Winesm32.exe w autostarcie, zamula kompa, nie da się usunąć,

[korzonlajner]

Tak jak w temacie. W autostarcie siedzi mi ciągle winesm32.exe i nie da się go usunąć. Ani przez msconfig,ani przez CCleaner. Jak włączę kompa to muszę najpierw parę minut poczekać,bo nie mogę w ogóle na pasek MENU kliknąć ponieważ jest jakby zamrożony. Pomóżcie.

LOG z OTL:

Kod: Zaznacz wszystko

OTL logfile created on: 2010-03-05 17:56:26 - Run 1
OTL by OldTimer - Version 3.1.34.0     Folder = C:\Documents and Settings\Motylek\Pulpit
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 62,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 84,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19,53 Gb Total Space | 6,23 Gb Free Space | 31,92% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
Drive E: | 78,13 Gb Total Space | 24,19 Gb Free Space | 30,96% Space Free | Partition Type: NTFS
Drive F: | 48,83 Gb Total Space | 17,06 Gb Free Space | 34,93% Space Free | Partition Type: NTFS
Drive G: | 86,26 Gb Total Space | 39,74 Gb Free Space | 46,07% Space Free | Partition Type: NTFS
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: R-672F11C538934
Current User Name: Motylek
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2010-03-05 17:43:43 | 000,553,984 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Motylek\Pulpit\OTL.exe
PRC - [2010-02-18 18:38:06 | 000,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2010-01-07 16:07:10 | 001,394,000 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
PRC - [2009-11-25 00:51:40 | 000,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe
PRC - [2009-11-25 00:51:35 | 000,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe
PRC - [2009-11-25 00:51:21 | 000,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
PRC - [2009-11-25 00:48:48 | 000,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
PRC - [2009-11-25 00:43:56 | 000,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
PRC - [2009-08-31 17:07:34 | 011,391,592 | ---- | M] (GG Network S.A.) -- C:\Program Files\Nowe Gadu-Gadu\gg.exe
PRC - [2009-08-31 15:56:26 | 000,077,824 | ---- | M] () -- C:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe
PRC - [2008-09-04 05:02:24 | 001,295,616 | ---- | M] (O&O Software GmbH) -- C:\WINDOWS\system32\oodag.exe
PRC - [2008-09-04 05:01:42 | 002,524,416 | ---- | M] (O&O Software GmbH) -- C:\WINDOWS\system32\oodtray.exe
PRC - [2008-06-13 17:04:02 | 000,025,256 | ---- | M] () -- C:\Program Files\Lexmark 3600-4600 Series\lxdxmsdmon.exe
PRC - [2008-06-13 17:04:01 | 000,668,328 | ---- | M] () -- C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe
PRC - [2008-04-15 13:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008-02-28 01:53:25 | 000,594,600 | ---- | M] ( ) -- C:\WINDOWS\system32\lxdxcoms.exe
PRC - [2007-02-28 17:12:12 | 000,208,896 | ---- | M] (UASSOFT.COM) -- C:\Program Files\Trust\Trust R-series Mouse And Keyboard\KMWDSrv.exe


[color=#E56717]========== Modules (SafeList) ==========[/color]

MOD - [2010-03-05 17:43:43 | 000,553,984 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Motylek\Pulpit\OTL.exe
MOD - [2009-11-25 00:50:32 | 000,139,264 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\AhJsctNs.dll


[color=#E56717]========== Win32 Services (SafeList) ==========[/color]

SRV - [2009-11-25 00:51:35 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus)
SRV - [2009-11-25 00:51:21 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner)
SRV - [2009-11-25 00:48:48 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner)
SRV - [2009-11-25 00:43:56 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv)
SRV - [2008-09-04 05:02:24 | 001,295,616 | ---- | M] (O&O Software GmbH) [Auto | Running] -- C:\WINDOWS\system32\oodag.exe -- (O&O Defrag)
SRV - [2008-02-28 01:53:25 | 000,594,600 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\lxdxcoms.exe -- (lxdx_device)
SRV - [2008-02-28 01:53:22 | 000,098,984 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdxserv.exe -- (lxdxCATSCustConnectService)
SRV - [2007-02-28 17:12:12 | 000,208,896 | ---- | M] (UASSOFT.COM) [Auto | Running] -- C:\Program Files\Trust\Trust R-series Mouse And Keyboard\KMWDSrv.exe -- (KMWDSERVICE)
SRV - [2005-11-14 00:06:04 | 000,069,632 | ---- | M] (Macrovision Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe -- (IDriverT)


[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV - File not found [Kernel | Unknown | Running] --  -- (szkgfs)
DRV - File not found [Kernel | Unknown | Running] --  -- (szkg5)
DRV - [2010-01-07 16:07:14 | 000,038,224 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)
DRV - [2009-11-25 00:50:59 | 000,094,160 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswmon2.sys -- (aswMon2)
DRV - [2009-11-25 00:50:12 | 000,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswSP.sys -- (aswSP)
DRV - [2009-11-25 00:50:00 | 000,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2009-11-25 00:49:07 | 000,048,560 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2009-11-25 00:48:57 | 000,023,120 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2009-11-25 00:47:54 | 000,027,408 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aavmker4.sys -- (Aavmker4)
DRV - [2008-05-24 20:09:10 | 000,073,728 | ---- | M] (EZB Systems, Inc.) [File_System | System | Running] -- C:\Program Files\UltraISO\drivers\ISODrive.sys -- (ISODrive)
DRV - [2008-04-15 13:00:00 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus)
DRV - [2008-04-13 23:05:40 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Sterownik NT karty Realtek RTL8139(A/B/C)
DRV - [2007-09-05 10:31:30 | 004,611,072 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2007-04-19 23:05:00 | 006,739,168 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2007-02-13 06:42:18 | 000,014,848 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\KMWDFilter.SYS -- (KMWDFilter)
DRV - [2006-12-14 09:44:06 | 000,085,120 | R--- | M] (Realtek Semiconductor Corporation                           ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2006-11-30 15:14:22 | 000,090,800 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se45unic.sys -- (se45unic) Sony Ericsson Device 069 USB Ethernet Emulation SEMC45 (WDM)
DRV - [2006-11-30 15:14:14 | 000,086,432 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se45obex.sys -- (se45obex)
DRV - [2006-11-30 15:14:10 | 000,088,624 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se45mgmt.sys -- (se45mgmt) Sony Ericsson Device 069 USB WMC Device Management Drivers (WDM)
DRV - [2006-11-30 15:14:10 | 000,018,704 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se45nd5.sys -- (se45nd5) Sony Ericsson Device 069 USB Ethernet Emulation SEMC45 (NDIS)
DRV - [2006-11-30 15:14:04 | 000,097,088 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se45mdm.sys -- (se45mdm)
DRV - [2006-11-30 15:14:04 | 000,009,360 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se45mdfl.sys -- (se45mdfl)
DRV - [2006-11-30 15:13:56 | 000,061,536 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\se45bus.sys -- (se45bus) Sony Ericsson Device 069 driver (WDM)
DRV - [2006-03-13 15:50:08 | 000,085,696 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w300obex.sys -- (w300obex)
DRV - [2006-03-13 15:50:06 | 000,087,824 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w300mgmt.sys -- (w300mgmt) Sony Ericsson W300 USB WMC Device Management Drivers (WDM)
DRV - [2006-03-13 15:50:02 | 000,096,352 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w300mdm.sys -- (w300mdm)
DRV - [2006-03-13 15:50:00 | 000,009,264 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w300mdfl.sys -- (w300mdfl)
DRV - [2006-03-13 15:49:54 | 000,060,800 | R--- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\w300bus.sys -- (w300bus) Sony Ericsson W300 Driver driver (WDM)


[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie


IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-448539723-842925246-725345543-1003\S-1-5-21-448539723-842925246-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.startup.homepage: "www.wp.pl"
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.7

FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010-03-03 19:31:55 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010-02-20 17:34:17 | 000,000,000 | ---D | M]

[2009-07-24 10:22:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Motylek\Dane aplikacji\Mozilla\Extensions
[2010-03-05 10:14:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Motylek\Dane aplikacji\Mozilla\Firefox\Profiles\yy7m5tc6.default\extensions
[2009-09-02 19:01:45 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Motylek\Dane aplikacji\Mozilla\Firefox\Profiles\yy7m5tc6.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010-02-20 18:08:49 | 000,000,000 | ---D | M] (Stylish) -- C:\Documents and Settings\Motylek\Dane aplikacji\Mozilla\Firefox\Profiles\yy7m5tc6.default\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}
[2010-03-05 10:14:47 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2009-11-03 09:31:08 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml
[2009-11-03 09:31:08 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml
[2009-11-03 09:31:08 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml
[2009-11-03 09:31:08 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml
[2009-11-03 09:31:08 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml
[2009-11-03 09:31:08 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml

O1 HOSTS File: ([2008-04-15 13:00:00 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (no name) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - No CLSID value found.
O2 - BHO: (no name) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - No CLSID value found.
O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [lxdxamon] C:\Program Files\Lexmark 3600-4600 Series\lxdxamon.exe ()
O4 - HKLM..\Run: [lxdxmon.exe] C:\Program Files\Lexmark 3600-4600 Series\lxdxmon.exe ()
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe (O&O Software GmbH)
O4 - HKLM..\Run: [Vistadrv] C:\Program Files\VistaDrives\vsdrv.exe ()
O4 - HKU\S-1-5-21-448539723-842925246-725345543-1003..\Run: [Nowe Gadu-Gadu] C:\Program Files\Nowe Gadu-Gadu\gg.exe (GG Network S.A.)
O4 - HKLM..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-21-448539723-842925246-725345543-1003\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-21-448539723-842925246-725345543-1003\Software\Policies\Microsoft\Internet Explorer\restrictions present
O7 - HKU\S-1-5-21-448539723-842925246-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-448539723-842925246-725345543-1003_Classes\Software\Policies\Microsoft\Internet Explorer\control panel present
O7 - HKU\S-1-5-21-448539723-842925246-725345543-1003_Classes\Software\Policies\Microsoft\Internet Explorer\restrictions present
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - F:\Program Files\BitComet\tools\BitCometBHO_1.2.1.2.dll File not found
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0-windows-i586.cab (Java Plug-in 1.6.0)
O16 - DPF: {CAFEEFAC-0016-0000-0017-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_17-windows-i586.cab (Java Plug-in 1.6.0_17)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 213.227.72.1 213.227.75.1
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Motylek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Motylek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009-07-21 16:44:24 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{02c01c53-761c-11de-9a18-00e04c621aa8}\Shell\AutoRun\command - "" = WScript.exe .\`.vbs
O33 - MountPoints2\{02c01c53-761c-11de-9a18-00e04c621aa8}\Shell\open\Command - "" = WScript.exe .\`.vbs
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O34 - HKLM BootExecute: (OODBS) - C:\WINDOWS\System32\OODBS.exe (O&O Software GmbH)
O35 - comfile [open] -- "%1" %*
O35 - exefile [open] -- "%1" %*

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2010-03-05 17:43:43 | 000,553,984 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Motylek\Pulpit\OTL.exe
[2010-03-05 17:39:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Motylek\Dane aplikacji\Malwarebytes
[2010-03-05 17:39:51 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys
[2010-03-05 17:39:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes
[2010-03-05 17:39:49 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2010-03-05 17:39:49 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2010-03-05 17:08:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\SITEguard
[2010-03-05 17:08:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\STOPzilla!
[2010-03-05 17:08:23 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\iS3
[2010-03-05 17:06:01 | 005,115,824 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Documents and Settings\Motylek\Pulpit\mbam-setup_1.44(dobreprogramy.pl).exe
[2010-03-04 16:58:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Motylek\Pulpit\tapety
[2010-03-03 19:32:03 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\appmgmt
[2010-03-03 19:01:27 | 000,000,000 | ---D | C] -- C:\QUARANTINE
[2010-03-03 18:06:56 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Cisco Systems
[2010-03-03 18:06:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\McAfee
[2010-03-03 18:06:48 | 000,000,000 | ---D | C] -- C:\Program Files\McAfee
[2010-03-03 18:04:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Motylek\Pulpit\McAfee Internet Security 2010 3 PCs
[2010-03-03 18:04:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Motylek\Pulpit\McAFee VirusScan Enterprise 8.7i SP1 Antivirus
[2010-03-01 18:53:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Google
[2010-03-01 18:30:31 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Motylek\Recent
[2010-02-28 20:51:39 | 000,008,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\i2omgmt.sys
[2010-02-28 14:25:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Motylek\Pulpit\Taniec ostatniej szansy  (2008)(lektor pl)DvDRip RMVB[www.download24.se]
[2010-02-28 08:29:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Motylek\Ustawienia lokalne\Dane aplikacji\Temp
[2010-02-26 17:51:13 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Motylek\Pulpit\Praca kontrolna DOROTA SKUTNIK Prezentacja multimedialna programu Microsoft PowerPoint
[2010-02-26 17:02:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Motylek\Pulpit\26.02.2010
[2010-02-25 19:01:55 | 000,000,000 | ---D | C] -- C:\Program Files\Riva
[2010-02-25 18:55:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Motylek\Moje dokumenty\Aiseesoft Studio
[2010-02-25 18:38:19 | 000,000,000 | ---D | C] -- C:\videooutput
[2010-02-25 18:38:17 | 000,000,000 | ---D | C] -- C:\Program Files\Smallvideosoft
[2010-02-25 17:58:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Motylek\Pulpit\dinusie;]
[2010-02-20 18:08:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Motylek\Dane aplikacji\Apple Computer
[2010-02-20 17:34:01 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2010-02-20 17:33:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
[2010-02-20 17:33:46 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2010-02-20 17:33:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Motylek\Ustawienia lokalne\Dane aplikacji\Apple
[2010-02-20 17:33:40 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update
[2010-02-20 17:33:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Apple
[2010-02-20 17:33:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Motylek\Ustawienia lokalne\Dane aplikacji\Apple Computer
[2010-02-16 11:35:43 | 000,000,000 | ---D | C] -- C:\Program Files\ALLConverter
[2010-02-13 18:09:13 | 000,892,928 | ---- | C] (Free Software Foundation) -- C:\WINDOWS\System32\iconv.dll
[2010-02-13 18:09:09 | 000,000,000 | ---D | C] -- C:\Program Files\ALLPlayer
[2010-02-13 18:08:13 | 001,415,680 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\WMV9VCM.dll
[2010-02-13 18:08:07 | 000,094,208 | ---- | C] (Ligos Corporation) -- C:\WINDOWS\System32\lmpgvd.ax
[2010-02-13 18:08:06 | 000,106,496 | ---- | C] (Ligos Corporation) -- C:\WINDOWS\System32\lmpgspl.ax
[2010-02-13 18:08:05 | 000,245,760 | ---- | C] (Ligos Corporation) -- C:\WINDOWS\System32\mplvpx.dll
[2010-02-13 18:08:03 | 000,086,528 | ---- | C] (Fraunhofer) -- C:\WINDOWS\System32\DVDVideo.ax
[2010-02-13 15:42:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Google
[2010-02-13 09:24:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Google
[2009-09-16 16:04:04 | 000,438,272 | ---- | C] ( ) -- C:\WINDOWS\System32\LXDXhcp.dll
[2009-09-16 16:04:04 | 000,364,544 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxinpa.dll
[2009-09-16 16:04:03 | 000,843,776 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxusb1.dll
[2009-09-16 16:04:03 | 000,339,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxiesc.dll
[2009-09-16 16:04:02 | 001,105,920 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxserv.dll
[2009-09-16 16:04:02 | 000,647,168 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxpmui.dll
[2009-09-16 16:04:02 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxprox.dll
[2009-09-16 16:04:01 | 000,569,344 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxlmpm.dll
[2009-09-16 16:04:00 | 000,663,552 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxhbn3.dll
[2009-09-16 16:03:58 | 000,376,832 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxcomm.dll
[2009-09-16 16:03:57 | 000,851,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdxcomc.dll
[2009-07-21 16:47:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft
[2009-07-21 16:47:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft
[2009-07-21 16:44:21 | 000,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft
[2009-07-21 16:44:21 | 000,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft
[1 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2010-03-05 17:55:00 | 000,000,462 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{759E65F9-6F97-43A0-9F9A-1C23FFD4E1E5}.job
[2010-03-05 17:43:43 | 000,553,984 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Motylek\Pulpit\OTL.exe
[2010-03-05 17:39:55 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk
[2010-03-05 17:37:34 | 000,000,752 | ---- | M] () -- C:\WINDOWS\System32\drivers\kgpcpy.cfg
[2010-03-05 17:37:10 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010-03-05 17:36:53 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010-03-05 17:36:46 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010-03-05 17:36:44 | 000,248,696 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010-03-05 17:36:43 | 000,804,825 | ---- | M] () -- C:\WINDOWS\System32\oodbs.lor
[2010-03-05 17:36:01 | 004,456,448 | -H-- | M] () -- C:\Documents and Settings\Motylek\NTUSER.DAT
[2010-03-05 15:15:20 | 000,000,078 | ---- | M] () -- C:\Documents and Settings\Motylek\Pulpit\winesm32 pomocy • forum.instalki.pl.URL
[2010-03-05 15:15:02 | 000,000,106 | ---- | M] () -- C:\Documents and Settings\Motylek\Pulpit\Win32rootkit siedzi w system32drivers • programosy.pl.URL
[2010-03-05 13:51:23 | 004,843,026 | -H-- | M] () -- C:\Documents and Settings\Motylek\Ustawienia lokalne\Dane aplikacji\IconCache.db
[2010-03-05 13:48:17 | 000,000,466 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{B82C9F5E-D2A9-4B8F-A006-2C7DA7FC4402}.job
[2010-03-05 11:15:03 | 000,690,688 | ---- | M] () -- C:\Documents and Settings\Motylek\Pulpit\biologia.doc
[2010-03-05 09:59:22 | 000,000,162 | -H-- | M] () -- C:\Documents and Settings\Motylek\Pulpit\~$ologia.doc
[2010-03-04 21:40:45 | 003,123,441 | ---- | M] () -- C:\Documents and Settings\Motylek\Pulpit\stefano terazzino - cin cin amore.mp3
[2010-03-04 21:35:31 | 003,232,527 | ---- | M] () -- C:\Documents and Settings\Motylek\Pulpit\stefano terazzino feat. patti - candy.mp3
[2010-03-04 12:26:20 | 000,264,704 | ---- | M] () -- C:\Documents and Settings\Motylek\Pulpit\Adam Bernard Mickiewicz herbu Poraj.doc
[2010-03-03 22:39:38 | 005,115,824 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Documents and Settings\Motylek\Pulpit\mbam-setup_1.44(dobreprogramy.pl).exe
[2010-03-03 19:29:42 | 000,000,654 | ---- | M] () -- C:\WINDOWS\win.ini
[2010-03-03 19:29:42 | 000,000,243 | ---- | M] () -- C:\WINDOWS\system.ini
[2010-03-01 18:33:28 | 000,067,584 | ---- | M] () -- C:\Documents and Settings\Motylek\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010-03-01 18:33:28 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini
[2010-03-01 16:45:17 | 000,000,292 | -HS- | M] () -- C:\Documents and Settings\Motylek\ntuser.ini
[2010-02-28 11:48:18 | 003,366,693 | ---- | M] () -- C:\Documents and Settings\Motylek\Pulpit\taio cruz - break your heart [lato 2009].mp3
[2010-02-25 17:27:31 | 000,010,752 | ---- | M] () -- C:\Documents and Settings\Motylek\Pulpit\Nowy Dokument programu Microsoft Word.doc
[2010-02-20 22:12:07 | 000,289,566 | ---- | M] () -- C:\Documents and Settings\Motylek\Pulpit\SDC10938.JPGf.jpg
[2010-02-20 17:33:42 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010-02-16 23:24:19 | 000,036,352 | ---- | M] () -- C:\Documents and Settings\Motylek\Pulpit\1.doc
[2010-02-15 17:01:47 | 000,019,968 | ---- | M] () -- C:\Documents and Settings\Motylek\Pulpit\http.doc
[2010-02-13 18:08:19 | 000,237,568 | ---- | M] () -- C:\WINDOWS\System32\OggDS.dll
[2010-02-13 18:08:18 | 000,921,600 | ---- | M] () -- C:\WINDOWS\System32\vorbisenc.dll
[2010-02-13 18:08:14 | 000,188,416 | ---- | M] () -- C:\WINDOWS\System32\vorbis.dll
[2010-02-13 18:08:13 | 001,415,680 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\WMV9VCM.dll
[2010-02-13 18:08:13 | 000,045,056 | ---- | M] () -- C:\WINDOWS\System32\ogg.dll
[2010-02-13 18:08:07 | 000,094,208 | ---- | M] (Ligos Corporation) -- C:\WINDOWS\System32\lmpgvd.ax
[2010-02-13 18:08:06 | 000,106,496 | ---- | M] (Ligos Corporation) -- C:\WINDOWS\System32\lmpgspl.ax
[2010-02-13 18:08:05 | 000,245,760 | ---- | M] (Ligos Corporation) -- C:\WINDOWS\System32\mplvpx.dll
[2010-02-13 18:08:04 | 000,009,216 | ---- | M] () -- C:\WINDOWS\System32\cpuinf32.dll
[2010-02-13 18:08:03 | 000,086,528 | ---- | M] (Fraunhofer) -- C:\WINDOWS\System32\DVDVideo.ax
[2010-02-08 20:07:13 | 000,184,832 | ---- | M] () -- C:\Documents and Settings\Motylek\Pulpit\PYTANIA I ODPOWIEDZI NA EGZAMIN II LU.doc
[1 C:\Documents and Settings\All Users\*.tmp files -> C:\Documents and Settings\All Users\*.tmp -> ]

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2010-03-05 17:39:55 | 000,000,696 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes' Anti-Malware.lnk
[2010-03-05 17:37:25 | 000,000,752 | ---- | C] () -- C:\WINDOWS\System32\drivers\kgpcpy.cfg
[2010-03-05 17:06:01 | 000,000,106 | ---- | C] () -- C:\Documents and Settings\Motylek\Pulpit\Win32rootkit siedzi w system32drivers • programosy.pl.URL
[2010-03-05 17:06:01 | 000,000,078 | ---- | C] () -- C:\Documents and Settings\Motylek\Pulpit\winesm32 pomocy • forum.instalki.pl.URL
[2010-03-05 09:59:22 | 000,000,162 | -H-- | C] () -- C:\Documents and Settings\Motylek\Pulpit\~$ologia.doc
[2010-03-04 21:40:45 | 003,123,441 | ---- | C] () -- C:\Documents and Settings\Motylek\Pulpit\stefano terazzino - cin cin amore.mp3
[2010-03-04 21:35:31 | 003,232,527 | ---- | C] () -- C:\Documents and Settings\Motylek\Pulpit\stefano terazzino feat. patti - candy.mp3
[2010-03-04 12:26:19 | 000,264,704 | ---- | C] () -- C:\Documents and Settings\Motylek\Pulpit\Adam Bernard Mickiewicz herbu Poraj.doc
[2010-03-04 12:26:08 | 000,690,688 | ---- | C] () -- C:\Documents and Settings\Motylek\Pulpit\biologia.doc
[2010-02-28 11:47:51 | 003,366,693 | ---- | C] () -- C:\Documents and Settings\Motylek\Pulpit\taio cruz - break your heart [lato 2009].mp3
[2010-02-25 17:27:31 | 000,010,752 | ---- | C] () -- C:\Documents and Settings\Motylek\Pulpit\Nowy Dokument programu Microsoft Word.doc
[2010-02-20 22:12:07 | 000,289,566 | ---- | C] () -- C:\Documents and Settings\Motylek\Pulpit\SDC10938.JPGf.jpg
[2010-02-20 17:33:42 | 000,000,284 | ---- | C] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job
[2010-02-16 23:24:18 | 000,036,352 | ---- | C] () -- C:\Documents and Settings\Motylek\Pulpit\1.doc
[2010-02-16 11:27:50 | 000,000,466 | -H-- | C] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{B82C9F5E-D2A9-4B8F-A006-2C7DA7FC4402}.job
[2010-02-13 18:09:13 | 000,675,840 | ---- | C] () -- C:\WINDOWS\System32\ac3filter.ax
[2010-02-13 18:08:19 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\OggDS.dll
[2010-02-13 18:08:18 | 000,921,600 | ---- | C] () -- C:\WINDOWS\System32\vorbisenc.dll
[2010-02-13 18:08:14 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\vorbis.dll
[2010-02-13 18:08:13 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\ogg.dll
[2010-02-13 18:08:04 | 000,009,216 | ---- | C] () -- C:\WINDOWS\System32\cpuinf32.dll
[2010-02-08 20:07:12 | 000,184,832 | ---- | C] () -- C:\Documents and Settings\Motylek\Pulpit\PYTANIA I ODPOWIEDZI NA EGZAMIN II LU.doc
[2009-09-16 16:07:43 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxdxvs.dll
[2009-09-16 16:07:41 | 000,360,448 | ---- | C] () -- C:\WINDOWS\System32\lxdxcoin.dll
[2009-09-16 16:07:14 | 000,782,336 | ---- | C] () -- C:\WINDOWS\System32\lxdxdrs.dll
[2009-09-16 16:07:14 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\lxdxcaps.dll
[2009-09-16 16:07:13 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\lxdxcnv4.dll
[2009-09-16 16:06:49 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\lxf3oem.dll
[2009-09-16 16:06:49 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\LXF3PMON.DLL
[2009-09-16 16:06:49 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXF3FXPU.DLL
[2009-09-16 16:06:49 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\LXF3PMRC.DLL
[2009-09-16 16:04:22 | 000,000,044 | ---- | C] () -- C:\WINDOWS\System32\lxdxrwrd.ini
[2009-09-16 16:04:04 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\LXDXinst.dll
[2009-09-16 16:03:59 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lxdxgrd.dll
[2009-07-27 10:08:52 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2009-07-22 18:10:28 | 000,067,584 | ---- | C] () -- C:\Documents and Settings\Motylek\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009-07-21 18:39:48 | 000,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI
[2009-07-21 18:31:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\OODCNT.INI
[2009-07-21 18:29:14 | 000,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009-07-21 18:29:14 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini
[2009-07-21 18:29:12 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2009-07-21 18:29:11 | 000,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2009-07-21 18:29:11 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2009-07-21 17:47:23 | 000,881,664 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2009-07-21 17:47:23 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2007-04-19 23:05:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll
[2007-04-19 23:05:00 | 001,474,560 | ---- | C] () -- C:\WINDOWS\System32\nview.dll
[2007-04-19 23:05:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll
[2007-04-19 23:05:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll
[2007-04-19 23:05:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll
[2004-02-05 00:54:00 | 000,005,679 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI

[color=#E56717]========== LOP Check ==========[/color]

[2009-12-07 16:20:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Electronic Arts
[2009-11-17 19:23:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ipla
[2010-03-05 17:08:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\SITEguard
[2010-03-05 17:39:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\STOPzilla!
[2009-07-24 11:33:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Teleca
[2009-12-07 16:20:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP
[2009-07-21 17:43:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\{3E318E90-4BE6-4440-A0EE-2EAF8419199C}
[2009-11-20 21:31:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Motylek\Dane aplikacji\ipla
[2010-02-15 16:47:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Motylek\Dane aplikacji\Lexmark Productivity Studio
[2009-09-28 16:50:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Motylek\Dane aplikacji\Nowe Gadu-Gadu
[2009-07-24 10:56:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Motylek\Dane aplikacji\Teleca
[2009-07-23 13:10:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Motylek\Dane aplikacji\URSoft
[2009-12-02 12:32:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Motylek\Dane aplikacji\XnView
[2010-03-05 17:55:00 | 000,000,462 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{759E65F9-6F97-43A0-9F9A-1C23FFD4E1E5}.job
[2010-03-05 13:48:17 | 000,000,466 | -H-- | M] () -- C:\WINDOWS\Tasks\User_Feed_Synchronization-{B82C9F5E-D2A9-4B8F-A006-2C7DA7FC4402}.job

[color=#E56717]========== Purity Check ==========[/color]



[color=#E56717]========== Alternate Data Streams ==========[/color]

@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:C4252FE0
< End of report >



[wojtas]

Proszę zastosować się do zasad wstawiania logów ( brak logu z Gmera) oraz 2 logu z OTL . extras.txt

[korzonlajner]

LOG EXTRAS:
http://wklej.org/id/292037/

LOG OTL:
http://wklej.org/id/292039/

Skanuję jeszcze GMER'em ale komp mi się wtedy wiesza... Tego winesm32.exe nie masz już w autostarcie (sam zniknął) ale dalej zamula tak jak wcześniej.

Już mam log z GMERA:
http://wklej.org/id/292110/

[wojtas]

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
O2 - BHO: (no name) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - No CLSID value found.
O2 - BHO: (no name) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - No CLSID value found.
O33 - MountPoints2\{02c01c53-761c-11de-9a18-00e04c621aa8}\Shell\AutoRun\command - "" = WScript.exe .\`.vbs
O33 - MountPoints2\{02c01c53-761c-11de-9a18-00e04c621aa8}\Shell\open\Command - "" = WScript.exe .\`.vbs

:Files
C:\WINDOWS\System32\dllcache\i2omgmt.sys
C:\WINDOWS\System32\drivers\kgpcpy.cfg

:Commands
[emptytemp]

Kliknij w Run Fix. I potwierdź reset kompa .

Czynności końcowe :

1.Uruchom OTL z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware (zaktualizuj, usuń co znajdzie )


Zaktualizuj zabezpieczenia:
>>> Adobe Reader 9.3
>>> Java™ 6 Update 18
>>> Mozilla Firefox
>>> Avast 5

[korzonlajner]

Może i trochę poprawiło,ale nadal jak włączam kompa to przez pierwsze kilka minut pasek MENU jest zamrożony,a jak najadę na niego kursorem to jest klepsydra i nie mogę w ogóle na niego kliknąć. Malwarebytes niczego nie wykrył...

[wojtas]

Daj loga z combofixa

[korzonlajner]

log z Combofix'a:
http://wklej.org/id/292710/

Trochę krócej się włącza,ale jeszcze przez chwilę pasek jest zamrożony:)

[wojtas]

widzę :

c:\program files\McAfee Security Scan

oraz avasta 5 czy McAfee to nie antywirus ? wiesz że w systemie powinien być tylko jeden ?
Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\drivers\i2omgmt.sys
c:\windows\system32\config\systemprofile\Dane aplikacji\rbuwzv.dat

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->
Rozpocznie się usuwanie i powstanie log daj go.

[korzonlajner]

Kurde za każdym razem wywala mi blue screen of death:/

[wojtas]

jakiej treści ?
Pobierz to

Start - programy - Debugging Tools for Windows - WinDbg

File Open Crash Dump

Pojawia sie okienko, w którym wskazujesz plik *.dmp
Znajduje sie w windows\minidump\ (najnowszy)
Na pytanie: Save information for workspace odpowiadasz no , następnie wklej zawartość na forum treść z programu

[korzonlajner]

Za trzecim razem się udało, oto log z combofix'a:
http://wklej.org/id/293334/

A tu ten minidump:
****************************************************************************
Executable search path is:
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Windows XP Kernel Version 2600 (Service Pack 3) MP (2 procs) Free x86 compatible
Product: WinNt, suite: TerminalServer SingleUserTS
Kernel base = 0x804d7000 PsLoadedModuleList = 0x8055d720
Debug session time: Tue Mar 9 18:12:32.125 2010 (GMT+1)
System Uptime: 0 days 0:03:41.865
*********************************************************************
* Symbols can not be loaded because symbol path is not initialized. *
* *
* The Symbol Path can be set by: *
* using the _NT_SYMBOL_PATH environment variable. *
* using the -y <symbol_path> argument when starting the debugger. *
* using .sympath and .sympath+ *
*********************************************************************
Unable to load image ntoskrnl.exe, Win32 error 2
*** WARNING: Unable to verify timestamp for ntoskrnl.exe
*** ERROR: Module load completed but symbols could not be loaded for ntoskrnl.exe
Loading Kernel Symbols
............................................................................................................................
Loading User Symbols
Loading unloaded module list
.......
Unable to load image KMWDFilter.SYS, Win32 error 2
*** WARNING: Unable to verify timestamp for KMWDFilter.SYS
*** ERROR: Module load completed but symbols could not be loaded for KMWDFilter.SYS
*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************

Use !analyze -v to get detailed debugging information.

BugCheck 1000008E, {c0000005, b9d8e3dc, b5bb9bc0, 0}

***** Kernel symbols are WRONG. Please fix symbols to do analysis.

Probably caused by : KMWDFilter.SYS ( KMWDFilter+13dc )

Followup: MachineOwner
---------

[wojtas]

Probably caused by : KMWDFilter.SYS ( KMWDFilter+13dc )

plik od Twojej myszki najprawdopodobniej. odinstaluj sterowniki od niej i ponownie zainstaluj

na kasację plik:

c:\windows\system32\dllcache\i2omgmt.sys

[korzonlajner]

Zrobiłem te sterowniki, usunąłem ten plik i teraz jest tak:
włączam kompa, załadują się pierwsze trzy ikonki na pasku,

zawiesi się na minutę i po minucie ładuje się reszta ikonek.

[wojtas]

daj nowego loga z OTL

[korzonlajner]

log OTL;
http://wklej.org/id/293943/

LOG EXTRAS;
http://wklej.org/id/293945/

[NieWiem]

Dalej siedzą szczątki od McAfee i Avast razem, plus wychodzi na to, że problem jest dalej powodowany przez sterowniki od myszy.

Avasta i McAfee wyinstaluj, pomoce naukowe znajdziesz tutaj:
http://www.searchengines.pl/Deinstalatory-narzedzi-ochronnych-t45565.html

Jak się już obydwóch pozbędziesz, to zainstaluj wtedy od nowa jednego.

[korzonlajner]

Usunąłem Avasta i MCAfee, odinstalowałem sterowniki od myszki, po ponownym uruchomieniu windows wyszukał swoje. Lecz dalej jest to samo. Wklejam logi

OTL:
http://wklej.org/id/294654/

EXTRAS:
http://wklej.org/id/294656/

[NieWiem]

Uwierz mi, że naprawdę nic w tym logu nie ma.

Start ++> uruchom ++> wpisujesz

ComboFix /Uninstall

i enter.

[korzonlajner]

Niestety wciąż jest to samo:(

[NieWiem]

No ale ja nic niestetey na to nie poradzę. Nie znajdę szkodników tam, gdzie ich nie ma

Przeleć komputer Malwarebytes' jeszcze raz, ale jestem pewny, że będą same "0".