ComboFix 08-11-09.03 - okay 2008-11-10 13:05:04.1 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1250.1.1045.18.1433 [GMT 1:00]
Uruchomiony z: c:\documents and settings\okay\Pulpit\ComboFix.exe
* Utworzono nowy punkt przywracania
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\NCTAudioInformation2.dll
c:\windows\system32\setup.ini
.
((((((((((((((((((((((((( Pliki utworzone od 2008-10-10 do 2008-11-10 )))))))))))))))))))))))))))))))
.
2008-11-10 08:31 . 2008-11-10 08:31 <DIR> d-------- c:\program files\Ubisoft
2008-11-09 15:52 . 2008-11-09 15:52 98,304 --a------ c:\windows\system32\CmdLineExt.dll
2008-11-09 15:51 . 2005-05-26 15:34 2,297,552 --a------ c:\windows\system32\d3dx9_26.dll
2008-11-06 18:34 . 2008-11-06 18:34 <DIR> d--hs---- C:\FOUND.000
2008-11-06 08:59 . 2008-11-06 08:59 <DIR> d-------- c:\program files\Skype
2008-11-06 08:59 . 2008-11-06 08:59 <DIR> d-------- c:\program files\Common Files\Skype
2008-11-06 08:59 . 2008-11-06 08:59 <DIR> d-------- c:\documents and settings\okay\Dane aplikacji\Skype
2008-11-06 08:59 . 2008-11-06 08:59 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Skype
2008-11-02 23:17 . 2003-03-25 15:08 286,720 --a------ c:\windows\system32\NCTWMAFile2.dll
2008-11-02 23:17 . 2002-12-03 03:07 168,448 --a------ c:\windows\system32\NCTAudioPlayer.dll
2008-11-02 23:17 . 2002-12-03 03:11 143,872 --a------ c:\windows\system32\NCTWMAFile.dll
2008-11-02 23:16 . 2002-12-03 03:02 491,520 --a------ c:\windows\system32\NCTAudioFile.dll
2008-11-02 23:16 . 2002-01-05 07:37 344,064 --a------ c:\windows\system32\msvcr70.dll
2008-11-02 23:16 . 2002-03-19 07:18 120,832 --a------ c:\windows\system32\lame_enc.dll
2008-11-01 12:26 . 2008-11-01 12:26 <DIR> d-------- c:\program files\Trend Micro
2008-11-01 01:07 . 2008-11-01 01:07 <DIR> d-------- c:\documents and settings\okay\.jpi_cache
2008-10-31 10:23 . 2008-10-31 10:23 433 --a------ c:\windows\wininit.ini
2008-10-22 21:40 . 2008-11-10 09:04 182,384 --a------ c:\windows\system32\PnkBstrB.exe
2008-10-22 21:40 . 2008-11-10 09:05 137,272 --a------ c:\windows\system32\drivers\PnkBstrK.sys
2008-10-22 21:39 . 2008-10-22 21:39 <DIR> d-------- c:\windows\system32\LogFiles
2008-10-22 21:39 . 2008-10-22 21:39 66,872 --a------ c:\windows\system32\PnkBstrA.exe
2008-10-19 19:04 . 2008-10-19 19:04 <DIR> d-------- c:\windows\system32\CatRoot_bak
2008-10-19 19:00 . 2008-10-19 19:00 <DIR> d-------- c:\program files\Lavasoft
2008-10-19 19:00 . 2008-10-19 19:00 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Lavasoft
2008-10-19 18:59 . 2008-10-19 18:59 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-10-19 18:34 . 2008-10-19 18:34 <DIR> d-------- c:\documents and settings\okay\WapSter
2008-10-19 18:33 . 2008-10-19 18:33 <DIR> d-------- c:\program files\WapSter
2008-10-19 17:53 . 2008-06-30 17:16 234,640 --a------ c:\windows\system32\drivers\afwcore.sys
2008-10-19 17:52 . 2008-10-19 17:52 <DIR> d-------- c:\windows\system32\Filt
2008-10-19 17:52 . 2008-10-19 17:52 <DIR> d-------- c:\program files\Agnitum
2008-10-19 17:52 . 2008-07-11 15:41 673,920 --a------ c:\windows\system32\drivers\SandBox.sys
2008-10-19 17:52 . 2008-06-30 17:16 30,864 --a------ c:\windows\system32\drivers\afw.sys
2008-10-19 17:52 . 2007-09-07 17:45 49 --a------ c:\windows\transp.gif
2008-10-19 17:51 . 2008-10-19 17:51 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Agnitum
2008-10-18 00:37 . 1998-10-07 12:54 327,168 --a------ c:\windows\IsUn0415.exe
2008-10-17 22:40 . 2008-10-17 22:40 <DIR> d-------- c:\program files\3DO
2008-10-17 19:34 . 2008-10-17 19:34 <DIR> d-------- c:\documents and settings\NetworkService\Dane aplikacji\Xfire
2008-10-15 16:18 . 2008-10-15 16:18 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2008-10-15 16:18 . 2008-10-15 16:18 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-10-14 19:18 . 2008-10-14 19:18 <DIR> d-------- c:\documents and settings\okay\.java
2008-10-14 16:15 . 2008-10-14 16:15 <DIR> d-------- c:\program files\Common Files\INCA Shared
2008-10-14 16:15 . 2003-07-21 05:17 5,174 --a------ c:\windows\system32\nppt9x.vxd
2008-10-14 16:15 . 2005-01-04 20:43 4,682 --a------ c:\windows\system32\npptNT2.sys
2008-10-14 14:43 . 2008-10-14 14:43 <DIR> d-------- c:\program files\Games-Masters.com
2008-10-14 14:00 . 2008-10-14 14:00 <DIR> d-------- c:\program files\Xfire
2008-10-14 14:00 . 2008-10-14 14:00 <DIR> d-------- c:\documents and settings\okay\Dane aplikacji\Xfire
2008-10-14 13:43 . 2008-10-14 13:43 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\ESET
2008-10-13 20:26 . 2008-10-13 20:26 <DIR> d-------- c:\windows\system32\AlertModule
2008-10-13 20:26 . 2008-10-13 20:26 <DIR> d-------- c:\program files\ZTE ZXDSL 852
2008-10-13 20:26 . 2008-10-13 20:26 <DIR> d-------- c:\program files\neostrada tp
2008-10-13 20:26 . 2006-06-02 22:38 425,984 -ra------ c:\windows\system32\stmcfg32.dll
2008-10-13 20:26 . 2006-06-02 15:01 151,552 -ra------ c:\windows\system32\stmctrl.dll
2008-10-13 20:26 . 2004-08-23 13:49 40,960 --a------ c:\windows\system32\FTRTSVC.exe
2008-10-13 20:26 . 2005-10-06 14:55 36,864 --a------ c:\windows\system32\IfHelper.dll
2008-10-13 20:26 . 2008-10-13 20:26 2,849 --a------ c:\windows\stsetup.htm
2008-10-13 19:50 . 2004-08-23 13:50 32,768 --a------ c:\windows\system32\WooDial2000.dll
2008-10-13 19:49 . 2003-08-04 13:22 94,208 --a------ c:\windows\system32\W32n50.dll
2008-10-13 19:49 . 2003-08-04 13:22 16,128 --------- c:\windows\system32\PCANDIS5.SYS
2008-10-13 19:48 . 2008-10-13 19:48 <DIR> d-------- c:\program files\Java
2008-10-13 19:48 . 2002-11-01 20:15 45,175 --------- c:\windows\system32\plugincpl140_03.cpl
2008-10-13 19:48 . 2002-11-01 20:15 41,068 --------- c:\windows\system32\ActPanel.dll
2008-10-13 19:46 . 2008-10-13 19:46 <DIR> d--hs---- c:\windows\ftpcache
2008-10-12 18:21 . 2008-10-12 18:21 <DIR> d-------- c:\windows\SxsCaPendDel
2008-10-12 18:17 . 2008-10-12 18:17 <DIR> d-------- c:\windows\Cache
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-10-09 01:48 42,320 ----a-w c:\windows\system32\xfcodec.dll
2008-10-04 13:49 --------- d-----w c:\program files\PocketRAR
2008-09-30 15:27 --------- d-----w c:\program files\DAEMON Tools Toolbar
2008-09-30 15:27 --------- d-----w c:\program files\DAEMON Tools Lite
2008-09-30 15:25 717,296 ----a-w c:\windows\system32\drivers\sptd.sys
2008-09-30 15:25 --------- d-----w c:\program files\ffdshow
2008-09-30 15:25 --------- d-----w c:\documents and settings\okay\Dane aplikacji\DAEMON Tools
2008-09-30 15:24 --------- d-----w c:\program files\SubEdit-Player
2008-09-29 17:38 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\CyberLink
2008-09-28 17:31 --------- d-----w c:\program files\WinPcap
2008-09-28 17:31 --------- d-----w c:\program files\Cain
2008-09-13 18:58 --------- d-----w c:\documents and settings\okay\Dane aplikacji\Ahead
2008-09-04 01:39 45,056 ----a-w c:\windows\system32\acovcnt.exe
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2006-03-02 15360]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112]
"AQQ"="c:\progra~1\WapSter\WAPSTE~1\AQQ.exe" [2008-09-18 1674736]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Wireless Console 2"="c:\program files\Wireless Console 2\wcourier.exe" [2007-07-05 1040384]
"ACU"="c:\program files\Atheros\ACU.exe" [2007-10-23 376921]
"ABLKSR"="c:\windows\ABLKSR\ABLKSR.exe" [2006-01-02 61440]
"WOOWATCH"="c:\progra~1\NEOSTR~1\Watch.exe" [2004-08-23 20480]
"WOOTASKBARICON"="c:\progra~1\NEOSTR~1\GestMaj.exe" [2004-10-14 32768]
"OutpostMonitor"="c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe" [2008-08-22 1157448]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-02 15360]
c:\windows\system32\config\systemprofile\Menu Start\Programy\Autostart\
CCC.lnk - c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-09-29 49152]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"msacm.avis"= ff_acm.acm
"VIDC.XFR1"= xfcodec.dll
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"SpybotSD TeaTimer"=c:\program files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"AdslTaskBar"=rundll32.exe stmctrl.dll,TaskBar
"OutpostFeedBack"="c:\program files\Agnitum\Outpost Firewall Pro\feedback.exe" /dump:os_startup
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
R1 SandBox;SandBox;c:\windows\system32\DRIVERS\SandBox.sys [2008-07-11 673920]
R2 acssrv;Agnitum Client Security Service;c:\progra~1\Agnitum\OUTPOS~1\acs.exe [2008-08-05 1238344]
R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;c:\windows\System32\StkCSrv.exe [2007-04-18 24576]
R3 afw;Agnitum firewall driver;c:\windows\system32\DRIVERS\afw.sys [2008-06-30 30864]
R3 afwcore;afwcore;c:\windows\system32\drivers\afwcore.sys [2008-06-30 234640]
R3 RTSTOR;USB Mass Stroage Device;c:\windows\system32\drivers\RTSTOR.SYS [2006-06-10 27520]
R3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;c:\windows\system32\Drivers\StkCMini.sys [2007-06-05 1260672]
R3 Stmatm;ATM/ADSL miniport;c:\windows\system32\DRIVERS\stmatm.sys [2003-08-12 60255]
R3 TaurusUsb;ADSL Modem USB Service;c:\windows\system32\DRIVERS\torususb.sys [2006-05-25 684265]
R3 WSIMD;wsimd Service;c:\windows\system32\DRIVERS\wsimd.sys [2007-07-03 57344]
S3 ASWFilt;ASWFilt;c:\windows\system32\Filt\ASWFilt.dll [2008-07-11 33408]
S3 AtcL002;NDIS Miniport Driver for Atheros L2 Fast Ethernet Controller;c:\windows\system32\DRIVERS\l251x86.sys [2007-08-21 30208]
S3 NPF;NetGroup Packet Filter Driver;c:\windows\system32\drivers\npf.sys [2007-11-06 34064]
S3 NSNDIS5;NSNDIS5 NDIS Protocol Driver;c:\windows\system32\NSNDIS5.SYS [2004-03-24 17280]
S3 usbstor;Sterownik magazynu masowego USB;c:\windows\system32\DRIVERS\USBSTOR.SYS [2006-03-02 26496]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static]
msiexec /fums {857D4360-762B-978B-76AD-491AA719E47A} /qb
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
.
------- Skan uzupełniający -------
.
FireFox -: Profile - c:\documents and settings\okay\Dane aplikacji\Mozilla\Firefox\Profiles\jj2c9w3n.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://google.pl/ | http://google.pl/
FF -: plugin - c:\program files\Adobe\Acrobat 6.0 CE\Reader\browser\nppdf32.dll
FF -: plugin - c:\program files\Java\j2re1.4.0_03\bin\NPJava11.dll
FF -: plugin - c:\program files\Java\j2re1.4.0_03\bin\NPJava12.dll
FF -: plugin - c:\program files\Java\j2re1.4.0_03\bin\NPJava13.dll
FF -: plugin - c:\program files\Java\j2re1.4.0_03\bin\NPJava32.dll
FF -: plugin - c:\program files\Java\j2re1.4.0_03\bin\NPJPI140_03.dll
FF -: plugin - c:\program files\Java\j2re1.4.0_03\bin\NPOJI610.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPJava11.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPJava12.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPJava13.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPJava32.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPJPI140_03.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\NPOJI610.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-10 13:10:17
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\SYSTEM32\ATI2EVXX.EXE
c:\program files\LAVASOFT\AD-AWARE\AAWSERVICE.EXE
c:\windows\SYSTEM32\ATI2EVXX.EXE
c:\windows\SYSTEM32\ACS.EXE
c:\program files\AGNITUM\OUTPOST FIREWALL PRO\ACS.EXE
c:\windows\SYSTEM32\FTRTSVC.EXE
c:\program files\NERO\NERO 7\INCD\INCDSRV.EXE
c:\program files\COMMON FILES\LIGHTSCRIBE\LSSRVC.EXE
c:\windows\SYSTEM32\PNKBSTRA.EXE
c:\program files\CYBERLINK\SHARED FILES\RICHVIDEO.EXE
c:\program files\ASUS\NB PROBE\SPM\SPMGR.EXE
c:\windows\SYSTEM32\WDFMGR.EXE
c:\windows\SYSTEM32\WSCNTFY.EXE
c:\program files\AGNITUM\OUTPOST FIREWALL PRO\OP_MON.EXE
c:\program files\NEOSTRADA TP\TASKBARICON.EXE
c:\program files\ATI TECHNOLOGIES\ATI.ACE\CORE-STATIC\MOM.EXE
c:\windows\SYSTEM32\WBEM\UNSECAPP.EXE
c:\program files\NEOSTRADA TP\NEOSTRADATP.EXE
c:\program files\NEOSTRADA TP\COMCOMP.EXE
c:\program files\NEOSTRADA TP\TOASTER.EXE
c:\program files\NEOSTRADA TP\INACTIVITY.EXE
c:\program files\NEOSTRADA TP\POLLINGMODULE.EXE
c:\windows\System32\ALERTM~1\ALERTM~1.EXE
c:\program files\NEOSTRADA TP\WATCH.EXE
.
**************************************************************************
.
Czas ukończenia: 2008-11-10 13:11:58 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2008-11-10 12:11:56
Przed: 79 225 421 824 bajtów wolnych
Po: 79,403,810,816 bajtów wolnych
WindowsXP-KB310994-SP2-Home-BootDisk-PLK.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
223
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:29:07, on 2008-11-10
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\Atheros\ACU.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe
c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\acs.exe
c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe
C:\WINDOWS\System32\FTRTSVC.exe
C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\StkCSrv.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\neostrada tp\neostradatp.exe
C:\Program Files\neostrada tp\ComComp.exe
C:\PROGRA~1\NEOSTR~1\Toaster.exe
C:\PROGRA~1\NEOSTR~1\Inactivity.exe
C:\PROGRA~1\NEOSTR~1\PollingModule.exe
C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE
C:\Program Files\neostrada tp\Watch.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.asus.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O4 - HKLM\..\Run: [Wireless Console 2] "C:\Program Files\Wireless Console 2\wcourier.exe"
O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui
O4 - HKLM\..\Run: [ABLKSR] C:\WINDOWS\ABLKSR\ABLKSR.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe
O4 - HKLM\..\Run: [OutpostMonitor] C:\PROGRA~1\Agnitum\OUTPOS~1\op_mon.exe /tray /noservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [StartCCC] c:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\WapSter\WAPSTE~1\AQQ.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - S-1-5-18 Startup: CCC.lnk = ? (User 'SYSTEM')
O4 - .DEFAULT Startup: CCC.lnk = ? (User 'Default user')
O4 - .DEFAULT User Startup: CCC.lnk = ? (User 'Default user')
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Ustawienia Outpost Firewall Pro - {44627E97-789B-40d4-B5C2-58BD171129A1} - C:\Program Files\Agnitum\Outpost Firewall Pro\ie_bar.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.asus.com
O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{8B52D584-4014-409C-B46C-DCB2967DDB88}: NameServer = 194.204.152.34 217.98.63.164
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Usługa konfiguracji Atheros (ACS) - Atheros - C:\WINDOWS\system32\acs.exe
O23 - Service: Agnitum Client Security Service (acssrv) - Agnitum Ltd. - C:\PROGRA~1\Agnitum\OUTPOS~1\acs.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe
O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe
O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe
O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\WINDOWS\System32\StkCSrv.exe
--
End of file - 6682 bytes
z góry dziękuje za sprawdzenie
