ComboFix
- Kod: Zaznacz wszystko
ComboFix 08-09-05.02 - beata1983 2008-09-06 12:22:06.4 - NTFSx86
Running from: C:\Documents and Settings\beata1983\Pulpit\ComboFix.exe
* Created a new restore point
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((( Files Created from 2008-08-06 to 2008-09-06 )))))))))))))))))))))))))))))))
.
2008-09-06 08:01 . 2008-09-06 08:01 <DIR> d-------- C:\Program Files\Mp3 Knife
2008-09-06 08:01 . 2004-04-12 17:27 1,081,616 --a------ C:\WINDOWS\system32\mscomctl.ocx
2008-09-06 08:01 . 2004-04-12 17:27 609,584 --a------ C:\WINDOWS\system32\comctl32.ocx
2008-09-06 08:01 . 2004-04-12 17:27 152,848 --a------ C:\WINDOWS\system32\comdlg32.ocx
2008-09-06 07:48 . 2008-09-06 07:48 <DIR> d-------- C:\Program Files\NCH Software
2008-09-06 07:48 . 2008-09-06 07:48 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\NCH Swift Sound
2008-09-06 07:47 . 2008-09-06 07:48 <DIR> d-------- C:\Program Files\NCH Swift Sound
2008-09-06 07:47 . 2008-09-06 07:47 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\NCH Swift Sound
2008-09-06 07:41 . 2007-08-11 20:05 158,208 --a------ C:\WINDOWS\system32\CDRipUpd.exe
2008-09-06 07:14 . 2008-09-06 07:25 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\AccurateRip
2008-09-06 07:13 . 2008-09-06 07:14 <DIR> d-------- C:\Program Files\Exact Audio Copy
2008-09-06 06:59 . 2008-09-06 06:59 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\PCToolsFirewallPlus
2008-09-06 06:57 . 2008-09-06 07:05 <DIR> d-------- C:\Program Files\PC Tools Firewall Plus
2008-09-06 06:57 . 2008-09-06 06:57 <DIR> d-------- C:\Program Files\Common Files\PC Tools
2008-09-06 06:57 . 2008-07-28 11:29 160,792 --a------ C:\WINDOWS\system32\drivers\pctfw2.sys
2008-09-06 06:57 . 2008-07-17 16:53 93,952 --a------ C:\WINDOWS\system32\drivers\pctfw.sys
2008-09-06 06:57 . 2008-08-05 15:58 58,136 --a------ C:\WINDOWS\system32\drivers\FWAuthdriver.sys
2008-09-05 21:28 . 2008-09-06 08:59 <DIR> d-a------ C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-09-05 21:27 . 2008-09-05 21:30 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-09-05 21:27 . 2008-09-05 21:27 <DIR> d-------- C:\Documents and Settings\beata1983\Dane aplikacji\PC Tools
2008-09-05 21:27 . 2008-08-25 11:36 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-09-05 21:27 . 2008-08-25 11:36 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-09-05 21:27 . 2008-08-25 11:36 40,840 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-09-05 21:27 . 2008-06-02 15:19 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-09-05 19:23 . 2008-09-05 19:23 <DIR> d-------- C:\Program Files\Kerio
2008-09-05 17:26 . 2008-09-05 17:26 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-09-05 17:26 . 2008-09-05 17:26 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-08-24 15:13 . 2008-08-24 15:13 580,096 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll
2008-08-24 15:10 . 2008-08-24 15:11 <DIR> d-------- C:\WINDOWS\ERUNT
2008-08-24 15:05 . 2008-08-24 15:21 <DIR> d-------- C:\SDFix
2008-08-24 13:48 . 2008-08-24 13:48 100 --a------ C:\index.ini
2008-08-24 09:57 . 2008-08-24 09:57 <DIR> d-------- C:\WINDOWS\system32\NtmsData
2008-08-24 09:39 . 2008-08-24 09:39 <DIR> d-------- C:\Program Files\PrevxCSI
2008-08-24 09:39 . 2008-08-24 09:39 17,408 --a------ C:\WINDOWS\system32\drivers\pxark.sys
2008-08-24 09:38 . 2008-09-06 09:01 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PrevxCSI
2008-08-23 14:10 . 2008-08-23 14:10 <DIR> d-------- C:\Program Files\Alwil Software
2008-08-23 14:03 . 2008-08-23 14:03 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Avg8
2008-08-23 09:14 . 2008-08-23 09:14 <DIR> d-------- C:\WINDOWS\system32\pl-pl
2008-08-23 09:14 . 2008-08-23 09:14 <DIR> d-------- C:\WINDOWS\system32\pl
2008-08-23 09:14 . 2008-08-23 09:14 <DIR> d-------- C:\WINDOWS\system32\bits
2008-08-23 09:14 . 2008-08-23 09:14 <DIR> d-------- C:\WINDOWS\l2schemas
2008-08-23 09:08 . 2008-08-23 09:15 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2008-08-23 08:50 . 2008-08-23 08:50 <DIR> d-------- C:\WINDOWS\EHome
2008-08-22 23:58 . 2008-08-23 10:30 <DIR> d-------- C:\Program Files\PokerStars
2008-08-22 18:57 . 2004-08-03 22:41 1,309,184 --------- C:\WINDOWS\system32\drivers\mtlstrm.sys
2008-08-22 18:57 . 2004-08-03 22:29 452,736 --------- C:\WINDOWS\system32\drivers\mtxparhm.sys
2008-08-22 18:57 . 2004-08-03 22:41 126,686 --------- C:\WINDOWS\system32\drivers\mtlmnt5.sys
2008-08-22 18:57 . 2004-07-17 11:35 67,866 --------- C:\WINDOWS\system32\drivers\netwlan5.img
2008-08-22 18:57 . 2004-08-04 14:00 36,644 -----c--- C:\WINDOWS\system32\dllcache\mplayer2.inf
2008-08-22 18:57 . 2004-08-04 14:00 22,060 -----c--- C:\WINDOWS\system32\dllcache\npds.zip
2008-08-22 18:57 . 2004-08-04 14:00 2,778 -----c--- C:\WINDOWS\system32\dllcache\mplogoh.gif
2008-08-22 18:57 . 2004-08-04 14:00 2,545 -----c--- C:\WINDOWS\system32\dllcache\mplogo.gif
2008-08-22 18:57 . 2004-08-04 14:00 403 -----c--- C:\WINDOWS\system32\dllcache\npdrmv2.zip
2008-08-22 18:56 . 2004-08-03 22:41 1,041,536 --------- C:\WINDOWS\system32\drivers\hsfdpsp2.sys
2008-08-22 18:56 . 2004-08-03 22:41 685,056 --------- C:\WINDOWS\system32\drivers\hsfcxts2.sys
2008-08-22 18:56 . 2004-08-03 22:41 220,032 --------- C:\WINDOWS\system32\drivers\hsfbs2s2.sys
2008-08-22 18:56 . 2004-08-04 14:00 5,971 -----c--- C:\WINDOWS\system32\dllcache\events.js
2008-08-22 18:55 . 2004-08-04 14:00 184,137 -----c--- C:\WINDOWS\system32\dllcache\compact.wmz
2008-08-22 18:55 . 2004-07-17 22:55 129,045 --------- C:\WINDOWS\system32\drivers\cxthsfs2.cty
2008-08-22 18:55 . 2004-08-04 14:00 9,585 -----c--- C:\WINDOWS\system32\dllcache\controls.css
2008-08-22 18:55 . 2004-08-04 14:00 999 -----c--- C:\WINDOWS\system32\dllcache\bktrh.gif
2008-08-22 18:55 . 2004-08-04 14:00 773 -----c--- C:\WINDOWS\system32\dllcache\cnth.gif
2008-08-22 18:55 . 2004-08-04 14:00 773 -----c--- C:\WINDOWS\system32\dllcache\cnt.gif
2008-08-22 18:55 . 2004-08-04 14:00 772 -----c--- C:\WINDOWS\system32\dllcache\cntd.gif
2008-08-22 18:55 . 2004-08-04 14:00 760 -----c--- C:\WINDOWS\system32\dllcache\cloapph.gif
2008-08-22 18:55 . 2004-08-04 14:00 717 -----c--- C:\WINDOWS\system32\dllcache\cloapp.gif
2008-08-15 19:16 . 2008-08-23 08:00 81,984 --a------ C:\WINDOWS\system32\bdod.bin
2008-08-15 19:10 . 2008-08-15 21:37 <DIR> d-------- C:\Program Files\Common Files\Softwin
2008-08-15 18:56 . 2008-08-15 18:56 <DIR> d-------- C:\Documents and Settings\beata1983\DoctorWeb
2008-08-15 14:47 . 2008-08-15 15:16 <DIR> d-------- C:\WINDOWS\BDOSCAN8
2008-08-15 13:53 . 2008-08-15 13:53 <DIR> d-------- C:\fsaua.data
2008-08-15 13:24 . 2008-04-11 21:06 691,712 -----c--- C:\WINDOWS\system32\dllcache\inetcomm.dll
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-09-06 10:12 --------- d-----w C:\Documents and Settings\beata1983\Dane aplikacji\foobar2000
2008-09-05 23:24 --------- d-----w C:\Program Files\DC++
2008-09-05 18:50 --------- d-----w C:\Documents and Settings\beata1983\Dane aplikacji\Skype
2008-09-05 18:01 --------- d-----w C:\Documents and Settings\beata1983\Dane aplikacji\skypePM
2008-09-05 17:06 --------- d-----w C:\Documents and Settings\beata1983\Dane aplikacji\gtk-2.0
2008-08-23 13:36 --------- d-----w C:\Program Files\SkanerOnline
2008-08-22 15:40 --------- d-----w C:\Program Files\Opera
2008-08-16 16:55 --------- d-----w C:\Program Files\SubEdit-Player
2008-08-09 04:37 --------- d-----w C:\Program Files\Java
2008-08-02 22:12 --------- d-----w C:\Program Files\foobar2000
2008-08-02 20:06 --------- d-----w C:\Program Files\Picasa2
2008-08-02 13:19 --------- d-----w C:\Program Files\Google
2008-08-02 13:00 --------- d-----w C:\Program Files\GIMP-2.0
2008-08-02 12:57 --------- d-----w C:\Program Files\Common Files\ACD Systems
2008-08-02 12:46 --------- d-----w C:\Documents and Settings\beata1983\Dane aplikacji\Ashampoo
2008-08-02 12:46 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\ashampoo
2008-08-02 12:37 --------- d-----w C:\Program Files\WebHat Software
2008-08-02 05:52 --------- d-----w C:\Program Files\Nowy folder (2)
2008-08-02 05:24 --------- d-----w C:\Program Files\Winamp Remote
2008-08-01 19:49 --------- d-----w C:\Program Files\PartyGaming.Net
2008-08-01 16:29 --------- d-----w C:\Program Files\Skype
2008-08-01 16:29 --------- d-----w C:\Program Files\Common Files\Skype
2008-08-01 16:29 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-07-29 11:49 --------- d-----w C:\Documents and Settings\beata1983\Dane aplikacji\Ahead
2008-07-07 20:29 253,952 ----a-w C:\WINDOWS\system32\es.dll
2008-07-06 07:51 --------- d-----w C:\Documents and Settings\beata1983\Dane aplikacji\DivX
2008-07-05 21:49 532,558 ----a-w C:\WINDOWS\system32\odGinaLibrary.dll
2008-07-05 21:49 139,330 ----a-w C:\WINDOWS\system32\odyGina.dll
2008-07-05 21:49 106,496 ----a-w C:\WINDOWS\system32\odyEvent.dll
2008-06-24 16:46 74,240 ----a-w C:\WINDOWS\system32\mscms.dll
2008-06-23 15:13 668,672 ----a-w C:\WINDOWS\system32\wininet.dll
2008-06-20 17:48 246,784 ----a-w C:\WINDOWS\system32\mswsock.dll
2008-06-18 17:52 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2008-06-11 00:07 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2008-06-11 00:07 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-06-11 00:07 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2008-06-11 00:07 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2008-06-11 00:07 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2008-06-11 00:04 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2008-06-11 00:04 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 15360]
"CDRipUpd.exe"="C:\WINDOWS\system32\CDRipUpd.exe" [2007-08-11 158208]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-04-05 339968]
"LaunchAp"="C:\Program Files\Launch Manager\LaunchAp.exe" [2005-03-30 32768]
"HotkeyApp"="C:\Program Files\Launch Manager\HotkeyApp.exe" [2005-05-02 57344]
"LMgrVolOSD"="C:\Program Files\Launch Manager\OSD.exe" [2005-03-16 204800]
"LMgrOSD"="C:\Program Files\Launch Manager\OSDCtrl.exe" [2004-10-11 245760]
"Wbutton"="C:\Program Files\Launch Manager\Wbutton.exe" [2005-04-18 81920]
"CtrlVol"="C:\Program Files\Launch Manager\CtrlVol.exe" [2003-09-16 20480]
"ISTray"="C:\Program Files\Spyware Doctor\pctsTray.exe" [2008-08-25 1168264]
"00PCTFW"="C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" [2008-08-05 2611096]
"SoundMan"="SOUNDMAN.EXE" [2005-03-24 C:\WINDOWS\SOUNDMAN.EXE]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.ac3filter"= ac3filter.acm
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Java\\jre1.5.0\\bin\\javaw.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=
R0 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-08-24 17408]
R1 Hotkey;Hotkey;C:\WINDOWS\system32\drivers\Hotkey.sys [2003-04-28 9867]
R1 pctfw2;pctfw2;C:\WINDOWS\system32\drivers\pctfw2.sys [2008-07-28 160792]
R2 CSIScanner;CSIScanner;C:\Program Files\PrevxCSI\prevxcsi.exe [2008-08-24 618040]
R3 FWAuth;FWAuth Driver;C:\WINDOWS\system32\drivers\FWAuthDriver.sys [2008-08-05 58136]
R3 HSFHWATI;HSFHWATI;C:\WINDOWS\system32\DRIVERS\HSFHWATI.sys [2004-12-15 200192]
S1 Wbutton;Wbutton;C:\WINDOWS\system32\drivers\Wbutton.sys [ ]
S3 odysseyIM4;Odyssey Network Agent Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM4.sys [2005-05-18 173056]
*Newly Created Service* - FWAUTH
*Newly Created Service* - PCTFW2
*Newly Created Service* - PCTOOLSFIREWALLPLUS
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = hxxp://www.onet.pl/
R1 -: HKCU-Internet Connection Wizard,ShellNext = iexplore
O9 -: {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 -: {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O16 -: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} - hxxp://arcaonline.arcabit.com/ArcaOnline.cab
C:\WINDOWS\Downloaded Program Files\ArcaOnline.inf
C:\WINDOWS\system32\ArcaMicroScanUpdater.exe
C:\WINDOWS\system32\ArcaOnlineUninstall.exe
C:\WINDOWS\system32\ArcaOnline.dll
O16 -: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab
C:\WINDOWS\Downloaded Program Files\SkanerOnline.inf
C:\WINDOWS\system32\SkanerOnlineUninstall.exe
C:\WINDOWS\system32\SkanerOnline.dll
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-09-06 12:24:36
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
CtrlVol = C:\Program Files\Launch Manager\CtrlVol.exe?????T??????|x??|????q??|?j?wQj?w????????0??? ???|???????????\??????|????????h?????@??J?????????????s???????s???sx??s@??????????????|h??sl??????????s?????????????????C?sc"?sx??s??????7~??@?N'?s?E9?-6@??E9????????
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-09-06 12:26:10
ComboFix-quarantined-files.txt 2008-09-06 10:25:51
Pre-Run: 4,478,164,992 bajtów wolnych
Post-Run: 4,572,798,976 bajtów wolnych
202 --- E O F --- 2008-08-23 16:36:02
raport Avenger
- Kod: Zaznacz wszystko
Logfile of The Avenger Version 2.0, (c) by Swandog46
http://swandog46.geekstogo.com
Platform: Windows XP
*******************
Script file opened successfully.
Script file read successfully.
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Rootkit scan active.
No rootkits found!
Folder "D:\System Volume Information\_restore{65155738-1155-4D94-A8B4-FDE0CEF58BCE}\RP36" deleted successfully.
Folder "D:\System Volume Information\_restore{65155738-1155-4D94-A8B4-FDE0CEF58BCE}\RP43" deleted successfully.
Completed script processing.
*******************
Finished! Terminate.
Dodano Dzisiaj, 18:52:
dodaję również najnowszy log z Hijackera. Proszę o wskazówki, czy zastosować jeszcze coś do kompa. Mam już zainstalowany antywirus Pc Tools i Firewall tej samej firmy. Mam nadzieję, że to mnie uchroni na przyszłość, a póki co, że nie muszę robić formata. Z góry dziękuję za pomoc!
- Kod: Zaznacz wszystko
Logfile of HijackThis v1.99.1
Scan saved at 18:47:35, on 2008-09-06
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Launch Manager\LaunchAp.exe
C:\Program Files\Launch Manager\HotkeyApp.exe
C:\Program Files\Launch Manager\OSD.exe
C:\Program Files\Launch Manager\OSDCtrl.exe
C:\Program Files\Launch Manager\Wbutton.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\CDRipUpd.exe
C:\Program Files\PrevxCSI\prevxcsi.exe
C:\Program Files\PrevxCSI\prevxcsi.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Opera\opera.exe
C:\DOCUME~1\BEATA1~1\USTAWI~1\Temp\Katalog tymczasowy 1 dla hijackthis.zip\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [LaunchAp] C:\Program Files\Launch Manager\LaunchAp.exe
O4 - HKLM\..\Run: [HotkeyApp] C:\Program Files\Launch Manager\HotkeyApp.exe
O4 - HKLM\..\Run: [LMgrVolOSD] C:\Program Files\Launch Manager\OSD.exe
O4 - HKLM\..\Run: [LMgrOSD] C:\Program Files\Launch Manager\OSDCtrl.exe
O4 - HKLM\..\Run: [Wbutton] "C:\Program Files\Launch Manager\Wbutton.exe"
O4 - HKLM\..\Run: [CtrlVol] C:\Program Files\Launch Manager\CtrlVol.exe
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [CDRipUpd.exe] C:\WINDOWS\system32\CDRipUpd.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
O9 - Extra button: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra 'Tools' menuitem: PartyPoker.net - {F4430FE8-2638-42e5-B849-800749B94EED} - C:\Program Files\PartyGaming.Net\PartyPokerNet\RunPF.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://arcaonline.arcabit.com/ArcaOnline.cab
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: CSIScanner - Unknown owner - C:\Program Files\PrevxCSI\prevxcsi.exe" /service (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
