Wyskakujące reklamy w nowych kartach

**Posty:** 6 · przez **DTM** 28 Mar 2013, 22:20

Witam

Co kilka-kilkanaście minut samoczynnie otwierają się nowe karty z reklamami. Przeglądarka najnowsza Chroma. Na innym forum polecono mi sprawdzenie logów. Oto raporty z GMER'a i OTL'a.

System: Windows 7 64 bity

Logi w załączniku. Proszę o sprawdzenie. Z góry dziękuje
Pozdrawiam

**Posty:** 4765 · przez **ordynat** 28 Mar 2013, 23:11

1) Odimstaluj reklamodawcę "TUTO4PC_is1" = TUTO4PC
2) Odinstaluj reklamodawcę "tuto4pc_pl_6_is1" = tuto4pc_pl_6
3) Odinstaluj niepotrzebny "AVG Secure Search" = AVG Security Toolbar (nie pomyl z AVG 2013!)
4) Odinstaluj niepotrzebny "delta" = Delta toolbar
5) Odinstaluj niepotrzebny "{177586E7-E42E-4F38-83D1-D15B4AF5B714}" = Delta Chrome Toolbar
6) Odinstaluj szkodliwy "{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}" = BrowserProtect
7) Użyj >Adw-cleaner (aby pobrać kliknij na dużą zieloną strzałkę po prawej).
Kliknij w nim Usuń
Pokaż raport z niego C:\AdwCleaner[S1].txt
8) Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej to:

:OTL
MOD - [2013-02-21 10:30:09 | 002,561,488 | ---- | M] () -- C:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe
MOD - [2013-02-21 10:28:52 | 002,231,248 | ---- | M] () -- c:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll
MOD - [2013-02-18 17:38:50 | 001,151,152 | ---- | M] () -- C:\Program Files (x86)\AVG Secure Search\vprot.exe
MOD - [2013-02-18 17:38:50 | 000,156,848 | ---- | M] () -- C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\14.2.0\SiteSafety.dll
MOD - [2013-01-25 18:46:26 | 003,883,368 | ---- | M] () -- C:\Program Files (x86)\tuto4pc_pl_6\tuto4pc_pl_6.exe
MOD - [2012-11-05 11:57:12 | 003,854,696 | ---- | M] () -- C:\Program Files (x86)\TUTO4PC\tuto4pc_pl_1.exe
SRV - [2013-02-21 10:30:09 | 002,561,488 | ---- | M] () [Auto | Running] -- C:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.exe -- (BrowserProtect)
SRV - [2013-02-18 17:38:50 | 000,968,880 | ---- | M] () [Auto | Running] -- C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe -- (vToolbarUpdater14.2.0)
SRV - [2012-11-05 11:57:12 | 003,055,976 | ---- | M] () [Auto | Running] -- C:\Users\DTM\AppData\Local\tuto4pc_pl_1\supt4pc_pl_1.exe -- (supt4pc_pl_1)
IE - HKLM\..\URLSearchHook: {79b8e308-95a2-4044-932d-80e833a863cc} - C:\Program Files (x86)\FreeOnlineRadioPlayerRecorder_V1\prxtbFree.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {79b8e308-95a2-4044-932d-80e833a863cc} - C:\Program Files (x86)\FreeOnlineRadioPlayerRecorder_V1\prxtbFree.dll (Conduit Ltd.)
FF - HKLM\Software\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin: C:\Program Files (x86)\Common Files\AVG Secure Search\SiteSafetyInstaller\14.2.0\\npsitesafety.dll ()
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\{0F827075-B026-42F3-885D-98981EE7B1AE}: C:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension [2013-02-22 21:00:00 | 000,000,000 | ---D | M]
O2 - BHO: (FreeOnlineRadioPlayerRecorder V1 Toolbar) - {79b8e308-95a2-4044-932d-80e833a863cc} - C:\Program Files (x86)\FreeOnlineRadioPlayerRecorder_V1\prxtbFree.dll (Conduit Ltd.)
O2 - BHO: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll ()
O2 - BHO: (delta Helper Object) - {C1AF5FA5-852C-4C90-812E-A7F75E011D87} - C:\Program Files (x86)\Delta\delta\1.8.10.0\bh\delta.dll (Delta-search.com)
O3 - HKLM\..\Toolbar: (FreeOnlineRadioPlayerRecorder V1 Toolbar) - {79b8e308-95a2-4044-932d-80e833a863cc} - C:\Program Files (x86)\FreeOnlineRadioPlayerRecorder_V1\prxtbFree.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Delta Toolbar) - {82E1477C-B154-48D3-9891-33D83C26BCD3} - C:\Program Files (x86)\Delta\delta\1.8.10.0\deltaTlbr.dll (Delta-search.com)
O3 - HKLM\..\Toolbar: (AVG Security Toolbar) - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files (x86)\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (FreeOnlineRadioPlayerRecorder V1 Toolbar) - {79B8E308-95A2-4044-932D-80E833A863CC} - C:\Program Files (x86)\FreeOnlineRadioPlayerRecorder_V1\prxtbFree.dll (Conduit Ltd.)
O4 - HKLM..\Run: [tuto4pc_pl_6] C:\Program Files (x86)\tuto4pc_pl_6\tuto4pc_pl_6.exe ()
O4 - HKLM..\Run: [Tutorials] C:\Program Files (x86)\TUTO4PC\tuto4pc_pl_1.exe ()
O4 - HKLM..\Run: [vProt] C:\Program Files (x86)\AVG Secure Search\vprot.exe ()
O20 - AppInit_DLLs: (c:\progra~3\browse~1\261095~1.52\{c16c1~1\browse~1.dll) - c:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.dll ()
[2013-02-22 20:59:40 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\Delta

:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"bProtector Start Page"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="http://www.google.com/"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
"bProtectorDefaultScope"=-
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{2C906940-2DC7-4C13-B2B2-0121BDE26BAB}]
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233}]

:Commands
[emptytemp]

Kliknij w Wykonaj Skrypt. Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie.
Następnie uruchom OTL ponownie, tym razem kliknij Skanuj.
Pokaż nowy log OTL.txt oraz raport z usuwania Skryptem.
9) Zainstaluj nowszą, bezpieczniejszą wersję Javy:
>http://www.oracle.com/technetwork/java/javase/downloads/jre7-downloads-1880261.html (wybierz: Windows x86 Offline)
Być może trzeba też zainstalować nowszą wersję Javy 64 bit >http://java.com/pl/download/faq/java_win64bit.xml
.

Autor postu otrzymał pochwałę

**Posty:** 6 · przez **DTM** 29 Mar 2013, 00:04

ok dzięki zaraz to wykonam, ale czym mam to odinstalować?

**Posty:** 4765 · przez **ordynat** 29 Mar 2013, 00:26

pierwsze 6 punktów moich zaleceń - tak, odinstaluj.

Autor postu otrzymał pochwałę

**Posty:** 6 · przez **DTM** 29 Mar 2013, 01:03

Czy to normalne że podczas tworzenia tego skryptu OTL'em program się zaiwesza (brak odpowiedzi) ? Czekam juz 15 min. i nadal nie rusza dalej.

**Posty:** 4765 · przez **ordynat** 29 Mar 2013, 01:11

Podejrzewam, że w Twoim Systemie są jakieś nieprawidłowe ustawienia, które obcinają lewy dolny róg Skryptu, i Skrypt ma trudności z wykonaniem swej roboty. To się dość często zdarza.
Przerwij to, i zrób nowy log z OTL.
Daj też raport z Adw-Cleaner'a.
.

Autor postu otrzymał pochwałę

**Posty:** 6 · przez **DTM** 29 Mar 2013, 01:21

ok nowe raporty:
AdwCleaner[S1]:

Kod: Zaznacz wszystko: # AdwCleaner v2.115 - Log utworzony 28/03/2013 o 23:32:50 # Aktualizacja 17/03/2013 przez Xplode # System operacyjny : Windows 7 Home Premium Service Pack 1 (64 bits) # Użytkownik : DTM - DTM-KOMPUTER # Tryb uruchomienia : Normalny # Ścieżka : E:\User\DTM\Pobrane\adwcleaner.exe # Opcja [Usuń] ***** [Usługi] ***** Zatrzymano & Usunięto : BrowserProtect Zatrzymano & Usunięto : supt4pc_pl_6 ***** [Pliki / Foldery] ***** Folder Usunięto : C:\Program Files (x86)\AVG Secure Search Folder Usunięto : C:\Program Files (x86)\Conduit Folder Usunięto : C:\Program Files (x86)\Delta Folder Usunięto : C:\Program Files (x86)\FreeOnlineRadioPlayerRecorder_V1 Folder Usunięto : C:\Program Files (x86)\GreenTree Applications Folder Usunięto : C:\Program Files (x86)\majtuto4pc Folder Usunięto : C:\Program Files (x86)\Tuto4pc Folder Usunięto : C:\Program Files (x86)\tuto4pc_pl_6 Folder Usunięto : C:\ProgramData\AVG Secure Search Folder Usunięto : C:\ProgramData\Babylon Folder Usunięto : C:\Users\DTM\AppData\Local\AVG Secure Search Folder Usunięto : C:\Users\DTM\AppData\Local\Conduit Folder Usunięto : C:\Users\DTM\AppData\Local\TempDir Folder Usunięto : C:\Users\DTM\AppData\Local\tuto4pc_pl_6 Folder Usunięto : C:\Users\DTM\AppData\LocalLow\AVG Secure Search Folder Usunięto : C:\Users\DTM\AppData\LocalLow\Conduit Folder Usunięto : C:\Users\DTM\AppData\LocalLow\FreeOnlineRadioPlayerRecorder_V1 Folder Usunięto : C:\Users\DTM\AppData\LocalLow\PriceGong Folder Usunięto : C:\Users\DTM\AppData\Roaming\Babylon Folder Usunięto : C:\Users\DTM\AppData\Roaming\Delta Folder Usunięto : C:\Users\DTM\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserProtect Plik Usunięto : C:\END Plik Usunięto : C:\Users\DTM\AppData\Local\Google\Chrome\User Data\Default\bProtector Web Data Plik Usunięto : C:\Users\DTM\AppData\Local\Google\Chrome\User Data\Default\bprotectorpreferences Usunięto po restarcie : C:\Program Files (x86)\Common Files\AVG Secure Search Usunięto po restarcie : C:\ProgramData\BrowserProtect ***** [Rejestr] ***** Dane Usunięto : HKLM\..\Windows [AppInit_DLLs] = c:\progra~3\browse~1\261095~1.52\{c16c1~1\browse~1.dll Klucz Usunięto : HKCU\Software\APN PIP Klucz Usunięto : HKCU\Software\AppDataLow\Software\Conduit Klucz Usunięto : HKCU\Software\AppDataLow\Software\ConduitSearchScopes Klucz Usunięto : HKCU\Software\AppDataLow\Software\FreeOnlineRadioPlayerRecorder_V1 Klucz Usunięto : HKCU\Software\AppDataLow\Software\PriceGong Klucz Usunięto : HKCU\Software\AppDataLow\Software\SmartBar Klucz Usunięto : HKCU\Software\AppDataLow\Toolbar Klucz Usunięto : HKCU\Software\AVG Secure Search Klucz Usunięto : HKCU\Software\Conduit Klucz Usunięto : HKCU\Software\DataMngr Klucz Usunięto : HKCU\Software\DataMngr_Toolbar Klucz Usunięto : HKCU\Software\Delta Klucz Usunięto : HKCU\Software\GreenTree Applications Klucz Usunięto : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\bProtectSettings Klucz Usunięto : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{79B8E308-95A2-4044-932D-80E833A863CC} Klucz Usunięto : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{95B7759C-8C7F-4BF1-B163-73684A933233} Klucz Usunięto : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{79B8E308-95A2-4044-932D-80E833A863CC} Klucz Usunięto : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{82E1477C-B154-48D3-9891-33D83C26BCD3} Klucz Usunięto : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{95B7759C-8C7F-4BF1-B163-73684A933233} Klucz Usunięto : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} Klucz Usunięto : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{F25AF245-4A81-40DC-92F9-E9021F207706} Klucz Usunięto : HKCU\Software\Softonic Klucz Usunięto : HKCU\Software\Tutorials Klucz Usunięto : HKCU\Software\TutoTag Klucz Usunięto : HKCU\Software\de88d9b439ec41 Klucz Usunięto : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Klucz Usunięto : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{95B7759C-8C7F-4BF1-B163-73684A933233} Klucz Usunięto : HKLM\Software\AVG Secure Search Klucz Usunięto : HKLM\Software\AVG Security Toolbar Klucz Usunięto : HKLM\Software\Babylon Klucz Usunięto : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947} Klucz Usunięto : HKLM\SOFTWARE\Classes\AppID\{1FDFF5A2-7BB1-48E1-8081-7236812B12B2} Klucz Usunięto : HKLM\SOFTWARE\Classes\AppID\{39CB8175-E224-4446-8746-00566302DF8D} Klucz Usunięto : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} Klucz Usunięto : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D} Klucz Usunięto : HKLM\SOFTWARE\Classes\AppID\{BB711CB0-C70B-482E-9852-EC05EBD71DBB} Klucz Usunięto : HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3} Klucz Usunięto : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} Klucz Usunięto : HKLM\SOFTWARE\Classes\AppID\escort.DLL Klucz Usunięto : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL Klucz Usunięto : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL Klucz Usunięto : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL Klucz Usunięto : HKLM\SOFTWARE\Classes\AppID\esrv.EXE Klucz Usunięto : HKLM\SOFTWARE\Classes\AppID\NCTAudioCDGrabber2.DLL Klucz Usunięto : HKLM\SOFTWARE\Classes\AppID\ScriptHelper.EXE Klucz Usunięto : HKLM\SOFTWARE\Classes\AppID\ViProtocol.DLL Klucz Usunięto : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI Klucz Usunięto : HKLM\SOFTWARE\Classes\AVG Secure Search.BrowserWndAPI.1 Klucz Usunięto : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj Klucz Usunięto : HKLM\SOFTWARE\Classes\AVG Secure Search.PugiObj.1 Klucz Usunięto : HKLM\SOFTWARE\Classes\delta.deltaappCore Klucz Usunięto : HKLM\SOFTWARE\Classes\delta.deltaappCore.1 Klucz Usunięto : HKLM\SOFTWARE\Classes\delta.deltadskBnd Klucz Usunięto : HKLM\SOFTWARE\Classes\delta.deltadskBnd.1 Klucz Usunięto : HKLM\SOFTWARE\Classes\delta.deltaHlpr Klucz Usunięto : HKLM\SOFTWARE\Classes\delta.deltaHlpr.1 Klucz Usunięto : HKLM\SOFTWARE\Classes\escort.escortIEPane Klucz Usunięto : HKLM\SOFTWARE\Classes\escort.escortIEPane.1 Klucz Usunięto : HKLM\SOFTWARE\Classes\esrv.deltaESrvc Klucz Usunięto : HKLM\SOFTWARE\Classes\esrv.deltaESrvc.1 Klucz Usunięto : HKLM\Software\Classes\Installer\Features\7E685771E24E83F4381D1DB5A45F7B41 Klucz Usunięto : HKLM\Software\Classes\Installer\Products\7E685771E24E83F4381D1DB5A45F7B41 Klucz Usunięto : HKLM\SOFTWARE\Classes\Prod.cap Klucz Usunięto : HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\viprotocol Klucz Usunięto : HKLM\SOFTWARE\Classes\S Klucz Usunięto : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi Klucz Usunięto : HKLM\SOFTWARE\Classes\ScriptHelper.ScriptHelperApi.1 Klucz Usunięto : HKLM\SOFTWARE\Classes\Toolbar.CT3282722 Klucz Usunięto : HKLM\SOFTWARE\Classes\TypeLib\{39CB8175-E224-4446-8746-00566302DF8D} Klucz Usunięto : HKLM\SOFTWARE\Classes\TypeLib\{4599D05A-D545-4069-BB42-5895B4EAE05B} Klucz Usunięto : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921} Klucz Usunięto : HKLM\SOFTWARE\Classes\TypeLib\{74FB6AFD-DD77-4CEB-83BD-AB2B63E63C93} Klucz Usunięto : HKLM\SOFTWARE\Classes\TypeLib\{93E3D79C-0786-48FF-9329-93BC9F6DC2B3} Klucz Usunięto : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8} Klucz Usunięto : HKLM\SOFTWARE\Classes\TypeLib\{C2AC8A0E-E48E-484B-A71C-C7A937FAAB94} Klucz Usunięto : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800} Klucz Usunięto : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE Klucz Usunięto : HKLM\SOFTWARE\Classes\ViProtocol.ViProtocolOLE.1 Klucz Usunięto : HKLM\Software\Conduit Klucz Usunięto : HKLM\Software\DataMngr Klucz Usunięto : HKLM\Software\Delta Klucz Usunięto : HKLM\Software\FreeOnlineRadioPlayerRecorder_V1 Klucz Usunięto : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASAPI32 Klucz Usunięto : HKLM\SOFTWARE\Microsoft\Tracing\ConduitInstaller_RASMANCS Klucz Usunięto : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASAPI32 Klucz Usunięto : HKLM\SOFTWARE\Microsoft\Tracing\MyBabylontb_RASMANCS Klucz Usunięto : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{7EF0E692-B7E1-4BA8-8587-3DE4610FF0FC} Klucz Usunięto : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{C6FDD0C3-266A-4DC3-B459-28C697C44CDC} Klucz Usunięto : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{F25AF245-4A81-40DC-92F9-E9021F207706} Klucz Usunięto : HKLM\SOFTWARE\MozillaPlugins\@avg.com/AVG SiteSafety plugin,version=11.0.0.1,application/x-avg-sitesafety-plugin Klucz Usunięto : HKLM\Software\PIP Klucz Usunięto : HKLM\Software\Tuto4PC Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{261DD098-8A3E-43D4-87AA-63324FA897D8} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{3C471948-F874-49F5-B338-4F214A2EE0B1} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{4FCB4630-2A1C-4AA1-B422-345E8DC8A6DE} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{79B8E308-95A2-4044-932D-80E833A863CC} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{7EF0E692-B7E1-4BA8-8587-3DE4610FF0FC} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{82E1477C-B154-48D3-9891-33D83C26BCD3} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{86838207-681D-469D-9511-D0DCC6F19F9B} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{95B7759C-8C7F-4BF1-B163-73684A933233} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{B658800C-F66E-4EF3-AB85-6C0C227862A9} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{CADAF6BE-BF50-4669-8BFD-C27BD4E6181B} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\CLSID\{F25AF245-4A81-40DC-92F9-E9021F207706} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\de88d9b439ec41 Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\eooncjejnppfjjklapaamhcdmjbilmde Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\pgafcinpmmpklohkojmllohdhomoefph Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{348C2DF3-1191-4C3E-92A6-B3A89A9D9C85} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8E6E65C8-ACDC-4BD1-BC80-308048AD5677} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{978F59B4-AB77-45E5-9CC2-144786CCDE24} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E7DF6BFF-55A5-4EB7-A673-4ED3E9456D39} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{F25AF245-4A81-40DC-92F9-E9021F207706} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{79B8E308-95A2-4044-932D-80E833A863CC} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95B7759C-8C7F-4BF1-B163-73684A933233} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C1AF5FA5-852C-4C90-812E-A7F75E011D87} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{15D2D75C-9CB2-4EFD-BAD7-B9B4CB4BC693} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{177586E7-E42E-4F38-83D1-D15B4AF5B714} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{1a413f37-ed88-4fec-9666-5c48dc4b7bb7} Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\AVG Secure Search Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Delta Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\FreeOnlineRadioPlayerRecorder_V1 Toolbar Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Tuto4pc_is1 Klucz Usunięto : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\tuto4pc_pl_6_is1 Klucz Usunięto : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217} Klucz Usunięto : HKLM\SOFTWARE\Classes\Interface\{3F607E46-0D3C-4442-B1DE-DE7FA4768F5C} Klucz Usunięto : HKLM\SOFTWARE\Classes\Interface\{49C00A51-6E59-41FE-B3FA-2D2157FAD67B} Klucz Usunięto : HKLM\SOFTWARE\Classes\Interface\{4E92DB5F-AAD9-49D3-8EAB-B40CBE5B1FF7} Klucz Usunięto : HKLM\SOFTWARE\Classes\Interface\{6DFF5DBA-AE3A-46DB-B301-ECFFC6DB2982} Klucz Usunięto : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC} Klucz Usunięto : HKLM\SOFTWARE\Classes\Interface\{C401D2CE-DC27-45C7-BC0C-8E6EA7F085D6} Klucz Usunięto : HKLM\SOFTWARE\Classes\Interface\{DE34CD67-F1C8-4001-9A23-B8A68F63F377} Klucz Usunięto : HKLM\SOFTWARE\Classes\Interface\{FE0273D1-99DF-4AC0-87D5-1371C6271785} Klucz Usunięto : HKU\S-1-5-21-1338922457-2414995319-2674530476-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4D79-A620-CCE0C0A66CC9} Wartość Usunięto : HKCU\Software\Microsoft\Internet Explorer\Main [bprotector start page] Wartość Usunięto : HKCU\Software\Microsoft\Internet Explorer\SearchScopes [bProtectorDefaultScope] Wartość Usunięto : HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser [{79B8E308-95A2-4044-932D-80E833A863CC}] Wartość Usunięto : HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks [{79B8E308-95A2-4044-932D-80E833A863CC}] Wartość Usunięto : HKCU\Software\Mozilla\Firefox\Extensions [{0F827075-B026-42F3-885D-98981EE7B1AE}] Wartość Usunięto : HKLM\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks [{79B8E308-95A2-4044-932D-80E833A863CC}] Wartość Usunięto : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [tuto4pc_pl_6] Wartość Usunięto : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run [Tutorials] Wartość Usunięto : HKLM\SOFTWARE\Mozilla\Firefox\Extensions [Avg@toolbar] Wartość Usunięto : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{79B8E308-95A2-4044-932D-80E833A863CC}] Wartość Usunięto : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{82E1477C-B154-48D3-9891-33D83C26BCD3}] Wartość Usunięto : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{95B7759C-8C7F-4BF1-B163-73684A933233}] ***** [Przeglądarki Internetowe] ***** -\\ Internet Explorer v9.0.8112.16470 Podmieniono : [HKCU\Software\Microsoft\Internet Explorer\Main - Start Page] = hxxp://www.delta-search.com/?affID=119816&babsrc=HP_ss&mntrId=f8f00500000000000000b888e37c12f6 --> hxxp://www.google.com -\\ Google Chrome v25.0.1364.172 Plik : C:\Users\DTM\AppData\Local\Google\Chrome\User Data\Default\Preferences Usunięto [l.2055] : homepage = "hxxp://www.delta-search.com/?affID=119816&babsrc=HP_ss&mntrId=f8f00500000000000000b8[...] Usunięto [l.2362] : urls_to_restore_on_startup = [ "hxxp://www.delta-search.com/?affID=119816&babsrc=HP_ss&mntrId[...] ************************* AdwCleaner[R1].txt - [17135 octets] - [28/03/2013 23:05:42] AdwCleaner[R2].txt - [17196 octets] - [28/03/2013 23:06:04] AdwCleaner[S1].txt - [16477 octets] - [28/03/2013 23:32:50] ########## EOF - C:\AdwCleaner[S1].txt - [16538 octets] ##########

OTL:

Kod: Zaznacz wszystko: OTL logfile created on: 2013-03-29 00:14:06 - Run 4 OTL by OldTimer - Version 3.2.69.0 Folder = E:\User\DTM\Pobrane 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 7.90 Gb Total Physical Memory | 6.06 Gb Available Physical Memory | 76.68% Memory free 15.81 Gb Paging File | 13.76 Gb Available in Paging File | 87.04% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 29.72 Gb Total Space | 1.98 Gb Free Space | 6.67% Space Free | Partition Type: NTFS Drive D: | 29.24 Gb Total Space | 0.00 Gb Free Space | 0.02% Space Free | Partition Type: FAT32 Drive E: | 390.62 Gb Total Space | 362.14 Gb Free Space | 92.71% Space Free | Partition Type: NTFS Drive F: | 481.20 Gb Total Space | 372.39 Gb Free Space | 77.39% Space Free | Partition Type: NTFS Computer Name: DTM-KOMPUTER | User Name: DTM | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2013-03-28 21:02:39 | 000,602,112 | ---- | M] (OldTimer Tools) -- E:\User\DTM\Pobrane\OTL.exe PRC - [2013-03-11 01:22:07 | 001,274,320 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe PRC - [2013-02-10 04:25:27 | 001,266,464 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe PRC - [2012-12-11 03:52:44 | 003,147,384 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgui.exe PRC - [2012-12-10 11:11:44 | 001,342,024 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgfws.exe PRC - [2012-12-04 13:19:10 | 000,066,872 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe PRC - [2012-11-15 23:34:30 | 005,814,904 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe PRC - [2012-10-22 13:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe PRC - [2012-02-28 10:20:02 | 000,363,800 | R--- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe PRC - [2012-02-28 10:19:56 | 000,277,784 | R--- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe PRC - [2012-02-28 10:19:46 | 000,161,560 | R--- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2013-03-11 01:22:06 | 000,459,728 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\ppGoogleNaClPluginChrome.dll MOD - [2013-03-11 01:22:05 | 012,662,224 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\PepperFlash\pepflashplayer.dll MOD - [2013-03-11 01:22:04 | 004,050,896 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\pdf.dll MOD - [2013-03-11 01:21:18 | 000,596,944 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\libglesv2.dll MOD - [2013-03-11 01:21:18 | 000,124,368 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\libegl.dll MOD - [2013-03-11 01:21:16 | 001,552,848 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\ffmpegsumo.dll MOD - [2012-12-03 16:47:14 | 000,004,096 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll MOD - [2012-11-29 22:59:32 | 000,093,696 | ---- | M] () -- E:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll MOD - [2011-06-02 13:58:18 | 000,132,448 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Onekey Theater\WindowsApiHookDll32.dll MOD - [2011-06-02 13:57:44 | 000,161,120 | ---- | M] () -- C:\Program Files (x86)\Lenovo\Onekey Theater\ActiveDetect32.dll [color=#E56717]========== Services (SafeList) ==========[/color] SRV:[b]64bit:[/b] - [2012-02-02 22:29:52 | 000,628,448 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\iCLS Client\HeciServer.exe -- (Intel(R) SRV:[b]64bit:[/b] - [2011-12-08 10:44:04 | 000,594,704 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe -- (ZeroConfigService) SRV:[b]64bit:[/b] - [2011-12-08 10:43:56 | 000,273,168 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS) SRV:[b]64bit:[/b] - [2011-12-08 10:43:48 | 000,618,256 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) SRV:[b]64bit:[/b] - [2011-12-08 10:43:44 | 000,148,752 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) SRV:[b]64bit:[/b] - [2011-12-05 09:30:50 | 000,659,968 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe -- (AMPPALR3) SRV:[b]64bit:[/b] - [2011-12-05 08:55:36 | 000,135,952 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe -- (BTHSSecurityMgr) SRV:[b]64bit:[/b] - [2009-07-14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2013-03-13 19:49:57 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013-02-10 04:25:27 | 001,266,464 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2012-12-18 20:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012-12-10 11:11:44 | 001,342,024 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgfws.exe -- (avgfws) SRV - [2012-12-04 13:19:10 | 000,066,872 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2012-11-15 23:34:30 | 005,814,904 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent) SRV - [2012-10-22 13:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd) SRV - [2012-03-02 22:48:54 | 000,276,248 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs) SRV - [2012-02-28 10:20:02 | 000,363,800 | R--- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) SRV - [2012-02-28 10:19:56 | 000,277,784 | R--- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) SRV - [2012-02-28 10:19:46 | 000,161,560 | R--- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe -- (jhi_service) SRV - [2011-11-30 16:18:02 | 000,514,048 | ---- | M] (Red Bend Ltd.) [Auto | Running] -- E:\Program Files\Intel\WiMAX\Bin\DMAgent.exe -- (DMAgent) SRV - [2011-11-30 16:12:00 | 000,979,456 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- E:\Program Files\Intel\WiMAX\Bin\AppSrv.exe -- (WiMAXAppSrv) SRV - [2010-03-18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009-06-10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV:[b]64bit:[/b] - [2013-03-28 20:16:24 | 000,564,824 | ---- | M] (Duplex Secure Ltd.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\sptd.sys -- (sptd) DRV:[b]64bit:[/b] - [2013-02-18 17:38:50 | 000,039,768 | ---- | M] (AVG Technologies) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtpx64.sys -- (avgtp) DRV:[b]64bit:[/b] - [2013-02-10 04:25:27 | 000,030,496 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\nvpciflt.sys -- (nvpciflt) DRV:[b]64bit:[/b] - [2012-12-02 14:15:56 | 000,039,008 | ---- | M] (Lenovo.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\LhdX64.sys -- (LHDmgr) DRV:[b]64bit:[/b] - [2012-12-02 14:15:56 | 000,030,816 | ---- | M] (Lenovo Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AcpiVpc.sys -- (ACPIVPC) DRV:[b]64bit:[/b] - [2012-11-15 23:33:24 | 000,111,968 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgmfx64.sys -- (Avgmfx64) DRV:[b]64bit:[/b] - [2012-10-22 13:02:44 | 000,154,464 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgidsdrivera.sys -- (AVGIDSDriver) DRV:[b]64bit:[/b] - [2012-10-15 03:48:50 | 000,063,328 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgidsha.sys -- (AVGIDSHA) DRV:[b]64bit:[/b] - [2012-10-02 03:30:38 | 000,185,696 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgldx64.sys -- (Avgldx64) DRV:[b]64bit:[/b] - [2012-09-21 03:46:04 | 000,200,032 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgtdia.sys -- (Avgtdia) DRV:[b]64bit:[/b] - [2012-09-21 03:46:00 | 000,225,120 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\avgloga.sys -- (Avgloga) DRV:[b]64bit:[/b] - [2012-09-14 03:05:18 | 000,040,800 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\avgrkx64.sys -- (Avgrkx64) DRV:[b]64bit:[/b] - [2012-09-04 10:39:32 | 000,050,296 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avgfwd6a.sys -- (Avgfwfd) DRV:[b]64bit:[/b] - [2012-05-20 18:47:38 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:[b]64bit:[/b] - [2012-05-20 18:30:20 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:[b]64bit:[/b] - [2012-05-20 18:30:20 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:[b]64bit:[/b] - [2012-03-12 01:59:32 | 000,788,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3xhc.sys -- (iusb3xhc) DRV:[b]64bit:[/b] - [2012-03-12 01:59:32 | 000,356,120 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\iusb3hub.sys -- (iusb3hub) DRV:[b]64bit:[/b] - [2012-02-17 18:28:54 | 014,692,896 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx) DRV:[b]64bit:[/b] - [2012-02-02 04:07:18 | 000,134,696 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bcbtums.sys -- (bcbtums) DRV:[b]64bit:[/b] - [2011-12-16 02:04:02 | 000,411,920 | ---- | M] (Synaptics Incorporated) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SynTP.sys -- (SynTP) DRV:[b]64bit:[/b] - [2011-12-06 12:23:08 | 000,331,264 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IntcDAud.sys -- (IntcDAud) DRV:[b]64bit:[/b] - [2011-12-05 09:22:58 | 000,195,584 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPALP) DRV:[b]64bit:[/b] - [2011-12-05 09:22:58 | 000,195,584 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AmpPal.sys -- (AMPPAL) DRV:[b]64bit:[/b] - [2011-12-01 15:51:00 | 011,417,088 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\NETwNs64.sys -- (NETwNs64) DRV:[b]64bit:[/b] - [2011-11-30 15:57:28 | 000,084,480 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\bpenum.sys -- (bpenum) DRV:[b]64bit:[/b] - [2011-11-15 04:12:10 | 000,111,216 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C) DRV:[b]64bit:[/b] - [2011-11-09 18:04:14 | 000,060,184 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) DRV:[b]64bit:[/b] - [2011-08-25 03:21:00 | 000,173,656 | ---- | M] (JMicron Technology Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\jmcr.sys -- (JMCR) DRV:[b]64bit:[/b] - [2010-11-21 04:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:[b]64bit:[/b] - [2010-11-21 04:23:47 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\sdbus.sys -- (sdbus) DRV:[b]64bit:[/b] - [2010-11-21 04:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:[b]64bit:[/b] - [2010-11-21 04:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD) DRV:[b]64bit:[/b] - [2009-07-14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:[b]64bit:[/b] - [2009-07-14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:[b]64bit:[/b] - [2009-07-14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:[b]64bit:[/b] - [2009-06-10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:[b]64bit:[/b] - [2009-06-10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:[b]64bit:[/b] - [2009-06-10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:[b]64bit:[/b] - [2009-06-10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV - [2012-05-10 15:05:38 | 000,030,592 | ---- | M] (REALiX(tm)) [Kernel | System | Running] -- E:\Program Files (x86)\HWiNFO32\HWiNFO64A.SYS -- (HWiNFO32) DRV - [2010-01-29 11:40:16 | 000,115,600 | ---- | M] (EZB Systems, Inc.) [File_System | System | Running] -- E:\Program Files (x86)\UltraISO\drivers\ISODrv64.sys -- (ISODrive) DRV - [2009-07-14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com IE - HKCU\..\SearchScopes,DefaultScope = IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{2C906940-2DC7-4C13-B2B2-0121BDE26BAB}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3282722&CUI=UN45357392230672178 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.13.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.13.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: E:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) [2013-02-22 20:59:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [color=#E56717]========== Chrome ==========[/color] CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter} CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\PepperFlash\pepflashplayer.dll CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\pdf.dll CHR - plugin: Adobe Acrobat (Enabled) = E:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll CHR - plugin: Intel\u00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll CHR - plugin: Intel\u00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll CHR - plugin: Java(TM) Platform SE 7 U13 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll CHR - plugin: Java Deployment Toolkit 7.0.130.20 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll CHR - Extension: FreeOnlineRadioPlayerRecorder V1 = C:\Users\DTM\AppData\Local\Google\Chrome\User Data\Default\Extensions\aicancafipiklohohmoognddncljhkio\10.15.0.562_0\ O1 HOSTS File: ([2009-06-10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (FlashGetBHO) - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Users\DTM\AppData\Roaming\FlashGetBHO\FlashGetBHO.dll (Trend Media Group) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited) O4:[b]64bit:[/b] - HKLM..\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe (Lenovo(beijing) Limited) O4:[b]64bit:[/b] - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [IntelWirelessWiMAX] E:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe (Intel® Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [OnekeyStudio] C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe (Lenovo) O4:[b]64bit:[/b] - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [RtHDVBg_Dolby] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor) O4:[b]64bit:[/b] - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:[b]64bit:[/b] - HKLM..\Run: [SynLenovoGestureMgr] C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe (Synaptics) O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" File not found O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8:[b]64bit:[/b] - Extra context menu item: Download all links by FlashGet3 - E:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgetallurl.htm () O8:[b]64bit:[/b] - Extra context menu item: Download all videos by FlashGet3 - E:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgetallflvurl.htm () O8:[b]64bit:[/b] - Extra context menu item: Download by FlashGet3 - E:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgeturl.htm () O8:[b]64bit:[/b] - Extra context menu item: Download current video by FlashGet3 - E:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgetflvurl.htm () O8:[b]64bit:[/b] - Extra context menu item: E&ksport do programu Microsoft Excel - E:\Program Files (x86)\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Download all links by FlashGet3 - E:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgetallurl.htm () O8 - Extra context menu item: Download all videos by FlashGet3 - E:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgetallflvurl.htm () O8 - Extra context menu item: Download by FlashGet3 - E:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgeturl.htm () O8 - Extra context menu item: Download current video by FlashGet3 - E:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgetflvurl.htm () O8 - Extra context menu item: E&ksport do programu Microsoft Excel - E:\Program Files (x86)\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\Program Files (x86)\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O13[b]64bit:[/b] - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 8.8.8.8 8.8.4.4 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{82D380C9-DBC3-4965-991C-F61FC55D16AC}: DhcpNameServer = 192.168.1.254 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A4249BE5-607B-4842-A0EE-24E460736AB8}: DhcpNameServer = 8.8.8.8 8.8.4.4 O18:[b]64bit:[/b] - Protocol\Handler\msdaipp - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\msdaipp\oledb - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\mso-offdap11 - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Filter\text/xml - No CLSID value found O20:[b]64bit:[/b] - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation) O20 - AppInit_DLLs: (c:\progra~3\browse~1\261095~1.52\{c16c1~1\browse~1.dll) - File not found O20 - AppInit_DLLs: (c:\windows\syswow64\nvinit.dll) - c:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20:[b]64bit:[/b] - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %* O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2013-03-28 22:56:12 | 000,000,000 | ---D | C] -- E:\User\DTM\Desktop\Gmail [2013-03-28 20:16:24 | 000,564,824 | ---- | C] (Duplex Secure Ltd.) -- C:\Windows\SysNative\drivers\sptd.sys [2013-03-26 00:00:09 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\usb8023.sys [2013-03-25 14:51:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office [2013-03-18 12:10:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight [2013-03-18 12:10:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight [2013-03-14 00:58:07 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2013-03-14 00:58:07 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2013-03-14 00:58:07 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2013-03-14 00:58:07 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2013-03-14 00:58:07 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2013-03-14 00:58:07 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2013-03-14 00:58:07 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2013-03-14 00:58:07 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2013-03-14 00:58:06 | 002,312,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2013-03-14 00:58:06 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2013-03-14 00:58:06 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2013-03-14 00:58:06 | 000,729,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2013-03-14 00:58:06 | 000,717,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2013-03-14 00:58:06 | 000,599,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\vbscript.dll [2013-03-14 00:58:05 | 000,816,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2013-03-13 20:49:32 | 000,000,000 | ---D | C] -- E:\User\DTM\Desktop\Nagrania [2013-03-10 14:02:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts [2013-03-10 14:00:41 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Common Files\EAInstaller [2013-03-08 11:50:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG [2013-03-03 21:11:46 | 000,000,000 | ---D | C] -- E:\User\DTM\Moje dokumenty\Criterion Games [2013-03-03 21:07:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Need For Speed Most Wanted [2013-02-27 17:13:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Euro Truck Simulator 2 [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2013-03-29 00:10:00 | 000,000,930 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013-03-29 00:00:00 | 000,001,042 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013-03-28 23:41:30 | 000,021,296 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013-03-28 23:41:30 | 000,021,296 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013-03-28 23:38:30 | 001,663,412 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013-03-28 23:38:30 | 000,738,192 | ---- | M] () -- C:\Windows\SysNative\perfh015.dat [2013-03-28 23:38:30 | 000,652,360 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013-03-28 23:38:30 | 000,154,848 | ---- | M] () -- C:\Windows\SysNative\perfc015.dat [2013-03-28 23:38:30 | 000,121,292 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013-03-28 23:34:27 | 000,001,038 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013-03-28 23:34:17 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013-03-28 23:34:15 | 2070,691,839 | -HS- | M] () -- C:\hiberfil.sys [2013-03-28 23:33:05 | 000,000,166 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat [2013-03-28 20:16:24 | 000,564,824 | ---- | M] (Duplex Secure Ltd.) -- C:\Windows\SysNative\drivers\sptd.sys [2013-03-27 15:27:06 | 003,188,537 | ---- | M] () -- E:\User\DTM\Desktop\vBulletin_3.8.5.rar [2013-03-27 00:35:49 | 000,007,602 | ---- | M] () -- C:\Users\DTM\AppData\Local\Resmon.ResmonCfg [2013-03-25 21:13:38 | 001,724,303 | ---- | M] () -- E:\User\DTM\Desktop\tablice_matematyczne.pdf [2013-03-21 15:32:26 | 000,000,817 | ---- | M] () -- E:\User\DTM\Desktop\HD Tune.lnk [2013-03-19 11:07:31 | 000,293,744 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2013-03-13 20:53:14 | 000,000,818 | ---- | M] () -- C:\Users\Public\Desktop\Need For Speed Most Wanted.lnk [2013-03-13 19:49:56 | 000,693,976 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2013-03-13 19:49:56 | 000,073,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2013-03-08 11:50:18 | 000,000,995 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk [2013-02-27 21:06:48 | 000,000,893 | ---- | M] () -- C:\Users\Public\Desktop\Euro Truck Simulator 2.lnk [color=#E56717]========== Files Created - No Company Name ==========[/color] [2013-03-28 23:32:57 | 000,000,166 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat [2013-03-27 15:26:34 | 003,188,537 | ---- | C] () -- E:\User\DTM\Desktop\vBulletin_3.8.5.rar [2013-03-27 00:35:49 | 000,007,602 | ---- | C] () -- C:\Users\DTM\AppData\Local\Resmon.ResmonCfg [2013-03-25 21:13:37 | 001,724,303 | ---- | C] () -- E:\User\DTM\Desktop\tablice_matematyczne.pdf [2013-03-21 15:31:43 | 000,000,817 | ---- | C] () -- E:\User\DTM\Desktop\HD Tune.lnk [2013-03-03 21:07:58 | 000,000,818 | ---- | C] () -- C:\Users\Public\Desktop\Need For Speed Most Wanted.lnk [2013-02-27 17:13:05 | 000,000,893 | ---- | C] () -- C:\Users\Public\Desktop\Euro Truck Simulator 2.lnk [2013-02-23 17:02:22 | 001,638,822 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2013-02-22 21:01:16 | 000,049,152 | ---- | C] () -- C:\Windows\SysWow64\OctaneARM.dll [2013-02-18 18:51:37 | 000,165,376 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll [2013-02-12 11:47:40 | 000,007,168 | ---- | C] () -- C:\Users\DTM\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2013-01-25 22:01:30 | 000,000,305 | ---- | C] () -- C:\Windows\SysWow64\secushr.dat [2013-01-25 21:26:32 | 000,000,025 | ---- | C] () -- C:\Windows\emcore.INI [2013-01-19 15:25:32 | 000,000,412 | ---- | C] () -- C:\Windows\ODBC.INI [2013-01-18 20:20:56 | 000,000,444 | ---- | C] () -- C:\Windows\QIII.INI [2012-12-05 13:57:49 | 000,000,248 | ---- | C] () -- C:\Windows\SysWow64\secustat.dat [2012-12-05 13:13:03 | 000,000,025 | ---- | C] () -- C:\Windows\libem.INI [2012-12-04 13:19:10 | 000,669,184 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe [2012-12-03 16:49:46 | 000,103,736 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2012-12-03 16:49:46 | 000,066,872 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2012-12-01 14:36:22 | 000,000,000 | ---- | C] () -- C:\Windows\Bench32_2.47(dobreprogramy.pl).INI [2012-11-29 20:26:11 | 000,000,000 | -H-- | C] () -- C:\Users\DTM\AppData\Roaming\Edg1yFHEEhjE [2012-11-29 19:11:18 | 013,020,160 | ---- | C] () -- C:\Windows\SysWow64\ig7icd32.dll [2012-11-29 19:11:18 | 000,735,796 | ---- | C] () -- C:\Windows\SysWow64\igkrng700.bin [2012-11-29 19:11:18 | 000,561,508 | ---- | C] () -- C:\Windows\SysWow64\igfcg700m.bin [2012-11-29 19:11:18 | 000,058,880 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll [2012-02-02 22:08:26 | 000,001,536 | ---- | C] () -- C:\Windows\SysWow64\IusEventLog.dll [color=#E56717]========== ZeroAccess Check ==========[/color] [2009-07-14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012-06-09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012-06-09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009-07-14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010-11-21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009-07-14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] [color=#E56717]========== LOP Check ==========[/color] [2012-12-11 13:09:42 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\.wtw [2012-11-30 13:14:08 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\AVG2013 [2013-03-28 18:44:02 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\BITS [2013-02-25 14:54:22 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\Cool Record Edit Pro [2012-12-24 12:40:39 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\CornerBowl [2013-03-09 22:59:50 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\FileZilla [2013-01-25 21:25:59 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\FlashGet [2013-01-25 21:26:03 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\FlashGetBHO [2013-01-14 17:18:26 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\FlashgetSetup [2013-02-25 14:49:33 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\Free Sound Recorder [2013-03-27 23:25:41 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\ipla [2013-01-17 09:16:24 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\JAM Software [2013-01-29 15:56:19 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\PhotoFiltre 7 [2013-02-24 19:00:52 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\Publish Providers [2013-02-24 19:44:39 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\Sony [2013-02-24 22:34:10 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\Sony Creative Software Inc [2013-03-25 23:52:14 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\TS3Client [2012-11-30 13:07:59 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\TuneUp Software [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:0E08FC17 < End of report >

Extras:

Kod: Zaznacz wszystko: OTL Extras logfile created on: 2013-03-29 00:14:06 - Run 4 OTL by OldTimer - Version 3.2.69.0 Folder = E:\User\DTM\Pobrane 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 7.90 Gb Total Physical Memory | 6.06 Gb Available Physical Memory | 76.68% Memory free 15.81 Gb Paging File | 13.76 Gb Available in Paging File | 87.04% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 29.72 Gb Total Space | 1.98 Gb Free Space | 6.67% Space Free | Partition Type: NTFS Drive D: | 29.24 Gb Total Space | 0.00 Gb Free Space | 0.02% Space Free | Partition Type: FAT32 Drive E: | 390.62 Gb Total Space | 362.14 Gb Free Space | 92.71% Space Free | Partition Type: NTFS Drive F: | 481.20 Gb Total Space | 372.39 Gb Free Space | 77.39% Space Free | Partition Type: NTFS Computer Name: DTM-KOMPUTER | User Name: DTM | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = ChromeHTML] -- Reg Error: Key error. File not found [color=#E56717]========== Shell Spawning ==========[/color] [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- "E:\Program Files (x86)\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "E:\Program Files (x86)\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [napiprojekt] -- "C:\Program Files (x86)\NapiProjekt\napisy.exe" "%1" Directory [napiprojekt0] -- "C:\Program Files (x86)\NapiProjekt\napisy.exe" "%1" -pobierz_ang Directory [Winamp.Bookmark] -- "E:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.) Directory [Winamp.Enqueue] -- "E:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.) Directory [Winamp.Play] -- "E:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [edit] -- "E:\Program Files (x86)\Microsoft Office\OFFICE11\msohtmed.exe" %1 (Microsoft Corporation) htmlfile [print] -- "E:\Program Files (x86)\Microsoft Office\OFFICE11\msohtmed.exe" /p %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [napiprojekt] -- "C:\Program Files (x86)\NapiProjekt\napisy.exe" "%1" Directory [napiprojekt0] -- "C:\Program Files (x86)\NapiProjekt\napisy.exe" "%1" -pobierz_ang Directory [Winamp.Bookmark] -- "E:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.) Directory [Winamp.Enqueue] -- "E:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.) Directory [Winamp.Play] -- "E:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] [color=#E56717]========== Firewall Settings ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "E:\Program Files (x86)\FlashGet Network\FlashGet 3\FlashGet3.exe" = E:\Program Files (x86)\FlashGet Network\FlashGet 3\FlashGet3.exe:*:Enabled:Flashget3 -- (Trend Media Corporation Limited) "E:\Program Files (x86)\FlashGet Network\FlashGet 3\FlashGet3.exe" = E:\Program Files (x86)\FlashGet Network\FlashGet 3\FlashGet3.exe:*:Enabled:Flashget3 -- (Trend Media Corporation Limited) [color=#E56717]========== Vista Active Open Ports Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{27FF0FA8-E9A2-4290-BD76-1B7E68E7AA03}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{2FD38BFB-9F63-4620-89B7-5F4B9865C48B}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{316457AC-55E9-499F-949F-CDB81E98997D}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{43A7728B-EE61-40C6-9CCD-BB60517CCBA9}" = lport=10243 | protocol=6 | dir=in | app=system | "{4414FEE0-1882-4BB0-A163-E3D9550FB2C3}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{498C7C21-6C6C-4EB4-AC43-4970E6FFC8E2}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | "{4C64F59C-A555-4C6A-B897-041358E8FD85}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{603E7B8F-7316-4FE5-99BE-8740269C0103}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | "{699AC322-23D9-4ADF-B98C-BFEC3C025D67}" = rport=10243 | protocol=6 | dir=out | app=system | "{6BCDBEFA-A3BA-42D9-B5F2-9E7E94E48DBD}" = lport=2869 | protocol=6 | dir=in | app=system | "{70D56240-EBA3-463F-920F-EEE94AFBA0B3}" = lport=137 | protocol=17 | dir=in | app=system | "{731BE043-BD8A-433D-90AE-123B5DBA0D0C}" = rport=138 | protocol=17 | dir=out | app=system | "{7408C463-AB31-4F98-97C0-8E3426F03504}" = rport=139 | protocol=6 | dir=out | app=system | "{78225157-A59F-451F-889A-09D250BB7DA4}" = lport=445 | protocol=6 | dir=in | app=system | "{7F2F5AB8-AC17-4108-B0C7-67D1EF263997}" = rport=137 | protocol=17 | dir=out | app=system | "{82F8D1D0-CBC1-4964-AE6C-D5167727A2D5}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | "{8432414D-C561-45F2-A9AF-061476FAD758}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | "{99A15697-8638-44C5-AB5C-3F295DF02808}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{9DD728A5-FFBA-4ADF-A49C-F936DA770B02}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe | "{B15DCAED-D850-4813-8C2D-FDE750E2A994}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | "{DCB6ECAA-E86D-498B-93C3-21C56DC56E82}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | "{DDB32FA7-D3E8-48EC-A94E-D82468DE2193}" = lport=139 | protocol=6 | dir=in | app=system | "{E4DDAB12-02C6-4A99-BB98-D9F37F9F5B44}" = lport=138 | protocol=17 | dir=in | app=system | "{E8ACAA48-59C1-4F0D-A04C-9E11B4980E54}" = rport=445 | protocol=6 | dir=out | app=system | [color=#E56717]========== Vista Active Application Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{00A8DAB8-F198-4F25-8094-5DA573E6F134}" = protocol=17 | dir=in | app=f:\gry\farming simulator 2013 multiplayer\farmingsimulator2013game.exe | "{0E941CA5-4E8C-4CFE-A907-B53620A845F6}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgdiagex.exe | "{0EA5E6FF-E69A-4800-85B0-880A60401539}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | "{10BD1FCB-AE41-4A66-A18F-0F0A846EA2F2}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | "{1257449A-318C-497A-8AD4-D481A1F39F2B}" = protocol=6 | dir=out | app=system | "{128AA843-4623-4281-97FD-7294BCEBB1FE}" = protocol=6 | dir=in | app=f:\program files (x86)\electronic arts\crytek\crysis\bin32\crysisdedicatedserver.exe | "{175D9A23-FFA6-4039-8526-4396C4604CEC}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgnsa.exe | "{1A3A2D12-E3D0-4E39-BD5E-441A3635848E}" = protocol=17 | dir=in | app=e:\program files\intel\wimax\bin\appsrv.exe | "{207AB4AB-C923-4FCF-B417-BB5F2C3F2317}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | "{2392C56F-5909-4936-8764-AD1473517C30}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | "{23A1071B-C3C2-46EB-AF4B-C70237C78619}" = protocol=6 | dir=in | app=f:\gry\farming simulator 2013 multiplayer\farmingsimulator2013.exe | "{23CB0284-834F-4E7E-9919-95B707037C23}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | "{293DE824-53EB-4BD6-A314-031E01C5FFFB}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{2D6263CB-2357-4882-A284-B526A19CD80C}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgnsa.exe | "{3011C898-27B6-4487-ABD3-44047FBEB275}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{348FAE85-EB17-41D0-AAE1-6223635C1F89}" = protocol=17 | dir=in | app=e:\program files\k2t\wtw\wtw.exe | "{383B0C6F-9E60-40BA-9FAA-30517557A9C8}" = dir=in | app=c:\program files\intel\wifi\bin\pandhcpdns.exe | "{3C7F5855-0BF2-440C-A1CF-8DC7DBD1B478}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | "{44EDA702-27AF-4D91-8EA6-A55BF537AC1A}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgdiagex.exe | "{4A10AB7B-1290-4F5E-B819-CACE7E4FA352}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | "{516B7E97-EAF5-49D7-A550-AE275D283158}" = protocol=17 | dir=in | app=f:\gry\crysis 3\crysis 3\bin32\crysis3.exe | "{52504F81-35E4-4D7E-A0B1-1294EA6474A9}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{52D76DF7-CA16-458B-BD70-AD820568BFD0}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | "{535F9297-5829-471A-9D51-262081355476}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgemca.exe | "{538E7FFB-10B4-4C86-A615-80F5FFD1F214}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | "{573264E2-1012-466D-A389-6E1ABD0D6949}" = protocol=17 | dir=in | app=e:\program files\intel\wimax\bin\dmagent.exe | "{57C93BEC-52A9-4482-99A3-6762B8C4B405}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgemca.exe | "{580AA9A8-AC51-4152-B52F-7CB587A3900F}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgnsa.exe | "{5981EEE5-CDB8-4B79-99F6-6A96AB9ECC92}" = protocol=17 | dir=in | app=f:\gry\farming simulator 2013 multiplayer\farmingsimulator2013.exe | "{5E159C8B-0A4E-438A-8EB9-1B8AD2476CF6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{5F2AF684-8819-4B16-B220-DBBB7E99B900}" = dir=in | app=f:\program files (x86)\cdp.pl\farming simulator 2013\farmingsimulator2013.exe | "{5FC29929-2CE8-4063-8F23-354FE0223703}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgdiagex.exe | "{6CF1E9E4-43E9-4424-B3CB-A96725747D51}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | "{6EE0A077-42A7-42ED-879E-8151FBBF143B}" = dir=in | app=f:\program files (x86)\cdp.pl\farming simulator 2013\farmingsimulator2013game.exe | "{72AF6573-7C92-4121-A11B-AD55BF8211E1}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | "{7870C9B1-0D92-4892-BBC9-C72BBB86F3DE}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgemca.exe | "{7B06CB83-C75F-4EF8-B043-F0F1FF2E588D}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{7DBEA3EC-0CB1-4A6E-95B9-39920FA872C3}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | "{7F8C9E78-B764-464E-B408-506E2B9BBAC5}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | "{84F905EE-2660-41A4-88CC-9EE14AC4E11F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{886C4C0D-1918-4C3C-BAF6-4A4C37E236D4}" = protocol=6 | dir=in | app=f:\gry\crysis 3\crysis 3\bin32\crysis3.exe | "{8DF1DA6F-583A-4FB5-92E7-C7D3D9F8425B}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | "{9802B3FA-5FC9-409E-AB33-3CD4351E61E7}" = protocol=6 | dir=in | app=e:\program files\intel\wimax\bin\dmagent.exe | "{983208B9-F6AF-4A09-AF29-5B6B1D6D8F88}" = protocol=17 | dir=in | app=f:\program files (x86)\electronic arts\crytek\crysis\bin32\crysis.exe | "{9B313C99-70D0-41F6-87C8-60B22A5113C4}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | "{A42EA43D-31A7-4A3B-A1C0-26373590E28C}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgemca.exe | "{A4AA5878-9A5E-4F87-A342-AA3F0DBBF34B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | "{A4D6D78A-5C8C-4990-9664-35F79F427A67}" = protocol=17 | dir=in | app=f:\program files (x86)\electronic arts\crytek\crysis\bin32\crysisdedicatedserver.exe | "{A88B3FD2-D161-4F88-A01F-B22468B8334E}" = protocol=6 | dir=in | app=f:\program files (x86)\electronic arts\crytek\crysis\bin32\crysis.exe | "{AAE6679C-D75F-407A-B2DF-4F09905E4D8F}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | "{AB19993C-C3DE-4B28-B2C7-D8EBED903E4F}" = protocol=6 | dir=in | app=f:\program files (x86)\electronic arts\crytek\crysis\bin64\crysisdedicatedserver.exe | "{AF99A5BC-E947-4E42-9214-4E598C56338A}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | "{B24D65C7-770F-4EF7-AC65-B6D79E3AE0A3}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{B429F323-4AFF-496A-B060-114637969FE0}" = protocol=6 | dir=in | app=e:\program files\k2t\wtw\wtw.exe | "{BC86EE77-83D9-46C0-8725-2F8F834B2919}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | "{C69F7502-81C3-4827-9DD6-BD7A72D2F313}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | "{C8ABEE25-F1F0-46BB-87C1-9F9D8C7DD404}" = protocol=6 | dir=in | app=f:\gry\farming simulator 2013 multiplayer\farmingsimulator2013game.exe | "{CB341925-7756-43FE-A5D6-472F5F1521B1}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe | "{CC9A49C5-758E-42F9-AFA3-4C6CFC568CB2}" = protocol=6 | dir=in | app=f:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis.exe | "{CE26D7EE-D4BB-4B71-983A-EFD77C0F246E}" = protocol=6 | dir=in | app=e:\program files\intel\wimax\bin\appsrv.exe | "{CEBBA699-26DE-4301-A78E-DE4A90207F7C}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgmfapx.exe | "{CF05F232-9714-40FB-A101-93C046AE3E01}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{D0CCC201-F79E-46E5-BAE0-D4AEA8797652}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | "{D9BA6D7D-9FA7-48F5-9EC5-FC7768D0450D}" = protocol=17 | dir=in | app=f:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis.exe | "{DDE6E103-1772-4144-8A94-BAD0D8A074FD}" = protocol=6 | dir=in | app=c:\program files (x86)\avg\avg2013\avgdiagex.exe | "{E7404B30-6EEA-4EAA-9AC1-045BD457AA4B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | "{E7C0AF29-AFE6-4B01-88BC-E75B3529F036}" = protocol=17 | dir=in | app=f:\program files (x86)\electronic arts\crytek\crysis\bin64\crysisdedicatedserver.exe | "{F211CC8E-0ACA-4D45-BA7D-62DDE836343B}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | "{FF7EEB33-8D9F-4F87-AD25-EEAB4E62ABAF}" = protocol=17 | dir=in | app=c:\program files (x86)\avg\avg2013\avgnsa.exe | [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64) "{09536BA1-E498-4CC3-B834-D884A67D7E34}" = Intel® Trusted Connect Service Client "{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 "{1DF5019A-68B5-4ba1-8E59-E185C7B7FF11}" = Komunikator WTW 0.9.10.3377 "{21B133D6-5979-47F0-BE1C-F6A6B304693F}" = Visual Studio 2010 x64 Redistributables "{2C0E6BD4-65B1-4E82-B2AC-43EFFC8F100C}" = Intel(R) PROSet/Wireless for Bluetooth(R) 3.0 + High Speed "{5F588B19-C575-4750-86FD-6ED2B76E61F1}" = Intel® PROSet/Wireless WiMAX Software "{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 "{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 "{8AAA8780-1D35-11E2-A3A6-F04DA23A5C58}" = MSVCRT Redists "{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended "{8E5DA9A6-7A9F-3A6F-BC5C-D6CBCA6A29C7}" = Microsoft .NET Framework 4 Extended PLK Language Pack "{9F0D08A0-5623-4EF6-A513-40048E20C4E0}" = AVG 2013 "{A49402DD-2781-3782-B0CF-52BDA349E3F3}" = Microsoft .NET Framework 4 Client Profile PLK Language Pack "{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64) "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = Panel sterowania NVIDIA 314.07 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Sterownik graficzny 314.07 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus 1.12.12 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA Oprogramowanie systemu PhysX 9.12.1031 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = Aktualizacje NVIDIA 1.12.12 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components "{DF7756DD-656A-45C3-BA71-74673E8259A9}" = Oprogramowanie Intel® PROSet/Wireless WiFi "{F5AA006A-1ABE-4F16-B6E1-FEE1F7D38102}" = AVG 2013 "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile "99841829BE839365AA67B2AD0E50D371F59F8A1E" = Pakiet sterowników systemu Windows - Lenovo (ACPIVPC) System (12/15/2011 7.1.0.1) "AVG" = AVG 2013 "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile PLK Language Pack" = Polski pakiet językowy dla programu Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended "Microsoft .NET Framework 4 Extended PLK Language Pack" = Polski pakiet językowy dla programu Microsoft .NET Framework 4 Extended "ProInst" = Intel PROSet Wireless "SynTPDeinstKey" = Synaptics Pointing Device Driver "TeamSpeak 3 Client" = TeamSpeak 3 Client "WinRAR archiver" = WinRAR 4.20 (64-bitowy) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{02B244A2-7F6A-42E8-A36F-8C385D7A1625}" = Gothic III "{1B705E8F-9893-4486-B5D7-4F7FEB9C871E}_is1" = Euro Truck Simulator 2 "{26604C7E-A313-4D12-867F-7C6E7820BE4C}" = JMicron Flash Media Controller Driver "{26A24AE4-039D-4CA4-87B4-2F83217013FF}" = Java 7 Update 13 "{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver "{3F0D0ABE-CDAF-431A-00BC-CBBE018EA74E}" = SimCity 4 Deluxe "{4198AE83-A3C6-4C41-85C8-EC63E990696E}" = Crysis®3 "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components "{6FB6D550-DDC4-4996-9CDF-91C34F0A4C4A}" = Gothic II - Noc Kruka "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}" = NVIDIA PhysX "{90110415-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003 "{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In "{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AC76BA86-7AD7-1045-7B44-AB0000000001}" = Adobe Reader XI (11.0.02) - Polish "{AE926337-7842-4377-8A20-475706EE5B31}_is1" = Need For Speed Most Wanted "{B8D84F70-0296-11E2-8DF5-F04DA23A5C58}" = MSVCRT Redists "{D0956C11-0F60-43FE-99AD-524E833471BB}" = Energy Management "{D417C96A-FCC7-4590-A1BB-FAF73F5BC98E}" = GTA San Andreas "{D4B060B9-AD4A-4152-9D99-28B93C615AFE}" = Onekey Theater "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 "{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{FCB3772C-B7D0-4933-B1A9-3707EBACC573}" = Intel(R) OpenCL CPU Runtime "7-Zip" = 7-Zip 4.65 "Ad Muncher" = Ad Muncher v4.93.33707 "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX "Cheat Engine 6.2_is1" = Cheat Engine 6.2 "CrystalDiskInfo_is1" = CrystalDiskInfo 5.2.0 "Dxtory2.0_is1" = Dxtory 2.0.108 "eDATA Unerase" = eDATA Unerase "EVEREST Ultimate Edition_is1" = EVEREST Ultimate Edition v5.50 "FarmingSimulator2013INT_is1" = Farming Simulator 2013 "FileZilla Client" = FileZilla Client 3.6.0.2 "FlashGet3.7" = FlashGet3.7 "Fraps" = Fraps (remove only) "Free Sound Recorder_is1" = Free Sound Recorder v9.4.1 "GoldWave v5.68" = GoldWave v5.68 "Google Chrome" = Google Chrome "HD Tune_is1" = HD Tune 2.55 "HWiNFO32_is1" = HWiNFO32 Version 4.02 "InstallShield_{D0956C11-0F60-43FE-99AD-524E833471BB}" = Energy Management "InstallShield_{D4B060B9-AD4A-4152-9D99-28B93C615AFE}" = Onekey Theater "ipla" = ipla 2.6 "IrfanView" = IrfanView (remove only) "KLiteCodecPack_is1" = K-Lite Codec Pack 6.2.0 (Basic) "PunkBusterSvc" = PunkBuster Services "Quake III Arena" = Quake III Arena "RADVideo" = RAD Video Tools "Railway Addon Mod - Single Track Rail" = Railway Addon Mod - Single Track Rail Set 1 "SpeedFan" = SpeedFan (remove only) "Street Addon Mod" = Street Addon Mod Beta v3 "TechPowerUp GPU-Z" = TechPowerUp GPU-Z "UltraISO_is1" = UltraISO Premium V9.53 "Winamp" = Winamp [color=#E56717]========== HKEY_CURRENT_USER Uninstall List ==========[/color] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Network Addon Mod" = Network Addon Mod Version 30 with Essentials r132 "PhotoFiltre 7" = PhotoFiltre 7 "RadioSure" = RadioSure "RealHighway Mod" = RealHighway Mod Version 5.0.0 "Winamp Detect" = Detektor Winampa [color=#E56717]========== Last 20 Event Log Errors ==========[/color] [ Application Events ] Error - 2013-03-26 06:29:50 | Computer Name = DTM-Komputer | Source = WinMgmt | ID = 10 Description = Error - 2013-03-26 06:30:28 | Computer Name = DTM-Komputer | Source = WinMgmt | ID = 10 Description = Error - 2013-03-27 07:52:16 | Computer Name = DTM-Komputer | Source = WinMgmt | ID = 10 Description = Error - 2013-03-28 07:41:27 | Computer Name = DTM-Komputer | Source = WinMgmt | ID = 10 Description = Error - 2013-03-28 15:14:35 | Computer Name = DTM-Komputer | Source = WinMgmt | ID = 10 Description = Error - 2013-03-28 15:16:20 | Computer Name = DTM-Komputer | Source = VSS | ID = 8194 Description = Error - 2013-03-28 15:17:23 | Computer Name = DTM-Komputer | Source = WinMgmt | ID = 10 Description = Error - 2013-03-28 18:34:26 | Computer Name = DTM-Komputer | Source = WinMgmt | ID = 10 Description = Error - 2013-03-28 18:51:11 | Computer Name = DTM-Komputer | Source = Application Hang | ID = 1002 Description = Program OTL.exe w wersji 3.2.69.0 zatrzymał interakcję z systemem Windows i został zamknięty. Aby zobaczyć, czy jest dostępnych więcej informacji dotyczących tego problemu, sprawdź historię problemu w panelu sterowania Centrum akcji. Identyfikator procesu: 1b70 Godzina rozpoczęcia: 01ce2c04a69971b4 Godzina zakończenia: 16 Ścieżka aplikacji: E:\User\DTM\Pobrane\OTL.exe Identyfikator raportu: f7a5e900-97f9-11e2-857b-08edb9d9affc Error - 2013-03-28 18:54:27 | Computer Name = DTM-Komputer | Source = Application Hang | ID = 1002 Description = Program OTL.exe w wersji 3.2.69.0 zatrzymał interakcję z systemem Windows i został zamknięty. Aby zobaczyć, czy jest dostępnych więcej informacji dotyczących tego problemu, sprawdź historię problemu w panelu sterowania Centrum akcji. Identyfikator procesu: 17c4 Godzina rozpoczęcia: 01ce2c06f037a599 Godzina zakończenia: 0 Ścieżka aplikacji: E:\User\DTM\Pobrane\OTL.exe Identyfikator raportu: 700a2dd7-97fa-11e2-857b-08edb9d9affc [ System Events ] Error - 2013-02-28 04:57:46 | Computer Name = DTM-Komputer | Source = Service Control Manager | ID = 7006 Description = Wywołanie ScRegSetValueExW dla FailureActions nie powiodło się i wystąpił następujący błąd: %%5. Error - 2013-02-28 04:57:46 | Computer Name = DTM-Komputer | Source = Service Control Manager | ID = 7006 Description = Wywołanie ScRegSetValueExW dla FailureActions nie powiodło się i wystąpił następujący błąd: %%5. Error - 2013-02-28 12:29:29 | Computer Name = DTM-Komputer | Source = volsnap | ID = 393252 Description = Wykonywanie kopii w tle woluminu C: zostało przerwane, ponieważ nie można powiększyć magazynu kopii w tle z powodu limitu wprowadzonego przez użytkownika. Error - 2013-02-28 19:26:54 | Computer Name = DTM-Komputer | Source = Service Control Manager | ID = 7006 Description = Wywołanie ScRegSetValueExW dla FailureActions nie powiodło się i wystąpił następujący błąd: %%5. Error - 2013-03-01 06:59:15 | Computer Name = DTM-Komputer | Source = Service Control Manager | ID = 7006 Description = Wywołanie ScRegSetValueExW dla FailureActions nie powiodło się i wystąpił następujący błąd: %%5. Error - 2013-03-01 06:59:16 | Computer Name = DTM-Komputer | Source = Service Control Manager | ID = 7006 Description = Wywołanie ScRegSetValueExW dla FailureActions nie powiodło się i wystąpił następujący błąd: %%5. Error - 2013-03-01 12:47:33 | Computer Name = DTM-Komputer | Source = volsnap | ID = 393252 Description = Wykonywanie kopii w tle woluminu C: zostało przerwane, ponieważ nie można powiększyć magazynu kopii w tle z powodu limitu wprowadzonego przez użytkownika. Error - 2013-03-01 19:25:43 | Computer Name = DTM-Komputer | Source = Service Control Manager | ID = 7006 Description = Wywołanie ScRegSetValueExW dla FailureActions nie powiodło się i wystąpił następujący błąd: %%5. Error - 2013-03-02 06:19:29 | Computer Name = DTM-Komputer | Source = Service Control Manager | ID = 7006 Description = Wywołanie ScRegSetValueExW dla FailureActions nie powiodło się i wystąpił następujący błąd: %%5. Error - 2013-03-02 06:19:29 | Computer Name = DTM-Komputer | Source = Service Control Manager | ID = 7006 Description = Wywołanie ScRegSetValueExW dla FailureActions nie powiodło się i wystąpił następujący błąd: %%5. < End of report >

**Posty:** 4765 · przez **ordynat** 29 Mar 2013, 01:26

Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej to:

:OTL
O20 - AppInit_DLLs: (c:\progra~3\browse~1\261095~1.52\{c16c1~1\browse~1.dll) - File not found
O4 - HKLM..\Run: [vProt] "C:\Program Files (x86)\AVG Secure Search\vprot.exe" File not found

:Files
C:\Users\DTM\AppData\Roaming\Edg1yFHEEhjE

:Reg
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{2C906940-2DC7-4C13-B2B2-0121BDE26BAB}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"

:Commands
[emptytemp]

Kliknij w Wykonaj Skrypt. Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie.
Następnie uruchom OTL ponownie, tym razem kliknij Skanuj.
Pokaż nowy log OTL.txt oraz raport z usuwania Skryptem.
Nowy log z OTL możesz zrobić skrócony - zaznacz:
Procesy: brak
Moduły: brak,
Usługi: brak
Sterowniki: brak
Rejest skan dodatkowy: brak
Pomiń: pliki Microsoftu
Pomiń: znane dobre pliki
LOP: bez skanowania
.
.

Autor postu otrzymał pochwałę

**Posty:** 6 · przez **DTM** 29 Mar 2013, 01:40

Raport z usuwania skryptem:
03292013_003125:

Kod: Zaznacz wszystko: All processes killed ========== OTL ========== Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\\AppInit_Dlls:c:\progra~3\browse~1\261095~1.52\{c16c1~1\browse~1.dll deleted successfully. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\vProt deleted successfully. ========== FILES ========== C:\Users\DTM\AppData\Roaming\Edg1yFHEEhjE moved successfully. ========== REGISTRY ========== Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{2C906940-2DC7-4C13-B2B2-0121BDE26BAB}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2C906940-2DC7-4C13-B2B2-0121BDE26BAB}\ not found. HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\\"DefaultScope"|"{0633EE93-D776-472f-A0FF-E1416B8B2E3A}" /E : value set successfully! ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: DTM ->Temp folder emptied: 378910664 bytes ->Temporary Internet Files folder emptied: 152621328 bytes ->Java cache emptied: 28454685 bytes ->Google Chrome cache emptied: 269463026 bytes ->Flash cache emptied: 3639 bytes User: Public User: UpdatusUser ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 305232695 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 50534 bytes RecycleBin emptied: 2405949 bytes Total Files Cleaned = 1 084.00 mb OTL by OldTimer - Version 3.2.69.0 log created on 03292013_003125 Files\Folders moved on Reboot... C:\Users\DTM\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. PendingFileRenameOperations files... Registry entries deleted on Reboot...

OTL:

Kod: Zaznacz wszystko: OTL logfile created on: 2013-03-29 00:37:46 - Run 5 OTL by OldTimer - Version 3.2.69.0 Folder = E:\User\DTM\Pobrane 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 7.90 Gb Total Physical Memory | 5.65 Gb Available Physical Memory | 71.44% Memory free 15.81 Gb Paging File | 13.53 Gb Available in Paging File | 85.59% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 29.72 Gb Total Space | 3.07 Gb Free Space | 10.32% Space Free | Partition Type: NTFS Drive D: | 29.24 Gb Total Space | 0.00 Gb Free Space | 0.02% Space Free | Partition Type: FAT32 Drive E: | 390.62 Gb Total Space | 362.14 Gb Free Space | 92.71% Space Free | Partition Type: NTFS Drive F: | 481.20 Gb Total Space | 372.39 Gb Free Space | 77.39% Space Free | Partition Type: NTFS Computer Name: DTM-KOMPUTER | User Name: DTM | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Services (SafeList) ==========[/color] SRV:[b]64bit:[/b] - [2012-02-02 22:29:52 | 000,628,448 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\iCLS Client\HeciServer.exe -- (Intel(R) SRV:[b]64bit:[/b] - [2011-12-08 10:44:04 | 000,594,704 | ---- | M] (Intel® Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe -- (ZeroConfigService) SRV:[b]64bit:[/b] - [2011-12-08 10:43:56 | 000,273,168 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS) SRV:[b]64bit:[/b] - [2011-12-08 10:43:48 | 000,618,256 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng) SRV:[b]64bit:[/b] - [2011-12-08 10:43:44 | 000,148,752 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc) SRV:[b]64bit:[/b] - [2011-12-05 09:30:50 | 000,659,968 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe -- (AMPPALR3) SRV:[b]64bit:[/b] - [2011-12-05 08:55:36 | 000,135,952 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe -- (BTHSSecurityMgr) SRV:[b]64bit:[/b] - [2009-07-14 02:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2013-03-13 19:49:57 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013-02-10 04:25:27 | 001,266,464 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2012-12-18 20:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012-12-10 11:11:44 | 001,342,024 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgfws.exe -- (avgfws) SRV - [2012-12-04 13:19:10 | 000,066,872 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2012-11-15 23:34:30 | 005,814,904 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgidsagent.exe -- (AVGIDSAgent) SRV - [2012-10-22 13:05:08 | 000,196,664 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2013\avgwdsvc.exe -- (avgwd) SRV - [2012-03-02 22:48:54 | 000,276,248 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Windows\SysWOW64\IntelCpHeciSvc.exe -- (cphs) SRV - [2012-02-28 10:20:02 | 000,363,800 | R--- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) SRV - [2012-02-28 10:19:56 | 000,277,784 | R--- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) SRV - [2012-02-28 10:19:46 | 000,161,560 | R--- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe -- (jhi_service) SRV - [2011-11-30 16:18:02 | 000,514,048 | ---- | M] (Red Bend Ltd.) [Auto | Running] -- E:\Program Files\Intel\WiMAX\Bin\DMAgent.exe -- (DMAgent) SRV - [2011-11-30 16:12:00 | 000,979,456 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- E:\Program Files\Intel\WiMAX\Bin\AppSrv.exe -- (WiMAXAppSrv) SRV - [2010-03-18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009-06-10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) [color=#E56717]========== Standard Registry (All) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\System32\blank.htm IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE:[b]64bit:[/b] - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com IE - HKCU\..\URLSearchHook: {CFBFAE00-17A6-11D0-99CB-00C04FD64497} - C:\Windows\SysWOW64\ieframe.dll (Microsoft Corporation) IE - HKCU\..\SearchScopes,DefaultScope = IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation) FF - HKLM\Software\MozillaPlugins\@intel-webapi.intel.com/Intel WebAPI updater: C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.13.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.13.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: E:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) [2013-02-22 20:59:33 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions [color=#E56717]========== Chrome ==========[/color] CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&q={searchTerms}&{google:cursorPosition}sugkey={google:suggestAPIKeyParameter} CHR - plugin: Shockwave Flash (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\PepperFlash\pepflashplayer.dll CHR - plugin: Chrome Remote Desktop Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Program Files (x86)\Google\Chrome\Application\25.0.1364.172\pdf.dll CHR - plugin: Adobe Acrobat (Enabled) = E:\Program Files (x86)\Adobe\Reader 11.0\Reader\Browser\nppdf32.dll CHR - plugin: Google Update (Enabled) = C:\Program Files (x86)\Google\Update\1.3.21.135\npGoogleUpdate3.dll CHR - plugin: Intel\u00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll CHR - plugin: Intel\u00AE Identity Protection Technology (Enabled) = C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll CHR - plugin: Java(TM) Platform SE 7 U13 (Enabled) = C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll CHR - plugin: Java Deployment Toolkit 7.0.130.20 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll CHR - Extension: FreeOnlineRadioPlayerRecorder V1 = C:\Users\DTM\AppData\Local\Google\Chrome\User Data\Default\Extensions\aicancafipiklohohmoognddncljhkio\10.15.0.562_0\ O1 HOSTS File: ([2009-06-10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (FlashGetBHO) - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Users\DTM\AppData\Roaming\FlashGetBHO\FlashGetBHO.dll (Trend Media Group) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [Energy Management] C:\Program Files (x86)\Lenovo\Energy Management\Energy Management.exe (Lenovo (Beijing) Limited) O4:[b]64bit:[/b] - HKLM..\Run: [EnergyUtility] C:\Program Files (x86)\Lenovo\Energy Management\Utility.exe (Lenovo(beijing) Limited) O4:[b]64bit:[/b] - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [IntelWirelessWiMAX] E:\Program Files\Intel\WiMAX\Bin\WiMAXCU.exe (Intel® Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [OnekeyStudio] C:\Program Files (x86)\Lenovo\Onekey Theater\OnekeyStudio.exe (Lenovo) O4:[b]64bit:[/b] - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [RtHDVBg_Dolby] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor) O4:[b]64bit:[/b] - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4:[b]64bit:[/b] - HKLM..\Run: [SynLenovoGestureMgr] C:\Program Files\Synaptics\SynTP\SynLenovoGestureMgr.exe (Synaptics) O4:[b]64bit:[/b] - HKLM..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe (Synaptics Incorporated) O4 - HKLM..\Run: [Adobe ARM] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [AVG_UI] C:\Program Files (x86)\AVG\AVG2013\avgui.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.) O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: ForceActiveDesktopOn = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17 O8:[b]64bit:[/b] - Extra context menu item: Download all links by FlashGet3 - E:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgetallurl.htm () O8:[b]64bit:[/b] - Extra context menu item: Download all videos by FlashGet3 - E:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgetallflvurl.htm () O8:[b]64bit:[/b] - Extra context menu item: Download by FlashGet3 - E:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgeturl.htm () O8:[b]64bit:[/b] - Extra context menu item: Download current video by FlashGet3 - E:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgetflvurl.htm () O8:[b]64bit:[/b] - Extra context menu item: E&ksport do programu Microsoft Excel - E:\Program Files (x86)\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Download all links by FlashGet3 - E:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgetallurl.htm () O8 - Extra context menu item: Download all videos by FlashGet3 - E:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgetallflvurl.htm () O8 - Extra context menu item: Download by FlashGet3 - E:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgeturl.htm () O8 - Extra context menu item: Download current video by FlashGet3 - E:\Program Files (x86)\FlashGet Network\FlashGet 3\BHO\fdgetflvurl.htm () O8 - Extra context menu item: E&ksport do programu Microsoft Excel - E:\Program Files (x86)\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\Program Files (x86)\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000001 [] - C:\Windows\SysNative\nlaapi.dll (Microsoft Corporation) O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000002 [] - C:\Windows\SysNative\NapiNSP.dll (Microsoft Corporation) O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000003 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation) O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000004 [] - C:\Windows\SysNative\pnrpnsp.dll (Microsoft Corporation) O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Windows\SysNative\winrnr.dll (Microsoft Corporation) O10:[b]64bit:[/b] - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Windows\SysNative\wshbth.dll (Microsoft Corporation) O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000001 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000002 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000003 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000004 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000005 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000006 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000007 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000008 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000009 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000010 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10:[b]64bit:[/b] - Protocol_Catalog9\Catalog_Entries64\000000000011 - C:\Windows\SysNative\mswsock.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\SysWOW64\nlaapi.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\SysWOW64\NapiNSP.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\SysWOW64\pnrpnsp.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Windows\SysWOW64\winrnr.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Windows\SysWOW64\wshbth.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000009 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000010 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\Windows\SysWOW64\mswsock.dll (Microsoft Corporation) O13[b]64bit:[/b] - gopher Prefix: missing O13 - gopher Prefix: missing O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 8.8.8.8 8.8.4.4 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{82D380C9-DBC3-4965-991C-F61FC55D16AC}: DhcpNameServer = 192.168.1.254 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A4249BE5-607B-4842-A0EE-24E460736AB8}: DhcpNameServer = 8.8.8.8 8.8.4.4 O18:[b]64bit:[/b] - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Handler\http\0x00000001 - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\http\oledb - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Handler\https\0x00000001 - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\https\oledb - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysNative\inetcomm.dll (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysNative\urlmon.dll (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Handler\msdaipp - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\msdaipp\oledb - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysNative\itss.dll (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Handler\mso-offdap11 - No CLSID value found O18:[b]64bit:[/b] - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysNative\MSVidCtl.dll (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysNative\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\about {3050F406-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\cdl {3dd53d40-7b8b-11D0-b013-00aa0059ce02} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\dvd {12D51199-0DB5-46FE-A120-47A3D7D937CC} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation) O18 - Protocol\Handler\file {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\ftp {79eac9e3-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\http {79eac9e2-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https {79eac9e5-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\javascript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\local {79eac9e7-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\mailto {3050f3DA-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\mhtml {05300401-BCBC-11d0-85E3-00C04FD85AB4} - C:\Windows\SysWOW64\inetcomm.dll (Microsoft Corporation) O18 - Protocol\Handler\mk {79eac9e6-baf9-11ce-8c82-00aa004ba90b} - C:\Windows\SysWOW64\urlmon.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-its {9D148291-B9C8-11D0-A4CC-0000F80149F6} - C:\Windows\SysWOW64\itss.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\PROGRA~2\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\res {3050F3BC-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation) O18 - Protocol\Handler\tv {CBD30858-AF45-11D2-B6D6-00C04FBBDE6E} - C:\Windows\SysWOW64\MSVidCtl.dll (Microsoft Corporation) O18 - Protocol\Handler\vbscript {3050F3B2-98B5-11CF-BB82-00AA00BDCE0B} - C:\Windows\SysWOW64\mshtml.dll (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysNative\mscoree.dll (Microsoft Corporation) O18:[b]64bit:[/b] - Protocol\Filter\text/xml - No CLSID value found O18 - Protocol\Filter\application/octet-stream {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-complus {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\application/x-msdownload {1E66F26B-79EE-11D2-8710-00C04F79ED0D} - C:\Windows\SysWow64\mscoree.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20:[b]64bit:[/b] - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation) O20 - AppInit_DLLs: (c:\windows\syswow64\nvinit.dll) - c:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysWow64\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:[b]64bit:[/b] - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O29:[b]64bit:[/b] - HKLM SecurityProviders - (credssp.dll) - C:\Windows\SysWow64\credssp.dll (Microsoft Corporation) O29 - HKLM SecurityProviders - (credssp.dll) - C:\Windows\SysWow64\credssp.dll (Microsoft Corporation) O30:[b]64bit:[/b] - LSA: Authentication Packages - (msv1_0) - C:\Windows\SysNative\msv1_0.dll (Microsoft Corporation) O30 - LSA: Authentication Packages - (msv1_0) - C:\Windows\SysWow64\msv1_0.dll (Microsoft Corporation) O30:[b]64bit:[/b] - LSA: Security Packages - (kerberos) - C:\Windows\SysNative\kerberos.dll (Microsoft Corporation) O30:[b]64bit:[/b] - LSA: Security Packages - (msv1_0) - C:\Windows\SysNative\msv1_0.dll (Microsoft Corporation) O30:[b]64bit:[/b] - LSA: Security Packages - (schannel) - C:\Windows\SysNative\schannel.dll (Microsoft Corporation) O30:[b]64bit:[/b] - LSA: Security Packages - (wdigest) - C:\Windows\SysNative\wdigest.dll (Microsoft Corporation) O30:[b]64bit:[/b] - LSA: Security Packages - (tspkg) - C:\Windows\SysNative\tspkg.dll (Microsoft Corporation) O30:[b]64bit:[/b] - LSA: Security Packages - (pku2u) - C:\Windows\SysNative\pku2u.dll (Microsoft Corporation) O30 - LSA: Security Packages - (kerberos) - C:\Windows\SysWow64\kerberos.dll (Microsoft Corporation) O30 - LSA: Security Packages - (msv1_0) - C:\Windows\SysWow64\msv1_0.dll (Microsoft Corporation) O30 - LSA: Security Packages - (schannel) - C:\Windows\SysWow64\schannel.dll (Microsoft Corporation) O30 - LSA: Security Packages - (wdigest) - C:\Windows\SysWow64\wdigest.dll (Microsoft Corporation) O30 - LSA: Security Packages - (tspkg) - C:\Windows\SysWow64\tspkg.dll (Microsoft Corporation) O30 - LSA: Security Packages - (pku2u) - C:\Windows\SysWow64\pku2u.dll (Microsoft Corporation) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %* O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2013-03-28 22:56:12 | 000,000,000 | ---D | C] -- E:\User\DTM\Desktop\Gmail [2013-03-28 20:16:24 | 000,564,824 | ---- | C] (Duplex Secure Ltd.) -- C:\Windows\SysNative\drivers\sptd.sys [2013-03-25 14:51:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Office [2013-03-18 12:10:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight [2013-03-18 12:10:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight [2013-03-13 20:49:32 | 000,000,000 | ---D | C] -- E:\User\DTM\Desktop\Nagrania [2013-03-10 14:02:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts [2013-03-10 14:00:41 | 000,000,000 | -H-D | C] -- C:\Program Files (x86)\Common Files\EAInstaller [2013-03-08 11:50:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG [2013-03-03 21:11:46 | 000,000,000 | ---D | C] -- E:\User\DTM\Moje dokumenty\Criterion Games [2013-03-03 21:07:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Need For Speed Most Wanted [2013-02-27 17:13:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Euro Truck Simulator 2 [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2013-03-29 00:33:06 | 000,001,038 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2013-03-29 00:32:56 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2013-03-29 00:32:54 | 2070,691,839 | -HS- | M] () -- C:\hiberfil.sys [2013-03-29 00:10:00 | 000,000,930 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2013-03-29 00:00:00 | 000,001,042 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2013-03-28 23:41:30 | 000,021,296 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2013-03-28 23:41:30 | 000,021,296 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2013-03-28 23:38:30 | 001,663,412 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2013-03-28 23:38:30 | 000,738,192 | ---- | M] () -- C:\Windows\SysNative\perfh015.dat [2013-03-28 23:38:30 | 000,652,360 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2013-03-28 23:38:30 | 000,154,848 | ---- | M] () -- C:\Windows\SysNative\perfc015.dat [2013-03-28 23:38:30 | 000,121,292 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2013-03-28 23:33:05 | 000,000,166 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat [2013-03-28 20:16:24 | 000,564,824 | ---- | M] (Duplex Secure Ltd.) -- C:\Windows\SysNative\drivers\sptd.sys [2013-03-27 15:27:06 | 003,188,537 | ---- | M] () -- E:\User\DTM\Desktop\vBulletin_3.8.5.rar [2013-03-27 00:35:49 | 000,007,602 | ---- | M] () -- C:\Users\DTM\AppData\Local\Resmon.ResmonCfg [2013-03-25 21:13:38 | 001,724,303 | ---- | M] () -- E:\User\DTM\Desktop\tablice_matematyczne.pdf [2013-03-21 15:32:26 | 000,000,817 | ---- | M] () -- E:\User\DTM\Desktop\HD Tune.lnk [2013-03-19 11:07:31 | 000,293,744 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2013-03-13 20:53:14 | 000,000,818 | ---- | M] () -- C:\Users\Public\Desktop\Need For Speed Most Wanted.lnk [2013-03-13 19:49:56 | 000,693,976 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2013-03-13 19:49:56 | 000,073,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2013-03-08 11:50:18 | 000,000,995 | ---- | M] () -- C:\Users\Public\Desktop\AVG 2013.lnk [2013-02-27 21:06:48 | 000,000,893 | ---- | M] () -- C:\Users\Public\Desktop\Euro Truck Simulator 2.lnk [color=#E56717]========== Files Created - No Company Name ==========[/color] [2013-03-28 23:32:57 | 000,000,166 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat [2013-03-27 15:26:34 | 003,188,537 | ---- | C] () -- E:\User\DTM\Desktop\vBulletin_3.8.5.rar [2013-03-27 00:35:49 | 000,007,602 | ---- | C] () -- C:\Users\DTM\AppData\Local\Resmon.ResmonCfg [2013-03-25 21:13:37 | 001,724,303 | ---- | C] () -- E:\User\DTM\Desktop\tablice_matematyczne.pdf [2013-03-21 15:31:43 | 000,000,817 | ---- | C] () -- E:\User\DTM\Desktop\HD Tune.lnk [2013-03-03 21:07:58 | 000,000,818 | ---- | C] () -- C:\Users\Public\Desktop\Need For Speed Most Wanted.lnk [2013-02-27 17:13:05 | 000,000,893 | ---- | C] () -- C:\Users\Public\Desktop\Euro Truck Simulator 2.lnk [2013-02-23 17:02:22 | 001,638,822 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2013-02-22 21:01:16 | 000,049,152 | ---- | C] () -- C:\Windows\SysWow64\OctaneARM.dll [2013-02-18 18:51:37 | 000,165,376 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll [2013-02-12 11:47:40 | 000,007,168 | ---- | C] () -- C:\Users\DTM\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2013-01-25 22:01:30 | 000,000,305 | ---- | C] () -- C:\Windows\SysWow64\secushr.dat [2013-01-25 21:26:32 | 000,000,025 | ---- | C] () -- C:\Windows\emcore.INI [2013-01-19 15:25:32 | 000,000,412 | ---- | C] () -- C:\Windows\ODBC.INI [2013-01-18 20:20:56 | 000,000,444 | ---- | C] () -- C:\Windows\QIII.INI [2012-12-05 13:57:49 | 000,000,248 | ---- | C] () -- C:\Windows\SysWow64\secustat.dat [2012-12-05 13:13:03 | 000,000,025 | ---- | C] () -- C:\Windows\libem.INI [2012-12-04 13:19:10 | 000,669,184 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe [2012-12-03 16:49:46 | 000,103,736 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2012-12-03 16:49:46 | 000,066,872 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2012-12-01 14:36:22 | 000,000,000 | ---- | C] () -- C:\Windows\Bench32_2.47(dobreprogramy.pl).INI [2012-11-29 19:11:18 | 013,020,160 | ---- | C] () -- C:\Windows\SysWow64\ig7icd32.dll [2012-11-29 19:11:18 | 000,735,796 | ---- | C] () -- C:\Windows\SysWow64\igkrng700.bin [2012-11-29 19:11:18 | 000,561,508 | ---- | C] () -- C:\Windows\SysWow64\igfcg700m.bin [2012-11-29 19:11:18 | 000,058,880 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll [2012-02-02 22:08:26 | 000,001,536 | ---- | C] () -- C:\Windows\SysWow64\IusEventLog.dll [color=#E56717]========== ZeroAccess Check ==========[/color] [2009-07-14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2012-06-09 06:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012-06-09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009-07-14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010-11-21 04:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009-07-14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] [color=#E56717]========== LOP Check ==========[/color] [2012-12-11 13:09:42 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\.wtw [2012-11-30 13:14:08 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\AVG2013 [2013-03-28 18:44:02 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\BITS [2013-02-25 14:54:22 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\Cool Record Edit Pro [2012-12-24 12:40:39 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\CornerBowl [2013-03-09 22:59:50 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\FileZilla [2013-01-25 21:25:59 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\FlashGet [2013-01-25 21:26:03 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\FlashGetBHO [2013-01-14 17:18:26 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\FlashgetSetup [2013-02-25 14:49:33 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\Free Sound Recorder [2013-03-27 23:25:41 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\ipla [2013-01-17 09:16:24 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\JAM Software [2013-01-29 15:56:19 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\PhotoFiltre 7 [2013-02-24 19:00:52 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\Publish Providers [2013-02-24 19:44:39 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\Sony [2013-02-24 22:34:10 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\Sony Creative Software Inc [2013-03-25 23:52:14 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\TS3Client [2012-11-30 13:07:59 | 000,000,000 | ---D | M] -- C:\Users\DTM\AppData\Roaming\TuneUp Software [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:0E08FC17 < End of report >

**Posty:** 4765 · przez **ordynat** 29 Mar 2013, 01:47

Jest OK.
W Adw-Cleaner kliknij na przycisk Odinstaluj
W OTL kliknij na przycisk Sprzątanie - to go usunie razem z jego Kwarantanną.
.

Autor postu otrzymał pochwałę

**Posty:** 6 · przez **DTM** 29 Mar 2013, 01:50

ok dzięki kolego bardzo mi pomogłeś

Pozdrawiam

**Posty:** 1 · przez **bilah** 09 Lip 2015, 10:21

Również prosze o pomoc w tym temacie, nie mogę sobie poradzić z wyskakującymi kartami

Windows 7 64bit
przeglądarka chrome

Logi OTL w załączeniu

**Posty:** 4765 · przez **ordynat** 09 Lip 2015, 10:35

@bilah
załóż swój własny temat
Użyj Adw-Cleaner http://www.programosy.pl/program,adwcleaner.html
najpierw kliknij na SZUKAJ (SCAN), a dopiero po zakończeniu skanowania, gdy uaktywni się przycisk USUŃ (CLEANING), to kliknij na niego.
Pokaż raport z niego C:\AdwCleaner\AdwCleaner[S].txt

Zrób logi z FRST > http://forum.programosy.pl/frst-otl-zoek-vt139692.html
Przed skanem zaznacz "Additional" oraz "Shortcut"
.

Kto jest na forum