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"H:\DC++\DCPlusPlus.exe"="H:\DC++\DCPlusPlus.exe:*:Disabled:DC++"
"C:\WINDOWS\Network Diagnostic\xpnetdiag.exe"="C:\WINDOWS\Network Diagnostic\xpnetdiag.exe:*:Disabled:@xpsp3res.dll,-20000"
"C:\WINDOWS\system32\sessmgr.exe"="C:\WINDOWS\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"G:\MACIEK\GRY\CS\hl.exe"="G:\MACIEK\GRY\CS\hl.exe:*:Enabled:Half-Life Launcher"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Program Files\Gadu-Gadu\gg.exe"="C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program główny"
"C:\Program Files\Maxthon2\Maxthon.exe"="C:\Program Files\Maxthon2\Maxthon.exe:*:Enabled:Maxthon Browser"
"C:\Program Files\SopCast\adv\SopAdver.exe"="C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver"
"H:\SCIAGANE Z DC\Pro Evolution Soccer 2008\PES2008.exe"="H:\SCIAGANE Z DC\Pro Evolution Soccer 2008\PES2008.exe:*:Enabled:Pro Evolution Soccer 2008"
"E:\RÓŻNE\GRY\Footballmanager 2009\fm.exe"="E:\RÓŻNE\GRY\Footballmanager 2009\fm.exe:*:Disabled:Football Manager 2009"
"C:\WINDOWS\system32\dpnsvr.exe"="C:\WINDOWS\system32\dpnsvr.exe:*:Disabled:Microsoft DirectPlay8 Server"
"C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe"="C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe:*:Enabled:BlueSoleil"
"C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ccdf1a8-4c5f-11dd-b82f-00e07dddfe23}]
shell\AutoRun\command - I:\Install.exe


======List of files/folders created in the last 1 months======

2009-06-02 18:53:50 ----D---- C:\32788R22FWJFW
2009-06-02 10:04:59 ----D---- C:\!KillBox
2009-06-02 09:20:10 ----RSH---- C:\WINDOWS\system32\AgCPanelGermant.exe
2009-05-31 17:56:59 ----D---- C:\WINDOWS\system32\NtmsData
2009-05-28 20:41:24 ----D---- C:\Program Files\jv16 PowerTools
2009-05-26 16:47:36 ----D---- C:\rsit
2009-05-22 19:21:10 ----D---- C:\Program Files\Audacity
2009-05-22 15:52:43 ----D---- C:\Program Files\mp3DirectCut
2009-05-22 15:47:53 ----D---- C:\Program Files\ToniArts
2009-05-21 18:17:43 ----A---- C:\WINDOWS\system32\rmoc3260.dll
2009-05-21 18:17:43 ----A---- C:\WINDOWS\system32\pndx5032.dll
2009-05-21 18:17:43 ----A---- C:\WINDOWS\system32\pndx5016.dll
2009-05-21 18:17:43 ----A---- C:\WINDOWS\system32\pncrt.dll
2009-05-21 18:17:42 ----D---- C:\Program Files\Real Alternative
2009-05-21 18:17:42 ----D---- C:\Documents and Settings\Xp\Dane aplikacji\Real
2009-05-21 18:17:42 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Real
2009-05-21 18:17:11 ----A---- C:\WINDOWS\system32\unrar.dll
2009-05-21 18:17:09 ----A---- C:\WINDOWS\system32\yv12vfw.dll
2009-05-21 18:17:09 ----A---- C:\WINDOWS\system32\xvidvfw.dll
2009-05-21 18:17:09 ----A---- C:\WINDOWS\system32\xvidcore.dll
2009-05-21 18:17:08 ----A---- C:\WINDOWS\system32\qt-dx331.dll
2009-05-21 18:17:08 ----A---- C:\WINDOWS\system32\dpl100.dll
2009-05-21 18:17:08 ----A---- C:\WINDOWS\system32\divx.dll
2009-05-21 18:17:06 ----A---- C:\WINDOWS\system32\ff_vfw.dll.manifest
2009-05-21 18:17:06 ----A---- C:\WINDOWS\system32\ff_vfw.dll
2009-05-21 18:17:04 ----D---- C:\Program Files\K-Lite Codec Pack
2009-05-21 15:16:03 ----D---- C:\WINDOWS\system32\IOSUBSYS
2009-05-19 16:30:44 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Bluetooth
2009-05-19 16:07:15 ----A---- C:\WINDOWS\system32\irmon.dll
2009-05-19 16:07:15 ----A---- C:\WINDOWS\system32\irftp.exe
2009-05-19 16:07:14 ----A---- C:\WINDOWS\system32\wshirda.dll
2009-05-08 17:32:01 ----D---- C:\Documents and Settings\Xp\Dane aplikacji\Publish Providers
2009-05-08 17:31:31 ----D---- C:\Documents and Settings\Xp\Dane aplikacji\Sony
2009-05-08 17:30:03 ----D---- C:\Program Files\Sony
2009-05-08 17:26:33 ----RSD---- C:\WINDOWS\assembly
2009-05-08 17:25:41 ----D---- C:\WINDOWS\Microsoft.NET
2009-05-08 17:23:09 ----D---- C:\Documents and Settings\Xp\Dane aplikacji\Sony Setup

======List of files/folders modified in the last 1 months======

2009-06-02 19:11:12 ----D---- C:\WINDOWS\Prefetch
2009-06-02 19:09:57 ----D---- C:\Documents and Settings\Xp\Dane aplikacji\MxBoost
2009-06-02 17:26:43 ----A---- C:\WINDOWS\wincmd.ini
2009-06-02 17:22:49 ----SH---- C:\boot.ini
2009-06-02 17:22:49 ----A---- C:\WINDOWS\win.ini
2009-06-02 17:22:49 ----A---- C:\WINDOWS\system.ini
2009-06-02 16:36:40 ----D---- C:\WINDOWS\system32
2009-06-02 16:36:40 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-06-02 16:33:06 ----D---- C:\WINDOWS\Temp
2009-06-02 16:31:46 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-06-02 10:06:34 ----D---- C:\WINDOWS\system32\CatRoot2
2009-06-02 09:21:41 ----D---- C:\WINDOWS\system32\drivers
2009-06-02 09:21:30 ----D---- C:\WINDOWS\system32\dllcache
2009-06-01 18:29:01 ----D---- C:\WINDOWS\security
2009-06-01 18:27:06 ----SHD---- C:\WINDOWS\Installer
2009-06-01 18:26:57 ----RD---- C:\Program Files
2009-06-01 18:26:53 ----HD---- C:\WINDOWS\inf
2009-06-01 07:54:25 ----D---- C:\Documents and Settings\Xp\Dane aplikacji\Nokia
2009-05-31 21:48:53 ----D---- C:\Documents and Settings\Xp\Dane aplikacji\Skype
2009-05-30 13:19:52 ----D---- C:\Program Files\Outlook Express
2009-05-29 10:37:02 ----D---- C:\Program Files\VirtualDub-1.8.8
2009-05-29 10:03:26 ----D---- C:\Program Files\Google
2009-05-28 21:12:55 ----D---- C:\WINDOWS
2009-05-28 21:12:55 ----D---- C:\Program Files\Common Files
2009-05-26 20:54:34 ----A---- C:\WINDOWS\wcx_ftp.ini
2009-05-26 16:31:47 ----D---- C:\WINDOWS\Minidump
2009-05-24 18:40:37 ----SD---- C:\Documents and Settings\Xp\Dane aplikacji\Microsoft
2009-05-22 15:47:53 ----HD---- C:\Program Files\InstallShield Installation Information
2009-05-21 18:13:38 ----D---- C:\WINDOWS\system
2009-05-19 21:01:03 ----D---- C:\WINDOWS\system32\wbem
2009-05-18 17:19:43 ----D---- C:\Documents and Settings\Xp\Dane aplikacji\Creative
2009-05-14 17:25:59 ----D---- C:\Program Files\SkanerOnline
2009-05-14 17:25:12 ----RSD---- C:\WINDOWS\Fonts
2009-05-14 17:23:12 ----D---- C:\WINDOWS\system32\QuickTime
2009-05-09 12:33:25 ----AD---- C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2009-05-08 17:26:35 ----D---- C:\WINDOWS\WinSxS
2009-05-08 17:25:46 ----D---- C:\WINDOWS\system32\mui
2009-05-08 17:25:46 ----D---- C:\Program Files\Internet Explorer
2009-05-07 09:16:29 ----A---- C:\WINDOWS\system32\MRT.exe
2009-05-06 13:20:53 ----SD---- C:\WINDOWS\Tasks

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 Aavmker4;avast! Asynchronous Virus Monitor; C:\WINDOWS\system32\drivers\Aavmker4.sys [2009-02-05 26944]
R1 aswSP;avast! Self Protection; C:\WINDOWS\system32\drivers\aswSP.sys [2009-02-05 114768]
R1 aswTdi;avast! Network Shield Support; C:\WINDOWS\system32\drivers\aswTdi.sys [2009-02-05 51376]
R1 intelppm;Sterownik procesora Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40448]
R1 kbdhid;Sterownik klawiatury HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
R1 PCLEPCI;PCLEPCI; \??\C:\WINDOWS\system32\drivers\pclepci.sys []
R1 sf;SFI Service; C:\WINDOWS\system32\drivers\sf.sys [2004-08-28 33995]
R2 {95808DC4-FA4A-4C74-92FE-5B863F82066B};{95808DC4-FA4A-4C74-92FE-5B863F82066B}; \??\C:\Program Files\CyberLink\PowerDVD\000.fcl []
R2 aswFsBlk;aswFsBlk; C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
R2 aswMon2;avast! Standard Shield Support; C:\WINDOWS\system32\drivers\aswMon2.sys [2009-02-05 94032]
R2 BT848;Conexant's BtPCI WDM Video Capture; C:\WINDOWS\system32\drivers\BT848.sys [2009-02-15 371349]
R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2004-05-17 133200]
R3 BrScnUsb;Brother USB Still Image driver; C:\WINDOWS\System32\Drivers\BrScnUsb.sys [2004-10-15 15295]
R3 BthEnum;Sterownik Bluetooth Request Block; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2008-04-14 17024]
R3 BTHMODEM;Sterownik komunikacyjny modemu Bluetooth; C:\WINDOWS\system32\DRIVERS\bthmodem.sys [2008-04-14 37888]
R3 BthPan;Bluetooth Device (Personal Area Network); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2008-04-14 101120]
R3 BTHUSB;Sterownik USB odbiornika radiowego Bluetooth; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2008-04-14 18944]
R3 HidUsb;Sterownik Microsoft klasy HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 MarvinBus;Pinnacle Marvin Bus; C:\WINDOWS\system32\DRIVERS\MarvinBus.sys [2004-06-21 78976]
R3 mouhid;Sterownik myszy HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-26 12160]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-03 6554496]
R3 pfc;Padus ASPI Shell; C:\WINDOWS\system32\drivers\pfc.sys [2009-04-21 10368]
R3 RFCOMM;Urządzenie Bluetooth (Protokół TDI RFCOMM); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2008-04-14 59136]
R3 rtl8139;Sterownik NT karty Realtek RTL8139(A/B/C)-based PCI Fast Ethernet; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2008-04-14 20992]
R3 senfilt;senfilt; C:\WINDOWS\system32\drivers\senfilt.sys [2004-04-26 381056]
R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2004-09-01 259648]
R3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Standardowy sterownik koncentratora USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
R3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S3 aswRdr;aswRdr; C:\WINDOWS\system32\drivers\aswRdr.sys [2009-02-05 23152]
S3 BlueletAudio;Bluetooth Audio Service; C:\WINDOWS\system32\DRIVERS\blueletaudio.sys []
S3 BlueletSCOAudio;Bluetooth SCO Audio Service; C:\WINDOWS\system32\DRIVERS\BlueletSCOAudio.sys []
S3 BT;Bluetooth PAN Network Adapter; C:\WINDOWS\system32\DRIVERS\btnetdrv.sys []
S3 Btcsrusb;Bluetooth USB For Bluetooth Service; C:\WINDOWS\System32\Drivers\btcusb.sys []
S3 BTHPORT;Sterownik portu Bluetooth; C:\WINDOWS\System32\Drivers\BTHport.sys [2008-06-14 273024]
S3 CCDECODE;Dekoder napisów; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 HWIONT;HWIONT; \??\E:\RÓŻNE\MORE TV\HWIONT.sys []
S3 mcdevice;mcdevice; C:\WINDOWS\system32\DRIVERS\mcdevice.sys [2007-12-05 15872]
S3 MidiSyn;MidiSyn; C:\WINDOWS\system32\drivers\MidiSyn.sys [2002-09-20 235100]
S3 MSTEE;Konwerter strumieni Tee/Sink-to-Sink Microsoft Streaming; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;Koder-dekoder NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Połączenie TV/wideo firmy Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2008-09-15 17664]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2008-09-15 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2007-09-17 21632]
S3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2001-08-17 5888]
S3 SE27bus;Sony Ericsson Device 039 Driver driver (WDM); C:\WINDOWS\system32\DRIVERS\SE27bus.sys [2006-09-18 61600]
S3 SE27mdfl;Sony Ericsson Device 039 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\SE27mdfl.sys [2006-09-18 9360]
S3 SE27mdm;Sony Ericsson Device 039 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\SE27mdm.sys [2006-09-18 97184]
S3 SE27mgmt;Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\SE27mgmt.sys [2006-09-18 88688]
S3 se27nd5;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS); C:\WINDOWS\system32\DRIVERS\se27nd5.sys [2006-09-18 18704]
S3 SE27obex;Sony Ericsson Device 039 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\SE27obex.sys [2006-09-18 86560]
S3 se27unic;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM); C:\WINDOWS\system32\DRIVERS\se27unic.sys [2006-09-18 90800]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 SONYPVU1;Sterownik filtru USB Sony (SONYPVU1); C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS [2001-08-17 7552]
S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2008-09-15 8064]
S3 usbscan;Sterownik skanera USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\DRIVERS\usbser.sys [2008-04-14 26112]
S3 V0260VID;Live! Cam Vista IM; C:\WINDOWS\system32\DRIVERS\V0260Vid.sys [2006-04-01 162176]
S3 VComm;Virtual Serial port driver; C:\WINDOWS\system32\DRIVERS\VComm.sys []
S3 VcommMgr;Bluetooth VComm Manager Service; C:\WINDOWS\System32\Drivers\VcommMgr.sys []
S3 VHidMinidrv;Bluetooth HID Device Service; C:\WINDOWS\system32\drivers\VHIDMini.sys []
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2008-03-27 503008]
S3 WSTCODEC;Kodery-dekodery teletekstu w standardzie światowym; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Brother XP spl Service;BrSplService; C:\WINDOWS\system32\brsvc01a.exe [2002-04-12 57344]
R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-03 159812]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared files\RichVideo.exe [2007-05-14 272024]
R2 SoundMAX Agent Service (default);SoundMAX Agent Service; C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe [2002-09-20 45056]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 aswUpdSv;avast! iAVS4 Control Service; C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe [2009-02-05 18752]
S2 avast! Antivirus;avast! Antivirus; C:\Program Files\Alwil Software\Avast4\ashServ.exe [2009-02-05 138680]
S2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files\Bonjour\mDNSResponder.exe [2006-02-28 229376]
S2 dmadminBITS;Usługa administracyjna Menedżera dysków logicznych dmadminBITS; C:\WINDOWS\system32\AgCPanelGermant.exe [2009-06-02 51712]
S2 gupdate1c98d19bbddcc46;Google Update Service (gupdate1c98d19bbddcc46); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-02-12 133104]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 avast! Mail Scanner;avast! Mail Scanner; C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe [2009-02-05 254040]
S3 avast! Web Scanner;avast! Web Scanner; C:\Program Files\Alwil Software\Avast4\ashWebSv.exe [2009-02-05 352920]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-04-14 654848]
S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-20 136120]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136]
S3 ServiceLayer;ServiceLayer; C:\Program Files\PC Connectivity Solution\ServiceLayer.exe [2008-04-07 430592]
S3 WMPNetworkSvc;Usługa udostępniania w sieci programu Windows Media Player; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-12-01 918016]

-----------------EOF-----------------


[wojtas]

moze przenies ten plik na pulpit.. wtedy skasuj zawartosc odpowiednia gdy bedziesz mial go na pulpicie i wtedy zapisz.. i wrzuc znowu do folderu etc.. bo nie masz wirusów na kompie.. moze to falszywy alarm?

[maci]

Oki .To jeszcze Ci powiem co zauważyłem.Wyskakują cały czas te strony z częstotliwoscią 5 minutowa.Nie odpale gg.Nie sciągnę nic z neta.Nie wejde w menadzera zadań ,chyba że jest zproblem z gg o któym pisałem w poprzednim poscie.Nie odpala sie avast przy starcie.Cieszę sie że nie ma wirusów jak piszesz,ale w takim razie co to mogło się stać ,że są takie jaja??

*****************E****************D******************I********************T***************

Jakoś się udało z tym plikiem.Zapisał się jako txt,usunąłem później mu rozszerzenie txt i jest ok.To jeszcze teraz trzeba włączyć avasta przy starcie systemu i wyeliminować te wyskakujące strony:)

Ten pieprzony adres http://89.149.244.137/default.aspx?ver=1007&uid=64260839733f6b1c

Ostatni log

Kod: Zaznacz wszystko

OTListIt logfile created on: 2009-06-02 19:46:37 - Run 2
OTListIt2 by OldTimer - Version 2.0.15.8     Folder = G:\MACIEK\OCHRONA KOMPA
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

510,68 Mb Total Physical Memory | 240,07 Mb Available Physical Memory | 47,01% Memory free
1,22 Gb Paging File | 1,00 Gb Available in Paging File | 81,97% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 48,83 Gb Total Space | 35,99 Gb Free Space | 73,72% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 124,63 Gb Total Space | 108,29 Gb Free Space | 86,89% Space Free | Partition Type: NTFS
Drive F: | 124,63 Gb Total Space | 118,88 Gb Free Space | 95,39% Space Free | Partition Type: NTFS
Drive G: | 97,65 Gb Total Space | 27,07 Gb Free Space | 27,72% Space Free | Partition Type: NTFS
Drive H: | 135,23 Gb Total Space | 15,79 Gb Free Space | 11,68% Space Free | Partition Type: NTFS
Drive I: | 3,94 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF

Computer Name: SPECIAL-XP
Current User Name: Xp
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Standard
File Age = 30 Days
Company Name Whitelist: On

[color=orange]========== Processes (SafeList) ==========[/color]

PRC - [2008-04-14 22:51:18 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2002-04-12 02:00:00 | 00,057,344 | ---- | M] (brother Industries Ltd) -- C:\WINDOWS\system32\brsvc01a.exe
PRC - [2001-12-13 02:01:00 | 00,045,056 | ---- | M] (brother Industries Ltd) -- C:\WINDOWS\system32\brss01a.exe
PRC - [2007-04-17 13:12:28 | 02,113,536 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\gg.exe
PRC - [2009-02-12 15:56:36 | 00,133,104 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Update\GoogleUpdate.exe
PRC - [2006-02-28 12:42:38 | 00,229,376 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe
PRC - [2008-05-03 05:46:00 | 00,159,812 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe
PRC - [2007-05-14 12:54:36 | 00,272,024 | ---- | M] () -- C:\Program Files\CyberLink\Shared files\RichVideo.exe
PRC - [2002-09-20 15:50:10 | 00,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
PRC - [2008-06-17 07:32:24 | 03,417,344 | ---- | M] (Maxthon International ltd.) -- C:\Program Files\Maxthon2\Maxthon.exe
PRC - [2009-02-06 12:10:02 | 00,227,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\wmiprvse.exe
PRC - [2008-04-22 07:03:00 | 01,083,848 | ---- | M] (C. Ghisler & Co.) -- C:\totalcmd\TOTALCMD.EXE
PRC - [2009-06-02 14:25:21 | 00,501,248 | ---- | M] (OldTimer Tools) -- G:\MACIEK\OCHRONA KOMPA\OTListIt2.exe

[color=orange]========== Win32 Services (SafeList) ==========[/color]

SRV - [2005-09-23 07:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2009-02-05 23:01:25 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv [Auto | Stopped])
SRV - [2009-02-05 23:08:40 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus [Auto | Stopped])
SRV - [2009-02-05 23:08:26 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner [On_Demand | Stopped])
SRV - [2009-02-05 23:06:04 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner [On_Demand | Stopped])
SRV - [2006-02-28 12:42:38 | 00,229,376 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service [Auto | Running])
SRV - [2002-04-12 02:00:00 | 00,057,344 | ---- | M] (brother Industries Ltd) -- C:\WINDOWS\system32\brsvc01a.exe -- (Brother XP spl Service [Auto | Running])
SRV - [2005-09-23 07:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2009-06-02 09:20:09 | 00,051,712 | RHS- | M] () -- C:\WINDOWS\system32\AgCPanelGermant.exe -- (dmadminBITS [Auto | Stopped])
SRV - [2009-04-14 13:42:03 | 00,654,848 | ---- | M] (Macrovision Europe Ltd.) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service [On_Demand | Stopped])
SRV - [2009-02-12 15:56:36 | 00,133,104 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Update\GoogleUpdate.exe -- (gupdate1c98d19bbddcc46 [Auto | Stopped])
SRV - [2008-11-20 21:18:52 | 00,136,120 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc [On_Demand | Stopped])
SRV - [2008-04-14 22:50:46 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2004-10-22 03:24:18 | 00,073,728 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped])
SRV - [2008-05-03 05:46:00 | 00,159,812 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc [Auto | Running])
SRV - [2003-07-28 20:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2007-05-14 12:54:36 | 00,272,024 | ---- | M] () -- C:\Program Files\CyberLink\Shared files\RichVideo.exe -- (RichVideo [Auto | Running])
SRV - [2008-04-07 09:17:30 | 00,430,592 | ---- | M] (Nokia.) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer [On_Demand | Stopped])
SRV - [2002-09-20 15:50:10 | 00,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default) [Auto | Running])
SRV - [2006-12-01 11:46:28 | 00,918,016 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])

[color=orange]========== Driver Services (SafeList) ==========[/color]

DRV - [2009-02-05 23:05:11 | 00,026,944 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4 [System | Running])
DRV - [2004-05-17 11:23:48 | 00,133,200 | ---- | M] (Andrea Electronics Corporation) -- C:\WINDOWS\system32\drivers\aeaudio.sys -- (aeaudio [On_Demand | Running])
DRV - [2009-02-05 23:07:12 | 00,020,560 | ---- | M] (ALWIL Software) -- C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys -- (aswFsBlk [Auto | Running])
DRV - [2009-02-05 23:08:10 | 00,094,032 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2 [Auto | Running])
DRV - [2009-02-05 23:06:10 | 00,023,152 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr [On_Demand | Stopped])
DRV - [2009-02-05 23:07:23 | 00,114,768 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP [System | Running])
DRV - [2009-02-05 23:06:20 | 00,051,376 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi [System | Running])
DRV - [2004-10-15 05:50:20 | 00,015,295 | ---- | M] (Brother Industries Ltd.) -- C:\WINDOWS\System32\Drivers\BrScnUsb.sys -- (BrScnUsb [On_Demand | Running])
DRV - [2009-02-15 00:10:11 | 00,371,349 | ---- | M] (Illusion & Hope.) -- C:\WINDOWS\system32\drivers\BT848.sys -- (BT848 [Auto | Running])
DRV - [2004-08-22 16:31:10 | 00,155,136 | ---- | M] ( ) -- C:\WINDOWS\system32\DRIVERS\d347bus.sys -- (d347bus [Boot | Running])
DRV - [2004-08-22 16:31:48 | 00,005,248 | ---- | M] ( ) -- C:\WINDOWS\System32\Drivers\d347prt.sys -- (d347prt [Boot | Running])
DRV - [2002-04-14 17:23:00 | 00,016,588 | ---- | M] (The freeware company) -- E:\RÓŻNE\MORE TV\HWIONT.sys -- (HWIONT [On_Demand | Stopped])
DRV - [2004-06-21 16:03:22 | 00,078,976 | ---- | M] (Pinnacle Systems GmbH) -- C:\WINDOWS\system32\DRIVERS\MarvinBus.sys -- (MarvinBus [On_Demand | Running])
DRV - [2007-12-05 23:34:18 | 00,004,864 | ---- | M] (ShiningMorning Inc.) -- C:\WINDOWS\system32\drivers\mcctl.sys -- (mcctl [Boot | Running])
DRV - [2007-12-05 23:45:20 | 00,015,872 | ---- | M] (ShiningMorning Inc.) -- C:\WINDOWS\system32\DRIVERS\mcdevice.sys -- (mcdevice [On_Demand | Stopped])
DRV - [2002-09-20 11:53:34 | 00,235,100 | ---- | M] (Analog Devices Inc) -- C:\WINDOWS\system32\drivers\MidiSyn.sys -- (MidiSyn [On_Demand | Stopped])
DRV - [2008-09-15 08:56:24 | 00,017,664 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd [On_Demand | Stopped])
DRV - [2008-09-15 08:56:24 | 00,022,016 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc [On_Demand | Stopped])
DRV - [2008-05-03 05:46:00 | 06,554,496 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Running])
DRV - [2007-09-17 15:53:26 | 00,021,632 | ---- | M] (Nokia) -- C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys -- (pccsmcfd [On_Demand | Stopped])
DRV - [2002-03-19 10:29:16 | 00,014,165 | ---- | M] (Pinnacle Systems GmbH) -- C:\WINDOWS\system32\drivers\pclepci.sys -- (PCLEPCI [System | Running])
DRV - [2009-04-21 21:02:23 | 00,010,368 | ---- | M] (Padus, Inc.) -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc [On_Demand | Running])
DRV - [2001-08-17 23:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2008-11-20 21:19:06 | 00,043,872 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running])
DRV - [2001-08-17 23:57:36 | 00,005,888 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\Drivers\RootMdm.sys -- (ROOTMODEM [On_Demand | Stopped])
DRV - [2008-04-14 00:05:40 | 00,020,992 | ---- | M] (Realtek Semiconductor Corporation) -- C:\WINDOWS\system32\DRIVERS\RTL8139.SYS -- (rtl8139 [On_Demand | Running])
DRV - [2006-09-18 14:58:48 | 00,061,600 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\SE27bus.sys -- (SE27bus [On_Demand | Stopped])
DRV - [2006-09-18 14:58:52 | 00,009,360 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\SE27mdfl.sys -- (SE27mdfl [On_Demand | Stopped])
DRV - [2006-09-18 14:58:54 | 00,097,184 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\SE27mdm.sys -- (SE27mdm [On_Demand | Stopped])
DRV - [2006-09-18 14:58:58 | 00,088,688 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\SE27mgmt.sys -- (SE27mgmt [On_Demand | Stopped])
DRV - [2006-09-18 14:59:00 | 00,018,704 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\se27nd5.sys -- (se27nd5 [On_Demand | Stopped])
DRV - [2006-09-18 14:59:02 | 00,086,560 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\SE27obex.sys -- (SE27obex [On_Demand | Stopped])
DRV - [2006-09-18 14:59:08 | 00,090,800 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\se27unic.sys -- (se27unic [On_Demand | Stopped])
DRV - [2008-04-13 22:09:18 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped])
DRV - [2004-04-26 10:49:56 | 00,381,056 | ---- | M] (Sensaura) -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt [On_Demand | Running])
DRV - [2004-08-28 13:54:38 | 00,033,995 | ---- | M] (Sonic Focus, Inc) -- C:\WINDOWS\system32\drivers\sf.sys -- (sf [System | Running])
DRV - [2008-05-02 08:48:55 | 00,062,208 | ---- | M] (Silicon Image, Inc.) -- C:\WINDOWS\System32\drivers\si3112.sys -- (Si3112 [Boot | Running])
DRV - [2004-09-01 12:18:40 | 00,259,648 | ---- | M] (Analog Devices, Inc.) -- C:\WINDOWS\system32\drivers\smwdm.sys -- (smwdm [On_Demand | Running])
DRV - [2001-08-17 22:56:16 | 00,007,552 | ---- | M] (Sony Corporation) -- C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS -- (SONYPVU1 [On_Demand | Stopped])
DRV - [2008-07-07 21:53:06 | 00,685,816 | ---- | M] () -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd [Boot | Running])
DRV - [2008-09-15 08:56:24 | 00,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) -- C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys -- (upperdev [On_Demand | Stopped])
DRV - [2008-04-14 00:15:38 | 00,026,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\DRIVERS\usbser.sys -- (usbser [On_Demand | Stopped])
DRV - [2006-04-01 17:16:44 | 00,162,176 | R--- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\DRIVERS\V0260Vid.sys -- (V0260VID [On_Demand | Stopped])
DRV - [2007-09-19 22:37:48 | 00,041,456 | ---- | M] (Cyberlink Corp.) -- C:\Program Files\CyberLink\PowerDVD\000.fcl -- ({95808DC4-FA4A-4C74-92FE-5B863F82066B} [Auto | Running])

[color=orange]========== Standard Registry (SafeList) ==========[/color]


[color=orange]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =  [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

FF - HKLM\software\mozilla\Firefox\Extensions\\{000a9d1c-beef-4f90-9363-039d445309b8}: C:\PROGRAM FILES\GOOGLE\GOOGLE GEARS\FIREFOX\ [2009-05-29 10:03:27 | 00,000,000 | ---D | M]


O1 HOSTS File: (740 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Gears Helper) - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.21.0\gears.dll (Google Inc.)
O4 - HKLM..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent File not found
O4 - HKLM..\Run: [Internet Connection Wizard Setup Tool] C:\Program Files\Internet Explorer\Connection Wizard\icwsetup.exe (http://www.softella.com/)
O4 - HKLM..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation)
O4 - HKCU..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray (Gadu-Gadu S.A.)
O4 - Startup: C:\Documents and Settings\All Users\Application Data\Microsoft\Shortcuts\icwsetup.exe (http://www.softella.com/)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 (Google Inc.)
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra 'Tools' menuitem : Ustawienia wtyczki &Gears - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.21.0\gears.dll (Google Inc.)
O9 - Extra Button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [Obszar nazw Bluetooth] - C:\WINDOWS\system32\wshbth.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} http://www.mks.com.pl/skaner/SkanerOnline.cab (MksSkanerOnline Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter:  - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll -  File not found
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008-07-07 13:28:58 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2005-02-25 18:24:46 | 00,000,051 | R--- | M] () - I:\autorun.inf -- [ UDF ]
O34 - HKLM BootExecute: (autocheck) -  File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - * [2009-06-02 19:46:21 | 00,000,000 | ---D | M]

[color=orange]========== Files/Folders - Created Within 30 Days ==========[/color]

[2 C:\WINDOWS\System32\*.tmp files]
[4 C:\WINDOWS\*.tmp files]
[2009-06-02 18:53:50 | 00,000,000 | ---D | C] -- C:\32788R22FWJFW
[2009-06-02 10:04:59 | 00,000,000 | ---D | C] -- C:\!KillBox
[2009-06-02 09:21:25 | 00,002,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\null.sys
[2009-06-02 09:21:25 | 00,002,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\null.sys
[2009-06-02 09:20:58 | 00,004,224 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\beep.sys
[2009-06-02 09:20:58 | 00,004,224 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\beep.sys
[2009-06-02 09:20:44 | 00,019,968 | ---- | C] (http://www.softella.com/) -- C:\Documents and Settings\All Users\Application Data\Microsoft\Shortcuts\icwsetup.exe
[2009-06-02 09:20:17 | 00,000,032 | --S- | C] () -- C:\WINDOWS\System32\3500322332.dat
[2009-06-02 09:20:10 | 00,051,712 | RHS- | C] () -- C:\WINDOWS\System32\AgCPanelGermant.exe
[2009-05-31 17:56:59 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2009-05-28 20:41:25 | 00,000,700 | ---- | C] () -- C:\Documents and Settings\Xp\Pulpit\jv16 PowerTools.lnk
[2009-05-28 20:41:24 | 00,000,000 | ---D | C] -- C:\Program Files\jv16 PowerTools
[2009-05-26 16:47:36 | 00,000,000 | ---D | C] -- C:\rsit
[2009-05-24 18:32:33 | 00,000,750 | ---- | C] () -- C:\Documents and Settings\Xp\Pulpit\Skrót do VirtualDub.lnk
[2009-05-24 18:20:37 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Ustawienia lokalne\Apps
[2009-05-23 22:28:20 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Moje dokumenty\Eksportowanie HTML programu Picasa
[2009-05-22 21:12:29 | 02,359,350 | ---- | C] () -- C:\WINDOWS\ACD Tapeta.bmp
[2009-05-22 19:21:12 | 00,000,630 | ---- | C] () -- C:\Documents and Settings\Xp\Pulpit\Audacity.lnk
[2009-05-22 19:21:10 | 00,000,000 | ---D | C] -- C:\Program Files\Audacity
[2009-05-22 16:04:53 | 00,184,320 | ---- | C] () -- C:\Documents and Settings\Xp\Moje dokumenty\Recording.mp3
[2009-05-22 15:52:44 | 00,000,730 | ---- | C] () -- C:\Documents and Settings\Xp\Pulpit\mp3DirectCut.lnk
[2009-05-22 15:52:43 | 00,000,000 | ---D | C] -- C:\Program Files\mp3DirectCut
[2009-05-22 15:47:53 | 00,000,000 | ---D | C] -- C:\Program Files\ToniArts
[2009-05-21 18:17:43 | 00,278,528 | ---- | C] (Real Networks, Inc) -- C:\WINDOWS\System32\pncrt.dll
[2009-05-21 18:17:42 | 00,000,000 | ---D | C] -- C:\Program Files\Real Alternative
[2009-05-21 18:17:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Dane aplikacji\Real
[2009-05-21 18:17:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Real
[2009-05-21 18:17:11 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009-05-21 18:17:10 | 00,839,680 | ---- | C] (http://www.mp3dev.org/) -- C:\WINDOWS\System32\lameACM.acm
[2009-05-21 18:17:10 | 00,000,414 | ---- | C] () -- C:\WINDOWS\System32\lame_acm.xml
[2009-05-21 18:17:09 | 00,795,648 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009-05-21 18:17:09 | 00,217,088 | ---- | C] (www.helixcommunity.org) -- C:\WINDOWS\System32\yv12vfw.dll
[2009-05-21 18:17:09 | 00,130,048 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009-05-21 18:17:09 | 00,118,784 | ---- | C] (fccHandler) -- C:\WINDOWS\System32\ac3acm.acm
[2009-05-21 18:17:08 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2009-05-21 18:17:08 | 00,684,032 | ---- | C] (DivX, Inc.) -- C:\WINDOWS\System32\divx.dll
[2009-05-21 18:17:08 | 00,086,016 | ---- | C] (DivX, Inc.) -- C:\WINDOWS\System32\dpl100.dll
[2009-05-21 18:17:06 | 00,067,584 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009-05-21 18:17:06 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009-05-21 18:17:04 | 00,000,000 | ---D | C] -- C:\Program Files\K-Lite Codec Pack
[2009-05-21 18:02:32 | 00,036,928 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2009-05-21 15:16:23 | 00,000,759 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Picasa 3.lnk
[2009-05-21 15:16:03 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\IOSUBSYS
[2009-05-19 21:09:40 | 00,013,944 | ---- | C] () -- C:\WINDOWS\desctemp.dat
[2009-05-19 16:30:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Moje dokumenty\Bluetooth
[2009-05-19 16:30:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Bluetooth
[2009-05-19 16:28:28 | 00,000,032 | ---- | C] () -- C:\WINDOWS\0
[2009-05-19 16:28:28 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\0
[2009-05-19 16:09:19 | 00,037,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\bthmodem.sys
[2009-05-19 16:09:19 | 00,037,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthmodem.sys
[2009-05-19 16:07:26 | 00,101,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\bthpan.sys
[2009-05-19 16:07:26 | 00,101,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthpan.sys
[2009-05-19 16:07:16 | 00,059,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\rfcomm.sys
[2009-05-19 16:07:16 | 00,059,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rfcomm.sys
[2009-05-19 16:07:15 | 00,152,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\irftp.exe
[2009-05-19 16:07:15 | 00,152,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\irftp.exe
[2009-05-19 16:07:15 | 00,028,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\irmon.dll
[2009-05-19 16:07:15 | 00,028,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\irmon.dll
[2009-05-19 16:07:15 | 00,017,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\BthEnum.sys
[2009-05-19 16:07:15 | 00,017,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthenum.sys
[2009-05-19 16:07:14 | 00,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wshirda.dll
[2009-05-19 16:07:14 | 00,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wshirda.dll
[2009-05-19 16:07:04 | 00,018,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\BTHUSB.SYS
[2009-05-19 16:07:04 | 00,018,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthusb.sys
[2009-05-17 08:44:54 | 00,001,836 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Google Earth.lnk
[2009-05-08 17:32:03 | 00,000,156 | ---- | C] () -- C:\WINDOWS\Twunk001.MTX
[2009-05-08 17:32:03 | 00,000,003 | ---- | C] () -- C:\WINDOWS\Twain001.Mtx
[2009-05-08 17:32:03 | 00,000,000 | ---- | C] () -- C:\WINDOWS\Twunk002.MTX
[2009-05-08 17:32:01 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Dane aplikacji\Publish Providers
[2009-05-08 17:31:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Moje dokumenty\My Videos
[2009-05-08 17:31:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Dane aplikacji\Sony
[2009-05-08 17:30:03 | 00,000,000 | ---D | C] -- C:\Program Files\Sony
[2009-05-08 17:26:33 | 00,000,000 | R-SD | C] -- C:\WINDOWS\assembly
[2009-05-08 17:25:41 | 00,000,000 | ---D | C] -- C:\WINDOWS\Microsoft.NET
[2009-05-08 17:23:09 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Dane aplikacji\Sony Setup
[2008-12-28 12:02:51 | 00,069,632 | ---- | C] () -- C:\WINDOWS\System32\JVideoWindow.dll
[2008-12-28 12:02:36 | 00,118,784 | ---- | C] () -- C:\WINDOWS\System32\JVideoSession.dll
[2008-12-28 12:02:19 | 00,098,304 | ---- | C] () -- C:\WINDOWS\System32\JInstantMessaging.dll
[2008-12-28 12:01:27 | 00,040,517 | ---- | C] () -- C:\WINDOWS\System32\jRegistryKey.dll
[2008-12-07 17:14:29 | 00,000,073 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll
[2008-12-07 17:14:29 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\tmpPrst.dll
[2008-12-07 17:14:29 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll
[2008-09-24 16:58:11 | 00,000,144 | ---- | C] () -- C:\WINDOWS\Eudcedit.ini
[2008-08-23 17:18:01 | 00,000,472 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini
[2008-08-10 00:18:13 | 00,000,037 | ---- | C] () -- C:\WINDOWS\Grappler.ini
[2008-07-14 15:03:15 | 00,002,048 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
[2008-07-14 15:03:15 | 00,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll
[2008-07-14 15:03:15 | 00,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll
[2008-07-12 17:59:00 | 00,000,091 | ---- | C] () -- C:\WINDOWS\System32\logon.ini
[2008-07-12 17:53:11 | 00,000,001 | ---- | C] () -- C:\WINDOWS\System32\sav950231.sys
[2008-07-10 19:07:10 | 00,027,019 | ---- | C] () -- C:\WINDOWS\maxlink.ini
[2008-07-08 00:31:02 | 00,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2008-07-07 22:12:26 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008-07-07 22:04:59 | 00,155,136 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347bus.sys
[2008-07-07 22:04:59 | 00,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347prt.sys
[2008-07-07 21:53:06 | 00,685,816 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2008-07-07 17:57:53 | 00,000,477 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2008-07-07 17:57:53 | 00,000,030 | ---- | C] () -- C:\WINDOWS\System32\brss01a.ini
[2008-07-07 17:57:53 | 00,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2008-07-07 15:25:45 | 00,015,360 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2008-07-07 15:20:18 | 00,003,074 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2008-07-07 14:46:57 | 00,000,093 | ---- | C] () -- C:\WINDOWS\AVerTV2K.ini
[2008-05-03 09:24:01 | 00,000,082 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2008-05-03 05:46:00 | 01,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2008-05-03 05:46:00 | 01,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2008-05-03 05:46:00 | 01,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2008-05-03 05:46:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008-05-03 05:46:00 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2007-07-23 09:03:32 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2007-07-23 09:03:32 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2007-07-23 09:03:32 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2007-07-23 09:03:30 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2007-07-23 09:03:30 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2007-07-23 09:03:30 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2007-07-23 09:03:30 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2007-07-23 09:03:30 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2007-07-23 09:03:30 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2007-03-29 23:00:40 | 00,203,264 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll
[2004-08-22 17:04:56 | 00,069,120 | ---- | C] () -- C:\WINDOWS\daemon.dll
[2004-03-18 08:44:29 | 01,663,068 | ---- | C] () -- C:\WINDOWS\System32\libmmd.dll
[2003-04-08 11:40:22 | 00,005,679 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002-03-21 15:39:02 | 00,073,728 | ---- | C] () -- C:\WINDOWS\System32\UNACEV2.DLL
[2002-03-04 10:16:34 | 00,110,592 | R--- | C] () -- C:\WINDOWS\System32\Jpeg32.dll
[2001-07-22 00:16:20 | 00,000,603 | ---- | C] () -- C:\WINDOWS\win.ini
[2001-07-22 00:15:52 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini

[color=orange]========== Files - Modified Within 30 Days ==========[/color]

[2 C:\WINDOWS\System32\*.tmp files]
[4 C:\WINDOWS\*.tmp files]
[2009-06-02 19:45:04 | 00,000,603 | ---- | M] () -- C:\WINDOWS\win.ini
[2009-06-02 19:45:04 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2009-06-02 19:45:04 | 00,000,211 | -HS- | M] () -- C:\boot.ini
[2009-06-02 19:43:56 | 00,003,074 | ---- | M] () -- C:\WINDOWS\wincmd.ini
[2009-06-02 19:40:27 | 00,993,330 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009-06-02 19:40:27 | 00,451,564 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat
[2009-06-02 19:40:27 | 00,395,336 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009-06-02 19:40:27 | 00,075,706 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat
[2009-06-02 19:40:27 | 00,059,576 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009-06-02 19:36:18 | 00,182,851 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2009-06-02 19:36:16 | 00,001,032 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job
[2009-06-02 19:36:12 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009-06-02 19:36:10 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\Xp\Ustawienia lokalne\desktop.ini
[2009-06-02 19:36:09 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009-06-02 19:32:19 | 00,000,740 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2009-06-02 09:34:39 | 00,001,734 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\HijackThis.lnk
[2009-06-02 09:20:17 | 00,000,032 | --S- | M] () -- C:\WINDOWS\System32\3500322332.dat
[2009-06-02 09:20:10 | 00,019,968 | ---- | M] (http://www.softella.com/) -- C:\Documents and Settings\All Users\Application Data\Microsoft\Shortcuts\icwsetup.exe
[2009-06-02 09:20:09 | 00,051,712 | RHS- | M] () -- C:\WINDOWS\System32\AgCPanelGermant.exe
[2009-06-01 18:27:00 | 00,000,032 | ---- | M] () -- C:\WINDOWS\0
[2009-06-01 07:51:15 | 00,002,341 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Nokia PC Suite.lnk
[2009-05-28 20:41:25 | 00,000,700 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\jv16 PowerTools.lnk
[2009-05-27 11:25:12 | 00,027,136 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\1.doc
[2009-05-26 20:54:34 | 00,000,472 | ---- | M] () -- C:\WINDOWS\wcx_ftp.ini
[2009-05-24 18:32:33 | 00,000,750 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\Skrót do VirtualDub.lnk
[2009-05-22 21:12:29 | 02,359,350 | ---- | M] () -- C:\WINDOWS\ACD Tapeta.bmp
[2009-05-22 19:21:12 | 00,000,630 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\Audacity.lnk
[2009-05-22 16:05:07 | 00,184,320 | ---- | M] () -- C:\Documents and Settings\Xp\Moje dokumenty\Recording.mp3
[2009-05-22 15:52:44 | 00,000,730 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\mp3DirectCut.lnk
[2009-05-21 18:32:35 | 00,002,657 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\ACDSee Pro.lnk
[2009-05-21 18:02:32 | 00,036,928 | -H-- | M] () -- C:\WINDOWS\System32\mlfcache.dat
[2009-05-21 15:16:23 | 00,000,759 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Picasa 3.lnk
[2009-05-21 15:11:16 | 00,000,752 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\CSI Kryminalne Zagadki Las Vegas.lnk
[2009-05-20 13:40:12 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009-05-19 21:09:40 | 00,013,944 | ---- | M] () -- C:\WINDOWS\desctemp.dat
[2009-05-19 17:27:23 | 00,002,645 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2009-05-19 16:28:28 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\0
[2009-05-17 08:44:54 | 00,001,836 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Google Earth.lnk
[2009-05-15 09:59:32 | 00,000,830 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\Counter Strike 1.6 Non Steam.lnk
[2009-05-14 17:56:02 | 01,498,416 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009-05-09 12:25:15 | 00,000,003 | ---- | M] () -- C:\WINDOWS\Twain001.Mtx
[2009-05-09 12:25:10 | 00,000,156 | ---- | M] () -- C:\WINDOWS\Twunk001.MTX
[2009-05-08 17:32:03 | 00,000,000 | ---- | M] () -- C:\WINDOWS\Twunk002.MTX
[2009-05-07 09:16:29 | 24,699,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe

[color=orange]========== Alternate Data Streams ==========[/color]

@Alternate Data Stream - 138 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:05EE1EEF
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:C8B8CEBD
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:94A19129
< End of report >


[wojtas]

przeinstaluj antywirusa i przegladarke moze pomoze.. do tego wyczysc ciasteczka itp

[maci]

przeinstaluj antywirusa i przegladarke moze pomoze.. do tego wyczysc ciasteczka itp

Czyli Wojtas reasumując ,jest wszystko ok ? Zobaczymy na jak długo ,mam nadzieje że na dłużej.Teraz zrobię tak jak mówisz.Przeinstaluje avasta i maxthlona.Zobaczymy czy nie będzie krzyczał.Jak coś to się odezwę poźniej.Narazie dzięki serdeczne.JJJBG

Dodano 02.06.2009 20:04:20:
Wracam.avast zainstalowany ,od nowa ,przegladarka zainstalowana od nowa,a problem pozostał.Nie uruchamia się avast przy starcie systemu,i wyskakuje znowu ta strona z tym adresem:) I co Wojtas powiesz na to?

I jeszcze takie cuś

Otwierają się zakładki o takich www
http://mzz09.biz/default.aspx?ver=1007&uid=64260839733f6b1c
http://w3org.biz/default.aspx?ver=1007&uid=64260839733f6b1c

jednak nawigacja zostaje anulowana i nie otwiera się nic

Dodano 02.06.2009 22:02:09:
Zmieniłem przeglądarkę na FF .Jednak nie uruchamia się dalej avast i nie mogę wejść w rejestr przez start uruchom. Coś pasuje z tym zrobić.Koniec na dzisiaj.

[wojtas]

poczytaj ten temat:

http://www.searchengines.pl/Naprawianie-szkod-systemowych-t79791.html

a czy w avascie masz zaznaczone bo o ile dobrze pamietam jest opcja zeby startował z systemem??

looknij tu też:

http://support.microsoft.com/kb/967941/pl

[maci]

Poczytałem.Słuchaj Wojtas ,jest jeszcze sprawa tego pliku

C:\Documents and Settings\All Users\Application Data\Microsoft\Shortcuts\icwsetup.exe

Wywaliłem dziada,a on wraca przy każdym starcie.Z właściwości tego pliku wynika że jest to od jakiegos playera .Co to wogóle jest za g....o?

I kolejna sprawa:Poleciłbyś jakiegoś antywirusa,bo ten avast za chiny nie odpali ,także go wywaliłem.Dam loga cobyś zerknał czy wszystko okej.Aha używam tylko teraz firewalla outposta,wiec jakiś by sie AV przydał.Wczoraj jeszcze Spybootem wywaliłem trochę infekcji

Kod: Zaznacz wszystko

OTListIt logfile created on: 2009-06-04 11:31:30 - Run 3
OTListIt2 by OldTimer - Version 2.0.15.8     Folder = G:\MACIEK\OCHRONA KOMPA
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 7.0.5730.13)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

510,68 Mb Total Physical Memory | 88,02 Mb Available Physical Memory | 17,24% Memory free
1,22 Gb Paging File | 0,85 Gb Available in Paging File | 69,38% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 48,83 Gb Total Space | 35,89 Gb Free Space | 73,51% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 124,63 Gb Total Space | 109,70 Gb Free Space | 88,02% Space Free | Partition Type: NTFS
Drive F: | 124,63 Gb Total Space | 118,88 Gb Free Space | 95,39% Space Free | Partition Type: NTFS
Drive G: | 97,65 Gb Total Space | 26,97 Gb Free Space | 27,62% Space Free | Partition Type: NTFS
Drive H: | 135,23 Gb Total Space | 15,53 Gb Free Space | 11,49% Space Free | Partition Type: NTFS
Drive I: | 3,94 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF

Computer Name: SPECIAL-XP
Current User Name: Xp
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: Current user
Output = Standard
File Age = 30 Days
Company Name Whitelist: On

[color=orange]========== Processes (SafeList) ==========[/color]

PRC - [2008-04-14 22:51:18 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE
PRC - [2002-04-12 02:00:00 | 00,057,344 | ---- | M] (brother Industries Ltd) -- C:\WINDOWS\system32\brsvc01a.exe
PRC - [2001-12-13 02:01:00 | 00,045,056 | ---- | M] (brother Industries Ltd) -- C:\WINDOWS\system32\brss01a.exe
PRC - [2007-04-17 13:12:28 | 02,113,536 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\gg.exe
PRC - [2008-05-03 05:46:00 | 00,159,812 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe
PRC - [2007-05-14 12:54:36 | 00,272,024 | ---- | M] () -- C:\Program Files\CyberLink\Shared files\RichVideo.exe
PRC - [2002-09-20 15:50:10 | 00,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
PRC - [2008-04-22 07:03:00 | 01,083,848 | ---- | M] (C. Ghisler & Co.) -- C:\totalcmd\TOTALCMD.EXE
PRC - [2009-04-24 11:54:23 | 00,307,704 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2009-06-02 14:25:21 | 00,501,248 | ---- | M] (OldTimer Tools) -- G:\MACIEK\OCHRONA KOMPA\OTListIt2.exe

[color=orange]========== Win32 Services (SafeList) ==========[/color]

SRV - [2008-08-05 15:50:50 | 01,238,344 | ---- | M] (Agnitum Ltd.) -- C:\Program Files\Agnitum\Outpost Firewall Pro\acs.exe -- (acssrv [Auto | Running])
SRV - [2005-09-23 07:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped])
SRV - [2006-02-28 12:42:38 | 00,229,376 | ---- | M] (Apple Computer, Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service [Auto | Stopped])
SRV - [2002-04-12 02:00:00 | 00,057,344 | ---- | M] (brother Industries Ltd) -- C:\WINDOWS\system32\brsvc01a.exe -- (Brother XP spl Service [Auto | Running])
SRV - [2005-09-23 07:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped])
SRV - [2009-06-02 09:20:09 | 00,051,712 | RHS- | M] () -- C:\WINDOWS\system32\AgCPanelGermant.exe -- (dmadminBITS [Auto | Stopped])
SRV - [2009-04-14 13:42:03 | 00,654,848 | ---- | M] (Macrovision Europe Ltd.) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service [On_Demand | Stopped])
SRV - [2009-02-12 15:56:36 | 00,133,104 | ---- | M] (Google Inc.) -- C:\Program Files\Google\Update\GoogleUpdate.exe -- (gupdate1c98d19bbddcc46 [Auto | Stopped])
SRV - [2008-11-20 21:18:52 | 00,136,120 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc [On_Demand | Stopped])
SRV - [2008-04-14 22:50:46 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2004-10-22 03:24:18 | 00,073,728 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped])
SRV - [2008-05-03 05:46:00 | 00,159,812 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc [Auto | Running])
SRV - [2003-07-28 20:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped])
SRV - [2007-05-14 12:54:36 | 00,272,024 | ---- | M] () -- C:\Program Files\CyberLink\Shared files\RichVideo.exe -- (RichVideo [Auto | Running])
SRV - [2008-04-07 09:17:30 | 00,430,592 | ---- | M] (Nokia.) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer [On_Demand | Stopped])
SRV - [2002-09-20 15:50:10 | 00,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default) [Auto | Running])
SRV - [2006-12-01 11:46:28 | 00,918,016 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])

[color=orange]========== Driver Services (SafeList) ==========[/color]

DRV - [2004-05-17 11:23:48 | 00,133,200 | ---- | M] (Andrea Electronics Corporation) -- C:\WINDOWS\system32\drivers\aeaudio.sys -- (aeaudio [On_Demand | Running])
DRV - [2008-06-30 17:16:00 | 00,030,864 | ---- | M] (Agnitum Ltd.) -- C:\WINDOWS\system32\DRIVERS\afw.sys -- (afw [On_Demand | Running])
DRV - [2008-06-30 17:16:14 | 00,234,640 | ---- | M] (Agnitum Ltd.) -- C:\WINDOWS\system32\drivers\afwcore.sys -- (afwcore [On_Demand | Running])
DRV - [2008-07-11 15:42:08 | 00,033,408 | ---- | M] (Agnitum Ltd.) -- C:\WINDOWS\system32\Filt\ASWFilt.dll -- (ASWFilt [On_Demand | Running])
DRV - [2004-10-15 05:50:20 | 00,015,295 | ---- | M] (Brother Industries Ltd.) -- C:\WINDOWS\System32\Drivers\BrScnUsb.sys -- (BrScnUsb [On_Demand | Running])
DRV - [2009-02-15 00:10:11 | 00,371,349 | ---- | M] (Illusion & Hope.) -- C:\WINDOWS\system32\drivers\BT848.sys -- (BT848 [Auto | Running])
DRV - [2004-08-22 16:31:10 | 00,155,136 | ---- | M] ( ) -- C:\WINDOWS\system32\DRIVERS\d347bus.sys -- (d347bus [Boot | Running])
DRV - [2004-08-22 16:31:48 | 00,005,248 | ---- | M] ( ) -- C:\WINDOWS\System32\Drivers\d347prt.sys -- (d347prt [Boot | Running])
DRV - [2002-04-14 17:23:00 | 00,016,588 | ---- | M] (The freeware company) -- E:\RÓŻNE\MORE TV\HWIONT.sys -- (HWIONT [On_Demand | Running])
DRV - [2004-06-21 16:03:22 | 00,078,976 | ---- | M] (Pinnacle Systems GmbH) -- C:\WINDOWS\system32\DRIVERS\MarvinBus.sys -- (MarvinBus [On_Demand | Running])
DRV - [2007-12-05 23:34:18 | 00,004,864 | ---- | M] (ShiningMorning Inc.) -- C:\WINDOWS\system32\drivers\mcctl.sys -- (mcctl [Boot | Running])
DRV - [2007-12-05 23:45:20 | 00,015,872 | ---- | M] (ShiningMorning Inc.) -- C:\WINDOWS\system32\DRIVERS\mcdevice.sys -- (mcdevice [On_Demand | Stopped])
DRV - [2002-09-20 11:53:34 | 00,235,100 | ---- | M] (Analog Devices Inc) -- C:\WINDOWS\system32\drivers\MidiSyn.sys -- (MidiSyn [On_Demand | Stopped])
DRV - [2008-09-15 08:56:24 | 00,017,664 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd [On_Demand | Stopped])
DRV - [2008-09-15 08:56:24 | 00,022,016 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc [On_Demand | Stopped])
DRV - [2008-05-03 05:46:00 | 06,554,496 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Running])
DRV - [2007-09-17 15:53:26 | 00,021,632 | ---- | M] (Nokia) -- C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys -- (pccsmcfd [On_Demand | Stopped])
DRV - [2002-03-19 10:29:16 | 00,014,165 | ---- | M] (Pinnacle Systems GmbH) -- C:\WINDOWS\system32\drivers\pclepci.sys -- (PCLEPCI [System | Running])
DRV - [2009-04-21 21:02:23 | 00,010,368 | ---- | M] (Padus, Inc.) -- C:\WINDOWS\system32\drivers\pfc.sys -- (pfc [On_Demand | Running])
DRV - [2001-08-17 23:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2008-11-20 21:19:06 | 00,043,872 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running])
DRV - [2001-08-17 23:57:36 | 00,005,888 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\Drivers\RootMdm.sys -- (ROOTMODEM [On_Demand | Stopped])
DRV - [2008-04-14 00:05:40 | 00,020,992 | ---- | M] (Realtek Semiconductor Corporation) -- C:\WINDOWS\system32\DRIVERS\RTL8139.SYS -- (rtl8139 [On_Demand | Running])
DRV - [2008-07-11 15:41:28 | 00,673,920 | ---- | M] (Agnitum Ltd.) -- C:\WINDOWS\system32\DRIVERS\SandBox.sys -- (SandBox [System | Running])
DRV - [2006-09-18 14:58:48 | 00,061,600 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\SE27bus.sys -- (SE27bus [On_Demand | Stopped])
DRV - [2006-09-18 14:58:52 | 00,009,360 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\SE27mdfl.sys -- (SE27mdfl [On_Demand | Stopped])
DRV - [2006-09-18 14:58:54 | 00,097,184 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\SE27mdm.sys -- (SE27mdm [On_Demand | Stopped])
DRV - [2006-09-18 14:58:58 | 00,088,688 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\SE27mgmt.sys -- (SE27mgmt [On_Demand | Stopped])
DRV - [2006-09-18 14:59:00 | 00,018,704 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\se27nd5.sys -- (se27nd5 [On_Demand | Stopped])
DRV - [2006-09-18 14:59:02 | 00,086,560 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\SE27obex.sys -- (SE27obex [On_Demand | Stopped])
DRV - [2006-09-18 14:59:08 | 00,090,800 | R--- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\se27unic.sys -- (se27unic [On_Demand | Stopped])
DRV - [2008-04-13 22:09:18 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped])
DRV - [2004-04-26 10:49:56 | 00,381,056 | ---- | M] (Sensaura) -- C:\WINDOWS\system32\drivers\senfilt.sys -- (senfilt [On_Demand | Running])
DRV - [2004-08-28 13:54:38 | 00,033,995 | ---- | M] (Sonic Focus, Inc) -- C:\WINDOWS\system32\drivers\sf.sys -- (sf [System | Running])
DRV - [2008-05-02 08:48:55 | 00,062,208 | ---- | M] (Silicon Image, Inc.) -- C:\WINDOWS\System32\drivers\si3112.sys -- (Si3112 [Boot | Running])
DRV - [2004-09-01 12:18:40 | 00,259,648 | ---- | M] (Analog Devices, Inc.) -- C:\WINDOWS\system32\drivers\smwdm.sys -- (smwdm [On_Demand | Running])
DRV - [2001-08-17 22:56:16 | 00,007,552 | ---- | M] (Sony Corporation) -- C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS -- (SONYPVU1 [On_Demand | Stopped])
DRV - [2008-07-07 21:53:06 | 00,685,816 | ---- | M] () -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd [Boot | Running])
DRV - [2008-09-15 08:56:24 | 00,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) -- C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys -- (upperdev [On_Demand | Stopped])
DRV - [2008-04-14 00:15:38 | 00,026,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\DRIVERS\usbser.sys -- (usbser [On_Demand | Stopped])
DRV - [2006-04-01 17:16:44 | 00,162,176 | R--- | M] (Creative Technology Ltd.) -- C:\WINDOWS\system32\DRIVERS\V0260Vid.sys -- (V0260VID [On_Demand | Stopped])
DRV - [2007-09-19 22:37:48 | 00,041,456 | ---- | M] (Cyberlink Corp.) -- C:\Program Files\CyberLink\PowerDVD\000.fcl -- ({95808DC4-FA4A-4C74-92FE-5B863F82066B} [Auto | Running])

[color=orange]========== Standard Registry (SafeList) ==========[/color]


[color=orange]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL =  [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

[color=orange]========== FireFox ==========[/color]

FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..extensions.enabledItems: {000a9d1c-beef-4f90-9363-039d445309b8}:0.5.21.0
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.10

FF - HKLM\software\mozilla\Firefox\Extensions\\{000a9d1c-beef-4f90-9363-039d445309b8}: C:\PROGRAM FILES\GOOGLE\GOOGLE GEARS\FIREFOX\ [2009-05-29 10:03:27 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009-06-02 22:40:20 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.0.10\extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009-06-02 22:40:12 | 00,000,000 | ---D | M]

[2009-06-02 22:40:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Xp\Dane aplikacji\mozilla\Extensions
[2009-06-02 22:40:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Xp\Dane aplikacji\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009-06-02 22:40:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Xp\Dane aplikacji\mozilla\Firefox\Profiles\t6zon6v7.default\extensions
[2009-06-02 22:40:12 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009-06-02 22:40:12 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009-04-24 11:54:25 | 00,023,032 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009-04-24 11:54:25 | 00,134,648 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2006-06-03 18:43:22 | 00,000,896 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml
[2008-04-03 19:19:08 | 00,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml
[2008-04-16 06:08:20 | 00,001,706 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.xml
[2007-03-31 19:11:54 | 00,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml
[2006-06-03 18:43:22 | 00,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml
[2008-03-28 23:36:04 | 00,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml
[2007-01-05 13:40:56 | 00,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml

O1 HOSTS File: (740 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (SSVHelper Class) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (Google Gears Helper) - {E0FEFE40-FBF9-42AE-BA58-794CA7E3FB53} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.21.0\gears.dll (Google Inc.)
O4 - HKLM..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent File not found
O4 - HKLM..\Run: [Internet Connection Wizard Setup Tool] C:\Program Files\Internet Explorer\Connection Wizard\icwsetup.exe (http://www.softella.com/)
O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation)
O4 - HKLM..\Run: [OutpostFeedBack] "C:\Program Files\Agnitum\Outpost Firewall Pro\feedback.exe" /dump:os_startup (Agnitum Ltd.)
O4 - HKLM..\Run: [OutpostMonitor] C:\PROGRA~1\Agnitum\OUTPOS~1\op_mon.exe /tray /noservice (Agnitum Ltd.)
O4 - HKCU..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray (Gadu-Gadu S.A.)
O4 - Startup: C:\Documents and Settings\All Users\Application Data\Microsoft\Shortcuts\icwsetup.exe (http://www.softella.com/)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 (Google Inc.)
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\npjpi160_07.dll (Sun Microsystems, Inc.)
O9 - Extra 'Tools' menuitem : Ustawienia wtyczki &Gears - {09C04DA7-5B76-4EBC-BBEE-B25EAC5965F5} - C:\Program Files\Google\Google Gears\Internet Explorer\0.5.21.0\gears.dll (Google Inc.)
O9 - Extra Button: Ustawienia Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall Pro\ie_bar.dll (Agnitum Ltd.)
O9 - Extra Button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [Obszar nazw Bluetooth] - C:\WINDOWS\system32\wshbth.dll (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKCU\..Trusted Domains: 48 domain(s) and sub-domain(s) not assigned to a zone.
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} http://www.mks.com.pl/skaner/SkanerOnline.cab (MksSkanerOnline Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\Program Files\Common Files\Microsoft Shared\Web Components\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter:  - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\progra~1\agnitum\outpos~1\wl_hook.dll) - c:\Program Files\Agnitum\Outpost Firewall Pro\wl_hook.dll (Agnitum Ltd.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\WgaLogon: DllName - WgaLogon.dll -  File not found
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008-07-07 13:28:58 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2005-02-25 18:24:46 | 00,000,051 | R--- | M] () - I:\autorun.inf -- [ UDF ]
O34 - HKLM BootExecute: (autocheck) -  File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - * [2009-06-02 20:40:26 | 00,000,000 | ---D | M]

[color=orange]========== Files/Folders - Created Within 30 Days ==========[/color]

[2 C:\WINDOWS\System32\*.tmp files]
[4 C:\WINDOWS\*.tmp files]
[2009-06-03 19:55:01 | 00,019,968 | ---- | C] (http://www.softella.com/) -- C:\Documents and Settings\All Users\Application Data\Microsoft\Shortcuts\icwsetup.exe
[2009-06-03 15:34:21 | 00,234,640 | ---- | C] (Agnitum Ltd.) -- C:\WINDOWS\System32\drivers\afwcore.sys
[2009-06-03 15:33:22 | 00,000,049 | ---- | C] () -- C:\WINDOWS\transp.gif
[2009-06-03 15:33:21 | 00,673,920 | ---- | C] (Agnitum Ltd.) -- C:\WINDOWS\System32\drivers\SandBox.sys
[2009-06-03 15:33:20 | 00,030,864 | ---- | C] (Agnitum Ltd.) -- C:\WINDOWS\System32\drivers\afw.sys
[2009-06-03 15:33:13 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\Filt
[2009-06-03 15:33:13 | 00,000,000 | ---D | C] -- C:\Program Files\Agnitum
[2009-06-03 15:33:05 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Agnitum
[2009-06-03 10:28:34 | 00,000,000 | ---D | C] -- C:\WINDOWS\CSC
[2009-06-03 10:26:32 | 00,000,790 | ---- | C] () -- C:\Documents and Settings\Xp\Pulpit\Skrót do Xp.exe.lnk
[2009-06-02 22:40:19 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Dane aplikacji\Mozilla
[2009-06-02 22:40:14 | 00,001,602 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Mozilla Firefox.lnk
[2009-06-02 22:40:11 | 00,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2009-06-02 20:44:40 | 00,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2009-06-02 10:04:59 | 00,000,000 | ---D | C] -- C:\!KillBox
[2009-06-02 09:21:25 | 00,002,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\null.sys
[2009-06-02 09:21:25 | 00,002,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\null.sys
[2009-06-02 09:20:58 | 00,004,224 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\beep.sys
[2009-06-02 09:20:58 | 00,004,224 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\beep.sys
[2009-06-02 09:20:17 | 00,000,032 | --S- | C] () -- C:\WINDOWS\System32\3500322332.dat
[2009-06-02 09:20:10 | 00,051,712 | RHS- | C] () -- C:\WINDOWS\System32\AgCPanelGermant.exe
[2009-05-31 17:56:59 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\NtmsData
[2009-05-28 20:41:25 | 00,000,700 | ---- | C] () -- C:\Documents and Settings\Xp\Pulpit\jv16 PowerTools.lnk
[2009-05-28 20:41:24 | 00,000,000 | ---D | C] -- C:\Program Files\jv16 PowerTools
[2009-05-26 16:47:36 | 00,000,000 | ---D | C] -- C:\rsit
[2009-05-24 18:32:33 | 00,000,750 | ---- | C] () -- C:\Documents and Settings\Xp\Pulpit\Skrót do VirtualDub.lnk
[2009-05-24 18:20:37 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Ustawienia lokalne\Apps
[2009-05-23 22:28:20 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Moje dokumenty\Eksportowanie HTML programu Picasa
[2009-05-22 21:12:29 | 02,359,350 | ---- | C] () -- C:\WINDOWS\ACD Tapeta.bmp
[2009-05-22 19:21:12 | 00,000,630 | ---- | C] () -- C:\Documents and Settings\Xp\Pulpit\Audacity.lnk
[2009-05-22 19:21:10 | 00,000,000 | ---D | C] -- C:\Program Files\Audacity
[2009-05-22 16:04:53 | 00,184,320 | ---- | C] () -- C:\Documents and Settings\Xp\Moje dokumenty\Recording.mp3
[2009-05-22 15:52:44 | 00,000,730 | ---- | C] () -- C:\Documents and Settings\Xp\Pulpit\mp3DirectCut.lnk
[2009-05-22 15:52:43 | 00,000,000 | ---D | C] -- C:\Program Files\mp3DirectCut
[2009-05-22 15:47:53 | 00,000,000 | ---D | C] -- C:\Program Files\ToniArts
[2009-05-21 18:17:43 | 00,278,528 | ---- | C] (Real Networks, Inc) -- C:\WINDOWS\System32\pncrt.dll
[2009-05-21 18:17:42 | 00,000,000 | ---D | C] -- C:\Program Files\Real Alternative
[2009-05-21 18:17:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Dane aplikacji\Real
[2009-05-21 18:17:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Real
[2009-05-21 18:17:11 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009-05-21 18:17:10 | 00,839,680 | ---- | C] (http://www.mp3dev.org/) -- C:\WINDOWS\System32\lameACM.acm
[2009-05-21 18:17:10 | 00,000,414 | ---- | C] () -- C:\WINDOWS\System32\lame_acm.xml
[2009-05-21 18:17:09 | 00,795,648 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009-05-21 18:17:09 | 00,217,088 | ---- | C] (www.helixcommunity.org) -- C:\WINDOWS\System32\yv12vfw.dll
[2009-05-21 18:17:09 | 00,130,048 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2009-05-21 18:17:09 | 00,118,784 | ---- | C] (fccHandler) -- C:\WINDOWS\System32\ac3acm.acm
[2009-05-21 18:17:08 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2009-05-21 18:17:08 | 00,684,032 | ---- | C] (DivX, Inc.) -- C:\WINDOWS\System32\divx.dll
[2009-05-21 18:17:08 | 00,086,016 | ---- | C] (DivX, Inc.) -- C:\WINDOWS\System32\dpl100.dll
[2009-05-21 18:17:06 | 00,067,584 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009-05-21 18:17:06 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009-05-21 18:17:04 | 00,000,000 | ---D | C] -- C:\Program Files\K-Lite Codec Pack
[2009-05-21 18:02:32 | 00,036,928 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2009-05-21 15:16:23 | 00,000,759 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Picasa 3.lnk
[2009-05-21 15:16:03 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\IOSUBSYS
[2009-05-19 21:09:40 | 00,013,944 | ---- | C] () -- C:\WINDOWS\desctemp.dat
[2009-05-19 16:30:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Moje dokumenty\Bluetooth
[2009-05-19 16:30:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Bluetooth
[2009-05-19 16:28:28 | 00,000,032 | ---- | C] () -- C:\WINDOWS\0
[2009-05-19 16:28:28 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\0
[2009-05-19 16:09:19 | 00,037,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\bthmodem.sys
[2009-05-19 16:09:19 | 00,037,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthmodem.sys
[2009-05-19 16:07:26 | 00,101,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\bthpan.sys
[2009-05-19 16:07:26 | 00,101,120 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthpan.sys
[2009-05-19 16:07:16 | 00,059,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\rfcomm.sys
[2009-05-19 16:07:16 | 00,059,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rfcomm.sys
[2009-05-19 16:07:15 | 00,152,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\irftp.exe
[2009-05-19 16:07:15 | 00,152,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\irftp.exe
[2009-05-19 16:07:15 | 00,028,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\irmon.dll
[2009-05-19 16:07:15 | 00,028,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\irmon.dll
[2009-05-19 16:07:15 | 00,017,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\BthEnum.sys
[2009-05-19 16:07:15 | 00,017,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthenum.sys
[2009-05-19 16:07:14 | 00,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\wshirda.dll
[2009-05-19 16:07:14 | 00,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wshirda.dll
[2009-05-19 16:07:04 | 00,018,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\BTHUSB.SYS
[2009-05-19 16:07:04 | 00,018,944 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthusb.sys
[2009-05-17 08:44:54 | 00,001,836 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Google Earth.lnk
[2009-05-08 17:32:03 | 00,000,156 | ---- | C] () -- C:\WINDOWS\Twunk001.MTX
[2009-05-08 17:32:03 | 00,000,003 | ---- | C] () -- C:\WINDOWS\Twain001.Mtx
[2009-05-08 17:32:03 | 00,000,000 | ---- | C] () -- C:\WINDOWS\Twunk002.MTX
[2009-05-08 17:32:01 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Dane aplikacji\Publish Providers
[2009-05-08 17:31:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Moje dokumenty\My Videos
[2009-05-08 17:31:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Dane aplikacji\Sony
[2009-05-08 17:30:03 | 00,000,000 | ---D | C] -- C:\Program Files\Sony
[2009-05-08 17:26:33 | 00,000,000 | R-SD | C] -- C:\WINDOWS\assembly
[2009-05-08 17:25:41 | 00,000,000 | ---D | C] -- C:\WINDOWS\Microsoft.NET
[2009-05-08 17:23:09 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Xp\Dane aplikacji\Sony Setup
[2008-12-28 12:02:51 | 00,069,632 | ---- | C] () -- C:\WINDOWS\System32\JVideoWindow.dll
[2008-12-28 12:02:36 | 00,118,784 | ---- | C] () -- C:\WINDOWS\System32\JVideoSession.dll
[2008-12-28 12:02:19 | 00,098,304 | ---- | C] () -- C:\WINDOWS\System32\JInstantMessaging.dll
[2008-12-28 12:01:27 | 00,040,517 | ---- | C] () -- C:\WINDOWS\System32\jRegistryKey.dll
[2008-12-07 17:14:29 | 00,000,073 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll
[2008-12-07 17:14:29 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\tmpPrst.dll
[2008-12-07 17:14:29 | 00,000,000 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll
[2008-09-24 16:58:11 | 00,000,144 | ---- | C] () -- C:\WINDOWS\Eudcedit.ini
[2008-08-23 17:18:01 | 00,000,472 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini
[2008-08-10 00:18:13 | 00,000,037 | ---- | C] () -- C:\WINDOWS\Grappler.ini
[2008-07-14 15:03:15 | 00,002,048 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll
[2008-07-14 15:03:15 | 00,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll
[2008-07-14 15:03:15 | 00,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll
[2008-07-12 17:59:00 | 00,000,091 | ---- | C] () -- C:\WINDOWS\System32\logon.ini
[2008-07-12 17:53:11 | 00,000,001 | ---- | C] () -- C:\WINDOWS\System32\sav950231.sys
[2008-07-10 19:07:10 | 00,027,019 | ---- | C] () -- C:\WINDOWS\maxlink.ini
[2008-07-08 00:31:02 | 00,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll
[2008-07-07 22:12:26 | 00,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2008-07-07 22:04:59 | 00,155,136 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347bus.sys
[2008-07-07 22:04:59 | 00,005,248 | ---- | C] ( ) -- C:\WINDOWS\System32\drivers\d347prt.sys
[2008-07-07 21:53:06 | 00,685,816 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys
[2008-07-07 17:57:53 | 00,000,477 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2008-07-07 17:57:53 | 00,000,030 | ---- | C] () -- C:\WINDOWS\System32\brss01a.ini
[2008-07-07 17:57:53 | 00,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI
[2008-07-07 15:25:45 | 00,015,360 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll
[2008-07-07 15:20:18 | 00,004,016 | ---- | C] () -- C:\WINDOWS\wincmd.ini
[2008-07-07 14:46:57 | 00,000,093 | ---- | C] () -- C:\WINDOWS\AVerTV2K.ini
[2008-05-03 09:24:01 | 00,000,082 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini
[2008-05-03 05:46:00 | 01,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2008-05-03 05:46:00 | 01,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2008-05-03 05:46:00 | 01,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2008-05-03 05:46:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2008-05-03 05:46:00 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2007-07-23 09:03:32 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll
[2007-07-23 09:03:32 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll
[2007-07-23 09:03:32 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll
[2007-07-23 09:03:30 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll
[2007-07-23 09:03:30 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll
[2007-07-23 09:03:30 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll
[2007-07-23 09:03:30 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll
[2007-07-23 09:03:30 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll
[2007-07-23 09:03:30 | 00,053,248 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll
[2007-03-29 23:00:40 | 00,203,264 | R--- | C] () -- C:\WINDOWS\System32\CddbCdda.dll
[2004-08-22 17:04:56 | 00,069,120 | ---- | C] () -- C:\WINDOWS\daemon.dll
[2004-03-18 08:44:29 | 01,663,068 | ---- | C] () -- C:\WINDOWS\System32\libmmd.dll
[2003-04-08 11:40:22 | 00,005,679 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI
[2002-03-21 15:39:02 | 00,073,728 | ---- | C] () -- C:\WINDOWS\System32\UNACEV2.DLL
[2002-03-04 10:16:34 | 00,110,592 | R--- | C] () -- C:\WINDOWS\System32\Jpeg32.dll
[2001-07-22 00:16:20 | 00,000,603 | ---- | C] () -- C:\WINDOWS\win.ini
[2001-07-22 00:15:52 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini

[color=orange]========== Files - Modified Within 30 Days ==========[/color]

[2 C:\WINDOWS\System32\*.tmp files]
[4 C:\WINDOWS\*.tmp files]
[2009-06-04 11:13:23 | 00,001,032 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachine.job
[2009-06-04 09:23:33 | 00,993,330 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009-06-04 09:23:33 | 00,451,564 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat
[2009-06-04 09:23:33 | 00,395,336 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009-06-04 09:23:33 | 00,075,706 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat
[2009-06-04 09:23:33 | 00,059,576 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009-06-04 09:20:52 | 00,004,016 | ---- | M] () -- C:\WINDOWS\wincmd.ini
[2009-06-04 09:19:07 | 00,182,851 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml
[2009-06-04 09:18:50 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009-06-04 09:18:49 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\Xp\Ustawienia lokalne\desktop.ini
[2009-06-04 09:18:45 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009-06-03 15:32:25 | 00,002,596 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2009-06-03 15:31:18 | 00,000,032 | --S- | M] () -- C:\WINDOWS\System32\3500322332.dat
[2009-06-03 10:26:32 | 00,000,790 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\Skrót do Xp.exe.lnk
[2009-06-03 07:21:29 | 00,000,603 | ---- | M] () -- C:\WINDOWS\win.ini
[2009-06-03 07:21:29 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2009-06-03 07:21:29 | 00,000,211 | -HS- | M] () -- C:\boot.ini
[2009-06-02 22:40:14 | 00,001,602 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Mozilla Firefox.lnk
[2009-06-02 19:32:19 | 00,000,740 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts
[2009-06-02 09:20:10 | 00,019,968 | ---- | M] (http://www.softella.com/) -- C:\Documents and Settings\All Users\Application Data\Microsoft\Shortcuts\icwsetup.exe
[2009-06-02 09:20:09 | 00,051,712 | RHS- | M] () -- C:\WINDOWS\System32\AgCPanelGermant.exe
[2009-06-01 18:27:00 | 00,000,032 | ---- | M] () -- C:\WINDOWS\0
[2009-06-01 07:51:15 | 00,002,341 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Nokia PC Suite.lnk
[2009-05-28 20:41:25 | 00,000,700 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\jv16 PowerTools.lnk
[2009-05-27 11:25:12 | 00,027,136 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\1.doc
[2009-05-26 20:54:34 | 00,000,472 | ---- | M] () -- C:\WINDOWS\wcx_ftp.ini
[2009-05-24 18:32:33 | 00,000,750 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\Skrót do VirtualDub.lnk
[2009-05-22 21:12:29 | 02,359,350 | ---- | M] () -- C:\WINDOWS\ACD Tapeta.bmp
[2009-05-22 19:21:12 | 00,000,630 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\Audacity.lnk
[2009-05-22 16:05:07 | 00,184,320 | ---- | M] () -- C:\Documents and Settings\Xp\Moje dokumenty\Recording.mp3
[2009-05-22 15:52:44 | 00,000,730 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\mp3DirectCut.lnk
[2009-05-21 18:32:35 | 00,002,657 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\ACDSee Pro.lnk
[2009-05-21 18:02:32 | 00,036,928 | -H-- | M] () -- C:\WINDOWS\System32\mlfcache.dat
[2009-05-21 15:16:23 | 00,000,759 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Picasa 3.lnk
[2009-05-21 15:11:16 | 00,000,752 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\CSI Kryminalne Zagadki Las Vegas.lnk
[2009-05-20 13:40:12 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009-05-19 21:09:40 | 00,013,944 | ---- | M] () -- C:\WINDOWS\desctemp.dat
[2009-05-19 16:28:28 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\0
[2009-05-17 08:44:54 | 00,001,836 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Google Earth.lnk
[2009-05-15 09:59:32 | 00,000,830 | ---- | M] () -- C:\Documents and Settings\Xp\Pulpit\Counter Strike 1.6 Non Steam.lnk
[2009-05-14 17:56:02 | 01,498,416 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2009-05-09 12:25:15 | 00,000,003 | ---- | M] () -- C:\WINDOWS\Twain001.Mtx
[2009-05-09 12:25:10 | 00,000,156 | ---- | M] () -- C:\WINDOWS\Twunk001.MTX
[2009-05-08 17:32:03 | 00,000,000 | ---- | M] () -- C:\WINDOWS\Twunk002.MTX
[2009-05-07 09:16:29 | 24,699,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe

[color=orange]========== Alternate Data Streams ==========[/color]

@Alternate Data Stream - 138 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:05EE1EEF
@Alternate Data Stream - 113 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:C8B8CEBD
@Alternate Data Stream - 112 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:94A19129
< End of report >


[wojtas]

moze od takiego programu:

http://www.programosy.pl/program,light-alloy.html

avira z darmowych
nod32 lub kaspersky z płatnych

Uruchom OTListIt2 i w oknie Custom Scans/Fixes wklej :

:OTLI
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O32 - AutoRun File - [2005-02-25 18:24:46 | 00,000,051 | R--- | M] () - I:\autorun.inf -- [ UDF ]

:Files
C:\WINDOWS\System32\3500322332.dat
C:\WINDOWS\System32\0
C:\WINDOWS\0

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .

[maci]

moze od takiego programu:

http://www.programosy.pl/program,light-alloy.html

Pewnie od niego,też go widziałem wczoraj na stronce,ale problem polega na tym ,że ja nie mam tego programu zainstalowanego.A i nie mogę tego usunąć.Problem jest jeszcze z tym rejestrem ,że nie mogę do niego wejść poprzez start-uruchom.

Zastanawiam się jeszcze co się mogło podziać z tym że avast sie nie chcial uruchomić,i co się działo ,że w maxthonie wyskakiwały te strony.

[wojtas]

start > uruchom > regedit i co jakis bląd czy cos ??

wklej do notatnika:

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"DisableRegistryTools"=–
"DisableRegedit"=–

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"DisableRegistryTools"=–
"DisableRegedit"=–

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> Uruchom plik FIX.REG i reset kompa