Zarazilem sie ld09.exe podobno grozny i nowy wirus

**Posty:** 120 · przez **artursushi** 13 Cze 2009, 18:30

Jestem niby zabazpieczony darmowym Zone Alarmem, Virus Scan On Access i SUPERAntiSpyware 4.26.1004 i wcale nie jest SUPER!! Na stronce nagle otworzył mi sie ADOBE reader choc nic nie naciskalem i juz jestem zainfekowany. Adobe reader tylko sie pokazal ze sie otwiera i sie nie otworzyl. Po restarcie kompa zobaczylem ze cos dziwnego pyta sie Zone Alarma o zgode na wyjscie... Z tego co czytalem ld09.exe to cos nowego i groznego, po starcie chce cos wyslac z mego kompa. KOmp dziwnie sie zachowuje nawet wklejenie loga jest bardzo wolne a pisanie wchodzi z opóxnieniem. scroll z boku tez mi wariuje i nie moge nic zaznaczyc bo wracam do poczatku. Na szczescie Zone Alarm pyta mnie o zgode ale cos czuje ze skoro ten ROBAL od tak sobie wszedl to i nie ma pewnie problemów z wyslaniem czegokolwiek. Od razu uprzedzam ze w GOOGLE sa strasznie komercyjne smieci co niby maja pomoc ale powoduja jeszcze wiecej zamieszania i oczywiscie chca kasy. Takze z gory uprzedzam przed sciaganiem PREVEXU i STOPzilli... STOPZilla doprowadza do szalu bo nie chce sie usunac tylko sie ciagle wciska z 'darmowa'(jasne) oferta i skutecznie wydluza proces usuwania. Wracajac do tematu prosze o pomoc jak sie pozbyc tego ld09.exe i wszystkich opcji co to tworzy. Wrzucam link do logów z OTLa a tu dorzuce Hijacka:

http://www.wklej.org/id/105470/

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 18:17:16, on 2009-06-13 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\Dit.exe C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\ALCWZRD.EXE C:\Program Files\Gigabyte\ET5\GUI.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe C:\Program Files\Windows Media Player\WMPNSCFG.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\WINDOWS\system32\cisvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Network Associates\Common Framework\FrameworkService.exe C:\Program Files\Network Associates\VirusScan\Mcshield.exe C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\User\Pulpit\OTL.exe C:\Documents and Settings\User\Pulpit\HijackThis1991.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo! R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: PDFCreator Toolbar Helper - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: PDFCreator Toolbar - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll O3 - Toolbar: Viewpoint Toolbar - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.9.0\IEViewBar.dll O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [Dit] Dit.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE O4 - HKLM\..\Run: [EasyTuneV] "C:\Program Files\Gigabyte\ET5\GUI.exe" O4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe O4 - HKCU\..\Run: [nvd32_r] rundll32.exe "C:\Documents and Settings\User\Dane aplikacji\unobi.dll" s O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll O10 - Unknown file in Winsock LSP: c:\program files\bonjour\mdnsnsp.dll O11 - Options group: [INTERNATIONAL] International O14 - IERESET.INF: START_PAGE_URL=http://www.vobis.pl/ O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl./resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} (GameDesire Card Games) - http://67.15.101.3/g_bin/pl/cards_2_0_0_71.cab O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} (Cult3D ActiveX Player) - http://www.cult3d.com/download/cult.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1103531480250 O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www3.ca.com/securityadvisor/virusinfo/webscan.cab O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} (ICSScanner Class) - http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37380.cab O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://www.hestia.pl/sigeh/files/ocx/AxisCamControl.cab O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm Element) - http://www.windowsecurity.com/trojanscan/axscan.cab O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} - http://skaner.mks.com.pl/SkanerOnline.cab O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4468/mcfscan.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing) O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing) O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

**Posty:** 18165 · przez **wojtas** 14 Cze 2009, 12:07

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O3 - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006\..\Toolbar\WebBrowser: (no name) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll ()
O3 - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006\..\Toolbar\WebBrowser: (no name) - {DE9C389F-3316-41A7-809B-AA305ED9D922} - Reg Error: Key error. File not found
O4 - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006..\Run: [nvd32_r] rundll32.exe "C:\Documents and Settings\User\Dane aplikacji\unobi.dll" s File not found
O33 - MountPoints2\{69fb5850-5288-11d9-9324-806d6172696f}\Shell\AutoRun\command - "" = D:\autorun.bat -- File not found

:Files
C:\WINDOWS\ld09.exe
C:\Documents and Settings\User\Dane aplikacji\unobi.dll

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .

Następnie uruchamiasz OTL z opcją Run Scan. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia kompa

**Posty:** 120 · przez **artursushi** 14 Cze 2009, 18:42

daje logi choc dla jasnosci wczesniej sam wyrzucilem pare rzeczy Hijackiem w tym tego ld09.exe

Kod: Zaznacz wszystko: ========== OTL ========== Process explorer.exe killed successfully! Registry value HKEY_USERS\S-1-5-21-3794943921-1926355880-1220886193-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{31CF9EBE-5755-4A1D-AC25-2834D952D9B4} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{31CF9EBE-5755-4A1D-AC25-2834D952D9B4}\ not found. File C:\Program Files\PDFCreator Toolbar\v3.0.0.0\PDFCreator_Toolbar.dll not found. Registry value HKEY_USERS\S-1-5-21-3794943921-1926355880-1220886193-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{DE9C389F-3316-41A7-809B-AA305ED9D922} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{DE9C389F-3316-41A7-809B-AA305ED9D922}\ not found. Registry value HKEY_USERS\S-1-5-21-3794943921-1926355880-1220886193-1006\Software\Microsoft\Windows\CurrentVersion\Run\\nvd32_r not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{69fb5850-5288-11d9-9324-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{69fb5850-5288-11d9-9324-806d6172696f}\ not found. File D:\autorun.bat not found. ========== FILES ========== File\Folder C:\WINDOWS\ld09.exe not found. File\Folder C:\Documents and Settings\User\Dane aplikacji\unobi.dll not found. ========== COMMANDS ========== User's Temp folder emptied. User's Internet Explorer cache folder emptied. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_608.dat scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\WFV14.tmp scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\ZLT0635c.TMP scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\ZLT06360.TMP scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\_Date-20090614_Time-165025546_EnterceptExceptions.dat scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\_Date-20090614_Time-165025546_EnterceptRules.dat scheduled to be deleted on reboot. Windows Temp folder emptied. Java cache emptied. Temp folders emptied. Explorer started successfully OTL by OldTimer - Version 2.1.1.0 log created on 06142009_175752 Files moved on Reboot... C:\WINDOWS\temp\Perflib_Perfdata_608.dat moved successfully. File C:\WINDOWS\temp\WFV14.tmp not found! C:\WINDOWS\temp\ZLT0635c.TMP moved successfully. C:\WINDOWS\temp\ZLT06360.TMP moved successfully. C:\WINDOWS\temp\_Date-20090614_Time-165025546_EnterceptExceptions.dat moved successfully. C:\WINDOWS\temp\_Date-20090614_Time-165025546_EnterceptRules.dat moved successfully. Registry entries deleted on Reboot...

Kod: Zaznacz wszystko: OTL logfile created on: 2009-06-14 18:38:55 - Run 2 OTL by OldTimer - Version 2.1.1.0 Folder = C:\Documents and Settings\User\Pulpit Windows XP Home Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1,50 Gb Total Physical Memory | 0,65 Gb Available Physical Memory | 43,59% Memory free 2,06 Gb Paging File | 1,39 Gb Available in Paging File | 67,38% Paging File free Paging file location(s): C:\pagefile.sys 720 1440 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 111,81 Gb Total Space | 56,37 Gb Free Space | 50,41% Space Free | Partition Type: NTFS Unable to calculate disk information. E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: TWOJA-54741CF84 Current User Name: User Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Output = Standard File Age = 30 Days Company Name Whitelist: On [color=orange]========== Processes (SafeList) ==========[/color] PRC - [2008-04-14 19:21:16 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE PRC - [2008-11-07 15:28:16 | 00,132,424 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe PRC - [2008-12-12 12:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe PRC - [2009-03-09 05:19:15 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe PRC - [2004-05-21 09:50:00 | 00,102,463 | ---- | M] (Network Associates, Inc.) -- C:\Program Files\Network Associates\Common Framework\FrameworkService.exe PRC - [2004-05-27 14:00:00 | 00,221,191 | ---- | M] (Network Associates, Inc.) -- C:\Program Files\Network Associates\VirusScan\Mcshield.exe PRC - [2004-05-27 14:00:00 | 00,027,648 | ---- | M] (Network Associates, Inc.) -- C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe PRC - [2004-10-29 17:50:00 | 00,127,043 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe PRC - [2004-05-21 09:50:00 | 00,237,623 | ---- | M] (Network Associates, Inc.) -- C:\Program Files\Network Associates\Common Framework\naPrdMgr.exe PRC - [2008-09-08 17:19:23 | 00,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe PRC - [2006-08-24 05:38:26 | 00,075,768 | ---- | M] (Zone Labs, LLC) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe PRC - [2006-12-01 18:46:28 | 00,918,016 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe PRC - [2008-09-08 17:21:05 | 00,112,072 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe PRC - [2004-01-29 10:31:10 | 00,086,016 | ---- | M] (ICSI Technology Ltd.) -- C:\WINDOWS\Dit.exe PRC - [2004-11-02 15:53:06 | 00,077,824 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE PRC - [2004-11-17 17:18:50 | 02,747,392 | ---- | M] (RealTek Semicoductor Corp.) -- C:\WINDOWS\ALCWZRD.EXE PRC - [2004-06-14 12:54:20 | 00,200,704 | ---- | M] () -- C:\Program Files\Gigabyte\ET5\GUI.exe PRC - [2004-05-27 14:00:00 | 00,090,112 | ---- | M] (Network Associates, Inc.) -- C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE PRC - [2004-05-21 09:50:00 | 00,135,224 | ---- | M] (Network Associates, Inc.) -- C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe PRC - [2006-08-24 05:38:28 | 00,968,696 | ---- | M] (Zone Labs, LLC) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe PRC - [2003-10-07 15:48:56 | 00,147,514 | ---- | M] (Network Associates, Inc.) -- C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe PRC - [2009-01-06 14:06:36 | 00,290,088 | ---- | M] (Apple Inc.) -- C:\Program Files\iTunes\iTunesHelper.exe PRC - [2009-03-09 05:19:17 | 00,148,888 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe PRC - [2009-01-06 14:06:24 | 00,536,872 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe PRC - [2008-11-07 15:31:38 | 21,633,320 | R--- | M] (Skype Technologies S.A.) -- C:\Program Files\Skype\Phone\Skype.exe PRC - [2004-08-04 14:00:00 | 00,008,192 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\cidaemon.exe PRC - [2009-05-27 14:47:57 | 01,830,128 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe PRC - [2009-03-20 14:32:32 | 01,312,256 | ---- | M] (Nokia) -- C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe PRC - [2006-12-01 18:46:38 | 00,204,288 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNSCFG.exe PRC - [2009-03-04 11:25:12 | 00,621,056 | ---- | M] (Nokia.) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe PRC - [2009-03-08 14:09:26 | 00,638,816 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe PRC - [2009-02-17 10:37:10 | 00,128,000 | ---- | M] () -- C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe PRC - [2009-03-09 13:44:12 | 00,130,560 | ---- | M] () -- C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe PRC - [2009-03-08 14:09:26 | 00,638,816 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe PRC - [2008-11-26 12:35:00 | 00,119,808 | ---- | M] () -- C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe PRC - [2008-11-07 15:31:40 | 00,076,744 | R--- | M] (Skype Technologies) -- C:\Program Files\Skype\Plugin Manager\skypePM.exe PRC - [2009-06-13 17:53:05 | 00,501,760 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\User\Pulpit\OTL.exe [color=orange]========== Win32 Services (SafeList) ==========[/color] SRV - [2008-11-07 15:28:16 | 00,132,424 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device [Auto | Running]) SRV - [2007-10-24 01:47:22 | 00,033,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped]) SRV - [2008-12-12 12:17:38 | 00,238,888 | ---- | M] (Apple Inc.) -- C:\Program Files\Bonjour\mDNSResponder.exe -- (Bonjour Service [Auto | Running]) SRV - [2007-10-24 01:47:40 | 00,070,144 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) SRV - [2005-11-30 11:47:52 | 00,013,888 | ---- | M] (ewido networks) -- C:\Program Files\ewido anti-malware\ewidoctrl.exe -- (ewido security suite control [Disabled | Stopped]) SRV - [2005-12-18 19:41:34 | 00,151,616 | ---- | M] (ewido networks) -- C:\Program Files\ewido anti-malware\ewidoguard.exe -- (ewido security suite guard [Disabled | Stopped]) SRV - [2008-07-30 14:46:26 | 00,654,848 | ---- | M] (Macrovision Europe Ltd.) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service [On_Demand | Stopped]) SRV - [2006-10-20 22:21:24 | 00,036,864 | ---- | M] (Microsoft Corporation) -- c:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe -- (FontCache3.0.0.0 [On_Demand | Stopped]) SRV - [2008-04-14 19:20:44 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running]) SRV - [2005-04-04 00:41:10 | 00,069,632 | ---- | M] (Macrovision Corporation) -- C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe -- (IDriverT [On_Demand | Stopped]) SRV - [2006-10-30 04:33:58 | 00,741,376 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe -- (idsvc [Unknown | Stopped]) SRV - [2009-01-06 14:06:24 | 00,536,872 | ---- | M] (Apple Inc.) -- C:\Program Files\iPod\bin\iPodService.exe -- (iPod Service [On_Demand | Running]) SRV - [2009-03-09 05:19:15 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running]) SRV - File not found -- -- (KodakCCS [Disabled | Stopped]) SRV - [2004-05-21 09:50:00 | 00,102,463 | ---- | M] (Network Associates, Inc.) -- C:\Program Files\Network Associates\Common Framework\FrameworkService.exe -- (McAfeeFramework [Auto | Running]) SRV - [2004-05-27 14:00:00 | 00,221,191 | ---- | M] (Network Associates, Inc.) -- C:\Program Files\Network Associates\VirusScan\Mcshield.exe -- (McShield [Auto | Running]) SRV - [2004-05-27 14:00:00 | 00,027,648 | ---- | M] (Network Associates, Inc.) -- C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe -- (McTaskManager [Auto | Running]) SRV - [2006-10-30 04:34:02 | 00,122,880 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe -- (NetTcpPortSharing [Disabled | Stopped]) SRV - [2004-10-29 17:50:00 | 00,127,043 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc [Auto | Running]) SRV - [2009-03-04 11:25:12 | 00,621,056 | ---- | M] (Nokia.) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer [On_Demand | Running]) SRV - [2008-09-08 17:19:23 | 00,024,652 | ---- | M] (Viewpoint Corporation) -- C:\Program Files\Viewpoint\Common\ViewpointService.exe -- (Viewpoint Manager Service [Auto | Running]) SRV - [2006-08-24 05:38:26 | 00,075,768 | ---- | M] (Zone Labs, LLC) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- (vsmon [Auto | Running]) SRV - [2006-12-01 18:46:28 | 00,918,016 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [Auto | Running]) [color=orange]========== Driver Services (SafeList) ==========[/color] DRV - [2009-06-14 18:17:36 | 00,013,440 | ---- | M] (ICSI Technology Ltd.) -- C:\WINDOWS\system32\Drivers\USBCRFT.SYS -- (CardReaderFilter [On_Demand | Stopped]) DRV - [2004-07-28 21:59:35 | 00,009,856 | ---- | M] (Elaborate Bytes AG) -- C:\WINDOWS\System32\Drivers\ElbyCDIO.sys -- (ElbyCDIO [Auto | Running]) DRV - [2004-06-09 00:13:49 | 00,003,968 | ---- | M] (Elaborate Bytes AG) -- C:\WINDOWS\System32\Drivers\ElbyDelay.sys -- (ElbyDelay [On_Demand | Running]) DRV - [2004-09-21 01:09:10 | 00,186,584 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\Drivers\ET5Drv.sys -- (ET5Drv [On_Demand | Running]) DRV - [2005-12-30 13:12:18 | 00,003,072 | ---- | M] () -- C:\Program Files\ewido anti-malware\guard.sys -- (ewido security suite driver [System | Running]) DRV - [2008-04-17 13:12:54 | 00,015,464 | ---- | M] (GEAR Software Inc.) -- C:\WINDOWS\SYSTEM32\DRIVERS\GEARAspiWDM.sys -- (GEARAspiWDM [On_Demand | Running]) DRV - [2004-08-12 18:45:52 | 00,113,664 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\system32\drivers\HdAudio.sys -- (HdAudAddService [On_Demand | Stopped]) DRV - [2008-04-13 18:36:05 | 00,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\system32\DRIVERS\HDAudBus.sys -- (HDAudBus [On_Demand | Running]) DRV - [2005-01-23 12:05:06 | 00,804,317 | ---- | M] (Intel Corporation) -- C:\WINDOWS\system32\DRIVERS\ialmnt5.sys -- (ialm [On_Demand | Stopped]) DRV - [2004-11-17 17:54:02 | 02,340,480 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService [On_Demand | Running]) DRV - [2003-04-15 11:16:48 | 00,008,236 | ---- | M] (Windows (R) 2000 DDK provider) -- C:\Program Files\Gigabyte\ET5\markfun.w32 -- (MarkFun_NT [On_Demand | Running]) DRV - [2007-09-05 01:46:34 | 00,092,544 | ---- | M] (MagicISO, Inc.) -- C:\WINDOWS\system32\DRIVERS\mcdbus.sys -- (mcdbus [On_Demand | Running]) DRV - [2002-07-15 20:16:02 | 00,034,706 | ---- | M] (TGE, Ltd.) -- C:\WINDOWS\System32\Drivers\Mp3Drv.sys -- (Mp3Drv [On_Demand | Stopped]) DRV - [2004-05-27 14:00:00 | 00,105,664 | ---- | M] (Network Associates, Inc.) -- C:\WINDOWS\system32\drivers\naiavf5x.sys -- (NaiAvFilter1 [On_Demand | Running]) DRV - [2004-05-27 14:00:00 | 00,055,520 | ---- | M] (Network Associates, Inc.) -- C:\WINDOWS\system32\drivers\mvstdi5x.sys -- (NaiAvTdi1 [System | Running]) DRV - [2005-11-10 02:02:29 | 00,057,062 | ---- | M] (Neoteris) -- C:\WINDOWS\system32\Drivers\NEOFLTR_510_9467.SYS -- (NEOFLTR_510_9467 [System | Running]) DRV - [2009-02-09 07:37:46 | 00,017,664 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd [On_Demand | Stopped]) DRV - [2009-02-09 07:37:46 | 00,022,016 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc [On_Demand | Stopped]) DRV - [2009-03-19 13:48:18 | 00,136,704 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\nmwcdnsu.sys -- (nmwcdnsu [On_Demand | Stopped]) DRV - [2009-03-19 13:48:12 | 00,008,320 | ---- | M] (Nokia) -- C:\WINDOWS\system32\drivers\nmwcdnsuc.sys -- (nmwcdnsuc [On_Demand | Stopped]) DRV - [2004-10-29 17:50:00 | 02,826,944 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Running]) DRV - [2008-08-26 10:26:12 | 00,018,816 | ---- | M] (Nokia) -- C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys -- (pccsmcfd [On_Demand | Stopped]) DRV - [2004-08-04 14:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\system32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running]) DRV - [2004-09-23 03:03:00 | 00,020,576 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\system32\DRIVERS\PxHelp20.sys -- (PxHelp20 [Boot | Running]) DRV - [2004-04-13 20:14:12 | 00,070,144 | ---- | M] (Realtek Semiconductor Corporation ) -- C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys -- (RTL8023xp [On_Demand | Running]) DRV - [2009-04-08 20:26:01 | 00,009,968 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV [System | Running]) DRV - [2006-02-16 17:51:08 | 00,004,096 | R--- | M] (SuperAdBlocker, Inc.) -- C:\Program Files\SUPERAntiSpyware\SASENUM.SYS -- (SASENUM [On_Demand | Running]) DRV - [2009-04-08 20:25:53 | 00,055,024 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys -- (SASKUTIL [System | Running]) DRV - [2008-07-07 09:40:49 | 00,056,108 | ---- | M] (PowerISO Computing, Inc.) -- C:\WINDOWS\System32\drivers\scdemu.sys -- (SCDEmu [System | Running]) DRV - [2007-11-13 12:25:55 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\system32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped]) DRV - [2006-10-06 18:00:27 | 00,029,680 | ---- | M] (Zone Labs, LLC) -- C:\WINDOWS\system32\ZoneLabs\srescan.sys -- (srescan [Boot | Running]) DRV - [2005-12-22 18:24:50 | 00,080,272 | ---- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\sscdbus.sys -- (sscdbus [On_Demand | Stopped]) DRV - [2005-12-22 18:24:52 | 00,010,864 | ---- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys -- (sscdmdfl [On_Demand | Stopped]) DRV - [2005-12-22 18:24:52 | 00,137,884 | ---- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\sscdmdm.sys -- (sscdmdm [On_Demand | Stopped]) DRV - [2005-03-30 03:47:42 | 00,052,416 | ---- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\ssm_bus.sys -- (ssm_bus [On_Demand | Stopped]) DRV - [2005-08-30 07:49:34 | 00,008,336 | ---- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\ssm_mdfl.sys -- (ssm_mdfl [On_Demand | Stopped]) DRV - [2005-08-30 07:49:38 | 00,094,000 | ---- | M] (MCCI) -- C:\WINDOWS\system32\DRIVERS\ssm_mdm.sys -- (ssm_mdm [On_Demand | Stopped]) DRV - [2008-12-19 13:10:35 | 00,005,632 | ---- | M] () -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen [System | Running]) DRV - [2002-07-15 20:15:42 | 00,048,397 | ---- | M] (TGE, Ltd.) -- C:\WINDOWS\system32\DRIVERS\StScsi.sys -- (StScsi [On_Demand | Stopped]) DRV - [2009-02-09 07:37:48 | 00,007,808 | ---- | M] (Nokia) -- C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys -- (upperdev [On_Demand | Stopped]) DRV - [2008-07-10 09:35:22 | 00,032,000 | ---- | M] (Apple, Inc.) -- C:\WINDOWS\System32\Drivers\usbaapl.sys -- (USBAAPL [On_Demand | Stopped]) DRV - [2008-04-13 21:45:36 | 00,026,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\drivers\usbser.sys -- (usbser [On_Demand | Stopped]) DRV - [2009-02-09 07:37:56 | 00,007,808 | ---- | M] (Nokia) -- C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys -- (UsbserFilt [On_Demand | Stopped]) DRV - [2006-08-24 05:38:36 | 00,392,824 | ---- | M] (Zone Labs, LLC) -- C:\WINDOWS\System32\vsdatant.sys -- (vsdatant [System | Running]) DRV - [2004-05-27 14:00:00 | 00,008,704 | ---- | M] (Network Associates, Inc) -- C:\WINDOWS\system32\drivers\EntDrv51.sys -- (EntDrv51 [On_Demand | Running]) [color=orange]========== Standard Registry (SafeList) ==========[/color] [color=orange]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.vobis.pl/ IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.vobis.pl/ IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.vobis.pl/ IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.vobis.pl/ IE - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/?fr=fp-yie8 IE - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = IE - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ IE - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = IE - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006\S-1-5-21-3794943921-1926355880-1220886193-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006\S-1-5-21-3794943921-1926355880-1220886193-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local [color=orange]========== FireFox ==========[/color] FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.startup.homepage: "www.yahoo.com" FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2008-12-04 12:07:34 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\extensions\\bkmrksync@nokia.com: C:\PROGRAM FILES\NOKIA\NOKIA PC SUITE 7\BKMRKSYNC\ [2009-04-27 13:48:40 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 1.0.7\Extensions\\Components: C:\PROGRAM FILES\MOZILLA FIREFOX\COMPONENTS [2009-03-01 19:01:43 | 00,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 1.0.7\Extensions\\Plugins: C:\PROGRAM FILES\MOZILLA FIREFOX\PLUGINS [2009-03-01 19:01:43 | 00,000,000 | ---D | M] [2006-12-10 13:39:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\mozilla\Firefox\Profiles\37xge8uj.default\extensions [2005-10-13 01:29:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\mozilla\Firefox\Profiles\37xge8uj.default\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2006-02-17 22:34:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\mozilla\Firefox\Profiles\nuifmewr.Art\extensions [2006-02-17 22:34:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\mozilla\Firefox\Profiles\nuifmewr.Art\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009-04-01 14:05:52 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions [2005-10-13 12:37:45 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2008-04-03 10:58:43 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} [2008-08-04 11:08:28 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} [2008-12-04 12:08:00 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} [2009-04-01 14:05:52 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [2005-10-13 01:29:16 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\defaults\profile\extensions [2005-10-13 01:29:16 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\defaults\profile\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} [2005-09-19 14:03:00 | 00,094,208 | ---- | M] () -- C:\Program Files\mozilla firefox\components\BrandRes.dll [2005-09-19 14:03:00 | 00,150,912 | ---- | M] (Full Circle Software, Inc.) -- C:\Program Files\mozilla firefox\components\fullsoft.dll [2005-09-19 14:03:00 | 00,041,578 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\jar50.dll [2005-09-19 14:03:00 | 00,048,228 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\jsd3250.dll [2005-09-19 14:03:00 | 00,008,818 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\qfaservices.dll [2005-09-19 14:03:00 | 00,160,876 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\xpinstal.dll [2006-08-20 17:45:37 | 00,003,710 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro.png [2006-08-20 17:45:37 | 00,001,030 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro.src [2005-09-19 14:03:00 | 00,001,076 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.gif [2008-02-12 17:02:36 | 00,000,750 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\google.src [2005-09-19 14:03:00 | 00,000,260 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\onet.gif [2005-09-19 14:03:00 | 00,000,944 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\onet.src [2005-09-19 14:03:00 | 00,000,318 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn.gif [2005-09-19 14:03:00 | 00,000,582 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn.src [2008-07-28 19:25:32 | 00,000,718 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Szukacz.png [2008-07-28 19:25:32 | 00,000,934 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Szukacz.src [2005-09-19 14:03:00 | 00,000,459 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.png [2005-09-19 14:03:00 | 00,001,056 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.src O1 HOSTS File: (364 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O3 - HKLM\..\Toolbar: (Viewpoint Toolbar) - {F8AD5AA5-D966-4667-9DAF-2561D68B2012} - C:\Program Files\Common Files\Viewpoint\Toolbar Runtime\3.9.0\IEViewBar.dll (Viewpoint Corporation) O3 - HKLM\..\Toolbar: (no name) - SITEguard - Reg Error: Key error. File not found O3 - HKU\.DEFAULT\..\Toolbar\WebBrowser: (no name) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - Reg Error: Key error. File not found O3 - HKU\S-1-5-18\..\Toolbar\WebBrowser: (no name) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - Reg Error: Key error. File not found O4 - HKLM..\Run: [AlcWzrd] ALCWZRD.EXE (RealTek Semicoductor Corp.) O4 - HKLM..\Run: [Dit] Dit.exe (ICSI Technology Ltd.) O4 - HKLM..\Run: [EasyTuneV] "C:\Program Files\Gigabyte\ET5\GUI.exe" () O4 - HKLM..\Run: [High Definition Audio Property Page Shortcut] HDAudPropShortcut.exe (Windows (R) Server 2003 DDK provider) O4 - HKLM..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe (Intel Corporation) O4 - HKLM..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe (Intel Corporation) O4 - HKLM..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" (Apple Inc.) O4 - HKLM..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey (Network Associates, Inc.) O4 - HKLM..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" (Network Associates, Inc.) O4 - HKLM..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] "RUNDLL32.EXE" C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit (NVIDIA Corporation) O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (Apple Inc.) O4 - HKLM..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE (Network Associates, Inc.) O4 - HKLM..\Run: [SoundMan] SOUNDMAN.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.) O4 - HKLM..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" (Zone Labs, LLC) O4 - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray (Nokia) O4 - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized (Skype Technologies S.A.) O4 - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com) O4 - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (Microsoft Corporation) O4 - HKLM..\RunOnceEx: [] File not found O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\control panel present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\control panel present O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\restrictions present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\control panel present O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\restrictions present O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\control panel present O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\restrictions present O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\control panel present O7 - HKU\S-1-5-19_Classes\Software\Policies\Microsoft\Internet Explorer\restrictions present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\control panel present O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\restrictions present O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\control panel present O7 - HKU\S-1-5-20_Classes\Software\Policies\Microsoft\Internet Explorer\restrictions present O7 - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006\Software\Policies\Microsoft\Internet Explorer\control panel present O7 - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006\Software\Policies\Microsoft\Internet Explorer\restrictions present O7 - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006_Classes\Software\Policies\Microsoft\Internet Explorer\control panel present O7 - HKU\S-1-5-21-3794943921-1926355880-1220886193-1006_Classes\Software\Policies\Microsoft\Internet Explorer\restrictions present O9 - Extra Button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [mdnsNSP] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} http://upload.facebook.com/controls/FacebookPhotoUploader5.cab (Facebook Photo Uploader 5) O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} http://www.kaspersky.pl./resources/virusscanner/kavwebscan_unicode.cab (CKAVWebScan Object) O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} http://67.15.101.3/g_bin/pl/cards_2_0_0_71.cab (GameDesire Card Games) O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} http://us.chat1.yimg.com/us.yimg.com/i/chat/applet/v45/yacscom.cab (Yahoo! Audio Conferencing) O16 - DPF: {31B7EB4E-8B4B-11D1-A789-00A0CC6651A8} http://www.cult3d.com/download/cult.cab (Cult3D ActiveX Player) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://v5.windowsupdate.microsoft.com/v5consumer/V5Controls/en/x86/client/wuweb_site.cab?1103531480250 (WUWebControl Class) O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} http://www3.ca.com/securityadvisor/virusinfo/webscan.cab (WScanCtl Class) O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} http://chat.yahoo.com/cab/yacsui.cab (Yahoo! Audio UI1) O16 - DPF: {7F8C8173-AD80-4807-AA75-5672F22B4582} http://download.zonelabs.com/bin/promotions/spywaredetector/ICSScanner37380.cab (ICSScanner Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} http://www.hestia.pl/sigeh/files/ocx/AxisCamControl.cab (CamImage Class) O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} http://www.windowsecurity.com/trojanscan/axscan.cab (ASquaredScanForm Element) O16 - DPF: {CAFEEFAC-0014-0002-0005-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E7544C6C-CFD6-43EA-B4E9-360CEE20BDF7} http://skaner.mks.com.pl/SkanerOnline.cab (Reg Error: Key error.) O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4468/mcfscan.cab (McFreeScan Class) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\!SASWinLogon: DllName - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com) O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\system32\igfxsrvc.dll (Intel Corporation) O28 - HKLM ShellExecuteHooks: {54D9498B-CF93-414F-8984-8CE7FDE0D391} - C:\Program Files\ewido anti-malware\shellhook.dll () O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com) O28 - HKLM ShellExecuteHooks: {93994DE8-8239-4655-B1D1-5F4E91300429} - C:\Program Files\DVD Region+CSS Free\DVDShell.dll (Fengtao Software Inc.) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2004-12-18 17:22:58 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - * [2009-06-14 18:38:40 | 00,000,000 | ---D | M] O34 - HKLM BootExecute: (SsiEfr.e) - File not found O34 - HKLM BootExecute: (SsiEfr.e) - File not found O34 - HKLM BootExecute: (SsiEfr.e) - File not found [color=orange]========== Files/Folders - Created Within 30 Days ==========[/color] [2009-06-14 17:21:35 | 00,000,000 | ---D | C] -- C:\_OTL [2009-06-13 17:52:54 | 00,501,760 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\User\Pulpit\OTL.exe [2009-06-13 15:52:05 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\SITEguard [2009-06-13 15:50:59 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\iS3 [2009-06-13 15:50:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\STOPzilla! [2009-06-13 15:27:28 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Pulpit\backups [2009-06-12 11:51:13 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Moje dokumenty\Version Cue [2009-06-12 11:51:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Moje dokumenty\AdobeStockPhotos [2009-06-10 08:49:15 | 00,012,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\xpshims.dll [2009-06-10 08:49:14 | 01,985,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iertutil.dll [2009-06-10 08:49:14 | 00,246,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieproxy.dll [2009-06-10 08:49:12 | 11,064,832 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieframe.dll [2009-06-09 13:44:04 | 00,156,913 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\PRO_215078_2009[1].pdf [2009-06-07 14:35:45 | 00,078,363 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\FOTO PISTAS TENIS.jpg [2009-06-04 13:21:29 | 00,297,427 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\20090604170.jpg [2009-06-04 13:21:28 | 00,405,963 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\20090604169.jpg [2009-06-04 13:21:28 | 00,340,563 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\20090604168.jpg [2009-05-26 12:47:53 | 00,135,168 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\Artur Koziorowski kalkulacja.xls [2009-05-25 02:58:47 | 00,001,829 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\ING SidomaOnLine 8.lnk [2008-12-19 13:11:32 | 00,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys [2008-11-25 15:25:00 | 00,000,041 | ---- | C] () -- C:\WINDOWS\Filzip.ini [2008-07-31 10:09:56 | 00,000,063 | ---- | C] () -- C:\WINDOWS\wininit.ini [2007-06-04 21:46:00 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\emfxp.dll [2007-04-18 22:14:42 | 00,000,029 | ---- | C] () -- C:\WINDOWS\atid.ini [2006-10-31 11:31:21 | 00,684,032 | ---- | C] () -- C:\WINDOWS\System32\libeay32.dll [2006-10-31 11:31:21 | 00,155,648 | ---- | C] () -- C:\WINDOWS\System32\ssleay32.dll [2006-10-10 11:02:28 | 00,116,224 | ---- | C] () -- C:\WINDOWS\System32\pdfcmnnt.dll [2006-08-15 00:27:28 | 00,796,584 | ---- | C] () -- C:\WINDOWS\System32\libeay32_0.9.6l.dll [2006-06-22 03:45:18 | 02,729,472 | ---- | C] () -- C:\WINDOWS\System32\fun_avcodec.dll [2006-06-22 02:41:58 | 02,067,140 | R--- | C] () -- C:\WINDOWS\System32\avcodec.dll [2006-04-14 23:24:10 | 00,684,032 | ---- | C] () -- C:\WINDOWS\libeay32.dll [2006-04-14 23:24:10 | 00,155,648 | ---- | C] () -- C:\WINDOWS\ssleay32.dll [2006-02-17 15:39:16 | 00,155,648 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2006-02-17 15:39:15 | 00,679,936 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2006-01-24 00:35:33 | 00,000,101 | ---- | C] () -- C:\WINDOWS\DVDRegionFree.INI [2005-05-26 18:02:56 | 00,000,000 | ---- | C] () -- C:\WINDOWS\regset.INI [2005-03-11 10:35:40 | 00,000,427 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2005-03-08 14:50:41 | 00,000,032 | ---- | C] () -- C:\WINDOWS\KEMP3.Ini [2005-03-02 12:03:35 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2005-02-08 09:15:38 | 00,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2004-12-20 09:10:47 | 00,000,260 | ---- | C] () -- C:\WINDOWS\Dit.INI [2004-12-20 09:09:48 | 00,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll [2004-12-19 01:07:30 | 00,000,736 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2004-12-19 01:07:03 | 00,001,434 | ---- | C] () -- C:\WINDOWS\win.ini [2004-12-19 01:07:01 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini [2002-12-06 00:51:00 | 00,059,392 | R--- | C] () -- C:\WINDOWS\System32\streamhlp.dll [2000-09-08 17:53:50 | 00,073,839 | ---- | C] () -- C:\WINDOWS\System32\KodakOneTouch.dll [1999-01-22 17:46:58 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL [color=orange]========== Files - Modified Within 30 Days ==========[/color] [1 C:\WINDOWS\*.tmp files] [2009-06-14 18:17:39 | 00,017,145 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml [2009-06-14 18:17:36 | 00,013,440 | ---- | M] (ICSI Technology Ltd.) -- C:\WINDOWS\System32\drivers\USBCRFT.SYS [2009-06-14 18:11:16 | 00,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009-06-14 18:11:10 | 00,048,883 | -H-- | M] () -- C:\WINDOWS\System32\vsconfig.xml [2009-06-14 18:10:11 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\User\Ustawienia lokalne\desktop.ini [2009-06-14 18:10:11 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-06-14 18:10:09 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-06-14 17:33:07 | 00,000,512 | ---- | M] () -- C:\WINDOWS\randseed.rnd [2009-06-13 20:26:57 | 00,000,101 | ---- | M] () -- C:\WINDOWS\DVDRegionFree.INI [2009-06-13 17:53:05 | 00,501,760 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\User\Pulpit\OTL.exe [2009-06-13 15:42:23 | 00,000,063 | ---- | M] () -- C:\WINDOWS\wininit.ini [2009-06-13 01:58:55 | 00,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2009-06-11 18:45:00 | 00,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2009-06-11 09:38:04 | 01,447,168 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2009-06-11 09:25:37 | 00,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK [2009-06-09 13:44:04 | 00,156,913 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\PRO_215078_2009[1].pdf [2009-06-07 14:35:47 | 00,078,363 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\FOTO PISTAS TENIS.jpg [2009-06-04 11:05:10 | 00,297,427 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\20090604170.jpg [2009-06-04 11:03:48 | 00,405,963 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\20090604169.jpg [2009-06-04 11:03:10 | 00,340,563 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\20090604168.jpg [2009-06-01 18:51:12 | 23,635,392 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe [2009-05-26 12:47:56 | 00,135,168 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\Artur Koziorowski kalkulacja.xls [2009-05-25 02:58:47 | 00,001,829 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\ING SidomaOnLine 8.lnk [color=orange]========== LOP Check ==========[/color] [2006-04-11 22:12:00 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji [2004-12-20 13:35:27 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Adobe [2004-12-20 13:35:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\AdobeUM [2004-12-20 09:27:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\CyberLink [2004-12-18 17:23:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Identities [2006-04-11 22:12:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Juniper Networks [2005-02-03 11:55:16 | 00,000,000 | --SD | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Microsoft [2004-12-18 17:23:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Sun [2009-06-13 17:49:34 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Dane aplikacji [2009-03-01 19:05:59 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\{3276BE95_AF08_429F_A64F_CA64CB79BCF6} [2005-04-20 10:06:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ABBYY [2008-07-30 15:14:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Adobe [2007-06-13 13:15:26 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\AOL [2007-04-18 22:17:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\AOL Downloads [2007-12-04 14:13:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Apple [2006-10-20 11:57:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer [2004-12-20 09:26:23 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\CyberLink [2008-04-04 09:35:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Downloaded Installations [2008-07-30 15:05:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\FLEXnet [2009-04-27 14:17:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Installations [2008-08-04 15:11:08 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab [2005-03-05 20:14:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Kazaa Lite [2005-11-08 16:06:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Kodak [2009-01-19 12:42:59 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes [2006-08-16 10:55:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\McAfee.com [2009-01-02 18:51:41 | 00,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft [2006-08-16 12:10:24 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Network Associates [2009-04-27 14:17:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Nokia [2005-03-03 15:12:42 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\nView_Profiles [2008-12-19 14:19:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite [2005-06-07 09:16:35 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\QuickTime [2009-06-13 17:43:10 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\SITEguard [2007-05-24 09:20:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Skype [2008-04-18 10:41:08 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy [2009-06-13 17:47:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\STOPzilla! [2007-11-05 08:50:08 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\SUPERAntiSpyware.com [2005-10-30 15:55:56 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Trymedia [2007-07-10 08:09:22 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Viewpoint [2006-03-05 13:15:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Windows Genuine Advantage [2009-06-12 12:01:19 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Yahoo! [2004-12-20 13:35:40 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Default User\Dane aplikacji [2004-12-20 13:35:27 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Dane aplikacji\Adobe [2004-12-20 13:35:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Dane aplikacji\AdobeUM [2004-12-20 09:27:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Dane aplikacji\CyberLink [2004-12-18 17:23:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Dane aplikacji\Identities [2005-02-03 11:55:16 | 00,000,000 | --SD | M] -- C:\Documents and Settings\Default User\Dane aplikacji\Microsoft [2004-12-18 17:23:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\Default User\Dane aplikacji\Sun [2008-04-03 19:38:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Dane aplikacji [2005-09-05 11:48:03 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Adobe [2005-09-05 11:48:08 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\AdobeUM [2005-12-08 02:34:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Juniper Networks [2005-05-27 21:20:11 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Macromedia [2007-01-10 02:03:16 | 00,000,000 | --SD | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Microsoft [2006-05-16 11:11:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Mozilla [2006-05-16 11:11:55 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Dane aplikacji\Talkback [2008-04-03 19:38:45 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji [2005-12-01 17:04:18 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Juniper Networks [2007-01-10 02:03:18 | 00,000,000 | --SD | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji\Microsoft [2009-06-14 17:21:39 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\User\Dane aplikacji [2005-04-20 10:07:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\ABBYY [2009-06-13 00:44:47 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Adobe [2009-06-13 01:08:34 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\AdobeUM [2009-06-12 11:59:44 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Aim [2008-07-24 14:10:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Apple Computer [2007-02-22 14:35:43 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\ConvertTemp [2004-12-20 09:27:13 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\CyberLink [2005-11-21 14:04:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Dokumenty AFi [2005-10-31 13:58:50 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\funkitron [2005-03-21 22:23:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Help [2004-12-18 17:23:07 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Identities [2007-11-17 12:31:33 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Juniper Networks [2009-01-02 18:51:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Lavasoft [2005-03-03 15:08:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Macromedia [2009-01-19 12:43:05 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Malwarebytes [2006-03-14 12:11:32 | 00,000,000 | --SD | M] -- C:\Documents and Settings\User\Dane aplikacji\Microsoft [2005-03-11 10:31:46 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Microsoft Web Folders [2005-10-13 01:29:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Mozilla [2009-04-27 14:58:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Nokia [2009-03-02 12:14:51 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\PC Suite [2008-07-06 15:46:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\PPMate [2006-07-31 00:39:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Samsung [2009-06-14 18:39:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Skype [2009-06-14 16:49:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\skypePM [2004-12-18 17:23:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Sun [2007-11-05 08:49:56 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\SUPERAntiSpyware.com [2005-10-13 01:29:36 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Talkback [2008-06-19 12:04:37 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Temporary [2008-08-06 19:31:12 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\TransRender [2006-04-12 00:12:40 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\TrojanHunter [2007-07-10 08:09:25 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Viewpoint [2009-04-09 10:09:03 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Yahoo! [2009-06-11 18:45:00 | 00,000,284 | ---- | M] () -- C:\WINDOWS\Tasks\AppleSoftwareUpdate.job [2004-08-04 14:00:00 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini [2009-06-14 18:10:11 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT [color=orange]========== Purity Check ==========[/color] < End of report >

**Posty:** 18165 · przez **wojtas** 15 Cze 2009, 00:18

1.Uruchom OTL z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
4. Wykonaj skan Dr. Web CureIt
5. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym (skasuj co znajdzie)

Malwarebytes Anti-Malware

Jeśli masz Adobe Reader to zaaktualizuj go do najnowszej wersji

**Posty:** 120 · przez **artursushi** 15 Cze 2009, 11:25

nie wiem o co chodzi ale wczoraj w OTLu nacisnalem "clean up" a dzis nie mam juz OTL na pulpicie. 2 to aplikacja gieldowa "Sidoma 8" zmienila ikonke na nierozpoznawalna i nie moge sie polaczyc przez nia z bankiem. czy tak sie ten OTL zachowuje?

Czy znow mam sciagnac OTLa zeby zrobic ten clean up czy to wlasnie na tym polega ze on sobie znika?

**Posty:** 18165 · przez **wojtas** 15 Cze 2009, 13:11

otl wyczyscil pliki po sobie... co do tej aplikacji to przeinstaluj ja i czekam na raport

Autor postu otrzymał pochwałę

**Posty:** 120 · przez **artursushi** 15 Cze 2009, 16:20

Oki zrobilem juz wszystko z wyjatkiem Kasperskiego i analizy bledów w optymalizacji systemu (po wlaczeniu jakos nie kwapil sie do tego sprawdzenia)... ale wieloma programami skanowalem kompa w tym AntiMalware i wszedzie mam informacje ze jestem czysty. I tak juz szykowalem sie do przeinstalowanie Windowsa XP jako ze ciagle mi cos w tle liczyl, po "wylacz komputer" rozlaczal sie z 5 minutowym opoznieniem i generalnie po 5 latach chyba mozna to zrobic

wiec tylko chcialem sie pozbyc tego ld09.exe bo w miedzy czasie jeszcze lacze sie z bankiem i wstukuje jakies kody. Generalnie DZIEKI bo procesor wyluzowal i przestal juz ciagle cos robic w tle pewnie dzieki defragmentacji Diskeeperem... no i chyba pozbylem sie tego wrusa tym OTLem.

Wielkie dzieki Artur