Szkodniki w systemie (tradedoubler)

**Posty:** 6 · przez **ula2771** 13 Sty 2010, 23:13

Witam! Jestem nowa na forum i nie wiem jeszcze jak tu się poruszać. Mam problem z wirusami na swoim komputerze. Zainstalowałam AVG i przeskanowałam U9stawiłam codzienne skanowanie, ponieważ pracuje codziennie przy komputerze) AVG znalazł ostrzeżenia - Tracking Cookie Yadro, Revsci i Tradedoubler. Następnie przeskanowałam komputer Malwarebytes' Anti-Malware i wyszukał mi to:Malwarebytes' Anti-Malware 1.44
Wersja bazy definicji: 3554
Windows 5.1.2600 Dodatek Service Pack 3
Internet Explorer 8.0.6001.18702

2010-01-13 16:19:31
mbam-log-2010-01-13 (16-19-31).txt

Typ skanowania: Pełne skanowanie (C:\|D:\|E:\|)
Przeskanowane obiekty: 218894
Upłynęło: 30 minute(s), 27 second(s)

Zainfekowane procesy w pamięci: 0
Zainfekowane moduły pamięci: 0
Zainfekowane klucze rejestru: 1
Zainfekowane wartości rejestru: 0
Zainfekowane pliki rejestru: 0
Zainfekowane foldery: 0
Zainfekowane pliki: 3

Zainfekowane procesy w pamięci:
(Nie wykryto groźnych plików)

Zainfekowane moduły pamięci:
(Nie wykryto groźnych plików)

Zainfekowane klucze rejestru:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Setup.exe (Trojan.Downloader) -> Quarantined and deleted successfully.

Zainfekowane wartości rejestru:
(Nie wykryto groźnych plików)

Zainfekowane pliki rejestru:
(Nie wykryto groźnych plików)

Zainfekowane foldery:
(Nie wykryto groźnych plików)

Zainfekowane pliki:
C:\Documents and Settings\ula\Pulpit\Inne\Puzzle\Kggz4\k4setup.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\ula\Pulpit\Inne\Zrecznosciowe\Car2k\Setup.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Documents and Settings\ula\Pulpit\Inne\Zrecznosciowe\Mouse Attack\Setup.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
Z tego co wiem mogę przesłać loga z programu Hijack This, ale nie bardzo wiem jak go tu umieścić. Czy ktoś mógłby mi pomóc? Bardzo proszę.

**Posty:** 18165 · przez **wojtas** 13 Sty 2010, 23:26

Proszę zastosować się do zasad wstawiania logów

**Posty:** 6 · przez **ula2771** 13 Sty 2010, 23:46

Kod: Zaznacz wszystko: OTL logfile created on: 2010-01-13 22:40:12 - Run 1 OTL by OldTimer - Version 3.1.24.0 Folder = C:\Documents and Settings\ula\Moje dokumenty\Pobieranie Windows XP Home Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 57,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 83,00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files Drive C: | 87,89 Gb Total Space | 41,03 Gb Free Space | 46,68% Space Free | Partition Type: NTFS Drive D: | 104,50 Gb Total Space | 38,39 Gb Free Space | 36,74% Space Free | Partition Type: NTFS Drive E: | 105,70 Gb Total Space | 103,99 Gb Free Space | 98,38% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: ULA-5C08FF52C9D Current User Name: ula Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-01-13 22:37:00 | 00,544,256 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ula\Moje dokumenty\Pobieranie\OTL.exe PRC - [2010-01-11 13:13:00 | 02,033,432 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgtray.exe PRC - [2010-01-10 11:58:26 | 01,055,000 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgchsvx.exe PRC - [2010-01-10 11:58:26 | 00,702,744 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgcsrvx.exe PRC - [2010-01-10 11:58:24 | 00,600,344 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgnsx.exe PRC - [2010-01-10 11:58:24 | 00,503,576 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgrsx.exe PRC - [2010-01-10 11:58:23 | 00,285,392 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG9\avgwdsvc.exe PRC - [2010-01-06 19:39:28 | 00,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009-12-30 19:33:52 | 00,066,872 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe PRC - [2009-12-26 12:34:04 | 00,289,584 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\uTorrent\uTorrent.exe PRC - [2009-12-23 17:14:30 | 14,100,888 | ---- | M] (Redefine Sp z o.o.) -- C:\Program Files\ipla\ipla.exe PRC - [2009-07-02 19:30:05 | 16,384,000 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTHDCPL.exe PRC - [2009-03-05 16:07:20 | 02,260,480 | RHS- | M] (Safer-Networking Ltd.) -- C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe PRC - [2008-06-24 15:06:06 | 01,840,424 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe PRC - [2008-06-24 15:05:56 | 00,537,896 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe PRC - [2008-06-08 08:31:04 | 00,877,864 | ---- | M] (Nero AG) -- C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe PRC - [2008-04-14 18:21:16 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007-11-28 09:45:31 | 00,155,716 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe PRC - [2007-11-27 13:36:54 | 02,169,368 | ---- | M] (Palit Microsystems, Inc.) -- C:\Program Files\VDOTool\TBPANEL.exe PRC - [2007-08-03 09:26:02 | 00,794,624 | ---- | M] (TODO: <Company name>) -- C:\Program Files\Freedom\Freedom.exe PRC - [2006-12-19 09:30:26 | 00,081,920 | ---- | M] (Prolific Technology Inc.) -- C:\WINDOWS\system32\IoctlSvc.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-01-13 22:37:00 | 00,544,256 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\ula\Moje dokumenty\Pobieranie\OTL.exe [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2010-01-10 11:58:23 | 00,285,392 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG9\avgwdsvc.exe -- (avg9wd) SRV - [2009-12-30 19:33:52 | 00,066,872 | ---- | M] () [Auto | Running] -- C:\WINDOWS\system32\PnkBstrA.exe -- (PnkBstrA) SRV - [2009-04-02 11:47:04 | 00,234,888 | ---- | M] () [Auto | Stopped] -- C:\Program Files\AskBarDis\bar\bin\ASKUpgrade.exe -- (ASKUpgrade) SRV - [2008-07-18 12:13:20 | 00,053,760 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.dll -- (Pml Driver HPZ12) SRV - [2008-07-18 12:13:20 | 00,044,032 | ---- | M] (Hewlett-Packard) [Auto | Running] -- C:\WINDOWS\system32\HPZinw12.dll -- (Net Driver HPZ12) SRV - [2008-06-24 15:05:56 | 00,537,896 | ---- | M] (Nero AG) [On_Demand | Running] -- C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe -- (NMIndexingService) SRV - [2008-06-08 08:31:04 | 00,877,864 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe -- (Nero BackItUp Scheduler 3) SRV - [2008-03-25 19:38:24 | 00,217,088 | ---- | M] (Hewlett-Packard Co.) [On_Demand | Running] -- C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll -- (hpqcxs08) SRV - [2007-11-28 09:45:31 | 00,155,716 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc) SRV - [2006-12-19 09:30:26 | 00,081,920 | ---- | M] (Prolific Technology Inc.) [Auto | Running] -- C:\WINDOWS\system32\IoctlSvc.exe -- (PLFlash DeviceIoControl Service) SRV - [2006-10-01 13:37:42 | 00,016,384 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\OpenVPN\bin\openvpnserv.exe -- (OpenVPNService) SRV - [2005-04-03 23:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2010-01-10 11:58:44 | 00,360,584 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\windows\System32\Drivers\avgtdix.sys -- (AvgTdiX) DRV - [2010-01-10 11:58:40 | 00,333,192 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\windows\System32\Drivers\avgldx86.sys -- (AvgLdx86) DRV - [2010-01-10 11:58:38 | 00,028,424 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\windows\System32\Drivers\avgmfx86.sys -- (AvgMfx86) DRV - [2009-07-02 19:30:06 | 04,603,904 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2008-04-13 17:39:16 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv) DRV - [2008-04-13 17:36:05 | 00,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus) DRV - [2007-11-28 09:45:31 | 07,429,088 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2007-03-16 09:11:38 | 00,012,256 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\TBPanel.sys -- (TBPanel) DRV - [2007-03-08 05:20:50 | 00,021,568 | R--- | M] (HP) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HPZius12.sys -- (HPZius12) DRV - [2007-03-08 05:20:49 | 00,016,496 | R--- | M] (HP) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HPZipr12.sys -- (HPZipr12) DRV - [2007-03-08 05:20:48 | 00,049,920 | R--- | M] (HP) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\HPZid412.sys -- (HPZid412) DRV - [2006-10-01 13:37:02 | 00,026,624 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\tap0801.sys -- (tap0801) DRV - [2006-07-05 13:50:52 | 00,683,791 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\torususb.sys -- (TaurusUsb) DRV - [2006-03-02 13:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink) DRV - [2003-08-12 12:51:00 | 00,060,255 | ---- | M] (STMicroelectronics ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\stmatm.sys -- (Stmatm) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKU\.DEFAULT\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () IE - HKU\S-1-5-18\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () IE - HKU\S-1-5-21-1957994488-1757981266-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.ask.com/?o=13928&l=dis [binary data] IE - HKU\S-1-5-21-1957994488-1757981266-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage IE - HKU\S-1-5-21-1957994488-1757981266-839522115-1004\..\URLSearchHook: {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () IE - HKU\S-1-5-21-1957994488-1757981266-839522115-1004\S-1-5-21-1957994488-1757981266-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultenginename: "BearShare Web Search" FF - prefs.js..browser.search.order.1: "BearShare Web Search" FF - prefs.js..browser.search.selectedEngine: "BearShare Web Search" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://www.onet.pl/\r" FF - prefs.js..extensions.enabledItems: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.5 FF - prefs.js..extensions.enabledItems: {E84D42CA-64EB-11DE-A65F-8C3656D89593}:3.0 FF - prefs.js..extensions.enabledItems: info@sciagaj.org:0.5 FF - prefs.js..extensions.enabledItems: {3f963a5b-e555-4543-90e2-c3908898db71}:9.0.0.716 FF - prefs.js..extensions.enabledItems: avg@igeared:3.011.025.005 FF - prefs.js..keyword.URL: "http://toolbar.ask.com/toolbarv/askRedirect?o=13925&gct=&gc=1&q=" FF - HKLM\software\mozilla\Firefox\Extensions\\{3f963a5b-e555-4543-90e2-c3908898db71}: C:\Program Files\AVG\AVG9\Firefox [2010-01-10 11:58:23 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\avg@igeared: C:\Program Files\AVG\AVG9\Toolbar\Firefox\avg@igeared [2010-01-10 11:58:32 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010-01-10 18:03:38 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.7\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010-01-10 18:11:50 | 00,000,000 | ---D | M] [2009-07-06 15:01:03 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Extensions [2010-01-10 21:57:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions [2009-10-03 19:34:35 | 00,000,000 | ---D | M] (MediaBar) -- C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593} [2009-07-09 10:55:39 | 00,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D} [2009-11-15 15:07:03 | 00,000,000 | ---D | M] -- C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\info@sciagaj.org [2009-07-09 10:56:16 | 00,000,687 | ---- | M] () -- C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\searchplugins\ask.xml [2009-07-18 00:02:48 | 00,002,476 | ---- | M] () -- C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\searchplugins\BearShareWebSearch.xml [2009-10-11 17:50:22 | 00,002,399 | ---- | M] () -- C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\searchplugins\daemon-search.xml [2009-07-28 13:07:38 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2009-07-15 20:00:25 | 00,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2009-07-18 00:02:48 | 00,002,476 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\BearShareWebSearch.xml [2009-07-15 20:00:25 | 00,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2009-07-15 20:00:25 | 00,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2009-07-15 20:00:25 | 00,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2009-07-15 20:00:25 | 00,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2009-07-15 20:00:25 | 00,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: (742 bytes) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG9\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (AVG Security Toolbar BHO) - {A3BC75A2-1F87-4686-AA43-5347D756017C} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\ula\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll (GG Network S.A.) O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () O3 - HKU\S-1-5-21-1957994488-1757981266-839522115-1004\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com) O3 - HKU\S-1-5-21-1957994488-1757981266-839522115-1004\..\Toolbar\WebBrowser: (AVG Security Toolbar) - {CCC7A320-B3CA-4199-B1A6-9F516DD69829} - C:\Program Files\AVG\AVG9\Toolbar\IEToolbar.dll () O4 - HKLM..\Run: [AdslTaskBar] C:\windows\System32\stmctrl.dll (STMicroelectronics ) O4 - HKLM..\Run: [Alcmtr] C:\windows\Alcmtr.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [AVG9_TRAY] C:\Program Files\AVG\AVG9\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe (Palit Microsystems, Inc.) O4 - HKLM..\Run: [NBKeyScan] C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe (Nero AG) O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [NvCplDaemon] C:\windows\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\windows\System32\NvMcTray.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\windows\System32\nwiz.exe () O4 - HKLM..\Run: [RTHDCPL] C:\windows\RTHDCPL.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [TkBellExe] File not found O4 - HKU\S-1-5-21-1957994488-1757981266-839522115-1004..\Run: [ALLUpdate] C:\Program Files\ALLPlayer\ALLUpdate.exe () O4 - HKU\S-1-5-21-1957994488-1757981266-839522115-1004..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe (Nero AG) O4 - HKU\S-1-5-21-1957994488-1757981266-839522115-1004..\Run: [IPLA!] C:\Program Files\ipla\ipla.exe (Redefine Sp z o.o.) O4 - HKU\S-1-5-21-1957994488-1757981266-839522115-1004..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.) O4 - HKU\S-1-5-21-1957994488-1757981266-839522115-1004..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1957994488-1757981266-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Szybkie dostosowywanie programu Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - Reg Error: Key error. File not found O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1246564535500 (WUWebControl Class) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG9\avgpp.dll (AVG Technologies CZ, s.r.o.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\ula\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\ula\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O33 - MountPoints2\{4df4c168-7c37-11de-a181-debeb5958f7c}\Shell\AutoRun\command - "" = 9dlvtiil.exe O33 - MountPoints2\{4df4c168-7c37-11de-a181-debeb5958f7c}\Shell\open\Command - "" = 9dlvtiil.exe O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-01-13 09:31:16 | 00,471,552 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\dllcache\aclayers.dll [2010-01-10 21:45:07 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ula\Dane aplikacji\Real [2010-01-10 18:36:28 | 00,839,680 | ---- | C] (http://www.mp3dev.org/) -- C:\windows\System32\lameACM.acm [2010-01-10 18:36:28 | 00,217,088 | ---- | C] (www.helixcommunity.org) -- C:\windows\System32\yv12vfw.dll [2010-01-10 18:36:28 | 00,118,784 | ---- | C] (fccHandler) -- C:\windows\System32\ac3acm.acm [2010-01-10 18:36:27 | 00,684,032 | ---- | C] (DivX, Inc.) -- C:\windows\System32\divx.dll [2010-01-10 18:36:27 | 00,086,016 | ---- | C] (DivX, Inc.) -- C:\windows\System32\dpl100.dll [2010-01-10 18:36:26 | 00,060,273 | ---- | C] (Open Source Software community project) -- C:\windows\System32\pthreadGC2.dll [2010-01-10 18:02:33 | 00,094,208 | ---- | C] (Apple Inc.) -- C:\windows\System32\QuickTimeVR.qtx [2010-01-10 18:02:33 | 00,069,632 | ---- | C] (Apple Inc.) -- C:\windows\System32\QuickTime.qts [2010-01-10 18:02:30 | 00,000,000 | ---D | C] -- C:\Program Files\QuickTime Alternative [2010-01-10 16:24:44 | 00,000,000 | ---D | C] -- C:\Program Files\ALLConverter [2010-01-10 16:24:37 | 00,892,928 | ---- | C] (Free Software Foundation) -- C:\windows\System32\iconv.dll [2010-01-10 16:24:34 | 00,000,000 | ---D | C] -- C:\Program Files\ALLPlayer [2010-01-10 16:06:38 | 00,000,000 | -HSD | C] -- C:\Config.Msi [2010-01-10 15:56:05 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer [2010-01-10 12:01:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ula\Ustawienia lokalne\Dane aplikacji\AVG Security Toolbar [2010-01-10 11:58:54 | 00,000,000 | -H-D | C] -- C:\$AVG [2010-01-10 11:58:44 | 00,360,584 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\windows\System32\drivers\avgtdix.sys [2010-01-10 11:58:44 | 00,012,464 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\windows\System32\avgrsstx.dll [2010-01-10 11:58:40 | 00,333,192 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\windows\System32\drivers\avgldx86.sys [2010-01-10 11:58:38 | 00,028,424 | ---- | C] (AVG Technologies CZ, s.r.o.) -- C:\windows\System32\drivers\avgmfx86.sys [2010-01-10 11:58:34 | 00,000,000 | ---D | C] -- C:\windows\System32\drivers\Avg [2010-01-10 11:58:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\AVG Security Toolbar [2010-01-10 11:58:23 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\avg9 [2010-01-10 11:57:41 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft [2010-01-10 11:57:41 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft [2010-01-10 11:57:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft [2010-01-10 11:57:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft [2010-01-10 11:31:17 | 00,000,000 | ---D | C] -- C:\windows\System32\InsFiles [2010-01-10 11:30:49 | 00,425,984 | ---- | C] (STMicroelectronics ) -- C:\windows\System32\stmcfg32.dll [2010-01-10 11:30:49 | 00,151,552 | ---- | C] (STMicroelectronics ) -- C:\windows\System32\stmctrl.dll [2010-01-10 11:30:46 | 00,446,464 | ---- | C] (STMicroelectronics ) -- C:\windows\System32\stmadsl.cpl [2010-01-10 11:30:46 | 00,102,400 | ---- | C] (STMicroelectronics ) -- C:\windows\stmtrace.exe [2010-01-10 11:30:46 | 00,065,536 | ---- | C] (STMicroelectronics) -- C:\windows\DSLTest.exe [2010-01-10 11:30:46 | 00,060,255 | ---- | C] (STMicroelectronics ) -- C:\windows\System32\drivers\stmatm.sys [2010-01-10 11:30:46 | 00,000,000 | ---D | C] -- C:\Program Files\ZTE ZXDSL 852 [2010-01-10 11:30:44 | 00,000,000 | ---D | C] -- C:\Program Files\Freedom [2010-01-09 21:01:07 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes [2010-01-09 20:58:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\ipla [2010-01-09 20:58:13 | 00,000,000 | --SD | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft [2010-01-09 20:54:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\HP [2010-01-09 15:41:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ula\Dane aplikacji\Malwarebytes [2010-01-09 15:41:31 | 00,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbamswissarmy.sys [2010-01-09 15:41:29 | 00,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys [2010-01-09 15:41:29 | 00,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2010-01-06 22:01:21 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\ula\Recent [2010-01-06 20:30:44 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro [2010-01-06 18:05:30 | 00,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy [2010-01-06 18:05:30 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy [2010-01-05 16:50:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\ReviverSoft [2010-01-05 01:51:05 | 00,000,000 | ---D | C] -- C:\windows\Prefetch [2010-01-05 00:39:51 | 00,000,000 | ---D | C] -- C:\Program Files\DX-Ball [2010-01-05 00:10:41 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ula\Moje dokumenty\My Games [2010-01-02 21:53:07 | 00,000,000 | ---D | C] -- C:\Program Files\Alawar [2010-01-02 14:59:13 | 00,000,000 | ---D | C] -- C:\Program Files\Managed DirectX (0900) [2010-01-02 14:45:28 | 00,000,000 | ---D | C] -- C:\Program Files\Hasbro [2010-01-01 17:41:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ula\Ustawienia lokalne\Dane aplikacji\Criterion Games [2010-01-01 15:10:59 | 00,000,000 | ---D | C] -- C:\ProgramData [2010-01-01 15:10:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ula\Ustawienia lokalne\Dane aplikacji\Downloaded Installations [2010-01-01 15:04:02 | 00,000,000 | ---D | C] -- C:\Program Files\Electronic Arts [2010-01-01 15:04:01 | 02,036,576 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_40.dll [2010-01-01 15:04:01 | 00,452,440 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_40.dll [2010-01-01 15:04:00 | 04,379,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DX9_40.dll [2010-01-01 15:04:00 | 00,514,384 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAudio2_3.dll [2010-01-01 15:04:00 | 00,070,992 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAPOFX1_2.dll [2010-01-01 15:03:59 | 00,509,448 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAudio2_2.dll [2010-01-01 15:03:59 | 00,235,856 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine3_3.dll [2010-01-01 15:03:59 | 00,068,616 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAPOFX1_1.dll [2010-01-01 15:03:59 | 00,023,376 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\X3DAudio1_5.dll [2010-01-01 15:03:58 | 03,851,784 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DX9_39.dll [2010-01-01 15:03:58 | 01,493,528 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_39.dll [2010-01-01 15:03:58 | 00,467,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_39.dll [2010-01-01 15:03:58 | 00,238,088 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine3_2.dll [2010-01-01 15:03:57 | 00,507,400 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAudio2_1.dll [2010-01-01 15:03:57 | 00,238,088 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine3_1.dll [2010-01-01 15:03:57 | 00,065,032 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAPOFX1_0.dll [2010-01-01 15:03:57 | 00,025,608 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\X3DAudio1_4.dll [2010-01-01 15:03:56 | 03,850,760 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DX9_38.dll [2010-01-01 15:03:56 | 01,491,992 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_38.dll [2010-01-01 15:03:56 | 00,479,752 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\XAudio2_0.dll [2010-01-01 15:03:56 | 00,467,984 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_38.dll [2010-01-01 15:03:55 | 01,420,824 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DCompiler_37.dll [2010-01-01 15:03:55 | 00,462,864 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\d3dx10_37.dll [2010-01-01 15:03:55 | 00,238,088 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\xactengine3_0.dll [2010-01-01 15:03:55 | 00,025,608 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\X3DAudio1_3.dll [2010-01-01 15:03:54 | 03,786,760 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\D3DX9_37.dll [2010-01-01 15:03:14 | 00,000,000 | ---D | C] -- C:\windows\Logs [2009-12-30 19:34:17 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ula\Moje dokumenty\NFS Undercover [2009-12-30 19:23:00 | 00,000,000 | ---D | C] -- C:\windows\NEED FOR SPEED UNDERCOVER [2009-12-30 19:23:00 | 00,000,000 | ---D | C] -- C:\Program Files\NEED FOR SPEED UNDERCOVER [2009-12-29 17:08:52 | 00,000,000 | ---D | C] -- C:\Program Files\Ubisoft [2009-12-29 17:08:52 | 00,000,000 | ---D | C] -- C:\windows\CSI Kryminalne Zagadki Las Vegas - Mroczne Motywy [2009-12-29 17:00:20 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ula\Pulpit\Downloads [2009-12-29 17:00:17 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ula\Dane aplikacji\GetRightToGo [2009-12-28 17:39:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\ula\Moje dokumenty\My ISO Files [2009-12-27 13:51:41 | 00,327,168 | ---- | C] (InstallShield Software Corporation) -- C:\windows\IsUn0415.exe [5 C:\windows\*.tmp files -> C:\windows\*.tmp -> ] [1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-01-13 22:38:20 | 00,000,558 | ---- | M] () -- C:\windows\DFC.INI [2010-01-13 17:28:45 | 00,000,470 | ---- | M] () -- C:\windows\tasks\Registry Reviver.job [2010-01-13 17:28:37 | 00,000,006 | -H-- | M] () -- C:\windows\tasks\SA.DAT [2010-01-13 17:28:36 | 00,002,048 | --S- | M] () -- C:\windows\bootstat.dat [2010-01-13 16:48:08 | 06,291,456 | ---- | M] () -- C:\Documents and Settings\ula\ntuser.dat [2010-01-13 16:48:08 | 00,000,188 | -HS- | M] () -- C:\Documents and Settings\ula\ntuser.ini [2010-01-13 14:46:43 | 02,107,502 | -H-- | M] () -- C:\Documents and Settings\ula\Ustawienia lokalne\Dane aplikacji\IconCache.db [2010-01-13 14:24:04 | 47,776,455 | ---- | M] () -- C:\windows\System32\drivers\Avg\incavi.avm [2010-01-13 14:23:50 | 00,138,990 | ---- | M] () -- C:\windows\System32\drivers\Avg\microavi.avg [2010-01-13 09:36:57 | 00,001,374 | ---- | M] () -- C:\windows\imsins.BAK [2010-01-11 21:26:47 | 00,000,372 | ---- | M] () -- C:\Documents and Settings\ula\Moje dokumenty\spider.sav [2010-01-10 19:31:02 | 00,000,069 | ---- | M] () -- C:\windows\NeroDigital.ini [2010-01-10 18:09:38 | 00,000,074 | ---- | M] () -- C:\Documents and Settings\ula\Dane aplikacji\default.pls [2010-01-10 17:36:56 | 00,000,755 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\ALLConverter to 3GP.lnk [2010-01-10 16:24:47 | 00,000,755 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\ALLConverter to PSP.lnk [2010-01-10 16:24:45 | 00,000,789 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\ALLConverter to iPhone.lnk [2010-01-10 16:24:40 | 00,000,664 | ---- | M] () -- C:\Documents and Settings\ula\Pulpit\Napi-projekt.lnk [2010-01-10 16:24:40 | 00,000,640 | ---- | M] () -- C:\Documents and Settings\ula\Pulpit\ALLPlayer V4.2.lnk [2010-01-10 15:56:05 | 00,054,156 | -H-- | M] () -- C:\windows\QTFont.qfn [2010-01-10 11:58:44 | 00,360,584 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\windows\System32\drivers\avgtdix.sys [2010-01-10 11:58:44 | 00,012,464 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\windows\System32\avgrsstx.dll [2010-01-10 11:58:44 | 00,001,507 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\AVG Free 9.0.lnk [2010-01-10 11:58:40 | 00,333,192 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\windows\System32\drivers\avgldx86.sys [2010-01-10 11:58:38 | 00,113,461 | ---- | M] () -- C:\windows\System32\drivers\Avg\iavichjw.avm [2010-01-10 11:58:38 | 00,028,424 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\windows\System32\drivers\avgmfx86.sys [2010-01-10 11:58:34 | 06,061,540 | ---- | M] () -- C:\windows\System32\drivers\Avg\avi7.avg [2010-01-10 11:58:34 | 00,492,629 | ---- | M] () -- C:\windows\System32\drivers\Avg\miniavi.avg [2010-01-10 11:31:35 | 00,003,255 | ---- | M] () -- C:\windows\stsetup.htm [2010-01-10 11:31:26 | 00,001,414 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\ZTE ZXDSL 852.lnk [2010-01-10 11:30:44 | 00,000,666 | ---- | M] () -- C:\Documents and Settings\ula\Pulpit\Freedom.lnk [2010-01-09 23:37:37 | 01,085,368 | ---- | M] () -- C:\windows\System32\PerfStringBackup.INI [2010-01-09 23:37:37 | 00,490,284 | ---- | M] () -- C:\windows\System32\perfh015.dat [2010-01-09 23:37:37 | 00,432,356 | ---- | M] () -- C:\windows\System32\perfh009.dat [2010-01-09 23:37:37 | 00,083,660 | ---- | M] () -- C:\windows\System32\perfc015.dat [2010-01-09 23:37:37 | 00,067,312 | ---- | M] () -- C:\windows\System32\perfc009.dat [2010-01-09 21:38:00 | 00,000,687 | ---- | M] () -- C:\windows\win.ini [2010-01-09 21:38:00 | 00,000,227 | ---- | M] () -- C:\windows\system.ini [2010-01-09 15:41:33 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk [2010-01-07 16:07:14 | 00,038,224 | ---- | M] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbamswissarmy.sys [2010-01-07 16:07:04 | 00,019,160 | ---- | M] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys [2010-01-06 22:03:21 | 00,003,700 | ---- | M] () -- C:\Documents and Settings\ula\Moje dokumenty\cc_20100106_220232.reg [2010-01-06 20:30:46 | 00,001,734 | ---- | M] () -- C:\Documents and Settings\ula\Pulpit\HijackThis.lnk [2010-01-06 18:05:36 | 00,000,933 | ---- | M] () -- C:\Documents and Settings\ula\Pulpit\Spybot - Search & Destroy.lnk [2010-01-06 15:41:47 | 00,021,128 | ---- | M] () -- C:\Documents and Settings\ula\Dane aplikacji\GDIPFONTCACHEV1.DAT [2010-01-05 22:07:21 | 00,000,383 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Colin McRae Rally 04.lnk [2010-01-05 17:10:44 | 00,001,548 | ---- | M] () -- C:\Documents and Settings\ula\Pulpit\CCleaner.lnk [2010-01-02 17:23:12 | 00,043,520 | ---- | M] () -- C:\windows\System32\CmdLineExt03.dll [2010-01-01 11:17:04 | 00,002,422 | ---- | M] () -- C:\windows\System32\wpa.dbl [2009-12-30 22:10:18 | 00,138,184 | ---- | M] () -- C:\windows\System32\drivers\PnkBstrK.sys [2009-12-30 22:10:11 | 00,183,112 | ---- | M] () -- C:\windows\System32\PnkBstrB.exe [2009-12-30 19:33:52 | 00,066,872 | ---- | M] () -- C:\windows\System32\PnkBstrA.exe [2009-12-30 19:32:56 | 00,001,660 | ---- | M] () -- C:\Documents and Settings\ula\Pulpit\Need for Speed Undercover.lnk [2009-12-30 15:01:56 | 00,025,088 | ---- | M] () -- C:\Documents and Settings\ula\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-12-30 13:44:39 | 00,001,409 | ---- | M] () -- C:\windows\QTFont.for [2009-12-30 09:53:24 | 00,021,128 | ---- | M] () -- C:\Documents and Settings\ula\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT [2009-12-30 09:53:09 | 00,126,912 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT [2009-12-29 17:11:33 | 00,002,089 | ---- | M] () -- C:\Documents and Settings\ula\Pulpit\CSI Kryminalne Zagadki Las Vegas - Mroczne Motywy.lnk [2009-12-21 13:38:41 | 00,000,104 | ---- | M] () -- C:\windows\System32\attfd42.dll [5 C:\windows\*.tmp files -> C:\windows\*.tmp -> ] [1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-01-11 21:26:47 | 00,000,372 | ---- | C] () -- C:\Documents and Settings\ula\Moje dokumenty\spider.sav [2010-01-10 18:36:29 | 00,168,448 | ---- | C] () -- C:\windows\System32\unrar.dll [2010-01-10 18:36:28 | 00,130,048 | ---- | C] () -- C:\windows\System32\xvidvfw.dll [2010-01-10 18:36:28 | 00,000,414 | ---- | C] () -- C:\windows\System32\lame_acm.xml [2010-01-10 18:36:27 | 03,596,288 | ---- | C] () -- C:\windows\System32\qt-dx331.dll [2010-01-10 18:36:27 | 00,067,584 | ---- | C] () -- C:\windows\System32\ff_vfw.dll [2010-01-10 18:36:27 | 00,000,547 | ---- | C] () -- C:\windows\System32\ff_vfw.dll.manifest [2010-01-10 16:24:48 | 00,000,755 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\ALLConverter to 3GP.lnk [2010-01-10 16:24:47 | 00,000,755 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\ALLConverter to PSP.lnk [2010-01-10 16:24:45 | 00,000,789 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\ALLConverter to iPhone.lnk [2010-01-10 16:24:40 | 00,000,664 | ---- | C] () -- C:\Documents and Settings\ula\Pulpit\Napi-projekt.lnk [2010-01-10 16:24:40 | 00,000,640 | ---- | C] () -- C:\Documents and Settings\ula\Pulpit\ALLPlayer V4.2.lnk [2010-01-10 16:24:37 | 00,797,184 | ---- | C] () -- C:\windows\System32\ac3filter.ax [2010-01-10 16:24:37 | 00,795,648 | ---- | C] () -- C:\windows\System32\xvidcore.dll [2010-01-10 11:58:44 | 00,001,507 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\AVG Free 9.0.lnk [2010-01-10 11:58:38 | 00,113,461 | ---- | C] () -- C:\windows\System32\drivers\Avg\iavichjw.avm [2010-01-10 11:58:34 | 47,776,455 | ---- | C] () -- C:\windows\System32\drivers\Avg\incavi.avm [2010-01-10 11:58:34 | 06,061,540 | ---- | C] () -- C:\windows\System32\drivers\Avg\avi7.avg [2010-01-10 11:58:34 | 00,492,629 | ---- | C] () -- C:\windows\System32\drivers\Avg\miniavi.avg [2010-01-10 11:58:34 | 00,138,990 | ---- | C] () -- C:\windows\System32\drivers\Avg\microavi.avg [2010-01-10 11:31:26 | 00,001,414 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\ZTE ZXDSL 852.lnk [2010-01-10 11:30:46 | 00,683,791 | ---- | C] () -- C:\windows\System32\drivers\torususb.sys [2010-01-10 11:30:46 | 00,036,864 | ---- | C] () -- C:\windows\System32\stmclean.exe [2010-01-10 11:30:46 | 00,018,498 | ---- | C] () -- C:\windows\System32\CSALogo.bmp [2010-01-10 11:30:46 | 00,000,915 | ---- | C] () -- C:\windows\System32\setup.ini [2010-01-10 11:30:46 | 00,000,766 | ---- | C] () -- C:\windows\System32\icStop.ico [2010-01-10 11:30:46 | 00,000,766 | ---- | C] () -- C:\windows\System32\icShTx.ico [2010-01-10 11:30:46 | 00,000,766 | ---- | C] () -- C:\windows\System32\icShTR.ico [2010-01-10 11:30:46 | 00,000,766 | ---- | C] () -- C:\windows\System32\icShRx.ico [2010-01-10 11:30:46 | 00,000,766 | ---- | C] () -- C:\windows\System32\icShow.ico [2010-01-10 11:30:46 | 00,000,766 | ---- | C] () -- C:\windows\System32\icNoMo.ico [2010-01-10 11:30:46 | 00,000,766 | ---- | C] () -- C:\windows\System32\icInit.ico [2010-01-10 11:30:46 | 00,000,161 | ---- | C] () -- C:\windows\DSLSetup.ini [2010-01-10 11:30:44 | 00,003,255 | ---- | C] () -- C:\windows\stsetup.htm [2010-01-10 11:30:44 | 00,000,666 | ---- | C] () -- C:\Documents and Settings\ula\Pulpit\Freedom.lnk [2010-01-09 22:50:33 | 06,291,456 | ---- | C] () -- C:\Documents and Settings\ula\ntuser.dat [2010-01-09 22:37:42 | 00,001,374 | ---- | C] () -- C:\windows\imsins.BAK [2010-01-09 21:38:00 | 00,001,750 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk [2010-01-09 20:53:35 | 00,001,984 | ---- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\hpzinstall.log [2010-01-09 15:41:33 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk [2010-01-06 22:02:36 | 00,003,700 | ---- | C] () -- C:\Documents and Settings\ula\Moje dokumenty\cc_20100106_220232.reg [2010-01-06 20:30:45 | 00,001,734 | ---- | C] () -- C:\Documents and Settings\ula\Pulpit\HijackThis.lnk [2010-01-06 18:05:36 | 00,000,933 | ---- | C] () -- C:\Documents and Settings\ula\Pulpit\Spybot - Search & Destroy.lnk [2010-01-05 22:07:21 | 00,000,383 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Colin McRae Rally 04.lnk [2010-01-05 17:10:44 | 00,001,548 | ---- | C] () -- C:\Documents and Settings\ula\Pulpit\CCleaner.lnk [2010-01-05 16:50:36 | 00,000,470 | ---- | C] () -- C:\windows\tasks\Registry Reviver.job [2010-01-02 14:50:15 | 00,043,520 | ---- | C] () -- C:\windows\System32\CmdLineExt03.dll [2009-12-30 19:34:05 | 00,138,184 | ---- | C] () -- C:\windows\System32\drivers\PnkBstrK.sys [2009-12-30 19:34:01 | 00,183,112 | ---- | C] () -- C:\windows\System32\PnkBstrB.exe [2009-12-30 19:33:52 | 00,066,872 | ---- | C] () -- C:\windows\System32\PnkBstrA.exe [2009-12-30 19:32:56 | 00,001,660 | ---- | C] () -- C:\Documents and Settings\ula\Pulpit\Need for Speed Undercover.lnk [2009-12-30 13:44:39 | 00,054,156 | -H-- | C] () -- C:\windows\QTFont.qfn [2009-12-30 13:44:39 | 00,001,409 | ---- | C] () -- C:\windows\QTFont.for [2009-12-29 17:11:33 | 00,002,089 | ---- | C] () -- C:\Documents and Settings\ula\Pulpit\CSI Kryminalne Zagadki Las Vegas - Mroczne Motywy.lnk [2009-11-12 19:27:43 | 00,021,840 | ---- | C] () -- C:\windows\System32\SIntfNT.dll [2009-11-12 19:27:43 | 00,017,212 | ---- | C] () -- C:\windows\System32\SIntf32.dll [2009-11-12 19:27:43 | 00,012,067 | ---- | C] () -- C:\windows\System32\SIntf16.dll [2009-07-06 17:05:12 | 00,000,754 | ---- | C] () -- C:\windows\WORDPAD.INI [2009-07-04 20:42:26 | 00,000,104 | ---- | C] () -- C:\windows\System32\attfd42.dll [2009-07-03 14:49:17 | 00,000,552 | ---- | C] () -- C:\windows\ODBC.INI [2009-07-02 23:25:26 | 00,025,088 | ---- | C] () -- C:\Documents and Settings\ula\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-07-02 23:19:59 | 00,000,074 | ---- | C] () -- C:\Documents and Settings\ula\Dane aplikacji\default.pls [2009-07-02 23:19:49 | 00,000,069 | ---- | C] () -- C:\windows\NeroDigital.ini [2009-07-02 19:38:08 | 00,000,558 | ---- | C] () -- C:\windows\DFC.INI [2007-11-28 09:45:31 | 01,703,936 | ---- | C] () -- C:\windows\System32\nvwdmcpl.dll [2007-11-28 09:45:31 | 01,474,560 | ---- | C] () -- C:\windows\System32\nview.dll [2007-11-28 09:45:31 | 01,019,904 | ---- | C] () -- C:\windows\System32\nvwimg.dll [2007-11-28 09:45:31 | 00,466,944 | ---- | C] () -- C:\windows\System32\nvshell.dll [2007-11-28 09:45:31 | 00,286,720 | ---- | C] () -- C:\windows\System32\nvnt4cpl.dll < End of report >

Dodano Dzisiaj, 23:13:
Mam nadzieję, że ten drugi log jest prawidłowy. Jestem po raz pierwszy na jakimkolwiek Forum i mam nikłe pojęcie jak tu się poruszać. Dziękuję za zainteresowanie

**Posty:** 18165 · przez **wojtas** 14 Sty 2010, 16:59

log jest ok ale nazwa tematu nie.. opisane wszystko w zasadach :

**Posty:** 6 · przez **ula2771** 14 Sty 2010, 23:12

Komputer po włączeniu wydaje dziwne odgłosy (wyje). Wczoraj zmieniła mi się ikonka "Freedom" ( była bardzo mała). Szczerze mówiąc nie wiem czy dobrze nazwałam ten temat. Denerwuję się, że przez te wirusy, trojany pewnego dnia komputer mi stanie i nie będę mogła pracować.

**Posty:** 18165 · przez **wojtas** 14 Sty 2010, 23:19

poprawiłem .. nie było tak trudno naprawdę ...

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
IE - HKU\S-1-5-21-1957994488-1757981266-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.ask.com/?o=13928&l=dis [binary data]
IE - HKU\S-1-5-21-1957994488-1757981266-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://www.ask.com/?o=13928&l=dis [binary data]
FF - prefs.js..browser.search.defaultenginename: "BearShare Web Search"
FF - prefs.js..browser.search.order.1: "BearShare Web Search"
FF - prefs.js..browser.search.selectedEngine: "BearShare Web Search"
FF - prefs.js..keyword.URL: "http://toolbar.ask.com/toolbarv/askRedirect?o=13925&gct=&gc=1&q="
O2 - BHO: (AskBar BHO) - {201f27d4-3704-41d6-89c1-aa35e39143ed} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O3 - HKU\S-1-5-21-1957994488-1757981266-839522115-1004\..\Toolbar\WebBrowser: (Ask Toolbar) - {3041D03E-FD4B-44E0-B742-2D9B88305F98} - C:\Program Files\AskBarDis\bar\bin\askBar.dll (Ask.com)
O4 - HKLM..\Run: [TkBellExe] File not found
O33 - MountPoints2\{4df4c168-7c37-11de-a181-debeb5958f7c}\Shell\AutoRun\command - "" = 9dlvtiil.exe
O33 - MountPoints2\{4df4c168-7c37-11de-a181-debeb5958f7c}\Shell\open\Command - "" = 9dlvtiil.exe

:Files
C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}
C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}
C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\searchplugins\ask.xml
C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\searchplugins\BearShareWebSearch.xml
C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\searchplugins\daemon-search.xml,
C:\Program Files\Mozilla Firefox\searchplugins\BearShareWebSearch.xml
C:\Program Files\AskBarDis

:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""

:Commands
[emptytemp]

Kliknij w Run Fix. I potwierdz reset kompa

te plik/i :

C:\windows\System32\attfd42.dll

przeskanuj tu
http://virusscan.jotti.org/
http://www.virustotal.com/

i daj raporty ze skanow

**Posty:** 6 · przez **ula2771** 14 Sty 2010, 23:55

Kod: Zaznacz wszystko: All processes killed ========== OTL ========== No active process named explorer.exe was found! Unable to set value : HKU\S-1-5-21-1957994488-1757981266-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main\\Secondary Start Pages| /E! Unable to set value : HKU\S-1-5-21-1957994488-1757981266-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main\\Secondary Start Pages| /E! Prefs.js: "BearShare Web Search" removed from browser.search.defaultenginename Prefs.js: "BearShare Web Search" removed from browser.search.order.1 Prefs.js: "BearShare Web Search" removed from browser.search.selectedEngine Prefs.js: "http://toolbar.ask.com/toolbarv/askRedirect?o=13925&gct=&gc=1&q=" removed from keyword.URL Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{201f27d4-3704-41d6-89c1-aa35e39143ed}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{201f27d4-3704-41d6-89c1-aa35e39143ed}\ deleted successfully. C:\Program Files\AskBarDis\bar\bin\askBar.dll moved successfully. Registry value HKEY_USERS\S-1-5-21-1957994488-1757981266-839522115-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{3041D03E-FD4B-44E0-B742-2D9B88305F98} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3041D03E-FD4B-44E0-B742-2D9B88305F98}\ deleted successfully. File C:\Program Files\AskBarDis\bar\bin\askBar.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\TkBellExe deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4df4c168-7c37-11de-a181-debeb5958f7c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4df4c168-7c37-11de-a181-debeb5958f7c}\ not found. File 9dlvtiil.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{4df4c168-7c37-11de-a181-debeb5958f7c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{4df4c168-7c37-11de-a181-debeb5958f7c}\ not found. File 9dlvtiil.exe not found. ========== FILES ========== C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}\components folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}\chrome\skin\searchbar folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}\chrome\skin\options folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}\chrome\skin\lib\weatherbutton\panels\images folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}\chrome\skin\lib\weatherbutton\panels folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}\chrome\skin\lib\weatherbutton\icons folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}\chrome\skin\lib\weatherbutton folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}\chrome\skin\lib\uwa folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}\chrome\skin\lib folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}\chrome\skin folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}\chrome\content\lib folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}\chrome\content\data\search folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}\chrome\content\data folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}\chrome\content folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}\chrome\components folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}\chrome folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593} folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\META-INF folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults\preferences folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\defaults folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D}\chrome folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\extensions\{E9A1DEE0-C623-4439-8932-001E7D17607D} folder moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\searchplugins\ask.xml moved successfully. C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\searchplugins\BearShareWebSearch.xml moved successfully. File\Folder C:\Documents and Settings\ula\Dane aplikacji\Mozilla\Firefox\Profiles\kwte30qz.default\searchplugins\daemon-search.xml, not found. C:\Program Files\Mozilla Firefox\searchplugins\BearShareWebSearch.xml moved successfully. C:\Program Files\AskBarDis\bar\Settings folder moved successfully. C:\Program Files\AskBarDis\bar\History folder moved successfully. C:\Program Files\AskBarDis\bar\Cache folder moved successfully. C:\Program Files\AskBarDis\bar\bin folder moved successfully. C:\Program Files\AskBarDis\bar folder moved successfully. C:\Program Files\AskBarDis folder moved successfully. ========== REGISTRY ========== HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"SuperHidden"|dword:00000001 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"Hidden"|dword:00000001 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"ShowSuperHidden"|dword:00000001 /E : value set successfully! HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\\"CheckedValue"|dword:00000001 /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden\ deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden\\@|"" /E : value set successfully! ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 227557 bytes User: ula ->Temp folder emptied: 251299721 bytes ->Temporary Internet Files folder emptied: 5436856 bytes ->FireFox cache emptied: 113492713 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2148726 bytes %systemroot%\System32 .tmp files removed: 2596 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 14045196 bytes RecycleBin emptied: 39884924 bytes Total Files Cleaned = 407,00 mb OTL by OldTimer - Version 3.1.24.0 log created on 01142010_223252 Files\Folders moved on Reboot... Registry entries deleted on Reboot...

Postąpiłam w/g wskazówek. Wysyłam loga, który wyświetlił mi się po restarcie komputera. Plik, który podałeś przeskanowałam na stronach, ale nie wiem jak dać raporty z tych skanów.

**Posty:** 18165 · przez **wojtas** 14 Sty 2010, 23:59

z virustotal dajesz link co jest koło napisu : Permalink:

**Posty:** 6 · przez **ula2771** 15 Sty 2010, 00:00

Plik attfd42.dll otrzymany 2010.01.14 21:50:25 (UTC)
Obecny status: zakończono
Wynik: 0/40 (0.00%)

Nazwa pliku: attfd42.dll
Stan:
Skanowanie zakończone. 0 z 20 skanerów zgłaszają wirusy.
Skanowanie podjęte w: czw 14 sty 2010 22:44:56 (CET) Link stały

Czy tak?

Dodano Dzisiaj, 23:03:
http://www.virustotal.com/pl/analisis/d0a69e0564adcc25b41d1d6a8daa6a237033a28424884e31f65ce5ccea92f77f-1263505825

Dodano Dzisiaj, 23:04:
http://virusscan.jotti.org/pl/scanresult/522b57bf2f0fb9bf7d76dfb006b849a76766f443/5883adb9a1f8f52464c481616c82903bc5179151

**Posty:** 18165 · przez **wojtas** 15 Sty 2010, 00:05

system jest czysty . nie masz wirusów

Autor postu otrzymał pochwałę

**Posty:** 6 · przez **ula2771** 15 Sty 2010, 00:12

Bardzo serdecznie DZIĘKUJĘ ZA POMOC!!! Sama nigdy nie dałabym sobie rady. Dopiero uczę się wszystkiego (komputer mam 1,5 roku) . Dzięki również za nazwę tematu

Następnym razem będzie lepiej.