Wygenerowałem logi co teraz/windows security alert

**Posty:** 3 · przez **rafalzlb** 06 Maj 2010, 17:04

Witam z góry uprzedzam jestem zielony jeśli chodzi o kwestie systemowe komputerów ale trafiłem na to forum z problemem który został już poruszony a mianowicie Windows security alert dokładnie od dnia dzisiejszego wszystko ( programy, notatniki) bo są zawirusowane.

Zrobiłem tak jak wyczytałem za pomocą OTL wygenerowałem log wklejam poniżej i co dalej mam zrobić?

Dodano Dzisiaj, 17:09:
z pliku extras:

Kod: Zaznacz wszystko: OTL Extras logfile created on: 2010-05-06 16:46:53 - Run 1 OTL by OldTimer - Version 3.2.4.1 Folder = C:\Users\Rafal\Downloads Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 61,00% Memory free 6,00 Gb Paging File | 5,00 Gb Available in Paging File | 81,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 109,88 Gb Total Space | 71,75 Gb Free Space | 65,30% Space Free | Partition Type: NTFS Drive D: | 110,00 Gb Total Space | 65,71 Gb Free Space | 59,74% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: RAFAL-PC Current User Name: Rafal Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = Reg Error: Unknown registry data type -- File not found [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [color=#E56717]========== Authorized Applications List ==========[/color] [color=#E56717]========== Vista Active Open Ports Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{23E94657-A40C-424D-B04B-0845BA93297E}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | [color=#E56717]========== Vista Active Application Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{1709D513-FC3B-4A8C-8089-B6C9A859E557}" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe | "{31DB680D-21F2-44A4-B859-694CB6214B66}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe | "{6767CDFE-1921-4B87-AD0C-55E564CD9837}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | "{6D889084-F467-48EB-9A19-EFE5A20CBD0D}" = dir=in | app=c:\program files\cyberlink\powerdvd8\powerdvd8.exe | "{A3D8CEF5-6045-428C-BB0D-30A7643BF2FC}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe | "{A4DE5A44-992E-417D-B846-0A213B88A968}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe | "{E41CFC94-6540-496C-8834-80E1D7654C05}" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe | [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.1.0.5200 "{04983D37-2202-4295-94A2-8B547C66133F}" = Atheros WLAN Client "{0A2C5854-557E-48C8-835A-3B9F074BDCAA}" = Python 2.5 "{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution III "{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager "{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite "{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 18 "{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ) "{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8 "{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor "{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4ac40384-37ba-421c-b14c-2ecbe4403817}" = Business Contact Manager z dodatkiem SP1 dla programu Outlook 2007 "{4DFF1415-4C29-44A8-BFD4-2BCE249C4991}" = SpPhones "{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies "{50A0893D-47D8-48E0-A7E8-44BCD7E4422E}" = Microsoft SQL Server Native Client "{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English) "{560F47F7-EB23-44B1-AAFC-667F1CD8FE5C}" = Sp5 "{68CAE442-579C-4D84-AA5F-253852522ED5}" = PCTroubleshooting "{6A1F72DD-2465-43A2-A137-8A849399B7A8}" = REALTEK Wireless LAN Software "{6C3959C6-943E-44B3-BAAD-570B04B134E5}" = SpCommon "{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Easy Battery Manager "{71A51B59-E7D3-11DB-A386-005056C00008}" = Namuga 1.3M Webcam "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{8E106A57-A17E-431D-B48F-175E42EB9F74}" = imagine digital freedom - Samsung "{90120000-0015-0415-0000-0000000FF1CE}" = Microsoft Office Access MUI (Polish) 2007 "{90120000-0016-0415-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Polish) 2007 "{90120000-0018-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Polish) 2007 "{90120000-0019-0415-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Polish) 2007 "{90120000-001A-0415-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Polish) 2007 "{90120000-001B-0415-0000-0000000FF1CE}" = Microsoft Office Word MUI (Polish) 2007 "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2007 "{90120000-002C-0415-0000-0000000FF1CE}" = Microsoft Office Proofing (Polish) 2007 "{90120000-006E-0415-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Polish) 2007 "{90260415-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Web Components "{90280415-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional z programem FrontPage "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager "{90A40415-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components "{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007 "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9EFDFBA8-9174-3C61-8645-28376C5CA994}" = Microsoft .NET Framework 3.5 Language Pack SP1 - plk "{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}" = Samsung Update Plus "{A7581D39-EA20-4883-A480-80C21047052B}" = Easy Network Manager "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AA16A9E5-40E9-44F5-801E-6B3D3CFE79E5}" = BatteryLifeExtender "{AC76BA86-7AD7-1045-7B44-A90000000001}" = Adobe Reader 9 - Polish "{AED53CDF-1046-4C6B-B5E2-C195125ECDA0}" = Oprogramowanie Intel(R) PROSet/Wireless WiFi "{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer "{C0D2F614-5CE5-4DCB-8678-E5C9AF7044F8}" = Microsoft SQL Server VSS Writer "{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint "{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{E415C943-37E5-473F-8BAE-043C56734124}" = Sp5TTInt "{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant "{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{FD4B33E1-24AE-4535-AA7B-162B30FB57CD}" = Sp5Intl "8461-7759-5462-8226" = Vuze "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Agere Systems Soft Modem" = Agere Systems HDA Modem "ALLPlayer_is1" = ALLPlayer V4.X "Applian FLV Player2.0.24" = Applian FLV Player "Business Contact Manager" = Business Contact Manager z dodatkiem SP1 dla programu Outlook 2007 "Gadu-Gadu" = Gadu-Gadu 6.1 "HDMI" = Intel(R) Graphics Media Accelerator Driver "InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite "InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8 "InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go "InstallShield_{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}" = Samsung Update Plus "InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer "InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector "IVONA - syntezator mowy, wersja demonstracyjna" = IVONA - syntezator mowy, wersja demonstracyjna "Marvell Miniport Driver" = Marvell Miniport Driver "McAfee Security Scan" = McAfee Security Scan "Microsoft .NET Framework 3.5 Language Pack SP1 - plk" = Pakiet językowy programu Microsoft .NET Framework 3.5 z dodatkiem SP1 — PLK "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Microsoft SQL Server 2005" = Microsoft SQL Server 2005 "Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3) "MSC" = McAfee SecurityCenter "PROHYBRIDR" = 2007 Microsoft Office system "ProInst" = Intel PROSet Wireless "SynTPDeinstKey" = Synaptics Pointing Device Driver "WinRAR archiver" = Archiwizator WinRAR [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-21-84699557-792703091-1178954015-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Paddy Power Poker" = Paddy Power Poker [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Application Events ] Error - 2010-04-28 05:21:26 | Computer Name = Rafal-PC | Source = WinMgmt | ID = 10 Description = Error - 2010-04-28 11:53:45 | Computer Name = Rafal-PC | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, moduł powodujący błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, kod wyjątku 0x40000015, przesunięcie błędu 0x0005badc, identyfikator procesu 0x16c, godzina rozpoczęcia aplikacji 0x01cae6eafb78ddd9. Error - 2010-04-28 11:54:58 | Computer Name = Rafal-PC | Source = WinMgmt | ID = 10 Description = Error - 2010-04-28 14:43:29 | Computer Name = Rafal-PC | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, moduł powodujący błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, kod wyjątku 0x40000015, przesunięcie błędu 0x0005badc, identyfikator procesu 0x180, godzina rozpoczęcia aplikacji 0x01cae702b19a6d43. Error - 2010-04-28 14:44:44 | Computer Name = Rafal-PC | Source = WinMgmt | ID = 10 Description = Error - 2010-04-29 03:45:54 | Computer Name = Rafal-PC | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, moduł powodujący błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, kod wyjątku 0x40000015, przesunięcie błędu 0x0005badc, identyfikator procesu 0x198, godzina rozpoczęcia aplikacji 0x01cae76ffe811eff. Error - 2010-04-29 03:46:39 | Computer Name = Rafal-PC | Source = WinMgmt | ID = 10 Description = Error - 2010-04-29 08:39:54 | Computer Name = Rafal-PC | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, moduł powodujący błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, kod wyjątku 0x40000015, przesunięcie błędu 0x0005badc, identyfikator procesu 0xc, godzina rozpoczęcia aplikacji 0x01cae79910837141. Error - 2010-04-29 08:40:58 | Computer Name = Rafal-PC | Source = WinMgmt | ID = 10 Description = Error - 2010-04-29 12:47:55 | Computer Name = Rafal-PC | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, moduł powodujący błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, kod wyjątku 0x40000015, przesunięcie błędu 0x0005badc, identyfikator procesu 0x188, godzina rozpoczęcia aplikacji 0x01cae7bbb68a9f1c. [ OSession Events ] Error - 2009-09-20 04:34:16 | Computer Name = Rafal-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 24 seconds with 0 seconds of active time. This session ended with a crash. Error - 2009-09-20 04:39:56 | Computer Name = Rafal-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 270 seconds with 240 seconds of active time. This session ended with a crash. Error - 2009-09-20 04:50:10 | Computer Name = Rafal-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 409 seconds with 300 seconds of active time. This session ended with a crash. [ System Events ] Error - 2010-05-06 10:30:58 | Computer Name = Rafal-PC | Source = Service Control Manager | ID = 7034 Description = Error - 2010-05-06 10:31:20 | Computer Name = Rafal-PC | Source = DCOM | ID = 10010 Description = Error - 2010-05-06 10:31:21 | Computer Name = Rafal-PC | Source = Service Control Manager | ID = 7009 Description = Error - 2010-05-06 10:31:21 | Computer Name = Rafal-PC | Source = Service Control Manager | ID = 7000 Description = Error - 2010-05-06 10:32:42 | Computer Name = Rafal-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001 Description = Error - 2010-05-06 10:43:00 | Computer Name = Rafal-PC | Source = HTTP | ID = 15016 Description = Error - 2010-05-06 10:43:59 | Computer Name = Rafal-PC | Source = Service Control Manager | ID = 7000 Description = Error - 2010-05-06 10:43:59 | Computer Name = Rafal-PC | Source = Service Control Manager | ID = 7011 Description = Error - 2010-05-06 10:43:59 | Computer Name = Rafal-PC | Source = Service Control Manager | ID = 7034 Description = Error - 2010-05-06 10:44:37 | Computer Name = Rafal-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001 Description = < End of report > [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = Reg Error: Unknown registry data type -- File not found [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [color=#E56717]========== Authorized Applications List ==========[/color] [color=#E56717]========== Vista Active Open Ports Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{23E94657-A40C-424D-B04B-0845BA93297E}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | [color=#E56717]========== Vista Active Application Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{1709D513-FC3B-4A8C-8089-B6C9A859E557}" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe | "{31DB680D-21F2-44A4-B859-694CB6214B66}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe | "{6767CDFE-1921-4B87-AD0C-55E564CD9837}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | "{6D889084-F467-48EB-9A19-EFE5A20CBD0D}" = dir=in | app=c:\program files\cyberlink\powerdvd8\powerdvd8.exe | "{A3D8CEF5-6045-428C-BB0D-30A7643BF2FC}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe | "{A4DE5A44-992E-417D-B846-0A213B88A968}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe | "{E41CFC94-6540-496C-8834-80E1D7654C05}" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe | [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.1.0.5200 "{04983D37-2202-4295-94A2-8B547C66133F}" = Atheros WLAN Client "{0A2C5854-557E-48C8-835A-3B9F074BDCAA}" = Python 2.5 "{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution III "{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager "{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite "{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 18 "{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ) "{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8 "{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor "{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4ac40384-37ba-421c-b14c-2ecbe4403817}" = Business Contact Manager z dodatkiem SP1 dla programu Outlook 2007 "{4DFF1415-4C29-44A8-BFD4-2BCE249C4991}" = SpPhones "{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies "{50A0893D-47D8-48E0-A7E8-44BCD7E4422E}" = Microsoft SQL Server Native Client "{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English) "{560F47F7-EB23-44B1-AAFC-667F1CD8FE5C}" = Sp5 "{68CAE442-579C-4D84-AA5F-253852522ED5}" = PCTroubleshooting "{6A1F72DD-2465-43A2-A137-8A849399B7A8}" = REALTEK Wireless LAN Software "{6C3959C6-943E-44B3-BAAD-570B04B134E5}" = SpCommon "{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Easy Battery Manager "{71A51B59-E7D3-11DB-A386-005056C00008}" = Namuga 1.3M Webcam "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{8E106A57-A17E-431D-B48F-175E42EB9F74}" = imagine digital freedom - Samsung "{90120000-0015-0415-0000-0000000FF1CE}" = Microsoft Office Access MUI (Polish) 2007 "{90120000-0016-0415-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Polish) 2007 "{90120000-0018-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Polish) 2007 "{90120000-0019-0415-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Polish) 2007 "{90120000-001A-0415-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Polish) 2007 "{90120000-001B-0415-0000-0000000FF1CE}" = Microsoft Office Word MUI (Polish) 2007 "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2007 "{90120000-002C-0415-0000-0000000FF1CE}" = Microsoft Office Proofing (Polish) 2007 "{90120000-006E-0415-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Polish) 2007 "{90260415-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Web Components "{90280415-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional z programem FrontPage "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager "{90A40415-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components "{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007 "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9EFDFBA8-9174-3C61-8645-28376C5CA994}" = Microsoft .NET Framework 3.5 Language Pack SP1 - plk "{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}" = Samsung Update Plus "{A7581D39-EA20-4883-A480-80C21047052B}" = Easy Network Manager "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AA16A9E5-40E9-44F5-801E-6B3D3CFE79E5}" = BatteryLifeExtender "{AC76BA86-7AD7-1045-7B44-A90000000001}" = Adobe Reader 9 - Polish "{AED53CDF-1046-4C6B-B5E2-C195125ECDA0}" = Oprogramowanie Intel(R) PROSet/Wireless WiFi "{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer "{C0D2F614-5CE5-4DCB-8678-E5C9AF7044F8}" = Microsoft SQL Server VSS Writer "{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint "{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{E415C943-37E5-473F-8BAE-043C56734124}" = Sp5TTInt "{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant "{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{FD4B33E1-24AE-4535-AA7B-162B30FB57CD}" = Sp5Intl "8461-7759-5462-8226" = Vuze "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Agere Systems Soft Modem" = Agere Systems HDA Modem "ALLPlayer_is1" = ALLPlayer V4.X "Applian FLV Player2.0.24" = Applian FLV Player "Business Contact Manager" = Business Contact Manager z dodatkiem SP1 dla programu Outlook 2007 "Gadu-Gadu" = Gadu-Gadu 6.1 "HDMI" = Intel(R) Graphics Media Accelerator Driver "InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite "InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8 "InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go "InstallShield_{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}" = Samsung Update Plus "InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer "InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector "IVONA - syntezator mowy, wersja demonstracyjna" = IVONA - syntezator mowy, wersja demonstracyjna "Marvell Miniport Driver" = Marvell Miniport Driver "McAfee Security Scan" = McAfee Security Scan "Microsoft .NET Framework 3.5 Language Pack SP1 - plk" = Pakiet językowy programu Microsoft .NET Framework 3.5 z dodatkiem SP1 — PLK "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Microsoft SQL Server 2005" = Microsoft SQL Server 2005 "Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3) "MSC" = McAfee SecurityCenter "PROHYBRIDR" = 2007 Microsoft Office system "ProInst" = Intel PROSet Wireless "SynTPDeinstKey" = Synaptics Pointing Device Driver "WinRAR archiver" = Archiwizator WinRAR [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-21-84699557-792703091-1178954015-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Paddy Power Poker" = Paddy Power Poker [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Application Events ] Error - 2010-04-28 05:21:26 | Computer Name = Rafal-PC | Source = WinMgmt | ID = 10 Description = Error - 2010-04-28 11:53:45 | Computer Name = Rafal-PC | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, moduł powodujący błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, kod wyjątku 0x40000015, przesunięcie błędu 0x0005badc, identyfikator procesu 0x16c, godzina rozpoczęcia aplikacji 0x01cae6eafb78ddd9. Error - 2010-04-28 11:54:58 | Computer Name = Rafal-PC | Source = WinMgmt | ID = 10 Description = Error - 2010-04-28 14:43:29 | Computer Name = Rafal-PC | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, moduł powodujący błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, kod wyjątku 0x40000015, przesunięcie błędu 0x0005badc, identyfikator procesu 0x180, godzina rozpoczęcia aplikacji 0x01cae702b19a6d43. Error - 2010-04-28 14:44:44 | Computer Name = Rafal-PC | Source = WinMgmt | ID = 10 Description = Error - 2010-04-29 03:45:54 | Computer Name = Rafal-PC | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, moduł powodujący błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, kod wyjątku 0x40000015, przesunięcie błędu 0x0005badc, identyfikator procesu 0x198, godzina rozpoczęcia aplikacji 0x01cae76ffe811eff. Error - 2010-04-29 03:46:39 | Computer Name = Rafal-PC | Source = WinMgmt | ID = 10 Description = Error - 2010-04-29 08:39:54 | Computer Name = Rafal-PC | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, moduł powodujący błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, kod wyjątku 0x40000015, przesunięcie błędu 0x0005badc, identyfikator procesu 0xc, godzina rozpoczęcia aplikacji 0x01cae79910837141. Error - 2010-04-29 08:40:58 | Computer Name = Rafal-PC | Source = WinMgmt | ID = 10 Description = Error - 2010-04-29 12:47:55 | Computer Name = Rafal-PC | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, moduł powodujący błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, kod wyjątku 0x40000015, przesunięcie błędu 0x0005badc, identyfikator procesu 0x188, godzina rozpoczęcia aplikacji 0x01cae7bbb68a9f1c. [ OSession Events ] Error - 2009-09-20 04:34:16 | Computer Name = Rafal-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 24 seconds with 0 seconds of active time. This session ended with a crash. Error - 2009-09-20 04:39:56 | Computer Name = Rafal-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 270 seconds with 240 seconds of active time. This session ended with a crash. Error - 2009-09-20 04:50:10 | Computer Name = Rafal-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 409 seconds with 300 seconds of active time. This session ended with a crash. [ System Events ] Error - 2010-05-06 10:30:58 | Computer Name = Rafal-PC | Source = Service Control Manager | ID = 7034 Description = Error - 2010-05-06 10:31:20 | Computer Name = Rafal-PC | Source = DCOM | ID = 10010 Description = Error - 2010-05-06 10:31:21 | Computer Name = Rafal-PC | Source = Service Control Manager | ID = 7009 Description = Error - 2010-05-06 10:31:21 | Computer Name = Rafal-PC | Source = Service Control Manager | ID = 7000 Description = Error - 2010-05-06 10:32:42 | Computer Name = Rafal-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001 Description = Error - 2010-05-06 10:43:00 | Computer Name = Rafal-PC | Source = HTTP | ID = 15016 Description = Error - 2010-05-06 10:43:59 | Computer Name = Rafal-PC | Source = Service Control Manager | ID = 7000 Description = Error - 2010-05-06 10:43:59 | Computer Name = Rafal-PC | Source = Service Control Manager | ID = 7011 Description = Error - 2010-05-06 10:43:59 | Computer Name = Rafal-PC | Source = Service Control Manager | ID = 7034 Description = Error - 2010-05-06 10:44:37 | Computer Name = Rafal-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001 Description = < End of report >

Kod: Zaznacz wszystko: [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation) .hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation) [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation) htmlfile [edit] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "C:\Program Files\Microsoft Office\Office10\msohtmed.exe" /p %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 "VistaSp1" = Reg Error: Unknown registry data type -- File not found [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [color=#E56717]========== Authorized Applications List ==========[/color] [color=#E56717]========== Vista Active Open Ports Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{23E94657-A40C-424D-B04B-0845BA93297E}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe | [color=#E56717]========== Vista Active Application Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{1709D513-FC3B-4A8C-8089-B6C9A859E557}" = protocol=17 | dir=in | app=c:\program files\vuze\azureus.exe | "{31DB680D-21F2-44A4-B859-694CB6214B66}" = protocol=17 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe | "{6767CDFE-1921-4B87-AD0C-55E564CD9837}" = dir=in | app=c:\program files\cyberlink\powerdirector\pdr.exe | "{6D889084-F467-48EB-9A19-EFE5A20CBD0D}" = dir=in | app=c:\program files\cyberlink\powerdvd8\powerdvd8.exe | "{A3D8CEF5-6045-428C-BB0D-30A7643BF2FC}" = dir=in | app=c:\program files\common files\mcafee\mna\mcnasvc.exe | "{A4DE5A44-992E-417D-B846-0A213B88A968}" = protocol=6 | dir=in | app=c:\program files\yahoo!\messenger\yahoomessenger.exe | "{E41CFC94-6540-496C-8834-80E1D7654C05}" = protocol=6 | dir=in | app=c:\program files\vuze\azureus.exe | [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.1.0.5200 "{04983D37-2202-4295-94A2-8B547C66133F}" = Atheros WLAN Client "{0A2C5854-557E-48C8-835A-3B9F074BDCAA}" = Python 2.5 "{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}" = Samsung Recovery Solution III "{17283B95-21A8-4996-97DA-547A48DB266F}" = Easy Display Manager "{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite "{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 18 "{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ) "{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8 "{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}" = Samsung Magic Doctor "{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4ac40384-37ba-421c-b14c-2ecbe4403817}" = Business Contact Manager z dodatkiem SP1 dla programu Outlook 2007 "{4DFF1415-4C29-44A8-BFD4-2BCE249C4991}" = SpPhones "{50120000-1105-0000-0000-0000000FF1CE}" = Microsoft Office 2007 Primary Interop Assemblies "{50A0893D-47D8-48E0-A7E8-44BCD7E4422E}" = Microsoft SQL Server Native Client "{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}" = Microsoft SQL Server Setup Support Files (English) "{560F47F7-EB23-44B1-AAFC-667F1CD8FE5C}" = Sp5 "{68CAE442-579C-4D84-AA5F-253852522ED5}" = PCTroubleshooting "{6A1F72DD-2465-43A2-A137-8A849399B7A8}" = REALTEK Wireless LAN Software "{6C3959C6-943E-44B3-BAAD-570B04B134E5}" = SpCommon "{6F730513-8688-4C3C-90A3-6B9792CE2EF3}" = Easy Battery Manager "{71A51B59-E7D3-11DB-A386-005056C00008}" = Namuga 1.3M Webcam "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{8E106A57-A17E-431D-B48F-175E42EB9F74}" = imagine digital freedom - Samsung "{90120000-0015-0415-0000-0000000FF1CE}" = Microsoft Office Access MUI (Polish) 2007 "{90120000-0016-0415-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Polish) 2007 "{90120000-0018-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Polish) 2007 "{90120000-0019-0415-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Polish) 2007 "{90120000-001A-0415-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Polish) 2007 "{90120000-001B-0415-0000-0000000FF1CE}" = Microsoft Office Word MUI (Polish) 2007 "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2007 "{90120000-002C-0415-0000-0000000FF1CE}" = Microsoft Office Proofing (Polish) 2007 "{90120000-006E-0415-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Polish) 2007 "{90260415-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Web Components "{90280415-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional z programem FrontPage "{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager "{90A40415-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components "{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007 "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9EFDFBA8-9174-3C61-8645-28376C5CA994}" = Microsoft .NET Framework 3.5 Language Pack SP1 - plk "{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}" = Samsung Update Plus "{A7581D39-EA20-4883-A480-80C21047052B}" = Easy Network Manager "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AA16A9E5-40E9-44F5-801E-6B3D3CFE79E5}" = BatteryLifeExtender "{AC76BA86-7AD7-1045-7B44-A90000000001}" = Adobe Reader 9 - Polish "{AED53CDF-1046-4C6B-B5E2-C195125ECDA0}" = Oprogramowanie Intel(R) PROSet/Wireless WiFi "{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer "{C0D2F614-5CE5-4DCB-8678-E5C9AF7044F8}" = Microsoft SQL Server VSS Writer "{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint "{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{E415C943-37E5-473F-8BAE-043C56734124}" = Sp5TTInt "{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}" = Microsoft Office Suite Activation Assistant "{EF367AA4-070B-493C-9575-85BE59D789C9}" = Easy SpeedUp Manager "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{FD4B33E1-24AE-4535-AA7B-162B30FB57CD}" = Sp5Intl "8461-7759-5462-8226" = Vuze "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Agere Systems Soft Modem" = Agere Systems HDA Modem "ALLPlayer_is1" = ALLPlayer V4.X "Applian FLV Player2.0.24" = Applian FLV Player "Business Contact Manager" = Business Contact Manager z dodatkiem SP1 dla programu Outlook 2007 "Gadu-Gadu" = Gadu-Gadu 6.1 "HDMI" = Intel(R) Graphics Media Accelerator Driver "InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink DVD Suite "InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = CyberLink PowerDVD 8 "InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go "InstallShield_{A5F483F0-2D79-4FCA-AE09-D0D96E23EBF7}" = Samsung Update Plus "InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer "InstallShield_{CB099890-1D5F-11D5-9EA9-0050BAE317E1}" = CyberLink PowerDirector "IVONA - syntezator mowy, wersja demonstracyjna" = IVONA - syntezator mowy, wersja demonstracyjna "Marvell Miniport Driver" = Marvell Miniport Driver "McAfee Security Scan" = McAfee Security Scan "Microsoft .NET Framework 3.5 Language Pack SP1 - plk" = Pakiet językowy programu Microsoft .NET Framework 3.5 z dodatkiem SP1 — PLK "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Microsoft SQL Server 2005" = Microsoft SQL Server 2005 "Mozilla Firefox (3.6.3)" = Mozilla Firefox (3.6.3) "MSC" = McAfee SecurityCenter "PROHYBRIDR" = 2007 Microsoft Office system "ProInst" = Intel PROSet Wireless "SynTPDeinstKey" = Synaptics Pointing Device Driver "WinRAR archiver" = Archiwizator WinRAR [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-21-84699557-792703091-1178954015-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Paddy Power Poker" = Paddy Power Poker [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Application Events ] Error - 2010-04-28 05:21:26 | Computer Name = Rafal-PC | Source = WinMgmt | ID = 10 Description = Error - 2010-04-28 11:53:45 | Computer Name = Rafal-PC | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, moduł powodujący błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, kod wyjątku 0x40000015, przesunięcie błędu 0x0005badc, identyfikator procesu 0x16c, godzina rozpoczęcia aplikacji 0x01cae6eafb78ddd9. Error - 2010-04-28 11:54:58 | Computer Name = Rafal-PC | Source = WinMgmt | ID = 10 Description = Error - 2010-04-28 14:43:29 | Computer Name = Rafal-PC | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, moduł powodujący błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, kod wyjątku 0x40000015, przesunięcie błędu 0x0005badc, identyfikator procesu 0x180, godzina rozpoczęcia aplikacji 0x01cae702b19a6d43. Error - 2010-04-28 14:44:44 | Computer Name = Rafal-PC | Source = WinMgmt | ID = 10 Description = Error - 2010-04-29 03:45:54 | Computer Name = Rafal-PC | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, moduł powodujący błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, kod wyjątku 0x40000015, przesunięcie błędu 0x0005badc, identyfikator procesu 0x198, godzina rozpoczęcia aplikacji 0x01cae76ffe811eff. Error - 2010-04-29 03:46:39 | Computer Name = Rafal-PC | Source = WinMgmt | ID = 10 Description = Error - 2010-04-29 08:39:54 | Computer Name = Rafal-PC | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, moduł powodujący błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, kod wyjątku 0x40000015, przesunięcie błędu 0x0005badc, identyfikator procesu 0xc, godzina rozpoczęcia aplikacji 0x01cae79910837141. Error - 2010-04-29 08:40:58 | Computer Name = Rafal-PC | Source = WinMgmt | ID = 10 Description = Error - 2010-04-29 12:47:55 | Computer Name = Rafal-PC | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, moduł powodujący błąd EvtEng.exe, wersja 12.0.4.0, sygnatura czasowa 0x4876d693, kod wyjątku 0x40000015, przesunięcie błędu 0x0005badc, identyfikator procesu 0x188, godzina rozpoczęcia aplikacji 0x01cae7bbb68a9f1c. [ OSession Events ] Error - 2009-09-20 04:34:16 | Computer Name = Rafal-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 24 seconds with 0 seconds of active time. This session ended with a crash. Error - 2009-09-20 04:39:56 | Computer Name = Rafal-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 270 seconds with 240 seconds of active time. This session ended with a crash. Error - 2009-09-20 04:50:10 | Computer Name = Rafal-PC | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 409 seconds with 300 seconds of active time. This session ended with a crash. [ System Events ] Error - 2010-05-06 10:30:58 | Computer Name = Rafal-PC | Source = Service Control Manager | ID = 7034 Description = Error - 2010-05-06 10:31:20 | Computer Name = Rafal-PC | Source = DCOM | ID = 10010 Description = Error - 2010-05-06 10:31:21 | Computer Name = Rafal-PC | Source = Service Control Manager | ID = 7009 Description = Error - 2010-05-06 10:31:21 | Computer Name = Rafal-PC | Source = Service Control Manager | ID = 7000 Description = Error - 2010-05-06 10:32:42 | Computer Name = Rafal-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001 Description = Error - 2010-05-06 10:43:00 | Computer Name = Rafal-PC | Source = HTTP | ID = 15016 Description = Error - 2010-05-06 10:43:59 | Computer Name = Rafal-PC | Source = Service Control Manager | ID = 7000 Description = Error - 2010-05-06 10:43:59 | Computer Name = Rafal-PC | Source = Service Control Manager | ID = 7011 Description = Error - 2010-05-06 10:43:59 | Computer Name = Rafal-PC | Source = Service Control Manager | ID = 7034 Description = Error - 2010-05-06 10:44:37 | Computer Name = Rafal-PC | Source = Microsoft-Windows-LanguagePackSetup | ID = 1001 Description = < End of report >

Co muszę dalej zrobić by problem ten usunąć ciągle kieruje mnie na stronę z płatnym antywirusem?[/size]

**Posty:** 14516 · przez **ToServeAndProtect** 06 Maj 2010, 17:29

rafalzlb,
1. naucz się wstawiac logi wg tego tematu: obowiazkowe-zasady-wstawiania-logow-wazne-vt117887.html
2. nie używaj niepotrzebnie większej czcionki bo to w niczym nie pomoże

**Posty:** 3 · przez **rafalzlb** 06 Maj 2010, 17:34

Oraz logi z pliku otl:

http://www.wklej.org/hash/ebaffd00c19/

**Posty:** 18165 · przez **wojtas** 06 Maj 2010, 17:46

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
O4 - HKU\S-1-5-21-84699557-792703091-1178954015-1003..\Run: [aecowbxx] C:\Users\Rafal\AppData\Local\itarmdgpt\ebuwqemtssd.exe ()
FF - prefs.js..browser.search.defaultthis.engineName: "Google Powered Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2504091&SearchSource=3&q={searchTerms}"
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2504091&q="

:Files
C:\Users\Rafal\AppData\Local\itarmdgpt\ebuwqemtssd.exe
C:\Users\Rafal\AppData\Roaming\mozilla\Firefox\Profiles\cm3fhcxv.default\extensions\{ba14329e-9550-4989-b3f2-9732e92d17cc}
C:\Users\Rafal\AppData\Local\itarmdgpt
C:\Users\Rafal\AppData\Roaming\Mozilla\FireFox\Profiles\cm3fhcxv.default\searchplugins\conduit.xml

:Commands
[emptytemp]
[resethosts]
[emptyflash]
[clearallrestorepoints]

Kliknij w Run Fix. I potwierdź reset kompa .

Następnie uruchamiasz OTL z opcją Run Scan. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia komputera + log z Gmera
gmer-opis-dzialania-vt117883.html

**Posty:** 3 · przez **rafalzlb** 06 Maj 2010, 18:19

.....na pierwszy rzut oka jest już ok nie ma tych komunikatów i wszystko chodzi ok. Zrobię te scany które zalecałeś. Dzięki Szacunek za wiedzę

Dodano Dzisiaj, 19:24:
z otl mam to:

Kod: Zaznacz wszystko: OTL logfile created on: 2010-05-06 18:05:07 - Run 2 OTL by OldTimer - Version 3.2.4.1 Folder = C:\Users\Rafal\Desktop Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 57,00% Memory free 6,00 Gb Paging File | 5,00 Gb Available in Paging File | 79,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 109,88 Gb Total Space | 72,09 Gb Free Space | 65,61% Space Free | Partition Type: NTFS Drive D: | 110,00 Gb Total Space | 65,71 Gb Free Space | 59,74% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: RAFAL-PC Current User Name: Rafal Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-05-06 16:40:08 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Users\Rafal\Desktop\OTL.exe PRC - [2010-04-03 12:13:31 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009-07-28 02:19:10 | 000,199,184 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee Security Scan\1.0.150\SSScheduler.exe PRC - [2009-07-10 03:26:42 | 000,894,136 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MPF\MpfSrv.exe PRC - [2009-07-10 00:26:20 | 000,865,832 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MSC\mcmscsvc.exe PRC - [2009-07-10 00:26:20 | 000,645,328 | ---- | M] (McAfee, Inc.) -- c:\Program Files\McAfee.com\Agent\mcagent.exe PRC - [2009-07-08 14:48:48 | 000,026,640 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\MSK\msksrver.exe PRC - [2009-07-08 13:43:40 | 000,144,704 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\Mcshield.exe PRC - [2009-07-08 13:11:52 | 000,606,736 | ---- | M] (McAfee, Inc.) -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe PRC - [2009-07-08 11:54:34 | 000,359,952 | ---- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe PRC - [2009-07-07 19:10:02 | 002,482,848 | ---- | M] (McAfee, Inc.) -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe PRC - [2009-05-15 08:47:58 | 000,692,224 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe PRC - [2009-04-15 16:52:06 | 000,091,432 | ---- | M] (CyberLink Corp.) -- C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe PRC - [2009-03-05 11:54:50 | 000,311,296 | ---- | M] () -- C:\Windows\System32\Rezip.exe PRC - [2009-02-09 14:51:00 | 000,565,248 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe PRC - [2009-01-23 10:46:14 | 000,203,280 | ---- | M] () -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe PRC - [2008-12-24 05:29:30 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe PRC - [2008-12-11 11:07:40 | 006,703,648 | ---- | M] (Realtek Semiconductor) -- C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe PRC - [2008-12-10 09:07:52 | 000,352,256 | ---- | M] (SAMSUNG Electronics co., LTD.) -- C:\Program Files\Samsung\EBM\EasyBatteryMgr3.exe PRC - [2008-12-03 09:20:02 | 000,298,664 | ---- | M] () -- C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe PRC - [2008-10-29 08:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2008-09-11 16:46:06 | 001,853,992 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTStackServer.exe PRC - [2008-09-11 16:46:06 | 000,752,168 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe PRC - [2008-08-26 02:59:54 | 000,045,056 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Samsung Magic Doctor\MagicDoctorKbdHk.exe PRC - [2008-08-19 06:18:10 | 000,174,616 | ---- | M] (Intel Corporation) -- C:\Windows\System32\igfxext.exe PRC - [2008-07-10 13:12:40 | 000,466,944 | ---- | M] (Intel(R) Corporation) -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe PRC - [2008-03-18 05:27:12 | 000,013,312 | ---- | M] (Agere Systems) -- C:\Windows\System32\agrsmsvc.exe PRC - [2008-01-16 05:04:36 | 000,030,312 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe PRC - [2006-03-06 16:55:32 | 000,086,016 | ---- | M] () -- C:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe PRC - [2005-03-31 11:18:49 | 000,790,528 | ---- | M] (sms-express.com) -- C:\Program Files\Gadu-Gadu\gg.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-05-06 16:40:08 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Users\Rafal\Desktop\OTL.exe MOD - [2009-01-23 10:46:18 | 000,013,840 | ---- | M] () -- C:\Program Files\McAfee\SiteAdvisor\sahook.dll MOD - [2008-01-21 04:24:37 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx MOD - [2008-01-21 04:23:44 | 001,684,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18000_none_5cdbaa5a083979cc\comctl32.dll MOD - [2000-07-07 18:42:56 | 000,032,768 | ---- | M] () -- C:\Program Files\Gadu-Gadu\ggwhook.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2009-07-10 03:26:42 | 000,894,136 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\MPF\MPFSrv.exe -- (MpfService) SRV - [2009-07-10 00:26:20 | 000,865,832 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\MSC\mcmscsvc.exe -- (mcmscsvc) SRV - [2009-07-08 15:15:04 | 000,365,072 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Program Files\McAfee\VirusScan\mcods.exe -- (McODS) SRV - [2009-07-08 14:48:48 | 000,026,640 | ---- | M] (McAfee, Inc.) [Auto | Running] -- C:\Program Files\McAfee\MSK\MskSrver.exe -- (MSK80Service) SRV - [2009-07-08 13:43:40 | 000,144,704 | ---- | M] (McAfee, Inc.) [Unknown | Running] -- C:\Program Files\McAfee\VirusScan\Mcshield.exe -- (McShield) SRV - [2009-07-08 13:11:52 | 000,606,736 | ---- | M] (McAfee, Inc.) [On_Demand | Running] -- C:\Program Files\McAfee\VirusScan\mcsysmon.exe -- (McSysmon) SRV - [2009-07-08 11:54:34 | 000,359,952 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\Common Files\McAfee\McProxy\McProxy.exe -- (McProxy) SRV - [2009-07-07 19:10:02 | 002,482,848 | ---- | M] (McAfee, Inc.) [Auto | Running] -- c:\Program Files\Common Files\McAfee\MNA\McNASvc.exe -- (McNASvc) SRV - [2009-03-05 11:54:50 | 000,311,296 | ---- | M] () [Auto | Running] -- C:\Windows\System32\Rezip.exe -- (Rezip) SRV - [2009-01-30 11:07:00 | 000,282,624 | ---- | M] (Marvell) [Auto | Running] -- C:\Windows\System32\ykx32mpcoinst.dll -- (yksvc) SRV - [2009-01-23 10:46:14 | 000,203,280 | ---- | M] () [Auto | Running] -- C:\Program Files\McAfee\SiteAdvisor\McSACore.exe -- (McAfee SiteAdvisor Service) SRV - [2008-07-10 13:42:14 | 000,819,200 | ---- | M] (Intel(R) Corporation) [Auto | Stopped] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) SRV - [2008-07-10 13:12:40 | 000,466,944 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) SRV - [2008-03-18 05:27:12 | 000,013,312 | ---- | M] (Agere Systems) [Auto | Running] -- C:\Windows\System32\agrsmsvc.exe -- (AgereModemAudio) SRV - [2008-01-21 04:23:32 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2008-01-16 05:04:36 | 000,030,312 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe -- (BcmSqlStartupSvc) SRV - [2006-04-14 03:07:20 | 028,933,976 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe -- (MSSQL$MSSMLBIZ) SQL Server (MSSMLBIZ) SRV - [2006-04-14 03:05:58 | 000,240,416 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser) SRV - [2006-04-14 03:04:54 | 000,087,840 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter) SRV - [2005-10-13 20:50:20 | 000,045,272 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft SQL Server\90\Shared\sqladhlp90.exe -- (MSSQLServerADHelper) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-07-16 12:32:26 | 000,130,424 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\Mpfp.sys -- (MPFP) DRV - [2009-07-08 13:44:20 | 000,214,024 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\mfehidk.sys -- (mfehidk) DRV - [2009-07-08 13:44:20 | 000,079,816 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfeavfk.sys -- (mfeavfk) DRV - [2009-07-08 13:44:20 | 000,040,552 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfesmfk.sys -- (mfesmfk) DRV - [2009-07-08 13:44:20 | 000,035,272 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mfebopk.sys -- (mfebopk) DRV - [2009-07-08 13:43:46 | 000,034,248 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mferkdk.sys -- (mferkdk) DRV - [2009-01-30 11:07:00 | 000,311,296 | ---- | M] (Marvell) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk60x86.sys -- (yukonwlh) DRV - [2008-12-11 10:23:08 | 002,250,272 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2008-12-04 05:34:52 | 000,328,728 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\iaStor.sys -- (iaStor) DRV - [2008-11-21 03:22:24 | 000,238,464 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VMC326.sys -- (VMC326) DRV - [2008-11-04 06:13:32 | 000,952,320 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr) DRV - [2008-09-12 06:58:32 | 000,081,960 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btwaudio.sys -- (btwaudio) DRV - [2008-09-12 06:58:32 | 000,017,320 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btwrchid.sys -- (btwrchid) DRV - [2008-09-12 06:58:30 | 000,100,392 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btwavdt.sys -- (btwavdt) DRV - [2008-08-28 04:52:52 | 000,199,344 | ---- | M] (Synaptics, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SynTP.sys -- (SynTP) DRV - [2008-08-12 04:03:20 | 000,013,312 | ---- | M] (SAMSUNG ELECTRONICS CO., LTD.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\KMDFMEMIO.sys -- (KMDFMEMIO) DRV - [2008-08-05 05:02:22 | 002,381,312 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\igdkmd32.sys -- (igfx) DRV - [2008-08-05 05:02:22 | 002,381,312 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\igdkmd32.sys -- (ialm) DRV - [2008-07-31 06:55:14 | 000,029,736 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\btwl2cap.sys -- (btwl2cap) DRV - [2008-06-29 22:52:26 | 000,112,128 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R) DRV - [2008-03-21 05:13:00 | 001,203,776 | ---- | M] (Agere Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2008-01-21 04:23:27 | 000,386,616 | ---- | M] (LSI Corporation, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasr.sys -- (MegaSR) DRV - [2008-01-21 04:23:27 | 000,149,560 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320) DRV - [2008-01-21 04:23:27 | 000,031,288 | ---- | M] (LSI Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas) DRV - [2008-01-21 04:23:26 | 000,101,432 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m) DRV - [2008-01-21 04:23:26 | 000,074,808 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4) DRV - [2008-01-21 04:23:26 | 000,040,504 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs) DRV - [2008-01-21 04:23:25 | 000,300,600 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci) DRV - [2008-01-21 04:23:25 | 000,089,656 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS) DRV - [2008-01-21 04:23:24 | 001,122,360 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300) DRV - [2008-01-21 04:23:24 | 000,118,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R) DRV - [2008-01-21 04:23:24 | 000,079,928 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas) DRV - [2008-01-21 04:23:23 | 000,235,064 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV) DRV - [2008-01-21 04:23:23 | 000,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid) DRV - [2008-01-21 04:23:23 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2) DRV - [2008-01-21 04:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI) DRV - [2008-01-21 04:23:23 | 000,096,312 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC) DRV - [2008-01-21 04:23:23 | 000,079,416 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc) DRV - [2008-01-21 04:23:22 | 000,342,584 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor) DRV - [2008-01-21 04:23:21 | 000,422,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx) DRV - [2008-01-21 04:23:21 | 000,102,968 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid) DRV - [2008-01-21 04:23:21 | 000,045,112 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor) DRV - [2008-01-21 04:23:20 | 002,225,664 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\NETw3v32.sys -- (NETw3v32) Intel(R) DRV - [2008-01-21 04:23:20 | 000,238,648 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci) DRV - [2008-01-21 04:23:00 | 000,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\viaide.sys -- (viaide) DRV - [2008-01-21 04:23:00 | 000,019,000 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide) DRV - [2008-01-21 04:23:00 | 000,017,464 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide) DRV - [2006-11-02 11:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx) DRV - [2006-11-02 11:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata) DRV - [2006-11-02 11:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960) DRV - [2006-11-02 11:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp) DRV - [2006-11-02 11:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx) DRV - [2006-11-02 11:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid) DRV - [2006-11-02 11:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi) DRV - [2006-11-02 11:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx) DRV - [2006-11-02 11:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3) DRV - [2006-11-02 11:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x) DRV - [2006-11-02 11:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi) DRV - [2006-11-02 10:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM) DRV - [2006-11-02 10:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer) DRV - [2006-11-02 10:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp) DRV - [2006-11-02 10:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo) DRV - [2006-11-02 10:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm) DRV - [2006-11-02 10:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm) DRV - [2006-11-02 09:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi) DRV - [2006-11-02 09:30:53 | 000,045,056 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\bcm4sbxp.sys -- (bcm4sbxp) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=SMSN&bmod=SMSN IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:5555 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultthis.engineName: "" FF - prefs.js..browser.search.defaulturl: "" FF - prefs.js..browser.startup.homepage: "wp.pl" FF - prefs.js..extensions.enabledItems: {B7082FAA-CB62-4872-9106-E42DD88EDE45}:2.8 FF - prefs.js..network.proxy.backup.ftp: "193.136.113.38" FF - prefs.js..network.proxy.backup.ftp_port: 80 FF - prefs.js..network.proxy.backup.gopher: "193.136.113.38" FF - prefs.js..network.proxy.backup.gopher_port: 80 FF - prefs.js..network.proxy.backup.socks: "193.136.113.38" FF - prefs.js..network.proxy.backup.socks_port: 80 FF - prefs.js..network.proxy.backup.ssl: "193.136.113.38" FF - prefs.js..network.proxy.backup.ssl_port: 80 FF - prefs.js..network.proxy.ftp: "193.136.113.38" FF - prefs.js..network.proxy.ftp_port: 80 FF - prefs.js..network.proxy.gopher: "193.136.113.38" FF - prefs.js..network.proxy.gopher_port: 80 FF - prefs.js..network.proxy.http: "193.136.113.38" FF - prefs.js..network.proxy.http_port: 80 FF - prefs.js..network.proxy.share_proxy_settings: true FF - prefs.js..network.proxy.socks: "193.136.113.38" FF - prefs.js..network.proxy.socks_port: 80 FF - prefs.js..network.proxy.ssl: "193.136.113.38" FF - prefs.js..network.proxy.ssl_port: 80 FF - HKLM\software\mozilla\Firefox\Extensions\\{B7082FAA-CB62-4872-9106-E42DD88EDE45}: C:\Program Files\McAfee\SiteAdvisor [2010-03-03 11:50:41 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010-04-03 12:13:37 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.3\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010-04-03 12:13:37 | 000,000,000 | ---D | M] [2009-11-03 20:54:25 | 000,000,000 | ---D | M] -- C:\Users\Rafal\AppData\Roaming\mozilla\Extensions [2010-05-06 18:01:53 | 000,000,000 | ---D | M] -- C:\Users\Rafal\AppData\Roaming\mozilla\Firefox\Profiles\cm3fhcxv.default\extensions [2009-11-03 21:02:06 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Rafal\AppData\Roaming\mozilla\Firefox\Profiles\cm3fhcxv.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-03-12 11:25:45 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2010-02-15 11:59:20 | 000,931,328 | ---- | M] (Ganymede Technologies) -- C:\Program Files\Mozilla Firefox\plugins\NPBOARDS.dll [2010-03-12 11:33:15 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2010-03-12 11:33:16 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2010-03-12 11:33:16 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2010-03-12 11:33:16 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2010-03-12 11:33:16 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2010-03-12 11:33:16 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2010-05-06 17:57:24 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - No CLSID value found. O2 - BHO: (McAfee Phishing Filter) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\Program Files\McAfee\MSK\mskapbho.dll () O2 - BHO: (scriptproxy) - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\Program Files\McAfee\VirusScan\scriptsn.dll (McAfee, Inc.) O2 - BHO: (McAfee SiteAdvisor BHO) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll () O3 - HKLM\..\Toolbar: (McAfee SiteAdvisor Toolbar) - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll () O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink) O4 - HKLM..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe (McAfee, Inc.) O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.) O4 - HKLM..\Run: [RemoteControl8] C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.) O4 - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdatePDRShortCut] C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdatePPShortCut] C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [ALLUpdate] D:\ALLPlayer\ALLUpdate.exe () O4 - Startup: C:\Users\Rafal\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\UniSpiker-2.6.lnk = C:\Program Files\ivo\UniSpiker-2.6\uni_spiker-2.6.exe () O8 - Extra context menu item: E&ksport do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Wyślij obraz do urządzenia &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Wyślij stronę do urządzenia &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {CAFEEFAC-0016-0000-0018-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab (Java Plug-in 1.6.0_18) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 127.0.0.1 89.186.31.1 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\sacore {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\Program Files\McAfee\SiteAdvisor\McIEPlg.dll () O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\Windows\System32\igfxdev.dll (Intel Corporation) O24 - Desktop WallPaper: C:\Users\Rafal\AppData\Roaming\Microsoft\Windows Photo Gallery\Tapeta z Galerii fotografii systemu Windows.jpg O24 - Desktop BackupWallPaper: C:\Users\Rafal\AppData\Roaming\Microsoft\Windows Photo Gallery\Tapeta z Galerii fotografii systemu Windows.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006-09-18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{b27487c6-2b55-11df-92a1-00265edc2f57}\Shell\AutoRun\command - "" = F:\USBNB.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-05-06 17:52:42 | 000,000,000 | ---D | C] -- C:\_OTL [2010-05-06 16:40:07 | 000,570,880 | ---- | C] (OldTimer Tools) -- C:\Users\Rafal\Desktop\OTL.exe [2010-05-06 15:00:19 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard [2010-04-15 09:06:45 | 000,430,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll [2010-04-15 09:06:40 | 000,062,464 | ---- | C] (Fraunhofer Institut Integrierte Schaltungen IIS) -- C:\Windows\System32\l3codeca.acm [2010-04-13 09:43:00 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\browserchoice.exe [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-05-06 18:12:01 | 002,359,296 | -HS- | M] () -- C:\Users\Rafal\NTUSER.DAT [2010-05-06 18:01:54 | 000,020,591 | ---- | M] () -- C:\Windows\System32\Config.MPF [2010-05-06 18:01:17 | 000,001,032 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2010-05-06 18:01:10 | 000,004,784 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010-05-06 18:01:10 | 000,004,784 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010-05-06 18:01:07 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010-05-06 18:01:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010-05-06 18:01:03 | 3150,557,184 | -HS- | M] () -- C:\hiberfil.sys [2010-05-06 17:57:31 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat [2010-05-06 17:57:30 | 000,524,288 | -HS- | M] () -- C:\Users\Rafal\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TMContainer00000000000000000001.regtrans-ms [2010-05-06 17:57:30 | 000,065,536 | -HS- | M] () -- C:\Users\Rafal\NTUSER.DAT{3a539871-6a70-11db-887c-d362bd253390}.TM.blf [2010-05-06 17:57:24 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts [2010-05-06 17:49:20 | 002,169,291 | -H-- | M] () -- C:\Users\Rafal\AppData\Local\IconCache.db [2010-05-06 17:34:02 | 000,293,376 | ---- | M] () -- C:\Users\Rafal\Desktop\imw49p7k.exe [2010-05-06 16:40:08 | 000,570,880 | ---- | M] (OldTimer Tools) -- C:\Users\Rafal\Desktop\OTL.exe [2010-05-06 16:40:00 | 000,001,036 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2010-05-06 16:30:27 | 000,381,952 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010-05-06 16:07:24 | 000,058,368 | ---- | M] () -- C:\Users\Rafal\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010-05-05 15:00:55 | 000,027,136 | ---- | M] () -- C:\Users\Rafal\Desktop\list motywacyjny.doc [2010-05-03 12:30:46 | 000,095,744 | ---- | M] () -- C:\Users\Rafal\Desktop\Rafał Kusiak CV.doc [2010-05-03 11:44:37 | 004,098,957 | ---- | M] () -- C:\Users\Rafal\Desktop\eldo - granice.mp3 [2010-05-01 17:55:34 | 000,085,504 | ---- | M] () -- C:\Users\Rafal\Desktop\PotrzebneRzeczy.doc [2010-04-30 10:40:32 | 000,044,032 | ---- | M] () -- C:\Users\Rafal\Desktop\CV Rafal Kusiak.doc [2010-04-22 12:30:00 | 000,063,488 | ---- | M] () -- C:\Users\Rafal\Desktop\aplikacja2010polska.doc [2010-04-10 14:21:03 | 001,600,154 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI [2010-04-10 14:21:03 | 000,708,764 | ---- | M] () -- C:\Windows\System32\perfh015.dat [2010-04-10 14:21:03 | 000,633,886 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2010-04-10 14:21:03 | 000,144,430 | ---- | M] () -- C:\Windows\System32\perfc015.dat [2010-04-10 14:21:03 | 000,118,772 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2010-04-08 20:05:56 | 000,000,713 | ---- | M] () -- C:\Users\Rafal\Desktop\Paddy Power Poker.lnk [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-05-06 17:34:01 | 000,293,376 | ---- | C] () -- C:\Users\Rafal\Desktop\imw49p7k.exe [2010-05-06 16:29:53 | 3150,557,184 | -HS- | C] () -- C:\hiberfil.sys [2010-05-03 11:41:12 | 004,098,957 | ---- | C] () -- C:\Users\Rafal\Desktop\eldo - granice.mp3 [2010-04-08 20:05:56 | 000,000,713 | ---- | C] () -- C:\Users\Rafal\Desktop\Paddy Power Poker.lnk [2009-10-31 18:54:53 | 000,795,648 | ---- | C] () -- C:\Windows\System32\xvidcore.dll [2009-09-22 11:51:57 | 000,000,232 | ---- | C] () -- C:\Windows\Ulead32.ini [2009-09-20 18:07:41 | 000,000,418 | ---- | C] () -- C:\Windows\ODBC.INI [2009-06-17 07:31:03 | 000,000,135 | R--- | C] () -- C:\Windows\System32\lngEng.ini [2009-06-17 07:31:03 | 000,000,117 | ---- | C] () -- C:\Windows\System32\lngKor.ini [2009-06-17 07:10:42 | 000,003,990 | ---- | C] () -- C:\Windows\HotFixList.ini [2009-06-17 07:06:02 | 000,328,728 | ---- | C] () -- C:\Windows\System32\drivers\iaStor.sys [2009-06-17 05:45:19 | 001,060,424 | ---- | C] () -- C:\Windows\System32\WdfCoInstaller01000.dll [2009-06-17 05:45:08 | 000,147,456 | ---- | C] () -- C:\Windows\System32\igfxCoIn_v1540.dll [2009-06-17 05:45:08 | 000,004,608 | ---- | C] () -- C:\Windows\System32\HdmiCoin.dll [2008-09-11 16:45:02 | 000,057,344 | ---- | C] () -- C:\Windows\System32\BtwNamespaceExt2.dll [2006-11-02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006-11-02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2001-11-14 13:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll < End of report >