Zawieszenie kompa, pojawianie się komunikatu brak dysku

[Kamcia]

Witam,
od miesiąca pojawia się bezustannie komunikat "System Windows - Brak dysku", dokładnie widać to na screenie => http://img149.imageshack.us/i/kom.jpg/ . Przy wciśnięciu na jakieś foto poprzez Pogląd obrazów i faksów systemu Windows, występuje okienko z informacją : "RUNDLL. Wystąpił błąd podczas ładowania C:\WINDOWS\system32\shimgvw.dll. Nieprawidłowy dostęp do komórki pamięci." A po godzinie korzystania z kompa, zawiesza się całkowicie, a w przypadku gdy np chcę wyszukać plik na dysku, wiesza się od razu. Jeszcze do tego, gdy chcę uruchomić menedżer zadań, wyskakuje kolejny komunikat: 'Menedżer zadań został wyłączony przez administratora". Dodam,że mam kompa bez zabezpieczeń...

Log z rsit

Kod: Zaznacz wszystko

Logfile of random's system information tool 1.06 (written by random/random)
Run by SysOp at 2009-07-18 13:50:50
Microsoft Windows XP Professional Dodatek Service Pack 3
System drive C: has 30 GB (80%) free of 38 GB
Total RAM: 255 MB (8% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:51:00, on 2009-07-18
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\blueconnect\blueconnect.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\DOCUME~1\SysOp\USTAWI~1\Temp\winhlxvg.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe
C:\Documents and Settings\SysOp\Moje dokumenty\Pobieranie\RSIT.exe
C:\Program Files\trend micro\SysOp.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nasza-klasa.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: IEPluginBHO - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\SysOp\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKCU\..\Run: [ctfmon.exe] ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [_nltide_3] rundll32 advpack.dll,LaunchINFSectionEx nLite.inf,C,,4,N (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [_nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user')
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: Kolekcja wycinków HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Zaznaczanie HP Smart - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {CAFEEFAC-0016-0000-0000-ABCDEFFEDCBA} (Java Plug-in 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u7-windows-i586.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{7153DEB3-FDDC-4D72-8935-B667AA97368E}: NameServer = 213.158.199.1 213.158.199.5
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

--
End of file - 6388 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0347C33E-8762-4905-BF09-768834316C61}]
HP Print Enhancer - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll [2007-03-02 1298024]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{053F9267-DC04-4294-A72C-58F732D338C0}]
HP Print Clips - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll [2007-03-02 177768]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-06-22 259696]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.15642\swg.dll [2009-06-27 669168]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C84D72FE-E17D-4195-BB24-76C02E2E7C4E}]
Google Dictionary Compression sdch - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll [2009-06-22 470512]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D}]
IEPluginBHO Class - C:\Documents and Settings\SysOp\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll [2009-05-28 42088]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll [2009-06-22 259696]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2007-04-16 577536]
"SunJavaUpdateSched"=C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784]
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 113520]
"HP Software Update"=C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-03-11 49152]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2001-02-20 8192]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-06-22 39408]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2008-12-31 133632]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=1
"DisableRegistryTools"=1

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableLUA"=0

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoSMHelp"=1
"NoSMConfigurePrograms"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\Nowe Gadu-Gadu\gg.exe"="C:\Program Files\Nowe Gadu-Gadu\gg.exe:*:Enabled:ipsec"
"I:\rcmabx.pif"="I:\rcmabx.pif:*:Enabled:ipsec"
"C:\Program Files\Internet Explorer\iexplore.exe"="C:\Program Files\Internet Explorer\iexplore.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\lkxec.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\lkxec.exe:*:Enabled:ipsec"
"C:\Program Files\Windows Media Player\wmplayer.exe"="C:\Program Files\Windows Media Player\wmplayer.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\kgywoa.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\kgywoa.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\hhyw.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\hhyw.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\xarckh.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\xarckh.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\rundll32.exe"="C:\WINDOWS\system32\rundll32.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\ybvwq.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\ybvwq.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winkjbo.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winkjbo.exe:*:Enabled:ipsec"
"C:\Program Files\Internet Explorer\iedw.exe"="C:\Program Files\Internet Explorer\iedw.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winijye.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winijye.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\mypd.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\mypd.exe:*:Enabled:ipsec"
"C:\WINDOWS\system32\freecell.exe"="C:\WINDOWS\system32\freecell.exe:*:Enabled:ipsec"
"C:\WINDOWS\Explorer.EXE"="C:\WINDOWS\Explorer.EXE:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winbohy.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winbohy.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winflvsjc.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winflvsjc.exe:*:Enabled:ipsec"
"C:\Program Files\blueconnect\blueconnect.exe"="C:\Program Files\blueconnect\blueconnect.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\lgqo.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\lgqo.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\tptn.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\tptn.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\slrwyk.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\slrwyk.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winjkbxf.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winjkbxf.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\wintjba.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\wintjba.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winglkdjf.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winglkdjf.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winjglv.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winjglv.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\tjam.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\tjam.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\wingmjy.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\wingmjy.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winyhvfni.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winyhvfni.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winuxgmr.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winuxgmr.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winhjfukb.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winhjfukb.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\kytj.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\kytj.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winntmi.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winntmi.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winlebak.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winlebak.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winechjo.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winechjo.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\vefhm.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\vefhm.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\vxlx.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\vxlx.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\jajvcj.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\jajvcj.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\wxfyi.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\wxfyi.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\wingbhhp.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\wingbhhp.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\fiscqn.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\fiscqn.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winctrfd.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winctrfd.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winfipil.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winfipil.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winrelcj.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winrelcj.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\voma.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\voma.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\kvlnov.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\kvlnov.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winawxano.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winawxano.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\xnuc.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\xnuc.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winggjvv.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winggjvv.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\ysovq.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\ysovq.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\olrib.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\olrib.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\umbuxk.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\umbuxk.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winqmue.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winqmue.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\adhid.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\adhid.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winkult.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winkult.exe:*:Enabled:ipsec"
"C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winxlpjsg.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winxlpjsg.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\jpetmy.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\jpetmy.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winrugdqp.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winrugdqp.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winjubgdm.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winjubgdm.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\vutm.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\vutm.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winjralal.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winjralal.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winuyybp.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winuyybp.exe:*:Enabled:ipsec"
"C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"="C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\wckgdx.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\wckgdx.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winxaybis.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winxaybis.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winsclga.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winsclga.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\stsfso.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\stsfso.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\wineoylje.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\wineoylje.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\mocsw.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\mocsw.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winepal.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winepal.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\flcovv.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\flcovv.exe:*:Enabled:ipsec"
"C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe"="C:\Program Files\Java\jre1.6.0_07\bin\jucheck.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winlthtd.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winlthtd.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winsvkj.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winsvkj.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winrtyicj.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winrtyicj.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\wingimky.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\wingimky.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\lbyniw.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\lbyniw.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\nwgmyk.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\nwgmyk.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\rvtcv.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\rvtcv.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winvnvj.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winvnvj.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\osvom.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\osvom.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\marhn.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\marhn.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\wintjdqaq.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\wintjdqaq.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winppsfhg.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winppsfhg.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winegqw.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winegqw.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winkrpln.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winkrpln.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\vdmf.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\vdmf.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winabhhs.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winabhhs.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winhyefdk.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winhyefdk.exe:*:Enabled:ipsec"
"C:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe"="C:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winrhhjxf.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winrhhjxf.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\onvkfj.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\onvkfj.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winggqxo.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winggqxo.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winifimbg.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winifimbg.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\ljaioe.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\ljaioe.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\mrsqiy.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\mrsqiy.exe:*:Enabled:ipsec"
"C:\DOCUME~1\SysOp\USTAWI~1\Temp\winipyoy.exe"="C:\DOCUME~1\SysOp\USTAWI~1\Temp\winipyoy.exe:*:Enabled:ipsec"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{53d01a74-6e4f-11de-9235-000d87b226cc}]
shell\AutoRun\command - G:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8e61a618-580a-11de-91ed-000d87b226cc}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
shell\Open(&0)\command - G:\Recycled\ctfmon.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9e249b9a-66cf-11de-9231-000d87b226cc}]
shell\AutoRun\command - G:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a5b45c24-6e54-11de-9236-000d87b226cc}]
shell\AutoRun\command - G:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae711c8c-512e-11de-91e1-000d87b226cc}]
shell\AutoRun\command - G:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae711c8f-512e-11de-91e1-000d87b226cc}]
shell\AutoRun\command - G:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ae711c91-512e-11de-91e1-000d87b226cc}]
shell\AutoRun\command - G:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{af057f21-5032-11de-91de-000d87b226cc}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe
shell\Open(&0)\command - G:\Recycled\ctfmon.exe


======List of files/folders created in the last 1 months======

2009-07-18 13:18:11 ----D---- C:\Program Files\IrfanView
2009-07-18 13:04:57 ----D---- C:\Program Files\trend micro
2009-07-18 13:04:52 ----D---- C:\rsit
2009-07-18 12:53:33 ----HD---- C:\WINDOWS\system32\GroupPolicy
2009-07-18 12:49:00 ----D---- C:\ERDNT
2009-07-18 12:48:58 ----D---- C:\WINDOWS\ERUNT
2009-07-18 12:48:58 ----D---- C:\WINDOWS\ERDNT
2009-07-18 12:48:44 ----D---- C:\!FixIEDef
2009-07-18 11:54:27 ----D---- C:\Documents and Settings\SysOp\Dane aplikacji\Mozilla
2009-07-18 11:54:12 ----D---- C:\Program Files\Mozilla Firefox
2009-07-16 11:11:12 ----D---- C:\Documents and Settings\SysOp\Dane aplikacji\HPAppData
2009-07-16 11:09:04 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\WEBREG
2009-07-16 11:07:45 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\HPSSUPPLY
2009-07-16 11:06:42 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\HP Product Assistant
2009-07-16 11:06:41 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\HP
2009-07-16 11:06:29 ----D---- C:\Program Files\Common Files\HP
2009-07-16 11:06:16 ----D---- C:\Program Files\Hewlett-Packard
2009-07-16 11:06:03 ----D---- C:\Program Files\Common Files\Hewlett-Packard
2009-07-16 11:04:31 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Hewlett-Packard
2009-07-16 11:04:23 ----RA---- C:\WINDOWS\system32\hpzids01.dll
2009-07-16 11:04:21 ----A---- C:\WINDOWS\system32\hpzll5ha.dll
2009-07-16 11:03:57 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-07-16 11:03:48 ----RA---- C:\WINDOWS\system32\difxapi.dll
2009-07-16 11:03:47 ----RA---- C:\WINDOWS\system32\hppldcoi.dll
2009-07-16 11:03:47 ----RA---- C:\WINDOWS\system32\hpowiax3.dll
2009-07-16 11:03:47 ----RA---- C:\WINDOWS\system32\hpovst10.dll
2009-07-16 11:03:47 ----RA---- C:\WINDOWS\system32\hpotscl3.dll
2009-07-16 10:56:00 ----D---- C:\Program Files\HP
2009-07-16 10:55:33 ----HD---- C:\Config.Msi
2009-07-12 19:51:27 ----D---- C:\Documents and Settings\SysOp\Dane aplikacji\Identities
2009-07-11 21:54:58 ----A---- C:\WINDOWS\ModemLog_HUAWEI Mobile Connect - 3G Modem #4.txt
2009-07-02 08:14:38 ----A---- C:\WINDOWS\ModemLog_HUAWEI Mobile Connect - 3G Modem #3.txt
2009-06-25 08:29:55 ----D---- C:\Documents and Settings\SysOp\Dane aplikacji\Media Player Classic
2009-06-22 15:32:21 ----D---- C:\Program Files\Common Files\Adobe
2009-06-22 15:29:18 ----D---- C:\Program Files\Adobe
2009-06-22 15:29:01 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Adobe
2009-06-22 15:28:57 ----D---- C:\Program Files\Common Files\Adobe AIR
2009-06-22 15:28:52 ----D---- C:\Documents and Settings\SysOp\Dane aplikacji\Macromedia
2009-06-22 15:28:50 ----D---- C:\Documents and Settings\SysOp\Dane aplikacji\Adobe
2009-06-22 15:26:51 ----D---- C:\Program Files\NOS
2009-06-22 15:26:51 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\NOS
2009-06-22 14:52:10 ----D---- C:\Documents and Settings\SysOp\Dane aplikacji\Google
2009-06-22 14:50:34 ----D---- C:\WINDOWS\Sun
2009-06-22 14:50:34 ----D---- C:\Documents and Settings\SysOp\Dane aplikacji\Sun
2009-06-22 14:49:23 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Google
2009-06-22 14:49:22 ----D---- C:\Program Files\Google
2009-06-22 14:48:57 ----A---- C:\WINDOWS\system32\javaws.exe
2009-06-22 14:48:57 ----A---- C:\WINDOWS\system32\javaw.exe
2009-06-22 14:48:57 ----A---- C:\WINDOWS\system32\java.exe
2009-06-22 14:48:35 ----D---- C:\Program Files\Java
2009-06-22 14:45:58 ----D---- C:\Program Files\Common Files\Java
2009-06-19 20:00:23 ----D---- C:\Documents and Settings\SysOp\Dane aplikacji\OpenFM
2009-06-19 19:38:08 ----D---- C:\Documents and Settings\SysOp\Dane aplikacji\Nowe Gadu-Gadu
2009-06-19 19:37:42 ----D---- C:\Program Files\Nowe Gadu-Gadu

======List of files/folders modified in the last 1 months======

2009-07-18 13:50:53 ----A---- C:\WINDOWS\ModemLog_HUAWEI Mobile Connect - 3G Modem #2.txt
2009-07-18 13:45:51 ----D---- C:\WINDOWS\Temp
2009-07-18 13:45:50 ----D---- C:\WINDOWS\system32\drivers
2009-07-18 13:45:35 ----SHD---- C:\WINDOWS\CSC
2009-07-18 13:18:11 ----RD---- C:\Program Files
2009-07-18 12:53:33 ----D---- C:\WINDOWS\system32
2009-07-18 12:51:41 ----D---- C:\WINDOWS\system32\CatRoot2
2009-07-18 12:48:58 ----D---- C:\WINDOWS
2009-07-18 00:35:34 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-07-16 11:08:57 ----SHD---- C:\WINDOWS\Installer
2009-07-16 11:08:34 ----A---- C:\WINDOWS\win.ini
2009-07-16 11:07:17 ----D---- C:\WINDOWS\WinSxS
2009-07-16 11:06:29 ----D---- C:\Program Files\Common Files
2009-07-16 11:06:21 ----D---- C:\WINDOWS\twain_32
2009-07-16 11:04:08 ----HD---- C:\WINDOWS\inf
2009-07-16 10:55:58 ----D---- C:\WINDOWS\Prefetch
2009-07-12 19:51:27 ----SD---- C:\Documents and Settings\SysOp\Dane aplikacji\Microsoft
2009-07-11 21:47:07 ----A---- C:\WINDOWS\ModemLog_HUAWEI Mobile Connect - 3G Modem.txt
2009-06-25 11:56:34 ----D---- C:\Program Files\Windows Media Player
2009-06-23 09:29:56 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-06-19 22:55:00 ----A---- C:\WINDOWS\system.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK7;Sterownik procesora AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2008-12-31 41856]
R3 abp470n5;abp470n5; \??\C:\WINDOWS\system32\drivers\pjnmjr.sys []
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2008-01-24 4127488]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-04-14 701440]
R3 FETNDIS;Sterownik NT karty VIA PCI 10/100Mb Fast Ethernet; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165]
R3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\WINDOWS\system32\DRIVERS\ewusbmdm.sys [2008-04-17 101376]
R3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2007-03-07 49920]
S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2007-03-07 16496]
S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2007-03-07 21568]
S3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;Sterownik skanera USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2008-12-31 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-12-31 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 hpqddsvc;Usługa HP CUE DeviceDiscovery; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]
R2 Net Driver HPZ12;Net Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-14 14336]
R3 hpqcxs08;hpqcxs08; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S3 gusvc;Google Software Updater; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2009-06-22 252400]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 162864]
S3 WMPNetworkSvc;Usługa udostępniania w sieci programu Windows Media Player; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-12-01 991744]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

-----------------EOF-----------------


Kod: Zaznacz wszystko

info.txt logfile of random's system information tool 1.06 2009-07-18 13:05:13

======Uninstall list======

32 Bit HP CIO Components Installer-->MsiExec.exe /I{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}
Acrobat.com-->MsiExec.exe /X{6D8D64BE-F500-55B6-705D-DFD08AFE0624}
Adobe AIR-->c:\Program Files\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{A2BCA9F1-566C-4805-97D1-7FDC93386723}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.1-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A91000000001}
blueconnect-->C:\Program Files\blueconnect\uninst.exe
Google Toolbar for Internet Explorer-->"C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarManager_9DE96A29E721D90A.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall
HP Customer cenzura! Program 9.0-->C:\Program Files\HP\Digital Imaging\ExtCapUninstall\hpzscr01.exe -datfile hpqhsc01.dat
HP Deskjet All-In-One Software 9.0-->C:\Program Files\HP\Digital Imaging\{FA8A44D7-3E8A-4034-9C4F-088FA6B72BC4}\setup\hpzscr01.exe -datfile hposcr14.dat
HP Imaging Device Functions 9.0-->C:\Program Files\HP\Digital Imaging\DeviceManagement\hpzscr01.exe -datfile hpqbud01.dat
HP Photosmart Essential 2.01-->C:\Program Files\HP\Digital Imaging\PhotoSmartEssential\hpzscr01.exe -datfile hpqbud13.dat
HP Smart Web Printing-->MsiExec.exe /X{415CDA53-9100-476F-A7B2-476691E117C7}
HP Solution Center 9.0-->C:\Program Files\HP\Digital Imaging\eSupport\hpzscr01.exe -datfile hpqbud05.dat
HP Update-->MsiExec.exe /X{AB40272D-92AB-4F30-B36B-22EDE16F8FE5}
HPSSupply-->MsiExec.exe /X{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
K-Lite Mega Codec Pack 4.2.5-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110415-6000-11D3-8CFE-0150048383C9}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Mozilla Firefox (3.5.1)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Nero 8 Micro 8.3.2.1-->"C:\Program Files\Nero\unins000.exe"
Nowe Gadu-Gadu-->C:\Program Files\Nowe Gadu-Gadu\Uninstall.exe
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x15  -removeonly
SubEdit-Player-->"C:\Program Files\SubEdit-Player\unins000.exe"

======System event log======

Computer Name: COA12
Event Code: 26
Message: Podręczne okno aplikacji: System Windows - Brak dysku : Exception Processing Message c0000013 Parameters 75b3bf7c 4 75b3bf7c 75b3bf7c

Record Number: 1781
Source Name: Application Popup
Time Written: 20090623130753.000000+120
Event Type: informacje
User:

Computer Name: COA12
Event Code: 26
Message: Podręczne okno aplikacji: System Windows - Brak dysku : Exception Processing Message c0000013 Parameters 75b3bf7c 4 75b3bf7c 75b3bf7c

Record Number: 1780
Source Name: Application Popup
Time Written: 20090623130749.000000+120
Event Type: informacje
User:

Computer Name: COA12
Event Code: 26
Message: Podręczne okno aplikacji: System Windows - Brak dysku : Exception Processing Message c0000013 Parameters 75b3bf7c 4 75b3bf7c 75b3bf7c

Record Number: 1779
Source Name: Application Popup
Time Written: 20090623130739.000000+120
Event Type: informacje
User:

Computer Name: COA12
Event Code: 26
Message: Podręczne okno aplikacji: System Windows - Brak dysku : Exception Processing Message c0000013 Parameters 75b3bf7c 4 75b3bf7c 75b3bf7c

Record Number: 1778
Source Name: Application Popup
Time Written: 20090623130737.000000+120
Event Type: informacje
User:

Computer Name: COA12
Event Code: 26
Message: Podręczne okno aplikacji: System Windows - Brak dysku : Exception Processing Message c0000013 Parameters 75b3bf7c 4 75b3bf7c 75b3bf7c

Record Number: 1777
Source Name: Application Popup
Time Written: 20090623094348.000000+120
Event Type: informacje
User:

=====Application event log=====

Computer Name: COA12
Event Code: 1000
Message: Liczniki wydajności dla usługi MSDTC (MSDTC) zostały pomyślnie załadowane.
Dane rekordu zawierają nowe wartości indeksu przypisane
do tej usługi.

Record Number: 5
Source Name: LoadPerf
Time Written: 20090602173106.000000+120
Event Type: informacje
User:

Computer Name: COA12
Event Code: 1000
Message: Liczniki wydajności dla usługi TermService (Usługi terminalowe) zostały pomyślnie załadowane.
Dane rekordu zawierają nowe wartości indeksu przypisane
do tej usługi.

Record Number: 4
Source Name: LoadPerf
Time Written: 20090602173103.000000+120
Event Type: informacje
User:

Computer Name: COA12
Event Code: 1000
Message: Liczniki wydajności dla usługi RemoteAccess (Routing i dostęp zdalny) zostały pomyślnie załadowane.
Dane rekordu zawierają nowe wartości indeksu przypisane
do tej usługi.

Record Number: 3
Source Name: LoadPerf
Time Written: 20090602172952.000000+120
Event Type: informacje
User:

Computer Name: COA12
Event Code: 1000
Message: Liczniki wydajności dla usługi PSched (PSched) zostały pomyślnie załadowane.
Dane rekordu zawierają nowe wartości indeksu przypisane
do tej usługi.

Record Number: 2
Source Name: LoadPerf
Time Written: 20090602172948.000000+120
Event Type: informacje
User:

Computer Name: COA12
Event Code: 1000
Message: Liczniki wydajności dla usługi RSVP (QoS RSVP) zostały pomyślnie załadowane.
Dane rekordu zawierają nowe wartości indeksu przypisane
do tej usługi.

Record Number: 1
Source Name: LoadPerf
Time Written: 20090602172947.000000+120
Event Type: informacje
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 8 Stepping 1, AuthenticAMD
"PROCESSOR_REVISION"=0801
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------


[wojtas]

Daj loga z combofixa ale zainstaluj wraz z nim konsolę odzyskiwania ( instrukcja programu )

[Kamcia]

Kod: Zaznacz wszystko

ComboFix 09-07-14.08 - SysOp 2009-07-18 20:11.1.1 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1250.48.1045.18.255.126 [GMT 2:00]
Uruchomiony z: c:\documents and settings\SysOp\Moje dokumenty\Pobieranie\ComboFix.exe
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\recycled\Recycled
c:\windows\system32\AutoRun.inf
c:\windows\system32\msconfig.exe

.
(((((((((((((((((((((((((   Pliki utworzone od 2009-06-18 do 2009-07-18  )))))))))))))))))))))))))))))))
.

2009-07-18 10:48 . 2009-07-18 10:48   --------   d-----w-   c:\windows\ERUNT
2009-07-18 10:48 . 2009-07-18 10:48   --------   d-----w-   C:\!FixIEDef
2009-07-18 09:54 . 2009-07-18 09:54   0   ----a-w-   c:\windows\nsreg.dat
2009-07-18 09:54 . 2009-07-18 09:54   --------   d-----w-   c:\documents and settings\SysOp\Ustawienia lokalne\Dane aplikacji\Mozilla
2009-07-17 18:18 . 2009-07-17 18:18   1989248   ----a-w-   c:\documents and settings\SysOp\Dane aplikacji\Macromedia\Flash Player\www.macromedia.com\bin\fpupdateax\fpupdateax.exe
2009-07-16 09:11 . 2009-07-16 09:11   --------   d-----w-   c:\documents and settings\SysOp\Dane aplikacji\HPAppData
2009-07-16 09:04 . 2008-04-02 08:01   2000   ------w-   c:\windows\hpomdl14.dat
2009-07-16 09:04 . 2009-07-16 09:04   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Hewlett-Packard
2009-07-16 09:04 . 2007-03-29 16:07   267864   ----a-r-   c:\windows\system32\hpzids01.dll
2009-07-16 09:04 . 2007-03-28 12:01   117760   ----a-w-   c:\windows\system32\hpzll5ha.dll
2009-07-16 09:04 . 2007-03-07 05:20   21568   ----a-r-   c:\windows\system32\drivers\HPZius12.sys
2009-07-16 09:03 . 2009-07-16 09:04   --------   dc----w-   c:\windows\system32\DRVSTORE
2009-07-16 09:03 . 2007-03-07 05:20   309760   ----a-r-   c:\windows\system32\difxapi.dll
2009-07-16 09:03 . 2007-03-16 17:11   675840   ----a-r-   c:\windows\system32\hpowiax3.dll
2009-07-16 09:03 . 2007-03-16 17:11   303104   ----a-r-   c:\windows\system32\hpovst10.dll
2009-07-16 09:03 . 2007-03-16 17:11   569344   ----a-r-   c:\windows\system32\hpotscl3.dll
2009-07-16 09:03 . 2007-03-07 05:20   364544   ----a-r-   c:\windows\system32\hppldcoi.dll
2009-07-16 09:03 . 2008-04-13 21:15   15104   ----a-w-   c:\windows\system32\drivers\usbscan.sys
2009-07-16 08:56 . 2009-07-16 09:07   --------   d-----w-   c:\program files\HP
2009-07-16 08:55 . 2008-04-13 21:17   25856   ----a-w-   c:\windows\system32\drivers\usbprint.sys
2009-07-12 17:51 . 2009-07-12 17:51   --------   d-----w-   c:\documents and settings\SysOp\Ustawienia lokalne\Dane aplikacji\Identities
2009-06-26 15:22 . 2009-06-26 15:22   --------   d-----w-   c:\documents and settings\SysOp\Ustawienia lokalne\Dane aplikacji\Help
2009-06-25 06:29 . 2009-06-25 06:29   --------   d-----w-   c:\documents and settings\SysOp\Dane aplikacji\Media Player Classic
2009-06-22 13:32 . 2009-06-22 13:32   --------   d-----w-   c:\program files\Common Files\Adobe
2009-06-22 13:29 . 2009-02-12 09:35   38208   ----a-w-   c:\documents and settings\SysOp\Dane aplikacji\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2009-06-22 13:28 . 2009-06-22 13:28   --------   d-----w-   c:\program files\Common Files\Adobe AIR
2009-06-22 13:27 . 2009-06-22 13:32   --------   d-----w-   c:\documents and settings\SysOp\Ustawienia lokalne\Dane aplikacji\Adobe
2009-06-22 13:27 . 2009-06-22 13:27   159744   ----a-w-   c:\documents and settings\All Users\Dane aplikacji\NOS\Adobe_Downloads\arh.exe
2009-06-22 13:26 . 2009-06-23 07:30   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\NOS
2009-06-22 13:26 . 2009-06-23 07:29   --------   d-----w-   c:\program files\NOS
2009-06-22 12:52 . 2009-06-22 14:19   --------   d-----w-   c:\documents and settings\SysOp\Ustawienia lokalne\Dane aplikacji\Google
2009-06-22 12:50 . 2009-06-22 12:50   --------   d-----w-   c:\windows\Sun
2009-06-22 12:49 . 2009-06-22 14:19   --------   d-----w-   c:\program files\Google
2009-06-22 12:48 . 2009-06-22 12:48   --------   d-----w-   c:\program files\Java
2009-06-22 12:45 . 2009-06-22 12:45   --------   d-----w-   c:\program files\Common Files\Java
2009-06-19 18:00 . 2009-06-19 18:00   --------   d-----w-   c:\documents and settings\SysOp\Dane aplikacji\OpenFM
2009-06-19 17:38 . 2009-06-19 19:07   --------   d-----w-   c:\documents and settings\SysOp\Dane aplikacji\Nowe Gadu-Gadu
2009-06-19 17:37 . 2009-07-15 19:44   --------   d-----w-   c:\program files\Nowe Gadu-Gadu

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-07-18 11:50 . 2009-07-18 11:04   --------   d-----w-   c:\program files\trend micro
2009-07-18 11:18 . 2009-07-18 11:18   --------   d-----w-   c:\program files\IrfanView
2009-07-16 09:10 . 2009-07-16 09:10   --------   d-----w-   c:\documents and settings\LocalService\Dane aplikacji\HP
2009-07-16 09:10 . 2009-07-16 09:04   155221   ----a-w-   c:\windows\hpoins14.dat
2009-07-16 09:09 . 2009-07-16 09:09   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\WEBREG
2009-07-16 09:08 . 2009-07-16 09:08   60960   ----a-w-   c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-07-16 09:07 . 2009-07-16 09:07   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\HPSSUPPLY
2009-07-16 09:07 . 2009-07-16 09:07   --------   d-----w-   c:\windows\system32\config\systemprofile\Dane aplikacji\HPAppData
2009-07-16 09:07 . 2009-07-16 09:06   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\HP
2009-07-16 09:06 . 2009-07-16 09:06   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\HP Product Assistant
2009-07-16 09:06 . 2009-07-16 09:06   --------   d-----w-   c:\program files\Common Files\HP
2009-07-16 09:06 . 2009-07-16 09:06   --------   d-----w-   c:\program files\Hewlett-Packard
2009-07-16 09:06 . 2009-07-16 09:06   --------   d-----w-   c:\program files\Common Files\Hewlett-Packard
2009-06-05 13:00 . 2009-06-05 13:00   --------   d-----w-   c:\documents and settings\SysOp\Dane aplikacji\Nero
2009-06-04 17:42 . 2001-10-26 17:15   47898   ----a-w-   c:\windows\system32\perfc015.dat
2009-06-04 17:42 . 2001-10-26 17:15   352770   ----a-w-   c:\windows\system32\perfh015.dat
2009-06-04 17:40 . 2009-06-04 17:40   60960   ----a-w-   c:\documents and settings\SysOp\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-06-04 17:40 . 2009-06-04 17:39   --------   d-----w-   c:\program files\blueconnect
2009-06-03 11:45 . 2009-06-03 11:39   --------   d-----w-   c:\program files\Common Files\InstallShield
2009-06-03 11:42 . 2009-06-03 11:42   --------   d-----w-   c:\program files\Microsoft.NET
2009-06-03 11:41 . 2009-06-03 11:41   --------   d-----w-   c:\program files\Microsoft Works
2009-06-03 11:40 . 2009-06-03 11:40   --------   d-----w-   c:\program files\Realtek AC97
2009-06-03 11:39 . 2009-06-03 11:39   --------   d--h--w-   c:\program files\InstallShield Installation Information
2009-06-03 11:38 . 2009-06-03 11:38   --------   d-----w-   c:\program files\Nero
2009-06-03 11:38 . 2009-06-03 11:37   --------   d-----w-   c:\program files\Common Files\Nero
2009-06-03 11:38 . 2009-06-03 11:38   --------   d-----w-   c:\documents and settings\All Users\Dane aplikacji\Nero
2009-06-03 11:37 . 2009-06-03 11:37   --------   d-----w-   c:\program files\SubEdit-Player
2009-06-03 11:36 . 2009-06-03 11:36   --------   d-----w-   c:\program files\K-Lite Codec Pack
2009-06-02 15:31 . 2009-06-02 15:31   21856   ----a-w-   c:\windows\system32\emptyregdb.dat
2009-06-02 15:30 . 2009-06-02 15:30   --------   d-----w-   c:\program files\Windows Media Connect 2
2009-05-28 09:23 . 2009-05-28 09:23   42088   ----a-w-   c:\documents and settings\SysOp\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll
2009-07-16 01:02 . 2009-07-18 09:54   137208   ----a-w-   c:\program files\mozilla firefox\components\brwsrcmp.dll
.

------- Sigcheck -------

[-] 2007-07-11 04:06   642560   CE594E18FE0D0AF804F1F3694921CE62   c:\windows\system32\user32.dll

[-] 2008-12-31 17:05   920064   88348F8C92C28BA99FE49BD392100CE0   c:\windows\system32\wininet.dll

[-] 2008-12-31 16:39   361344   030DC4D48CC2B894FEE2F390D8E66AD5   c:\windows\system32\drivers\tcpip.sys

[-] 2008-12-31 17:04   549888   335813EACD16E84F3047A3326F6E5473   c:\windows\system32\winlogon.exe

[-] 2008-12-31 17:13   2069632   D7A09FA4882D09DE80D55562356CD516   c:\windows\system32\ntkrnlpa.exe

[-] 2008-12-23 15:31   2192640   D58ECB038A8F2F7D20181370FDB3BDF7   c:\windows\system32\ntoskrnl.exe

[-] 2008-12-31 17:03   1553408   BDA7A4169BF5E1F3EE76B017396E4F47   c:\windows\explorer.exe

[-] 2001-02-20 11:09   8192   D36A33C21EEED5A6C1DAECB7C80A1909   c:\windows\system32\CTFMON.EXE

[-] 2008-12-31 17:04   112128   37ED43F3DEC4400586554D61C3129478   c:\windows\system32\wuauclt.exe

[-] 2008-12-31 16:58   1420800   4678172D19476FA7D539682FCA42C942   c:\windows\system32\comres.dll


[-] 2008-12-31 16:57   724992   7F059A93D251284A8BC758327ECD3D69   c:\windows\system32\comctl32.dll
[7] 2001-08-18 07:37   921088   AEF3D788DBF40C7C4D204EA45EB0C505   c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.0.0_x-ww_1382d70a\comctl32.dll
[7] 2008-04-14 19:29   1054208   737739FACEAD60683AA8D7FF7602FD14   c:\windows\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.5512_x-ww_35d4ce83\comctl32.dll
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2009-06-22 39408]
"ctfmon.exe"="ctfmon.exe" - c:\windows\system32\CTFMON.EXE [2001-02-20 8192]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 113520]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"SoundMan"="SOUNDMAN.EXE" - c:\windows\soundman.exe [2007-04-16 577536]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"_nltide_2"="shell32" [X]
"_nltide_3"="advpack.dll" - c:\windows\system32\advpack.dll [2008-12-31 123904]

c:\documents and settings\All Users\Menu Start\Programy\Autostart\
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2007-3-11 210520]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableTaskMgr"= 1 (0x1)
"DisableRegistryTools"= 1 (0x1)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)

[COLOR=RED] Klucz Trybu Awaryjnego wymaga naprawy. Komputer nie może wejść w Tryb Awaryjny. [/COLOR]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system]
@="Driver Group"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys]
@="Driver"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}]
@="DiskDrive"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}]
@="Hdc"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}]
@="Keyboard"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}]
@="Mouse"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}]
@="System"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}]
@="Volume"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"AntiVirusOverride"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"FirewallDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"UacDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=
"c:\\Program Files\\Windows Media Player\\wmplayer.exe"=
"c:\\Program Files\\Internet Explorer\\iedw.exe"=
"c:\\WINDOWS\\system32\\freecell.exe"=
"c:\\Program Files\\blueconnect\\blueconnect.exe"=
"c:\\Program Files\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe"=
"c:\\Program Files\\Adobe\\Reader 9.0\\Reader\\Reader_sl.exe"=
"c:\\Program Files\\Java\\jre1.6.0_07\\bin\\jucheck.exe"=
"c:\\Program Files\\Nowe Gadu-Gadu\\spellchecker_gg.exe"=
"c:\\WINDOWS\\SOUNDMAN.EXE"=
"c:\\Program Files\\HP\\Smart Web Printing\\hpswp_clipbook.exe"=

R0 viasraid;viasraid;c:\windows\system32\drivers\viasraid.sys [2008-12-31 77312]
R3 abp470n5;abp470n5;\??\c:\windows\system32\drivers\pjnmjr.sys --> c:\windows\system32\drivers\pjnmjr.sys [?]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12   REG_MULTI_SZ      Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt   REG_MULTI_SZ      hpqcxs08 hpqddsvc
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.nasza-klasa.pl/
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
FF - ProfilePath - c:\documents and settings\SysOp\Dane aplikacji\Mozilla\Firefox\Profiles\3tm3tev9.default\
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll

---- FIREFOX - SPOSÓB POSTĘPOWANIA ----
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess");
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota",      5120);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true);
c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history",     true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata",    true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords",   false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads",   true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies",     true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache",       true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions",    true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history",                 true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata",                true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords",               false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads",               true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies",                 true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache",                   true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions",                true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps",             false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings",            false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs",    false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json");
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-07-18 20:15
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'winlogon.exe'(648)
c:\windows\system32\sfc_os.dll
c:\windows\system32\cscui.dll

- - - - - - - > 'lsass.exe'(724)
c:\windows\system32\scecli.dll
.
Czas ukończenia: 2009-07-18 20:17
ComboFix-quarantined-files.txt  2009-07-18 18:17

Przed: 31 665 459 200 bajtów wolnych
Po: 31 823 437 824 bajtów wolnych

WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

265


[wojtas]

Otworz notatnik i wklej w nim to:

File::
c:\windows\system32\drivers\pjnmjr.sys

Driver::
abp470n5

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

[Kamcia]

Próbowałam zrobić,tak jak prosiłeś i wsystąpiły kolejne błędy:

"System windows nie moźe odnależć pliku grpconv.Upewnij się,że wpisana nazwa jest poprawna i spróbuj ponownie(..)"
"Błąd krytyczny-brakuje pliku. Brak pliku c:\windows\regedit.exe"
Za trzecim razem przeciągniecia notatnika na combofix, wystąpił komunikat "Uwaga! Kontynuacja NIE jest bezpieczna! Zawartość programu combofix została naruszona.(..) Twój komputer może być zainfekowany wirusem modyfikującym pliki "virut".

Zainstalowałam wcześniej avasta, który wykrył ponad 1000 zainfekowanych aplikacji,które posiadam na kompie...

[wojtas]

poczytaj wykonaj bootowalna plytke Dr Web Live Cd i skanuj kompa:

http://www.searchengines.pl/Infekcje-plikow-wykonywalnych-exe-dll-scr-t122692.html

chodz moze byc ciezko...