Zamulanie komputera, antywirus wykrył autorun

**Posty:** 84 · przez **barto0o** 17 Gru 2009, 21:14

antywirus wykrył jakiś autorun i konia trojańskiego, nie pamiętam nazwy, obawiam się że coś jeszcze siedzi

OTL:

Kod: Zaznacz wszystko: http://wklejto.pl/50567

Rsit

Kod: Zaznacz wszystko: http://wklejto.pl/50568

**Posty:** 18165 · przez **wojtas** 17 Gru 2009, 21:31

Proszę zmienić nazwę tematu na bardziej dokładną, mówiącą więcej o problemie. Tak, aby przeglądający forum zanim kliknie w Twój temat wiedział o czym on jest, dodatkowo opisz swój problem, aby zmienić temat kliknij w pierwszym swoim poście

Inaczej temat zostanie usunięty.

**Posty:** 84 · przez **barto0o** 17 Gru 2009, 22:03

zrobione na ile mogłem

**Posty:** 18165 · przez **wojtas** 17 Gru 2009, 22:15

jakiego antywirusa używasz ? bo widze avast , coś od nortona jest

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O4 - HKLM..\Run: [raidhost] C:\WINDOWS\raidhost.exe (Microsoft)
O33 - MountPoints2\{0bde18a0-da7f-11de-b0b9-001b77790e9b}\Shell - "" = AutoRun
O33 - MountPoints2\{0bde18a0-da7f-11de-b0b9-001b77790e9b}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -- File not found
O33 - MountPoints2\{0bde18a1-da7f-11de-b0b9-001b77790e9b}\Shell\AutoRun\command - "" = I:\cold\hott\raidhost.exe -- File not found
O33 - MountPoints2\{0bde18a1-da7f-11de-b0b9-001b77790e9b}\Shell\Explore\Command - "" = I:\cold\hott\raidhost.exe -- File not found
O33 - MountPoints2\{0bde18a1-da7f-11de-b0b9-001b77790e9b}\Shell\open\command - "" = I:\cold\hott\raidhost.exe -- File not found

:Files
C:\Program Files\DAEMON Tools Toolbar
C:\WINDOWS\System32\yeam.inf

:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .

Następnie uruchamiasz OTL z opcją Run Scan. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia kompa

**Posty:** 84 · przez **barto0o** 17 Gru 2009, 22:21

czyszczenie

Kod: Zaznacz wszystko: All processes killed ========== OTL ========== No active process named explorer.exe was found! Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\raidhost deleted successfully. C:\WINDOWS\raidhost.exe moved successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0bde18a0-da7f-11de-b0b9-001b77790e9b}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0bde18a0-da7f-11de-b0b9-001b77790e9b}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0bde18a0-da7f-11de-b0b9-001b77790e9b}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0bde18a0-da7f-11de-b0b9-001b77790e9b}\ not found. File H:\LaunchU3.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0bde18a1-da7f-11de-b0b9-001b77790e9b}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0bde18a1-da7f-11de-b0b9-001b77790e9b}\ not found. File I:\cold\hott\raidhost.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0bde18a1-da7f-11de-b0b9-001b77790e9b}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0bde18a1-da7f-11de-b0b9-001b77790e9b}\ not found. File I:\cold\hott\raidhost.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{0bde18a1-da7f-11de-b0b9-001b77790e9b}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0bde18a1-da7f-11de-b0b9-001b77790e9b}\ not found. File I:\cold\hott\raidhost.exe not found. ========== FILES ========== C:\Program Files\DAEMON Tools Toolbar\Resources folder moved successfully. C:\Program Files\DAEMON Tools Toolbar folder moved successfully. C:\WINDOWS\System32\yeam.inf moved successfully. ========== REGISTRY ========== HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"SuperHidden"|dword:00000001 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"Hidden"|dword:00000001 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"ShowSuperHidden"|dword:00000001 /E : value set successfully! HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\\"CheckedValue"|dword:00000001 /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden\ deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden\\@|"" /E : value set successfully! ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temporary Internet Files folder emptied: 33170 bytes User: Michal ->Temp folder emptied: 328679444 bytes ->Temporary Internet Files folder emptied: 45262843 bytes ->Java cache emptied: 848559 bytes ->FireFox cache emptied: 99871108 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2352022 bytes %systemroot%\System32 .tmp files removed: 2604 bytes Windows Temp folder emptied: 694946 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 455,68 mb OTL by OldTimer - Version 3.1.17.0 log created on 12172009_211813 Files\Folders moved on Reboot... C:\WINDOWS\temp\_av_proI.tm~a00528\setup.lok moved successfully. File\Folder C:\WINDOWS\temp\_avast4_\Webshlock.txt not found! File\Folder C:\WINDOWS\temp\JET9D78.tmp not found! File\Folder C:\WINDOWS\temp\JET9E82.tmp not found! File\Folder C:\WINDOWS\temp\Perflib_Perfdata_7f8.dat not found! Registry entries deleted on Reboot...

Kod: Zaznacz wszystko: OTL logfile created on: 2009-12-17 21:22:08 - Run 2 OTL by OldTimer - Version 3.1.17.0 Folder = C:\Documents and Settings\Michal\Moje dokumenty\Pobieranie Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1021,91 Mb Total Physical Memory | 431,59 Mb Available Physical Memory | 42,23% Memory free 2,40 Gb Paging File | 1,88 Gb Available in Paging File | 78,30% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 51,14 Gb Total Space | 38,14 Gb Free Space | 74,58% Space Free | Partition Type: NTFS Drive D: | 50,89 Gb Total Space | 18,24 Gb Free Space | 35,84% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: GWIAZDA Current User Name: Michal Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2009-12-17 19:59:08 | 00,538,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Michal\Moje dokumenty\Pobieranie\OTL.exe PRC - [2009-12-17 17:12:51 | 00,908,248 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009-12-12 18:18:44 | 14,100,376 | ---- | M] (Redefine Sp z o.o.) -- C:\Program Files\ipla\ipla.exe PRC - [2009-12-04 19:37:37 | 02,752,560 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\Setup\avast.setup PRC - [2009-11-25 04:21:40 | 00,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe PRC - [2009-11-25 04:21:35 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe PRC - [2009-11-25 04:21:21 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe PRC - [2009-11-25 04:18:48 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe PRC - [2009-11-25 04:13:56 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe PRC - [2009-11-13 01:04:29 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe PRC - [2009-11-13 01:04:29 | 00,136,600 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe PRC - [2009-10-30 16:27:08 | 00,369,200 | ---- | M] (DT Soft Ltd) -- C:\Program Files\DAEMON Tools Lite\DTLite.exe PRC - [2009-10-03 04:08:38 | 00,035,696 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe PRC - [2009-06-04 22:56:22 | 00,869,888 | ---- | M] () -- C:\Program Files\ALLPlayer\ALLUpdate.exe PRC - [2009-01-26 04:53:36 | 01,891,328 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2008-09-12 21:15:48 | 00,036,352 | ---- | M] () -- C:\Program Files\Winamp\winampa.exe PRC - [2008-05-02 03:45:46 | 00,015,872 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerAssistant.exe PRC - [2007-12-05 07:23:58 | 00,495,616 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe PRC - [2007-05-10 18:08:00 | 16,342,528 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTHDCPL.exe PRC - [2006-10-06 00:26:28 | 00,280,779 | ---- | M] () -- C:\WINDOWS\VistaDrive\VistaDrive.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2009-12-17 19:59:08 | 00,538,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Michal\Moje dokumenty\Pobieranie\OTL.exe MOD - [2008-05-02 03:45:36 | 00,004,608 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerHook.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2009-11-25 04:21:35 | 00,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus) SRV - [2009-11-25 04:21:21 | 00,254,040 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner) SRV - [2009-11-25 04:18:48 | 00,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner) SRV - [2009-11-25 04:13:56 | 00,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv) SRV - [2009-11-13 01:04:29 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) [Auto | Running] -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2007-12-05 07:23:58 | 00,495,616 | ---- | M] (ATI Technologies Inc.) [Auto | Running] -- C:\WINDOWS\system32\ati2evxx.exe -- (Ati HotKey Poller) SRV - [2007-09-28 21:05:00 | 00,593,920 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\system32\ati2sgag.exe -- (ATI Smart) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-11-25 08:59:23 | 00,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd) DRV - [2009-11-25 04:18:57 | 00,023,120 | ---- | M] (ALWIL Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\aswRdr.sys -- (aswRdr) DRV - [2009-11-25 04:17:54 | 00,027,408 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2009-09-15 15:26:14 | 00,094,160 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswmon2.sys -- (aswMon2) DRV - [2009-09-15 15:25:30 | 00,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\aswSP.sys -- (aswSP) DRV - [2009-09-15 15:25:19 | 00,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2009-02-02 09:17:44 | 00,308,248 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\iastor78.sys -- (iastor78) DRV - [2008-09-12 22:02:56 | 00,327,192 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\iaStor.sys -- (iaStor) DRV - [2008-09-10 23:09:08 | 00,176,640 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k) DRV - [2008-04-15 15:30:00 | 00,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus) DRV - [2008-04-15 15:30:00 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\secdrv.sys -- (Secdrv) DRV - [2008-04-15 15:30:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ptilink.sys -- (Ptilink) DRV - [2008-03-13 05:55:36 | 02,530,176 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NETw4x32.sys -- (NETw4x32) Sterownik karty Intel(R) DRV - [2007-12-05 09:56:40 | 02,782,208 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2007-05-10 18:28:00 | 04,419,584 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2007-03-21 22:02:04 | 00,037,376 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rixdptsk.sys -- (rismxdp) DRV - [2007-03-08 04:21:00 | 00,043,528 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20) DRV - [2007-02-24 14:42:22 | 00,039,936 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimmptsk.sys -- (rimmptsk) DRV - [2007-01-23 16:40:20 | 00,042,496 | ---- | M] (REDC) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\rimsptsk.sys -- (rimsptsk) DRV - [2006-05-18 09:49:02 | 00,061,067 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ftser2k.sys -- (FTSER2K) DRV - [2006-05-18 09:48:50 | 00,047,249 | ---- | M] (FTDI Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ftdibus.sys -- (FTDIBUS) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.startup.homepage: "www.onet.pl" FF - prefs.js..extensions.enabledItems: DTToolbar@toolbarnet.com:1.1.1.0014 FF - prefs.js..extensions.enabledItems: npfax@microgaming.co.uk:2.1.0.19 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009-12-17 17:12:57 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.5.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009-12-17 17:12:57 | 00,000,000 | ---D | M] [2009-11-13 01:15:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Michal\Dane aplikacji\Mozilla\Extensions [2009-12-16 21:21:17 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Michal\Dane aplikacji\Mozilla\Firefox\Profiles\3ztm1w26.default\extensions [2009-11-27 15:19:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Michal\Dane aplikacji\Mozilla\Firefox\Profiles\3ztm1w26.default\extensions\DTToolbar@toolbarnet.com [2009-11-24 11:36:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Michal\Dane aplikacji\Mozilla\Firefox\Profiles\3ztm1w26.default\extensions\npfax@microgaming.co.uk [2009-11-25 08:59:25 | 00,002,059 | ---- | M] () -- C:\Documents and Settings\Michal\Dane aplikacji\Mozilla\Firefox\Profiles\3ztm1w26.default\searchplugins\daemon-search.xml [2009-12-16 21:21:17 | 00,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2009-12-04 19:37:06 | 00,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2009-12-04 19:37:06 | 00,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2009-12-04 19:37:06 | 00,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2009-12-04 19:37:06 | 00,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2009-12-04 19:37:06 | 00,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2009-12-04 19:37:06 | 00,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: (742 bytes) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll File not found O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll File not found O4 - HKLM..\Run: [Adobe ARM] C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [AtiPTA] C:\WINDOWS\System32\atiptaxx.exe (ATI Technologies, Inc.) O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software) O4 - HKLM..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh) O4 - HKLM..\Run: [RTHDCPL] C:\WINDOWS\RTHDCPL.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe () O4 - HKLM..\Run: [VistaDrive] C:\WINDOWS\VistaDrive\VistaDrive.exe () O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe () O4 - HKCU..\Run: [ALLUpdate] C:\Program Files\ALLPlayer\ALLUpdate.exe () O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKCU..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe (http://www.emule-project.net) O4 - HKCU..\Run: [Gadu-Gadu] C:\Program Files\Gadu-Gadu\gg.exe (Gadu-Gadu S.A.) O4 - HKCU..\Run: [IPLA!] C:\Program Files\ipla\ipla.exe (Redefine Sp z o.o.) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office10\EXCEL.EXE (Microsoft Corporation) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11) O16 - DPF: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_11-windows-i586.cab (Java Plug-in 1.6.0_11) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.2 O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-11-13 00:56:28 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - comfile [open] -- "%1" %* O35 - exefile [open] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2009-12-17 21:23:42 | 00,000,000 | ---D | C] -- C:\WINDOWS\LastGood [2009-12-17 21:18:13 | 00,000,000 | ---D | C] -- C:\_OTL [2009-12-17 20:02:47 | 00,000,000 | ---D | C] -- C:\Program Files\trend micro [2009-12-17 20:02:46 | 00,000,000 | ---D | C] -- C:\rsit [2009-12-11 09:45:01 | 00,000,000 | RH-D | C] -- C:\Documents and Settings\Michal\Recent [2009-12-09 13:38:07 | 00,176,128 | ---- | C] (FTDI Ltd) -- C:\WINDOWS\System32\ftd2xx.dll [2009-12-09 13:38:07 | 00,106,496 | ---- | C] (FTDI Ltd.) -- C:\WINDOWS\System32\ftbusui.dll [2009-12-09 13:38:07 | 00,102,400 | ---- | C] (FTDI) -- C:\WINDOWS\System32\FTLang.dll [2009-12-09 13:38:07 | 00,061,067 | ---- | C] (FTDI Ltd.) -- C:\WINDOWS\System32\drivers\ftser2k.sys [2009-12-09 13:38:07 | 00,047,249 | ---- | C] (FTDI Ltd.) -- C:\WINDOWS\System32\drivers\ftdibus.sys [2009-12-09 13:38:07 | 00,033,360 | ---- | C] (FTDI Ltd.) -- C:\WINDOWS\System32\ftserui2.dll [2009-12-09 13:38:07 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Michal\Pulpit\OFERTA [2009-12-09 13:38:06 | 00,000,000 | ---D | C] -- C:\Program Files\Polski VAG 4.9 [2009-12-09 13:36:22 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Michal\Ustawienia lokalne\Dane aplikacji\Adobe [2009-12-09 13:35:44 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Adobe [2009-12-09 13:35:32 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe [2009-12-09 13:35:32 | 00,000,000 | ---D | C] -- C:\Program Files\Adobe [2009-12-09 13:31:05 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Michal\Moje dokumenty\Pobieranie [2009-12-02 15:50:55 | 00,000,000 | ---D | C] -- C:\Program Files\eMule [2009-11-27 17:57:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Michal\Dane aplikacji\ipla [2009-11-27 17:57:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\ipla [2009-11-27 17:57:03 | 00,000,000 | ---D | C] -- C:\Program Files\ipla [2009-11-27 17:56:40 | 01,700,352 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\gdiplus.dll [2009-11-26 16:00:18 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Michal\Dane aplikacji\U3 [2009-11-25 17:32:10 | 04,178,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DX9_41.dll [2009-11-25 17:32:10 | 01,846,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_41.dll [2009-11-25 17:32:10 | 00,453,456 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx10_41.dll [2009-11-25 17:32:09 | 00,517,448 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAudio2_4.dll [2009-11-25 17:32:09 | 00,235,352 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine3_4.dll [2009-11-25 17:32:09 | 00,069,448 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAPOFX1_3.dll [2009-11-25 17:32:09 | 00,022,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\X3DAudio1_6.dll [2009-11-25 17:32:08 | 02,036,576 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_40.dll [2009-11-25 17:32:08 | 00,452,440 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx10_40.dll [2009-11-25 17:32:07 | 00,514,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAudio2_3.dll [2009-11-25 17:32:07 | 00,235,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine3_3.dll [2009-11-25 17:32:07 | 00,070,992 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\XAPOFX1_2.dll [2009-11-25 17:32:06 | 00,023,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\X3DAudio1_5.dll [2009-11-25 09:37:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Michal\Moje dokumenty\Sports Interactive [2009-11-25 09:37:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dokumenty\Sports Interactive [2009-11-25 09:23:32 | 00,000,000 | ---D | C] -- C:\Program Files\Sports Interactive [2009-11-25 09:22:46 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dokumenty\DAEMON Tools Images [2009-11-25 09:11:53 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Michal\Dane aplikacji\Sports Interactive [2009-11-25 09:11:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Sports Interactive [2009-11-25 09:08:01 | 00,267,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_10.dll [2009-11-25 09:08:00 | 03,734,536 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_36.dll [2009-11-25 09:08:00 | 01,374,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_36.dll [2009-11-25 09:08:00 | 00,444,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx10_36.dll [2009-11-25 09:07:59 | 03,727,720 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_35.dll [2009-11-25 09:07:59 | 01,358,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_35.dll [2009-11-25 09:07:59 | 00,444,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx10_35.dll [2009-11-25 09:07:59 | 00,267,112 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_9.dll [2009-11-25 09:07:58 | 01,124,720 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_34.dll [2009-11-25 09:07:58 | 00,443,752 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx10_34.dll [2009-11-25 09:07:58 | 00,266,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_8.dll [2009-11-25 09:07:58 | 00,017,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\X3DAudio1_2.dll [2009-11-25 09:07:57 | 03,497,832 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_34.dll [2009-11-25 09:07:57 | 00,261,480 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_7.dll [2009-11-25 09:07:57 | 00,081,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xinput1_3.dll [2009-11-25 09:07:56 | 01,123,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\D3DCompiler_33.dll [2009-11-25 09:07:56 | 00,443,752 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx10_33.dll [2009-11-25 09:07:54 | 03,495,784 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_33.dll [2009-11-25 09:07:54 | 00,255,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_6.dll [2009-11-25 09:07:54 | 00,251,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_5.dll [2009-11-25 09:07:53 | 03,426,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_32.dll [2009-11-25 09:07:53 | 02,414,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_31.dll [2009-11-25 09:07:53 | 00,237,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_4.dll [2009-11-25 09:07:53 | 00,015,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\x3daudio1_1.dll [2009-11-25 09:07:52 | 00,236,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_3.dll [2009-11-25 09:07:52 | 00,230,168 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_2.dll [2009-11-25 09:07:52 | 00,062,744 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xinput1_2.dll [2009-11-25 09:07:52 | 00,062,672 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xinput1_1.dll [2009-11-25 09:07:51 | 00,229,584 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_1.dll [2009-11-25 09:07:44 | 02,388,176 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_30.dll [2009-11-25 09:07:44 | 00,230,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xactengine2_0.dll [2009-11-25 09:07:44 | 00,014,032 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\x3daudio1_0.dll [2009-11-25 09:07:43 | 02,332,368 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_29.dll [2009-11-25 09:07:43 | 02,323,664 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_28.dll [2009-11-25 09:07:43 | 00,061,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\xinput9_1_0.dll [2009-11-25 09:07:42 | 02,337,488 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_25.dll [2009-11-25 09:07:42 | 02,319,568 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_27.dll [2009-11-25 09:07:42 | 02,297,552 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_26.dll [2009-11-25 09:07:41 | 02,222,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\d3dx9_24.dll [2009-11-25 09:03:32 | 00,000,000 | -H-D | C] -- C:\Program Files\Zero G Registry [2009-11-25 09:03:14 | 00,000,000 | -H-D | C] -- C:\Documents and Settings\Michal\InstallAnywhere [2009-11-25 08:57:28 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite [2009-11-25 08:56:56 | 00,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Lite [2009-11-25 08:53:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Michal\Dane aplikacji\DAEMON Tools Lite [2009-11-24 18:38:35 | 00,000,000 | ---D | C] -- C:\Program Files\SopCast [2009-11-24 14:25:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Symantec [2009-11-24 14:25:54 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Norton [2009-11-24 14:25:52 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\NortonInstaller [2009-11-24 11:24:16 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\Adobe [2009-11-21 10:00:09 | 00,000,000 | ---D | C] -- C:\Program Files\Pontifex Demo [2009-11-20 21:02:06 | 00,000,000 | ---D | C] -- C:\Program Files\Pontifex II Demo [2009-11-13 01:09:54 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft [2009-11-13 01:00:18 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft [2009-11-13 00:56:22 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Microsoft [2009-11-13 00:56:03 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Microsoft [4 C:\Documents and Settings\Michal\*.tmp files -> C:\Documents and Settings\Michal\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2009-12-17 21:19:54 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-12-17 21:19:47 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-12-17 21:18:36 | 03,932,160 | -H-- | M] () -- C:\Documents and Settings\Michal\NTUSER.DAT [2009-12-17 21:18:36 | 00,000,188 | -HS- | M] () -- C:\Documents and Settings\Michal\ntuser.ini [2009-12-17 21:18:16 | 01,115,526 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009-12-17 21:18:16 | 00,500,540 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2009-12-17 21:18:16 | 00,441,458 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2009-12-17 21:18:16 | 00,089,036 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2009-12-17 21:18:16 | 00,071,394 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2009-12-15 21:37:06 | 00,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2009-12-15 19:05:15 | 00,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2009-12-15 16:49:08 | 00,007,680 | ---- | M] () -- C:\Documents and Settings\Michal\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-12-13 14:15:26 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009-12-09 13:41:58 | 00,001,397 | ---- | M] () -- C:\Documents and Settings\Michal\Pulpit\Menedżer urządzeń windows.lnk [2009-12-09 13:38:09 | 00,000,827 | ---- | M] () -- C:\Documents and Settings\Michal\Pulpit\Polski VAG 2.5.lnk [2009-12-09 13:38:09 | 00,000,714 | ---- | M] () -- C:\Documents and Settings\Michal\Pulpit\Polski VAG 4.9.lnk [2009-12-09 13:35:55 | 00,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Adobe Reader 9.lnk [2009-12-04 19:38:23 | 00,002,645 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT [2009-12-02 15:51:05 | 00,000,652 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\eMule.lnk [2009-11-28 06:09:22 | 73,118,3104 | ---- | M] () -- C:\Documents and Settings\Michal\Pulpit\galerianki-pl.avi [2009-11-27 23:52:14 | 05,334,730 | -H-- | M] () -- C:\Documents and Settings\Michal\Ustawienia lokalne\Dane aplikacji\IconCache.db [2009-11-27 17:57:13 | 00,019,152 | ---- | M] () -- C:\Documents and Settings\Michal\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT [2009-11-27 17:57:09 | 00,000,626 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\ipla.lnk [2009-11-27 17:56:40 | 01,700,352 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\gdiplus.dll [2009-11-25 17:31:12 | 00,000,490 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Football Manager 2010.lnk [2009-11-25 09:27:05 | 00,000,918 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Football Manager 2009.lnk [2009-11-25 08:59:24 | 00,001,613 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\DAEMON Tools Lite.lnk [2009-11-25 08:59:23 | 00,691,696 | ---- | M] () -- C:\WINDOWS\System32\drivers\sptd.sys [2009-11-25 04:24:29 | 01,280,480 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\aswBoot.exe [2009-11-25 04:21:09 | 00,093,424 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys [2009-11-25 04:18:57 | 00,023,120 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys [2009-11-25 04:17:54 | 00,027,408 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys [2009-11-25 04:17:28 | 00,097,480 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\AVASTSS.scr [2009-11-24 18:38:36 | 00,000,666 | ---- | M] () -- C:\Documents and Settings\Michal\Pulpit\SopCast.lnk [2009-11-21 10:00:10 | 00,000,717 | ---- | M] () -- C:\Documents and Settings\Michal\Pulpit\Pontifex Demo.lnk [4 C:\Documents and Settings\Michal\*.tmp files -> C:\Documents and Settings\Michal\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2009-12-09 13:38:09 | 00,001,397 | ---- | C] () -- C:\Documents and Settings\Michal\Pulpit\Menedżer urządzeń windows.lnk [2009-12-09 13:38:09 | 00,000,827 | ---- | C] () -- C:\Documents and Settings\Michal\Pulpit\Polski VAG 2.5.lnk [2009-12-09 13:38:09 | 00,000,714 | ---- | C] () -- C:\Documents and Settings\Michal\Pulpit\Polski VAG 4.9.lnk [2009-12-09 13:38:07 | 00,188,416 | ---- | C] () -- C:\WINDOWS\System32\ftdiunin.exe [2009-12-09 13:38:07 | 00,000,133 | ---- | C] () -- C:\WINDOWS\System32\ftdiun2k.ini [2009-12-09 13:35:55 | 00,001,729 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Adobe Reader 9.lnk [2009-12-04 20:59:24 | 73,118,3104 | ---- | C] () -- C:\Documents and Settings\Michal\Pulpit\galerianki-pl.avi [2009-12-04 20:58:45 | 73,415,4752 | ---- | C] () -- C:\Documents and Settings\Michal\Pulpit\Wojna.Polsko.Ruska.2009.PL.DVDRip.XViD-M14CH0.avi [2009-12-02 15:51:05 | 00,000,652 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\eMule.lnk [2009-11-27 18:33:21 | 00,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2009-11-27 17:57:09 | 00,000,626 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\ipla.lnk [2009-11-25 17:31:12 | 00,000,490 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Football Manager 2010.lnk [2009-11-25 09:27:05 | 00,000,918 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Football Manager 2009.lnk [2009-11-25 08:56:58 | 00,001,613 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\DAEMON Tools Lite.lnk [2009-11-25 08:53:57 | 00,691,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2009-11-24 18:38:36 | 00,000,666 | ---- | C] () -- C:\Documents and Settings\Michal\Pulpit\SopCast.lnk [2009-11-21 10:00:10 | 00,000,717 | ---- | C] () -- C:\Documents and Settings\Michal\Pulpit\Pontifex Demo.lnk [2009-11-14 17:39:15 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2009-11-14 07:41:04 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009-11-14 07:41:02 | 00,130,048 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009-11-14 07:41:01 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2009-11-14 07:40:59 | 00,067,584 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009-11-14 07:40:59 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009-11-14 06:41:55 | 00,000,532 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2009-11-13 22:20:41 | 00,016,480 | ---- | C] () -- C:\WINDOWS\System32\rixdicon.dll [2009-11-13 22:07:24 | 00,000,011 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.ini [2009-11-13 07:20:44 | 00,795,648 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2009-11-13 07:19:40 | 00,007,680 | ---- | C] () -- C:\Documents and Settings\Michal\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-11-13 01:05:52 | 00,000,081 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI [2009-11-13 01:00:21 | 00,068,608 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat [2009-02-02 05:32:33 | 00,394,240 | ---- | C] () -- C:\WINDOWS\System32\HMTCD.dll [2008-04-15 15:30:00 | 00,061,440 | ---- | C] () -- C:\WINDOWS\System32\CopyToSendTo.dll < End of report >

**Posty:** 18165 · przez **wojtas** 17 Gru 2009, 22:27

.Uruchom OTL z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware (usuń co znajdzie ) i daj raport ze skanu