Zamula od jakiegoś czasu prosze o sprawdzenie

**Posty:** 21 · przez **Mentoll** 28 Sty 2010, 20:23

Witam.. Od jakiegoś czasu komputer zaczal mi zamulać, tracil polaczenie z internetem itp...

Bardzo proszę o sprawdzenie loga.. Dzieki

)

OTL Plik Extras

Kod: Zaznacz wszystko: OTL Extras logfile created on: 2010-01-28 19:21:19 - Run 1 OTL by OldTimer - Version 3.1.27.0 Folder = C:\Documents and Settings\Marcin\Pulpit Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 3,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 82,00% Memory free 5,00 Gb Paging File | 5,00 Gb Available in Paging File | 91,00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 48,82 Gb Total Space | 23,57 Gb Free Space | 48,27% Space Free | Partition Type: NTFS Drive D: | 195,31 Gb Total Space | 113,17 Gb Free Space | 57,94% Space Free | Partition Type: NTFS Drive E: | 221,61 Gb Total Space | 128,85 Gb Free Space | 58,14% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: MX8PC Current User Name: Marcin Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: On Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation) .inf [@ = inffile] -- C:\WINDOWS\System32\NOTEPAD.EXE () .ini [@ = inifile] -- C:\WINDOWS\System32\NOTEPAD.EXE () .txt [@ = txtfile] -- C:\WINDOWS\System32\NOTEPAD.EXE () [HKEY_USERS\S-1-5-21-776561741-1214440339-1801674531-1004\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 () batfile [open] -- "%1" %* batfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 () cmdfile [edit] -- %SystemRoot%\System32\NOTEPAD.EXE %1 () cmdfile [open] -- "%1" %* cmdfile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 () comfile [open] -- "%1" %* exefile [open] -- "%1" %* htmlfile [edit] -- Reg Error: Key error. htmlfile [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation) http [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome (Microsoft Corporation) https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" -nohome (Microsoft Corporation) inffile [open] -- %SystemRoot%\System32\NOTEPAD.EXE %1 () inffile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 () inifile [open] -- %SystemRoot%\System32\NOTEPAD.EXE %1 () inifile [print] -- %SystemRoot%\System32\NOTEPAD.EXE /p %1 () jsfile [edit] -- %SystemRoot%\System32\Notepad.exe %1 () jsfile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 () jsefile [edit] -- %SystemRoot%\System32\Notepad.exe %1 () jsefile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 () piffile [open] -- "%1" %* regfile [edit] -- %SystemRoot%\system32\NOTEPAD.EXE %1 () regfile [merge] -- Reg Error: Key error. regfile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 () scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation) scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. txtfile [open] -- %SystemRoot%\system32\NOTEPAD.EXE %1 () txtfile [print] -- %SystemRoot%\system32\NOTEPAD.EXE /p %1 () txtfile [printto] -- %SystemRoot%\system32\notepad.exe /pt "%1" "%2" "%3" "%4" () vbefile [edit] -- %SystemRoot%\System32\Notepad.exe %1 () vbefile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 () vbsfile [edit] -- %SystemRoot%\System32\Notepad.exe %1 () vbsfile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 () wsffile [edit] -- %SystemRoot%\System32\Notepad.exe %1 () wsffile [print] -- %SystemRoot%\System32\Notepad.exe /p %1 () Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /k cd "%L" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [Winamp.Bookmark] -- "D:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft) Directory [Winamp.Enqueue] -- "D:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft) Directory [Winamp.Play] -- "D:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "%programfiles%\internet explorer\iexplore.exe" (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirewallDisableNotify" = 0 "AntiVirusDisableNotify" = 0 "UpdatesDisableNotify" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DoNotAllowExceptions" = 0 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008 "139:TCP" = 139:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22002 "21197:TCP" = 21197:TCP:*:Enabled:BitComet 21197 TCP "21197:UDP" = 21197:UDP:*:Enabled:BitComet 21197 UDP [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "D:\Program Files\Nowe Gadu-Gadu\gg.exe" = D:\Program Files\Nowe Gadu-Gadu\gg.exe:*:Enabled:Nowe Gadu-Gadu -- (GG Network S.A.) "D:\Program Files\Steam\steamapps\mentoll240\counter-strike\hl.exe" = D:\Program Files\Steam\steamapps\mentoll240\counter-strike\hl.exe:*:Enabled:Half-Life Launcher -- (Valve) "E:\OFP Dragon Rising\OFDR.exe" = E:\OFP Dragon Rising\OFDR.exe:*:Enabled:OF Dragon Rising -- (Codemasters Software Company Limited) "C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation) "E:\Counter-Strike NS\hl.exe" = E:\Counter-Strike NS\hl.exe:*:Enabled:Half-Life Launcher -- (Valve) "E:\Grand Theft Auto 4\Rockstar Games Social Club\RGSCLauncher.exe" = E:\Grand Theft Auto 4\Rockstar Games Social Club\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club -- (Take-Two Interactive Software, Inc.) "E:\Grand Theft Auto 4\Grand Theft Auto IV\LaunchGTAIV.exe" = E:\Grand Theft Auto 4\Grand Theft Auto IV\LaunchGTAIV.exe:*:Enabled:Grand Theft Auto IV -- (Sony DADC Austria AG) "E:\Grand Theft Auto 4\Grand Theft Auto IV\GTAIV.exe" = E:\Grand Theft Auto 4\Grand Theft Auto IV\GTAIV.exe:*:Enabled:Grand Theft Auto IV -- (Take-Two Interactive Software, Inc.) "C:\Program Files\Skype\Plugin Manager\skypePM.exe" = C:\Program Files\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager -- (Skype Technologies) "C:\Program Files\Livebox\Connectivity\ConnectivityManager.exe" = C:\Program Files\Livebox\Connectivity\ConnectivityManager.exe:*:enabled:CSS -- (France Telecom SA) "E:\Settlers VI\base\bin\Settlers6.exe" = E:\Settlers VI\base\bin\Settlers6.exe:*:Enabled:THE SETTLERS - Narodziny Imperium -- (Blue Byte GmbH) "D:\Program Files\uTorrent.exe" = D:\Program Files\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.) "E:\Dragon Age - Origins\bin_ship\daorigins.exe" = E:\Dragon Age - Origins\bin_ship\daorigins.exe:*:Enabled:Dragon Age: Origins -- (BioWare) "E:\Prototype\prototypef.exe" = E:\Prototype\prototypef.exe:*:Enabled:Prototype(TM) -- (Activision) "C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype -- (Skype Technologies S.A.) [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0323C306-8B8C-BB5F-E644-5BFE9A42A7BF}" = Catalyst Control Center Localization Hungarian "{0397B1DD-1474-40AE-9A20-6EB5BB999E8B}" = Areo Kalkulator "{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam "{054CCA19-DADE-A3C9-171A-8735E23CA6FA}" = Catalyst Control Center Localization Italian "{055EE59D-217B-43A7-ABFF-507B966405D8}" = ATI Catalyst Control Center "{07300F01-89CA-4CF8-92BD-2A605EB83C95}" = EasySaver B9.0205.1 "{08B21B7E-DC6F-69F0-780F-FE7918726A34}" = Catalyst Control Center Localization Korean "{08B3869E-D282-424C-9AFC-870E04A4BA14}" = Rockstar Games Social Club "{106E35DE-FFF3-033A-0D1B-288A231BDE64}" = Catalyst Control Center Localization Russian "{193DDD97-B56A-511D-0CD6-78D5F421D5BD}" = Catalyst Control Center HydraVision Full "{19CA0312-BD69-A0DE-D242-BD806E9D627A}" = CCC Help Dutch "{1A4052AB-BA77-44F7-8EE7-9F9131BFD7A6}" = OF Dragon Rising "{1A8F390D-E05E-A124-3FB7-89E3E49F81E2}" = CCC Help Polish "{1B4FC4DB-4ACD-77A1-BA99-C820E5CB68BC}" = CCC Help Chinese Standard "{26A24AE4-039D-4CA4-87B4-2F83216014FF}" = Java(TM) 6 Update 14 "{2BE013D0-4CF4-AA57-05E1-19F9FACCF622}" = CCC Help English "{2E660A2A-A55F-43CD-9F73-CAD7382EEB78}" = Microsoft Games for Windows - LIVE Redistributable "{2ED57AFF-081D-3B60-0C76-E51F68A9F0D8}" = Catalyst Control Center Localization Polish "{336D9EAB-B952-6023-C94C-8DE52AD75E7D}" = Catalyst Control Center Localization German "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{36753DE9-4B0F-1C39-D2C6-D9E9A1814FC3}" = CCC Help Hungarian "{36CDA33B-909B-4719-97D1-C4B99309BDC7}" = ATI Parental Control & Encoder "{3F3733A5-8322-454D-A638-3B74E1C83752}" = Gadget Installer "{4891561F-8CE7-1162-5967-E741306F7616}" = CCC Help Italian "{4AE31F12-E34D-83C1-BA1A-D65AF3BBB95F}" = Catalyst Control Center Localization Spanish "{4AE3A0CB-87B0-4F51-BECD-3D1F8DFDD62F}" = SAGEM F@st 800-840 "{4C8E4664-A6A1-4847-61D0-D4FA02C42BB0}" = Skins "{4CACC1AC-7EDF-4E73-0019-A446CE2CA02B}" = Catalyst Control Center Localization Chinese Standard "{4F28C8B9-E1A5-7BC1-915A-29913E129042}" = Catalyst Control Center Localization Japanese "{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features "{579BA58C-F33D-4970-9953-B94B43768AC3}" = Grand Theft Auto IV "{57B2B2E4-A1D5-1097-C223-6A4E81554458}" = Catalyst Control Center Localization Danish "{5BE36E29-4207-2D14-1413-DF103390CC19}" = CCC Help French "{5D2B8C32-D051-0DB0-D8BD-5CA32E13723B}" = CCC Help Swedish "{5E85647B-DAF4-E174-9954-210D18B123E6}" = Catalyst Control Center Localization Thai "{63CA4C0D-7C03-69FE-AE5D-96319AD6AA08}" = CCC Help Norwegian "{667B8F35-6242-50D3-D69E-69D3BE5445D5}" = Catalyst Control Center Localization Finnish "{6A6818AD-60CE-9346-60BB-0717876E40F4}" = ccc-core-preinstall "{6C188171-FF2C-48DA-8178-8F4DC091032B}_is1" = Dragon Age - Origins "{6CDC748B-47B0-45EB-B740-681E8429F7F9}" = Opera 10.01 "{6DAC0917-50F5-7F70-9776-4215DA7E2D1B}" = CCC Help German "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{76E3C633-BC8E-E33D-8774-4A3DF581C8FE}" = CCC Help Portuguese "{788F45B5-816D-2294-33DD-BF080093D54D}" = Catalyst Control Center Graphics Previews Common "{789289CA-F73A-4A16-A331-54D498CE069F}" = Ventrilo "{79A636B4-3FA8-1E2F-A85D-6B6A4A0DA43D}" = CCC Help Russian "{7A14BF33-11BF-033B-02CC-732A30C09314}" = Catalyst Control Center Localization Greek "{7C7575F4-351D-8F62-5693-61D6E0171F85}" = CCC Help Korean "{82D1C246-2D78-5311-8D3F-8214B94EEFA4}" = CCC Help Turkish "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{85B4D6CC-ADF6-A78F-1463-F70C2E274849}" = CCC Help Finnish "{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}" = ATI AVIVO Codecs "{8A183127-7EDB-B2DD-7D87-70FBFA3A33C1}" = Catalyst Control Center Localization Portuguese "{8B35E3B4-0E9B-ED12-F102-EB8160DD1F46}" = Catalyst Control Center Localization Swedish "{8FD6CA17-DB2B-9411-CEF5-B899DCBAB685}" = CCC Help Danish "{90120000-008A-0409-0000-0000000FF1CE}" = Microsoft Office 2007 Recent Documents Gadget "{90D73DED-670E-BE24-C645-C4D546A1F2C3}" = CCC Help Spanish "{9210C991-FE28-2B30-3E27-0F921AB5B9EC}" = Catalyst Control Center Localization Chinese Traditional "{926D18B2-11B5-7210-621A-5231DC005705}" = CCC Help Czech "{9322A850-9091-4D0E-B252-3E82EDA3D94A}" = Prototype(TM) "{9B0CCE51-B328-D4F7-C4A4-65723AF20574}" = Catalyst Control Center Core Implementation "{A13C84F5-B2FC-823B-ADB2-6F5B2A6EE9DE}" = ccc-utility "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2 "{A45F3795-1527-47FA-BE1A-2DD242B439E5}_is1" = Need for Speed - Shift "{B70E4F29-F9C9-4D32-80F3-6E24ED1DBCDF}" = Catalyst Control Center Localization Norwegian "{B9C149DB-E4F6-573A-DF3B-B9E392F1BA64}" = CCC Help Thai "{BB05D173-9681-4812-A7FA-BD4042A3DA00}" = Alky for Applications (Windows XP) "{BDC209E0-8D38-F913-5246-4376FC4C3EF5}" = Catalyst Control Center Localization French "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2 "{C151CE54-E7EA-4804-854B-F515368B0798}" = AMD Processor Driver "{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}" = NVIDIA PhysX "{C73B3D3A-2FDC-EE8F-F0E5-0269A85014D3}" = Catalyst Control Center Graphics Light "{C8838D06-D7DB-4CB0-BF13-7191D2D84C42}" = Gadget Extractor "{C8C08FE3-05DC-7A8B-C23B-9276FFE21183}" = Catalyst Control Center Localization Dutch "{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{D00A7B31-C764-94AF-7915-87676458CC66}" = Catalyst Control Center Localization Turkish "{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.1 "{D3B1C799-CB73-42DE-BA0F-2344793A095C}" = Catalyst Control Center - Branding "{D3F80A98-05AB-4D8C-9272-766CCFA6A48D}" = THE SETTLERS - Narodziny Imperium "{D4B95A0D-CF13-633F-09A6-15D78B24F3AE}" = CCC Help Chinese Traditional "{D9509DDD-74B4-A7CB-3669-7358BEE3C1AC}" = ccc-core-static "{E46B244B-9BF2-EA75-2D4C-7BD0BA12860A}" = CCC Help Japanese "{EA5C28E2-3048-5BC5-67C4-E0BB33C60FDA}" = Catalyst Control Center Localization Czech "{ECA89BA0-1C9B-237D-F59E-EC62534831A5}" = Catalyst Control Center Graphics Full New "{ECB29C3B-4D64-17C0-430D-DEB933D76834}" = CCC Help Greek "{ED862528-0058-F09F-F4B3-3E3276A3F3C7}" = Catalyst Control Center Graphics Full Existing "{F112F66E-25CA-42DD-983C-6118EB38F606}" = Microsoft Games for Windows - LIVE "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{ORAHSS}.UninstallSuite" = Livebox "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe Shockwave Player" = Adobe Shockwave Player 11.5 "All ATI Software" = Narzędzie Software Uninstall Utility firmy ATI "Ashampoo Burning Studio 2010_is1" = Ashampoo Burning Studio 2010 "ATI Display Driver" = ATI Display Driver "AutoConnect" = AutoConnect v0.1.3.1 "DAEMON Tools Toolbar" = DAEMON Tools Toolbar "Divinity II - Ego Draconis_is1" = Divinity II - Ego Draconis "ESET Online Scanner" = ESET Online Scanner v3 "Foxit Reader" = Foxit Reader "InstallShield_{9322A850-9091-4D0E-B252-3E82EDA3D94A}" = Prototype(TM) "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Mozilla Firefox (3.0.17)" = Mozilla Firefox (3.0.17) "My Free Mahjong_is1" = My Free Mahjong "NAPIPROJEKT_is1" = NAPIPROJEKT 1.0.6.2 "NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs "Nowe Gadu-Gadu" = Nowe Gadu-Gadu "PowerMenu" = PowerMenu 1.51 "PySol version 4.20_is1" = PySol version 4.20 "RealAlt_is1" = Real Alternative 1.9.0 Lite "ShockwaveFlash" = Adobe Flash Player 9 ActiveX "SubEdit-Player_is1" = SubEdit-Player "Tibia_is1" = Tibia "TMIPC" = Tibia MULTI-ip changer "UltraISO_is1" = UltraISO Premium V9.35 "uTorrent" = µTorrent "Winamp" = Winamp "Windows Media Format Runtime" = Windows Media Format 11 runtime "Windows Sidebar" = Windows Sidebar "WinRAR archiver" = Archiwizator WinRAR "WMFDist11" = Windows Media Format 11 runtime [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-21-776561741-1214440339-1801674531-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Winamp Detect" = Detektor Winampa [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Application Events ] Error - 2010-01-28 13:56:05 | Computer Name = MX8PC | Source = Userenv | ID = 1041 Description = System Windows nie może wykonać kwerendy wpisu rejestru DllName dla aplikacji {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}, która nie zostanie załadowana. Prawdopodobną przyczyną jest błąd rejestracji. Error - 2010-01-28 13:56:06 | Computer Name = MX8PC | Source = Userenv | ID = 1041 Description = System Windows nie może wykonać kwerendy wpisu rejestru DllName dla aplikacji {7B849a69-220F-451E-B3FE-2CB811AF94AE}, która nie zostanie załadowana. Prawdopodobną przyczyną jest błąd rejestracji. Error - 2010-01-28 13:56:06 | Computer Name = MX8PC | Source = Userenv | ID = 1041 Description = System Windows nie może wykonać kwerendy wpisu rejestru DllName dla aplikacji {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}, która nie zostanie załadowana. Prawdopodobną przyczyną jest błąd rejestracji. Error - 2010-01-28 14:05:03 | Computer Name = MX8PC | Source = Userenv | ID = 1041 Description = System Windows nie może wykonać kwerendy wpisu rejestru DllName dla aplikacji {7B849a69-220F-451E-B3FE-2CB811AF94AE}, która nie zostanie załadowana. Prawdopodobną przyczyną jest błąd rejestracji. Error - 2010-01-28 14:05:03 | Computer Name = MX8PC | Source = Userenv | ID = 1041 Description = System Windows nie może wykonać kwerendy wpisu rejestru DllName dla aplikacji {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}, która nie zostanie załadowana. Prawdopodobną przyczyną jest błąd rejestracji. Error - 2010-01-28 14:05:04 | Computer Name = MX8PC | Source = Userenv | ID = 1041 Description = System Windows nie może wykonać kwerendy wpisu rejestru DllName dla aplikacji {7B849a69-220F-451E-B3FE-2CB811AF94AE}, która nie zostanie załadowana. Prawdopodobną przyczyną jest błąd rejestracji. Error - 2010-01-28 14:05:04 | Computer Name = MX8PC | Source = Userenv | ID = 1041 Description = System Windows nie może wykonać kwerendy wpisu rejestru DllName dla aplikacji {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}, która nie zostanie załadowana. Prawdopodobną przyczyną jest błąd rejestracji. Error - 2010-01-28 14:15:47 | Computer Name = MX8PC | Source = Userenv | ID = 1041 Description = System Windows nie może wykonać kwerendy wpisu rejestru DllName dla aplikacji {7B849a69-220F-451E-B3FE-2CB811AF94AE}, która nie zostanie załadowana. Prawdopodobną przyczyną jest błąd rejestracji. Error - 2010-01-28 14:15:47 | Computer Name = MX8PC | Source = Userenv | ID = 1041 Description = System Windows nie może wykonać kwerendy wpisu rejestru DllName dla aplikacji {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}, która nie zostanie załadowana. Prawdopodobną przyczyną jest błąd rejestracji. Error - 2010-01-28 14:15:48 | Computer Name = MX8PC | Source = Userenv | ID = 1041 Description = System Windows nie może wykonać kwerendy wpisu rejestru DllName dla aplikacji {7B849a69-220F-451E-B3FE-2CB811AF94AE}, która nie zostanie załadowana. Prawdopodobną przyczyną jest błąd rejestracji. [ System Events ] Error - 2010-01-28 13:57:39 | Computer Name = MX8PC | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi wscsvc z powodu następującego błędu: %%1083 Error - 2010-01-28 13:57:39 | Computer Name = MX8PC | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Usługa bramy warstwy aplikacji z powodu następującego błędu: %%2 Error - 2010-01-28 14:06:39 | Computer Name = MX8PC | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi General Purpose USB Driver (adildr.sys) z powodu następującego błędu: %%2 Error - 2010-01-28 14:06:39 | Computer Name = MX8PC | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi StarWind AE Service z powodu następującego błędu: %%2 Error - 2010-01-28 14:06:39 | Computer Name = MX8PC | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi wscsvc z powodu następującego błędu: %%1083 Error - 2010-01-28 14:06:39 | Computer Name = MX8PC | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Usługa bramy warstwy aplikacji z powodu następującego błędu: %%2 Error - 2010-01-28 14:17:21 | Computer Name = MX8PC | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi General Purpose USB Driver (adildr.sys) z powodu następującego błędu: %%2 Error - 2010-01-28 14:17:21 | Computer Name = MX8PC | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi StarWind AE Service z powodu następującego błędu: %%2 Error - 2010-01-28 14:17:21 | Computer Name = MX8PC | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi wscsvc z powodu następującego błędu: %%1083 Error - 2010-01-28 14:17:21 | Computer Name = MX8PC | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Usługa bramy warstwy aplikacji z powodu następującego błędu: %%2 < End of report >

Otl. txt

http://www.wklej.org/id/270349/

**Posty:** 2183 · przez **NieWiem** 28 Sty 2010, 20:46

Zamulanie to pół biedy. Ja mam wrażenie, że tutaj jest keylogger. Nie loguj się na razie w żadne poważne miejsca z tego komputera.

Uruchom ponownie OTL i wklej do niego na dole taki skrypt:

:OTL
PRC - [2009-06-27 16:16:26 | 03,642,368 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
FF - prefs.js..extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.1.0014
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKU\S-1-5-21-776561741-1214440339-1801674531-1004\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O4 - Startup: C:\Documents and Settings\Marcin\Menu Start\Programy\Autostart\nssvc32.exe ()
O4 - Startup: C:\Documents and Settings\Marcin\Menu Start\Programy\Autostart\vmon.exe ()
O20 - Winlogon\Notify\LogonInit: DllName - logonInit.dll - C:\Program Files\Common Files\logonInit.dll ()
O28 - HKLM ShellExecuteHooks: {AEB6717E-7E19-11d0-97EE-00C04FD91972} - Reg Error: Key error. File not found
:Files
C:\Qoobox
C:\WINDOWS\SWXCACLS.exe
C:\WINDOWS\SWREG.exe
C:\WINDOWS\SWSC.exe
C:\Documents and Settings\Marcin\Pulpit\ComboFix.exe
C:\Program Files\Common Files\userInit.dll
C:\WINDOWS\PEV.exe
C:\WINDOWS\sed.exe
C:\WINDOWS\grep.exe
C:\WINDOWS\MBR.exe
C:\WINDOWS\zip.exe
C:\Program Files\DAEMON Tools Toolbar
C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\Firefox\Profiles\kab7nj07.default\searchplugins\daemon-search.xml
C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\Firefox\Profiles\kab7nj07.default\extensions\DTToolbar@toolbarnet.com
:Commands
[purity]
[emptytemp]
[start explorer]
[reboot]

Kliknij Run Fix i zatwierdź restart. Wracasz z logiem z czyszczenia i nowym logiem z OTL.

**Posty:** 21 · przez **Mentoll** 28 Sty 2010, 21:01

Skan po czyszczeniu

Kod: Zaznacz wszystko: All processes killed ========== OTL ========== No active process named explorer.exe was found! Prefs.js: DTToolbar@toolbarnet.com:1.1.1.0014 removed from extensions.enabledItems Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ deleted successfully. C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll moved successfully. Registry value HKEY_USERS\S-1-5-21-776561741-1214440339-1801674531-1004\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found. File C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll not found. C:\Documents and Settings\Marcin\Menu Start\Programy\Autostart\nssvc32.exe moved successfully. C:\Documents and Settings\Marcin\Menu Start\Programy\Autostart\vmon.exe moved successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\LogonInit\ deleted successfully. C:\Program Files\Common Files\logonInit.dll moved successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\\{AEB6717E-7E19-11d0-97EE-00C04FD91972} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AEB6717E-7E19-11d0-97EE-00C04FD91972}\ not found. ========== FILES ========== C:\Qoobox\Quarantine\Registry_backups folder moved successfully. C:\Qoobox\Quarantine\E folder moved successfully. C:\Qoobox\Quarantine\D folder moved successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32 folder moved successfully. C:\Qoobox\Quarantine\C\WINDOWS folder moved successfully. C:\Qoobox\Quarantine\C folder moved successfully. C:\Qoobox\Quarantine folder moved successfully. C:\Qoobox\BackEnv folder moved successfully. C:\Qoobox folder moved successfully. C:\WINDOWS\SWXCACLS.exe moved successfully. C:\WINDOWS\SWREG.exe moved successfully. C:\WINDOWS\SWSC.exe moved successfully. C:\Documents and Settings\Marcin\Pulpit\ComboFix.exe moved successfully. C:\Program Files\Common Files\userInit.dll moved successfully. C:\WINDOWS\PEV.exe moved successfully. C:\WINDOWS\sed.exe moved successfully. C:\WINDOWS\grep.exe moved successfully. C:\WINDOWS\MBR.exe moved successfully. C:\WINDOWS\zip.exe moved successfully. C:\Program Files\DAEMON Tools Toolbar\Resources folder moved successfully. C:\Program Files\DAEMON Tools Toolbar folder moved successfully. C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\Firefox\Profiles\kab7nj07.default\searchplugins\daemon-search.xml moved successfully. C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\Firefox\Profiles\kab7nj07.default\extensions\DTToolbar@toolbarnet.com\components\Resources folder moved successfully. C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\Firefox\Profiles\kab7nj07.default\extensions\DTToolbar@toolbarnet.com\components folder moved successfully. C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\Firefox\Profiles\kab7nj07.default\extensions\DTToolbar@toolbarnet.com\chrome folder moved successfully. C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\Firefox\Profiles\kab7nj07.default\extensions\DTToolbar@toolbarnet.com folder moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes User: LocalService ->Temporary Internet Files folder emptied: 32902 bytes User: Marcin ->Temp folder emptied: 741797 bytes ->Temporary Internet Files folder emptied: 72510 bytes ->Java cache emptied: 634486 bytes ->FireFox cache emptied: 113028959 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 67 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 2596 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 109,00 mb OTL by OldTimer - Version 3.1.27.0 log created on 01282010_195933 Files\Folders moved on Reboot... Registry entries deleted on Reboot...

Nowy skan OTL.txt

Kod: Zaznacz wszystko: OTL logfile created on: 2010-01-28 20:15:19 - Run 1 OTL by OldTimer - Version 3.1.27.0 Folder = C:\Documents and Settings\Marcin\Pulpit Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 3,00 Gb Total Physical Memory | 3,00 Gb Available Physical Memory | 82,00% Memory free 5,00 Gb Paging File | 5,00 Gb Available in Paging File | 91,00% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 48,82 Gb Total Space | 23,63 Gb Free Space | 48,40% Space Free | Partition Type: NTFS Drive D: | 195,31 Gb Total Space | 113,17 Gb Free Space | 57,94% Space Free | Partition Type: NTFS Drive E: | 221,61 Gb Total Space | 128,85 Gb Free Space | 58,14% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: MX8PC Current User Name: Marcin Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: On Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-01-28 19:20:39 | 00,548,864 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Marcin\Pulpit\OTL.exe PRC - [2010-01-06 21:37:42 | 00,307,672 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009-08-31 17:07:34 | 11,391,592 | ---- | M] (GG Network S.A.) -- D:\Program Files\Nowe Gadu-Gadu\gg.exe PRC - [2009-08-31 15:56:26 | 00,077,824 | ---- | M] () -- D:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe PRC - [2009-06-27 16:16:26 | 03,642,368 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2009-02-10 16:30:02 | 00,364,544 | ---- | M] (France Telecom SA) -- C:\Program Files\Livebox\Connectivity\corecom\CoreCom.exe PRC - [2009-02-05 12:43:26 | 00,068,136 | ---- | M] () -- C:\Program Files\Gigabyte\EasySaver\essvr.exe PRC - [2009-01-13 07:37:06 | 18,084,864 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTHDCPL.EXE PRC - [2008-12-01 21:38:42 | 00,598,016 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe PRC - [2008-09-02 10:48:12 | 00,049,152 | ---- | M] (Advanced Micro Devices Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe PRC - [2008-09-02 10:40:46 | 00,049,152 | ---- | M] (ATI Technologies Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe PRC - [2008-06-20 12:11:04 | 00,028,672 | ---- | M] (France Telecom SA) -- C:\Program Files\Livebox\Connectivity\corecom\OraConfigRecover.exe PRC - [2008-06-20 12:08:24 | 00,065,536 | ---- | M] (France Telecom SA) -- C:\Program Files\Common Files\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe PRC - [2008-06-20 12:08:08 | 00,065,536 | ---- | M] (France Telecom SA) -- C:\Program Files\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe PRC - [2008-06-10 11:14:42 | 00,147,456 | ---- | M] (France Telecom SA) -- C:\Program Files\Livebox\Systray\SystrayApp.exe PRC - [2008-06-10 11:14:14 | 00,602,864 | ---- | M] (France Telecom SA) -- C:\Program Files\Livebox\Launcher\Launcher.exe PRC - [2008-06-10 11:11:34 | 00,712,704 | ---- | M] (France Telecom SA) -- C:\Program Files\Livebox\Connectivity\ConnectivityManager.exe PRC - [2008-06-10 11:11:04 | 00,090,112 | ---- | M] (France Telecom SA) -- C:\Program Files\Common Files\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-01-28 19:20:39 | 00,548,864 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Marcin\Pulpit\OTL.exe MOD - [2009-04-28 10:47:54 | 00,348,160 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msvcr71.dll MOD - [2008-06-10 11:12:26 | 00,006,144 | ---- | M] (France Telecom SA) -- C:\Program Files\Livebox\Launcher\Inactivity.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Auto | Stopped] -- -- (StarWindServiceAE) SRV - File not found [On_Demand | Stopped] -- -- (CiSvc) SRV - File not found [On_Demand | Stopped] -- -- (ALG) SRV - [2009-10-23 19:21:43 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) [Disabled | Stopped] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2009-02-05 12:43:26 | 00,068,136 | ---- | M] () [Auto | Running] -- C:\Program Files\Gigabyte\EasySaver\ESSVR.EXE -- (ES lite Service) SRV - [2008-12-01 21:38:42 | 00,598,016 | ---- | M] (ATI Technologies Inc.) [Auto | Running] -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller) SRV - [2008-12-01 13:35:00 | 00,593,920 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\system32\ati2sgag.exe -- (ATI Smart) SRV - [2008-06-20 12:08:08 | 00,065,536 | ---- | M] (France Telecom SA) [Auto | Running] -- C:\Program Files\Common Files\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe -- (FTRTSVC) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2010-01-28 20:00:44 | 00,016,608 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\gdrv.sys -- (gdrv) DRV - [2009-12-04 06:28:46 | 00,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd) DRV - [2009-11-29 17:24:20 | 00,278,984 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt) DRV - [2009-11-29 17:24:19 | 00,025,416 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt) DRV - [2009-07-05 01:19:05 | 00,062,208 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\si3112.sys -- (Si3112) DRV - [2009-01-20 11:53:06 | 05,027,840 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2008-12-25 10:32:32 | 03,721,664 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtKHDMI.sys -- (RTHDMIAzAudService) DRV - [2008-12-01 23:13:40 | 03,452,928 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2008-10-31 19:52:16 | 00,093,184 | ---- | M] (ATI Research Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV - [2008-10-30 14:14:20 | 00,117,888 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp) DRV - [2008-04-13 23:09:18 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv) DRV - [2008-04-13 23:06:06 | 00,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus) DRV - [2007-10-12 02:40:12 | 00,009,096 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\amdide.sys -- (amdide) DRV - [2007-04-16 15:46:34 | 00,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM) DRV - [2006-03-01 19:53:54 | 00,032,128 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\pcandis5.sys -- (PCANDIS5) DRV - [2003-09-23 11:38:34 | 00,034,688 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\pcampr5.sys -- (PCAMPR5) DRV - [2001-08-18 00:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ IE - HKU\S-1-5-20\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-776561741-1214440339-1801674531-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ IE - HKU\S-1-5-21-776561741-1214440339-1801674531-1004\..\URLSearchHook: {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Livebox\SearchURLHook\SearchPageURL.dll () IE - HKU\S-1-5-21-776561741-1214440339-1801674531-1004\S-1-5-21-776561741-1214440339-1801674531-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.startup.homepage: "www.google.pl" FF - prefs.js..extensions.enabledItems: {B042753D-F57E-4e8e-A01B-7379A6D4CEFB}:1.17 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {B13721C7-F507-4982-B2E5-502A71474FED}:3.3.0.3971 FF - HKLM\software\mozilla\Mozilla Firefox 3.0.17\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010-01-23 16:02:36 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.17\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010-01-06 21:37:44 | 00,000,000 | ---D | M] [2009-10-23 21:18:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\Extensions [2010-01-28 20:01:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\Firefox\Profiles\kab7nj07.default\extensions [2010-01-01 20:04:29 | 00,000,000 | ---D | M] (BitComet Video Downloader) -- C:\Documents and Settings\Marcin\Dane aplikacji\Mozilla\Firefox\Profiles\kab7nj07.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB} [2010-01-28 20:07:15 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2009-12-18 01:31:54 | 00,063,488 | ---- | M] (Nullsoft) -- C:\Program Files\Mozilla Firefox\plugins\npwachk.dll [2009-10-25 18:51:44 | 00,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2009-10-25 18:51:44 | 00,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2009-10-25 18:51:44 | 00,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2009-10-25 18:51:44 | 00,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2009-10-25 18:51:44 | 00,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2009-10-25 18:51:44 | 00,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2001-10-26 18:45:16 | 00,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O4 - HKLM..\Run: [ORAHSSSessionManager] C:\Program Files\Livebox\SessionManager\SessionManager.exe (France Telecom SA) O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKU\.DEFAULT..\Run: [TransBar] C:\WINDOWS\TransBar.exe (AKSoftware) O4 - HKU\S-1-5-18..\Run: [TransBar] C:\WINDOWS\TransBar.exe (AKSoftware) O4 - HKU\S-1-5-21-776561741-1214440339-1801674531-1004..\Run: [Nowe Gadu-Gadu] D:\Program Files\Nowe Gadu-Gadu\gg.exe (GG Network S.A.) O4 - HKU\S-1-5-21-776561741-1214440339-1801674531-1004..\Run: [TransBar] C:\WINDOWS\TransBar.exe (AKSoftware) O4 - HKU\.DEFAULT..\RunOnce: [_nltide_3] C:\WINDOWS\System32\advpack.dll (Microsoft Corporation) O4 - HKU\S-1-5-18..\RunOnce: [_nltide_3] C:\WINDOWS\System32\advpack.dll (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktopCleanupWizard = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoInternetOpenWith = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableStatusMessages = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: VerboseStatus = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMMyPictures = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMMyPictures = 1 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 1 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 149 O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMMyPictures = 1 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 1 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1 O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-776561741-1214440339-1801674531-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-776561741-1214440339-1801674531-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-21-776561741-1214440339-1801674531-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMMyPictures = 1 O7 - HKU\S-1-5-21-776561741-1214440339-1801674531-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMConfigurePrograms = 1 O7 - HKU\S-1-5-21-776561741-1214440339-1801674531-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMHelp = 1 O7 - HKU\S-1-5-21-776561741-1214440339-1801674531-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 1 O7 - HKU\S-1-5-21-776561741-1214440339-1801674531-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 1 O7 - HKU\S-1-5-21-776561741-1214440339-1801674531-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1 O7 - HKU\S-1-5-21-776561741-1214440339-1801674531-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1 O7 - HKU\S-1-5-21-776561741-1214440339-1801674531-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-21-776561741-1214440339-1801674531-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\S-1-5-21-776561741-1214440339-1801674531-1004_Classes\Software\Policies\Microsoft\Internet Explorer\Control Panel present O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14) O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 0.0.0.0 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-10-23 19:20:53 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-01-28 19:59:38 | 00,000,000 | -HSD | C] -- C:\RECYCLER [2010-01-28 19:19:51 | 00,548,864 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Marcin\Pulpit\OTL.exe [2010-01-28 19:14:52 | 00,000,000 | -HSD | C] -- C:\Documents and Settings\Marcin\Recent [2010-01-28 06:45:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Moje dokumenty\Prototype [2010-01-21 17:45:21 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\cstrike [2010-01-17 23:35:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\Polish House Mafia- Every Day [2010-01-13 22:04:33 | 00,000,000 | ---D | C] -- C:\WINDOWS\Downloaded Installations [2010-01-09 15:20:08 | 03,088,792 | ---- | C] (MyPlayCity, Inc. ) -- C:\Documents and Settings\Marcin\Pulpit\mahjong_setup.exe [2010-01-09 10:04:26 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\DirectX [2010-01-09 10:04:10 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\Divinity 2 [2010-01-09 09:55:28 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Dane aplikacji\ProtectDisc [2010-01-09 09:55:18 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Divinity 2 [2010-01-07 20:58:41 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Moje dokumenty\BioWare [2010-01-06 21:43:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\Driver Viwe [2010-01-04 11:25:43 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\xircom [2010-01-04 11:25:43 | 00,000,000 | ---D | C] -- C:\Program Files\xerox [2010-01-04 11:25:43 | 00,000,000 | ---D | C] -- C:\WINDOWS\srchasst [2010-01-04 11:25:43 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\oobe [2010-01-04 11:25:42 | 00,000,000 | ---D | C] -- C:\Program Files\netmeeting [2010-01-04 11:25:42 | 00,000,000 | ---D | C] -- C:\Program Files\msn gaming zone [2010-01-04 11:25:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\msagent [2010-01-04 11:25:42 | 00,000,000 | ---D | C] -- C:\Program Files\microsoft frontpage [2010-01-02 21:25:15 | 00,000,000 | ---D | C] -- C:\WINDOWS\pss [2010-01-02 21:23:26 | 00,000,000 | ---D | C] -- C:\Program Files\ESET [2010-01-02 21:08:49 | 00,000,000 | RHSD | C] -- C:\cmdcons [2010-01-02 21:06:54 | 00,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2010-01-02 21:04:10 | 00,421,888 | ---- | C] (Microsoft Corporation) -- C:\Documents and Settings\Marcin\Pulpit\cmd.exe [2010-01-02 10:30:39 | 01,297,460 | ---- | C] ( ) -- C:\Documents and Settings\Marcin\Pulpit\napiprojekt1.0.6.2.exe [2010-01-02 10:27:15 | 00,000,000 | -H-D | C] -- C:\WINDOWS\PIF [2010-01-01 20:33:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Moje dokumenty\Downloads [2010-01-01 20:23:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Dane aplikacji\uTorrent [2010-01-01 20:23:28 | 00,289,584 | ---- | C] (BitTorrent, Inc.) -- C:\Documents and Settings\Marcin\Pulpit\utorrent.exe [2010-01-01 20:08:01 | 00,000,000 | ---D | C] -- C:\Downloads [2010-01-01 16:46:57 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Marcin\Pulpit\maltazar ss [2009-10-23 19:28:17 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft [2009-10-23 19:28:17 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft [2009-10-23 19:20:20 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft [2009-10-23 19:17:31 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-01-28 20:07:13 | 00,003,186 | ---- | M] () -- C:\WINDOWS\System32\NOTEPAD.ini [2010-01-28 20:00:42 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010-01-28 20:00:39 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010-01-28 20:00:36 | 00,069,112 | ---- | M] () -- C:\WINDOWS\System32\ativvaxx.cap [2010-01-28 19:59:52 | 05,767,168 | -H-- | M] () -- C:\Documents and Settings\Marcin\NTUSER.DAT [2010-01-28 19:59:52 | 00,000,188 | -HS- | M] () -- C:\Documents and Settings\Marcin\ntuser.ini [2010-01-28 19:20:39 | 00,548,864 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Marcin\Pulpit\OTL.exe [2010-01-28 19:14:51 | 03,737,618 | -H-- | M] () -- C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\IconCache.db [2010-01-28 19:11:26 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2010-01-28 19:09:11 | 00,000,528 | ---- | M] () -- C:\WINDOWS\win.ini [2010-01-28 19:09:11 | 00,000,293 | RHS- | M] () -- C:\boot.ini [2010-01-28 18:01:00 | 00,002,267 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk [2010-01-28 17:19:41 | 00,002,129 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Steam.lnk [2010-01-28 07:01:36 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010-01-28 06:43:05 | 00,000,530 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Prototype(TM).lnk [2010-01-27 07:12:08 | 00,007,415 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\product_thumb.php [2010-01-27 07:11:18 | 00,004,267 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\product_thumb.php.jpeg [2010-01-27 06:54:20 | 00,003,351 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Pobieranie.JPG [2010-01-25 21:03:00 | 05,860,236 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\alex tekk - cenzura-spam is good (booty club mix).mp3 [2010-01-24 22:35:49 | 01,713,005 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\paffendorf - lalala girl.mp3 [2010-01-23 19:13:47 | 00,028,672 | ---- | M] () -- C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010-01-23 18:23:32 | 00,004,358 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\config.cfg [2010-01-22 18:10:13 | 00,212,534 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Full_Package_Version_1-548.7z [2010-01-21 17:54:19 | 00,051,316 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\bez tytułu.JPG [2010-01-17 23:12:16 | 13,704,0343 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Polish House Mafia- Every Day.rar [2010-01-16 14:50:39 | 00,001,054 | ---- | M] () -- C:\Documents and Settings\Marcin\Moje dokumenty\pejoo.m3u [2010-01-14 06:42:55 | 00,001,571 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Kalkulator.lnk [2010-01-12 06:33:39 | 01,106,650 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2010-01-12 06:33:39 | 00,497,572 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2010-01-12 06:33:39 | 00,438,750 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010-01-12 06:33:39 | 00,087,228 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2010-01-12 06:33:39 | 00,069,926 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010-01-11 21:22:38 | 07,458,513 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\akalk(dobreprogramy.pl).exe [2010-01-09 15:20:31 | 00,000,575 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\My Free Mahjong.lnk [2010-01-09 15:20:31 | 00,000,559 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Play Online Games.lnk [2010-01-09 15:20:31 | 00,000,534 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\MyPlayCity Games.lnk [2010-01-09 15:20:11 | 03,088,792 | ---- | M] (MyPlayCity, Inc. ) -- C:\Documents and Settings\Marcin\Pulpit\mahjong_setup.exe [2010-01-09 10:14:55 | 00,004,096 | ---- | M] () -- C:\Documents and Settings\All Users\Dokumenty\000012A3.LCS [2010-01-09 09:55:20 | 00,000,696 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Divinity II - Ego Draconis.lnk [2010-01-07 20:33:26 | 00,000,550 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Dragon Age - Origins.lnk [2010-01-07 20:33:00 | 02,401,248 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\jail_school.zip [2010-01-05 07:04:55 | 00,003,690 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2010-01-02 21:23:08 | 02,672,312 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\esetsmartinstaller_plk.exe [2010-01-02 21:04:12 | 00,421,888 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\cmd.exe [2010-01-02 21:04:12 | 00,421,888 | ---- | M] (Microsoft Corporation) -- C:\Documents and Settings\Marcin\Pulpit\cmd.exe [2010-01-02 10:32:54 | 00,000,564 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Napi-projekt.lnk [2010-01-02 10:31:08 | 01,297,460 | ---- | M] ( ) -- C:\Documents and Settings\Marcin\Pulpit\napiprojekt1.0.6.2.exe [2010-01-01 20:24:34 | 00,000,457 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\µTorrent.lnk [2010-01-01 20:23:29 | 00,289,584 | ---- | M] (BitTorrent, Inc.) -- C:\Documents and Settings\Marcin\Pulpit\utorrent.exe [2010-01-01 20:03:25 | 06,472,504 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\bitcomet_setup.exe [2010-01-01 16:41:16 | 05,655,727 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\maltazar_ss.rar [2009-12-30 20:49:07 | 00,184,924 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Nokalt.JPG [2009-12-30 16:52:56 | 00,204,901 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Zdjęcie0041.JPG [2009-12-30 16:52:49 | 00,202,654 | ---- | M] () -- C:\Documents and Settings\Marcin\Pulpit\Zdjęcie0040.JPG [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-01-28 06:43:05 | 00,000,530 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Prototype(TM).lnk [2010-01-27 06:51:23 | 00,003,351 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\Pobieranie.JPG [2010-01-25 21:03:00 | 05,860,236 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\alex tekk - cenzura-spam is good (booty club mix).mp3 [2010-01-24 22:35:49 | 01,713,005 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\paffendorf - lalala girl.mp3 [2010-01-23 21:30:08 | 00,004,358 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\config.cfg [2010-01-23 14:29:36 | 00,007,415 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\product_thumb.php [2010-01-23 14:28:21 | 00,004,267 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\product_thumb.php.jpeg [2010-01-22 18:10:12 | 00,212,534 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\Full_Package_Version_1-548.7z [2010-01-21 17:54:19 | 00,051,316 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\bez tytułu.JPG [2010-01-17 22:44:28 | 13,704,0343 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\Polish House Mafia- Every Day.rar [2010-01-16 14:50:39 | 00,001,054 | ---- | C] () -- C:\Documents and Settings\Marcin\Moje dokumenty\pejoo.m3u [2010-01-14 06:42:55 | 00,001,571 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\Kalkulator.lnk [2010-01-11 21:02:45 | 07,458,513 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\akalk(dobreprogramy.pl).exe [2010-01-09 15:20:31 | 00,000,575 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\My Free Mahjong.lnk [2010-01-09 15:20:31 | 00,000,559 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\Play Online Games.lnk [2010-01-09 15:20:31 | 00,000,534 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\MyPlayCity Games.lnk [2010-01-09 09:55:30 | 00,004,096 | ---- | C] () -- C:\Documents and Settings\All Users\Dokumenty\000012A3.LCS [2010-01-09 09:55:20 | 00,000,696 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\Divinity II - Ego Draconis.lnk [2010-01-07 20:33:26 | 00,000,550 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Dragon Age - Origins.lnk [2010-01-07 20:32:50 | 02,401,248 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\jail_school.zip [2010-01-02 21:20:41 | 02,672,312 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\esetsmartinstaller_plk.exe [2010-01-02 21:08:51 | 00,000,223 | ---- | C] () -- C:\Boot.bak [2010-01-02 21:08:50 | 00,262,400 | ---- | C] () -- C:\cmldr [2010-01-02 10:32:54 | 00,000,564 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\Napi-projekt.lnk [2010-01-01 20:24:34 | 00,000,457 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\µTorrent.lnk [2010-01-01 20:02:34 | 06,472,504 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\bitcomet_setup.exe [2010-01-01 16:40:18 | 05,655,727 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\maltazar_ss.rar [2009-12-30 20:49:07 | 00,184,924 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\Nokalt.JPG [2009-12-30 16:52:56 | 00,204,901 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\Zdjęcie0041.JPG [2009-12-30 16:52:49 | 00,202,654 | ---- | C] () -- C:\Documents and Settings\Marcin\Pulpit\Zdjęcie0040.JPG [2009-11-29 17:24:20 | 00,278,984 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys [2009-11-29 17:24:19 | 00,025,416 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys [2009-10-24 17:01:52 | 00,691,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2009-10-23 21:17:10 | 00,028,672 | ---- | C] () -- C:\Documents and Settings\Marcin\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-10-23 20:37:00 | 00,003,186 | ---- | C] () -- C:\WINDOWS\System32\NOTEPAD.ini [2009-10-23 19:25:24 | 00,919,752 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat [2009-10-23 19:22:12 | 00,000,047 | ---- | C] () -- C:\WINDOWS\TransBar.ini [2009-08-07 19:51:34 | 00,178,430 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat [2009-08-03 00:21:54 | 00,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll [2009-08-03 00:21:54 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll [2009-08-03 00:21:54 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll [2009-08-03 00:21:54 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll [2009-08-03 00:21:54 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll [2009-08-03 00:21:54 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll [2009-08-03 00:21:54 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll [2009-08-03 00:21:54 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll [2009-08-03 00:21:52 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll [2009-08-03 00:21:52 | 00,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll [2009-07-05 17:59:43 | 00,000,861 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [color=#E56717]========== LOP Check ==========[/color] [2009-10-23 19:21:27 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Foxit [2009-10-27 14:56:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo [2009-12-04 06:28:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite [2010-01-09 09:55:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Divinity 2 [2009-10-23 19:21:27 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Dane aplikacji\Foxit [2009-10-27 14:57:54 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\Ashampoo [2009-10-24 17:06:55 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\DAEMON Tools Lite [2009-10-23 19:21:27 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\Foxit [2009-10-30 22:19:01 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\Nowe Gadu-Gadu [2009-11-05 22:19:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\Opera [2010-01-09 10:14:52 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\ProtectDisc [2010-01-07 23:24:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\Tibia [2010-01-28 19:02:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Marcin\Dane aplikacji\uTorrent [color=#E56717]========== Purity Check ==========[/color] < End of report >

Extras

http://www.wklej.org/id/270383/

@Down Faja ze mnie

**Posty:** 2183 · przez **NieWiem** 28 Sty 2010, 21:11

Wkleiłeś 2x plik extras, a potrzebuję tego drugiego.

**Posty:** 21 · przez **Mentoll** 31 Sty 2010, 02:55

Czy przeanalizuje ktos? :cry:

**Posty:** 2183 · przez **NieWiem** 31 Sty 2010, 14:11

Wygląda OK.

Na zakończenie Malwarebytes' i trochę sprzątania.

Pobierz program OTC
Kliknij dwukrotnie na ikonę, aby uruchomić program (użytkownicy systemów Vista oraz Se7en => prawoklik oraz wybrać opcję Uruchom jako Administrator).
Wciśnij przycisk Clean Up!
Na pytanie "Begin cleanup Process?" wciśnij Yes.
Jeśli padnie prośba o restart - zgódź się.

Pobierz program TFC
Zamknij wszystkie otwarte programy - inaczej TFC zrobi to za Ciebie
Kliknij dwukrotnie na ikonę, aby uruchomić program (użytkownicy systemów Vista oraz Se7en => prawoklik oraz wybrać opcję Uruchom jako Administrator).
Kliknij przycisk Start
Czyszczenie lokalizacji tymczasowych może chwilę potrwać (ale znowu bez przesady), uzbrój się w cierpliwość.
Jeśli padnie prośba o restart - zgódź się.

Czyszczenie punktów przywracania systemu jest konieczne, ponieważ w backupach Windowsa znajdują się także kopie szkodników.

Wyłączenie przywracania systemu
- Na pulpicie => prawoklik na Mój Komputer
- opcja Właściwości
- zakładka Przywracanie systemu
- Zaznaczyć opcję Wyłącz przywracanie systemu
- Kliknąć Zastosuj, a potem OK.
Zrestartować komputer!
Włączanie przywracania systemu
- Na pulpicie => prawoklik na Mój Komputer
- opcja Właściwości
- zakładka Przywracanie systemu
- Odznaczyć opcję Wyłącz przywracanie systemu
- Kliknąć Zastosuj, a potem OK.

Pobierz program Malwarebytes' Anti-Malware i zainstaluj.
Wersja freeware nie ma opcji automatycznych aktualizacji, dlatego pod koniec instalacji upewnij się, że zaznaczone są opcje:
- Update Malwarebytes' Anti-Malware
- Launch Malwarebytes' Anti-Malware
Wciśnij Finish.
Przeprowadź pełne skanowanie komputera.
Raport z tego skanowania proszę wkleić na forum w tagach [code], lub na stronie http://www.wklej.org a w odpowiedzi podać tylko linka do tej strony.

Autor postu otrzymał pochwałę

**Posty:** 21 · przez **Mentoll** 01 Lut 2010, 14:44

Kod: Zaznacz wszystko: Malwarebytes' Anti-Malware 1.44 Wersja bazy definicji: 3671 Windows 5.1.2600 Dodatek Service Pack 3 Internet Explorer 6.0.2900.5512 2010-02-01 13:41:37 mbam-log-2010-02-01 (13-41-34).txt Typ skanowania: Pełne skanowanie (C:\|D:\|E:\|) Przeskanowane obiekty: 180477 Upłynęło: 12 minute(s), 26 second(s) Zainfekowane procesy w pamięci: 0 Zainfekowane moduły pamięci: 0 Zainfekowane klucze rejestru: 0 Zainfekowane wartości rejestru: 0 Zainfekowane pliki rejestru: 1 Zainfekowane foldery: 0 Zainfekowane pliki: 1 Zainfekowane procesy w pamięci: (Nie wykryto groźnych plików) Zainfekowane moduły pamięci: (Nie wykryto groźnych plików) Zainfekowane klucze rejestru: (Nie wykryto groźnych plików) Zainfekowane wartości rejestru: (Nie wykryto groźnych plików) Zainfekowane pliki rejestru: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSMHelp (Hijack.Help) -> Bad: (1) Good: (0) -> No action taken. Zainfekowane foldery: (Nie wykryto groźnych plików) Zainfekowane pliki: E:\PySol-4.20\python\DLLs\msvcrt.dll (Malware.Packer.Gen) -> No action taken.

**Posty:** 18165 · przez **wojtas** 01 Lut 2010, 14:49

osuń co znajdzie i powinno być ok

**Posty:** 21 · przez **Mentoll** 02 Lut 2010, 11:37

Myślę, że Pysol-4.20 jest niegrozny, przenież to zwykłe karty

A ten (klucz?) już poleciał...

Wielkie dzieki bardzo mi pomogliscie

**Posty:** 1 · przez **Marusha** 02 Lut 2010, 18:49

Ja też mam problem z zamulającym sie komputerem ... próbowałam samodzielnie odkurzyć wszystkie możliwe zakamarki. Używałam szmatek i tradycyjnych srodków czyszczących i odkurzacza ... ale za bardzo nie pomogło! :banan:

Czy ktoś zna jakieś sprawdzone środki czyszczące do komputera? To nie sa tanie środki, więc nie chciałabym eksperymentować. Trafiłam na stronkę iBOX-a ale chciałabym zaczerpnąć opinii internautów o tej stronce i oferowanych przez nich artykułów do czyszczenia komputera!

**Posty:** 18165 · przez **wojtas** 02 Lut 2010, 22:12

Marusha, Proszę zastosować się do zasad wstawiania logów i założyć swój temat zgodnie z zasadami

Kto jest na forum