komp się wyłacza.

**Posty:** 99 · przez **Dominik16** 24 Maj 2007, 13:33

Wyskakuje mi błąd i daje nie wysyłaj raportu, a później takie coś
http://www.wgraj.net/img.php?mode=full&file=835
Pokazało mi się to kilka razy

**Posty:** 4 · przez **c_szok** 24 Maj 2007, 13:54

Twój problem nie jest skomplikowany. Trzeba tylko ściągnąc 2 pliki aktualizacyjne do windowsa i po problemie

Problem w tym że nie pamietam jakie to pliki były

A swoją drogą czy masz Service Pack 2 ?? Na SP2 ten problem nie powinien sie pojawiac....

**Posty:** 18165 · przez **wojtas** 24 Maj 2007, 13:55

daj logi wg opisu:

http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

**Posty:** 99 · przez **Dominik16** 24 Maj 2007, 14:09

Mam Sevice Pack2

**Posty:** 18165 · przez **wojtas** 24 Maj 2007, 14:13

wojtas19162 napisał(a):daj logi wg opisu:

http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

**Posty:** 99 · przez **Dominik16** 24 Maj 2007, 14:29

Logfile of HijackThis v1.99.1
Scan saved at 14:10:41, on 2007-05-24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\windows\Mixer.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\windows\system32\smss0.exe
C:\Program Files\Eset\nod32kui.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\RALINK\RT2400 Wireless LAN Card\Installer\WINXP\RaConfig.exe
C:\Program Files\PC-TV\WinManager\WinManager.exe
C:\windows\SHELLNEW\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Dominik\Pulpit\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 193.219.28.146:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: Lch - {5A3700EE-5330-4DE3-A9B6-D9B56E9791F6} - C:\windows\system32\lch.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {A05DA7E0-383C-4E99-A72A-742050A152A2} - C:\WINDOWS\system32\iifgdab.dll (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {D1159422-16E3-462F-A93D-FB718E100407} - C:\windows\system32\d4xofa.dll
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SvcManager] smss0.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [NAV CfgWiz] "C:\Program Files\Common Files\Symantec Shared\OPC\{31011D49-D90C-4da0-878B-78D28AD507AF}\CfgWiz.exe" /GUID {BC8D3EAF-F864-4d4b-AB4D-B3D0C32E2840} /MODE CfgWiz /CMDLINE "REBOOT"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe"
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - Global Startup: Raconfig.lnk = C:\Program Files\RALINK\RT2400 Wireless LAN Card\Installer\WINXP\RaConfig.exe
O4 - Global Startup: WinManager.lnk = C:\Program Files\PC-TV\WinManager\WinManager.exe
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: iifgdab - iifgdab.dll (file missing)
O20 - Winlogon Notify: winhdn32 - winhdn32.dll (file missing)
O20 - Winlogon Notify: wudb - C:\WINDOWS\system32\wudb.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: DirectX Service (Kuhuh) - Unknown owner - C:\windows\system32\directx.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

**Posty:** 18165 · przez **wojtas** 24 Maj 2007, 14:34

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Drivers to unload:

Kuhuh

Files to delete:

C:\windows\system32\lch.dll
C:\windows\system32\smss0.exe
C:\windows\system32\d4xofa.dll
C:\windows\system32\directx.exe
C:\windows\system32\wudb.dll
C:\windows\SHELLNEW\explorer.exe

Folders to delete:

C:\Program Files\MyGlobalSearch

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Po restarcie w HijackThis usuwasz wpis/y

O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O2 - BHO: Lch - {5A3700EE-5330-4DE3-A9B6-D9B56E9791F6} - C:\windows\system32\lch.dll
O2 - BHO: (no name) - {A05DA7E0-383C-4E99-A72A-742050A152A2} - C:\WINDOWS\system32\iifgdab.dll (file missing)
O2 - BHO: (no name) - {D1159422-16E3-462F-A93D-FB718E100407} - C:\windows\system32\d4xofa.dll
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O4 - HKLM\..\Run: [SvcManager] smss0.exe
O20 - Winlogon Notify: iifgdab - iifgdab.dll (file missing)
O20 - Winlogon Notify: winhdn32 - winhdn32.dll (file missing)
O20 - Winlogon Notify: wudb - C:\WINDOWS\system32\wudb.dll
O23 - Service: DirectX Service (Kuhuh) - Unknown owner - C:\windows\system32\directx.exe

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z hijacka oraz z:

http://download.bleepingcomputer.com/sUBs/ComboFix.exe

**Posty:** 99 · przez **Dominik16** 24 Maj 2007, 14:35

A nie idzie prościej ? :wink:

**Posty:** 18165 · przez **wojtas** 24 Maj 2007, 15:08

Dominik16 napisał(a):A nie idzie prościej ?

to jest najprosciej

**Posty:** 99 · przez **Dominik16** 24 Maj 2007, 15:34

Logfile of HijackThis v1.99.1
Scan saved at 15:13, on 2007-05-24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\savedump.exe
C:\windows\system32\lsass.exe
C:\windows\system32\Ati2evxx.exe
C:\windows\system32\svchost.exe
C:\windows\System32\svchost.exe
C:\windows\system32\Ati2evxx.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\windows\Explorer.EXE
C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\windows\system32\spoolsv.exe
C:\Program Files\Eset\nod32krn.exe
C:\Program Files\CyberLink\Shared files\RichVideo.exe
C:\windows\Mixer.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Eset\nod32kui.exe
C:\windows\system32\ctfmon.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\BitComet\BitComet.exe
C:\Program Files\eMule\emule.exe
C:\windows\system32\wuauclt.exe
C:\Program Files\RALINK\RT2400 Wireless LAN Card\Installer\WINXP\RaConfig.exe
C:\Program Files\PC-TV\WinManager\WinManager.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Dominik\Pulpit\hijackthis_199\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 193.219.28.146:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {D1159422-16E3-462F-A93D-FB718E100407} - C:\windows\system32\d4xofa.dll (file missing)
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe"
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O4 - Global Startup: Raconfig.lnk = C:\Program Files\RALINK\RT2400 Wireless LAN Card\Installer\WINXP\RaConfig.exe
O4 - Global Startup: WinManager.lnk = C:\Program Files\PC-TV\WinManager\WinManager.exe
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Wyolij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyolij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Symantec AppCore Service (SymAppCore) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe

Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\krxkxutq

*******************

Script file located at: \??\C:\windows\system32\kwgnkikk.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

Driver Kuhuh unloaded successfully.
File C:\windows\system32\lch.dll deleted successfully.
File C:\windows\system32\smss0.exe deleted successfully.
File C:\windows\system32\d4xofa.dll deleted successfully.
File C:\windows\system32\directx.exe deleted successfully.
File C:\windows\system32\wudb.dll deleted successfully.
File C:\windows\SHELLNEW\explorer.exe deleted successfully.
Folder C:\Program Files\MyGlobalSearch deleted successfully.

Completed script processing.

*******************

Finished! Terminate.

A z tego
http://download.bleepingcomputer.com/sUBs/ComboFix.exe to nie wiem jak, jak wałczyłem to coś tam skanowało ale komp się wyłączał i wariował.

**Posty:** 18165 · przez **wojtas** 24 Maj 2007, 15:39

skasuj i

O2 - BHO: (no name) - {D1159422-16E3-462F-A93D-FB718E100407} - C:\windows\system32\d4xofa.dll (file missing)

daj loga z :

http://www.techsupportforum.com/sectools/Deckard/dss.exe

**Posty:** 99 · przez **Dominik16** 24 Maj 2007, 16:07

Cały czas wyskakuje mi błąd:
http://obrazkowo.pl/out.php?i=6094_yf.jpg
http://obrazkowo.pl/out.php?i=6096_wtgg.jpg
:oops:

[ Dodano: Dzisiaj o 15:19 ]
Nie umiem zainstalować tego dss.exe bo mi sie komp resetuje i kaplica

**Posty:** 18165 · przez **wojtas** 24 Maj 2007, 16:22

sciagnij gmera:

http://gmer.net/gmer.zip

1. Zakładka Rootkit >>> zaznaczone wszystko oprócz Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta
2. Zakładka Rootkit >>> zaznaczone tylko Usługi i Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta

**Posty:** 99 · przez **Dominik16** 24 Maj 2007, 16:59

Kurde próbowałem dwa razy to przeskanować i zawsze w trakcie skanowania komp sie resetuje

**Posty:** 18165 · przez **wojtas** 24 Maj 2007, 17:37

to daj loga z silent runners:

http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

i sprobuj w awaryjnym zrobic loga

http://www.techsupportforum.com/sectools/Deckard/dss.exe
lub
http://download.bleepingcomputer.com/sUBs/ComboFix.exe

**Posty:** 99 · przez **Dominik16** 24 Maj 2007, 18:08

Deckard's System Scanner v20070426.43
Run by Dominik on 2007-05-24 at 20:27:49
Computer is in Safe Mode with Networking.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Failed to create restore point; computer is in safe mode.

-- Last 5 Restore Point(s) --
5: 2007-05-24 13:53:39 UTC - RP39 - Deckard's System Scanner Restore Point
4: 2007-05-24 13:34:05 UTC - RP38 - Deckard's System Scanner Restore Point
3: 2007-05-24 12:38:59 UTC - RP37 - Norton AntiVirus post configuration restore point
2: 2007-05-24 01:00:40 UTC - RP36 - Software Distribution Service 2.0
1: 2007-05-23 13:49:25 UTC - RP35 - Punkt kontrolny systemu

Performed disk cleanup.

-- HijackThis (run as Dominik.exe) ---------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 20:28, on 2007-05-24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\windows\System32\smss.exe
C:\windows\system32\winlogon.exe
C:\windows\system32\services.exe
C:\windows\system32\lsass.exe
C:\windows\system32\svchost.exe
C:\windows\system32\svchost.exe
C:\windows\Explorer.EXE
C:\Documents and Settings\Dominik\Pulpit\dss.exe
C:\DOCUME~1\Dominik\Pulpit\HIJACK~1\Dominik.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 193.219.28.146:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = L1cza
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton AntiVirus\osCheck.exe"
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\windows\system32\ctfmon.exe
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [BitComet] "C:\Program Files\BitComet\BitComet.exe"
O4 - Global Startup: Raconfig.lnk = C:\Program Files\RALINK\RT2400 Wireless LAN Card\Installer\WINXP\RaConfig.exe
O4 - Global Startup: WinManager.lnk = C:\Program Files\PC-TV\WinManager\WinManager.exe
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Wyolij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyolij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload.adobe.com/pub/shockwave/cabs/flash/swflash.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\windows\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon (file missing)
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Symantec IS Password Validation (ISPwdSvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\isPwdSvc.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

-- HijackThis Fixed Entries (C:\DOCUME~1\Dominik\Pulpit\HIJACK~1\backups\) -----

backup-20070524-144308-970 O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
backup-20070524-144308-888 O2 - BHO: Lch - {5A3700EE-5330-4DE3-A9B6-D9B56E9791F6} - C:\windows\system32\lch.dll (file missing)
backup-20070524-144308-667 O2 - BHO: (no name) - {A05DA7E0-383C-4E99-A72A-742050A152A2} - C:\WINDOWS\system32\iifgdab.dll (file missing)
backup-20070524-144308-877 O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
backup-20070524-144308-637 O4 - HKLM\..\Run: [SvcManager] smss0.exe
backup-20070524-144308-904 O20 - Winlogon Notify: iifgdab - iifgdab.dll (file missing)
backup-20070524-144309-724 O20 - Winlogon Notify: winhdn32 - winhdn32.dll (file missing)
backup-20070524-144309-534 O20 - Winlogon Notify: wudb - C:\WINDOWS\system32\wudb.dll (file missing)

-- File Associations -----------------------------------------------------------

All associations okay.

-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R3 RT2400 (RT2400 Wireless Driver) - c:\windows\system32\drivers\rt2400.sys <Not Verified; Ralink Technology Inc.; Ralink 802.11 Wireless PCI Adapters>

S1 PQNTDrv - c:\windows\system32\drivers\pqntdrv.sys <Not Verified; PowerQuest Corporation; PowerQuest product>
S2 MDC8021X (AEGIS Protocol (IEEE 802.1x) v2.3.1.9) - c:\windows\system32\drivers\mdc8021x.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 2.3.1.9>
S3 DtvAudio - c:\windows\system32\drivers\dtvaudio.sys <Not Verified; TwinHan Provide; DTVAudio>
S3 DtvVideo - c:\windows\system32\drivers\dtvvideo.sys <Not Verified; TwinHan Provide; DTV Video Controller.>
S3 SF-620 (Kingsun SF-620 USB Infrared Adapter) - c:\windows\system32\drivers\sf-620.sys <Not Verified; Kingsun Corporation; KSC Infrared Driver.>

-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

S2 RichVideo (Cyberlink RichVideo Service(CRVS)) - "c:\program files\cyberlink\shared files\richvideo.exe" <Not Verified; ; RichVideo Module>

-- Files created between 2007-04-24 and 2007-05-24 -----------------------------

2007-05-24 20:26:59 0 d-------- C:\windows\CSC
2007-05-24 20:26:50 0 d--hs---- C:\FOUND.020
2007-05-24 20:12:30 0 d--hs---- C:\FOUND.019
2007-05-24 19:57:59 0 d-------- C:\index.php
2007-05-24 18:45:24 0 d--hs---- C:\FOUND.018
2007-05-24 17:59:56 0 d--hs---- C:\FOUND.017
2007-05-24 17:55:54 0 d--hs---- C:\FOUND.016
2007-05-24 15:55:34 0 d--hs---- C:\FOUND.015
2007-05-24 15:35:48 0 d--hs---- C:\FOUND.014
2007-05-24 15:26:26 0 d--hs---- C:\FOUND.013
2007-05-24 14:34:50 0 d-------- C:\avenger
2007-05-24 12:42:52 0 --a------ C:\sysrun23.dll
2007-05-24 12:30:39 101888 -----n--- C:\windows\system32\VB6STKIT.DLL <Not Verified; Microsoft Corporation; Microsoft® Visual Basic for Windows>
2007-05-24 12:30:38 0 d-------- C:\Program Files\Northworks Solutions Ltd
2007-05-23 15:10:30 0 d--hs---- C:\FOUND.012
2007-05-23 14:16:27 1024000 --a------ C:\windows\system32\3ivx.dll <Not Verified; 3ivx.com; 3ivx D4 4.5.1 Plus>
2007-05-23 14:16:21 0 d-------- C:\Program Files\Acala 3GP Movies Free
2007-05-22 19:37:50 0 d--hs---- C:\FOUND.011
2007-05-22 15:18:28 0 d--hs---- C:\FOUND.010
2007-05-22 11:57:56 0 d--hs---- C:\FOUND.009
2007-05-22 00:17:38 0 d-------- C:\Program Files\Norton AntiVirus
2007-05-22 00:17:16 0 d-------- C:\Program Files\Symantec
2007-05-21 22:20:27 0 d-------- C:\Program Files\WinAVI VideoConverter
2007-05-21 15:36:42 0 d-------- C:\Program Files\WMV to AVI MPEG DVD WMV Converter
2007-05-21 08:22:09 0 d-------- C:\Downloads
2007-05-16 19:53:28 0 d--hs---- C:\FOUND.008
2007-05-15 20:57:08 0 d--hs---- C:\FOUND.007
2007-05-15 16:55:01 1040384 --a------ C:\windows\system32\libeay32.dll <Not Verified; The OpenSSL Project, http://www.openssl.org/; The OpenSSL Toolkit>
2007-05-15 16:54:41 196608 --a------ C:\windows\system32\ssleay32.dll <Not Verified; The OpenSSL Project, http://www.openssl.org/; The OpenSSL Toolkit>
2007-05-15 13:58:40 71680 --a------ C:\windows\g1465671.exe
2007-05-15 13:38:41 71680 --a------ C:\windows\g265296.exe
2007-05-15 07:24:24 71680 --a------ C:\windows\g149000.exe
2007-05-14 22:23:34 0 d--hs---- C:\FOUND.006
2007-05-14 21:53:48 0 d--hs---- C:\FOUND.005
2007-05-14 16:19:39 71680 --a------ C:\windows\g2798234.exe
2007-05-14 16:09:00 0 d-------- C:\windows\system32\appmgmt
2007-05-14 15:57:28 71680 --a------ C:\windows\g1467250.exe
2007-05-14 15:35:29 71680 --a------ C:\windows\g147078.exe
2007-05-14 14:56:52 0 d-------- C:\Program Files\Common Files\Symantec Shared
2007-05-13 21:46:38 0 d-------- C:\Program Files\Online_TV
2007-05-13 21:01:32 0 d-------- C:\Program Files\FrostWire
2007-05-11 23:39:52 0 d--hs---- C:\FOUND.004
2007-05-11 23:32:22 15961 -ra------ C:\windows\system32\drivers\SF-620.sys <Not Verified; Kingsun Corporation; KSC Infrared Driver.>
2007-05-11 23:15:30 0 d--hs---- C:\FOUND.003
2007-05-11 20:58:57 0 d-------- C:\Program Files\Motorola
2007-05-11 18:48:44 0 d--hs---- C:\FOUND.002
2007-05-11 18:32:34 8192 -----n--- C:\windows\system32\embedded
2007-05-10 14:56:26 0 d--hs---- C:\FOUND.001
2007-05-09 21:01:24 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-05-09 16:24:06 0 d--hs---- C:\FOUND.000
2007-05-09 15:32:44 0 d-------- C:\windows\pss
2007-05-09 13:51:36 0 d-------- C:\Program Files\Activision Value
2007-05-08 19:32:53 0 d-------- C:\Program Files\ProgDVB
2007-05-08 19:30:53 0 d-------- C:\Program Files\PC-TV
2007-05-08 19:30:50 25600 -ra------ C:\windows\system32\drivers\DtvVideo.sys <Not Verified; TwinHan Provide; DTV Video Controller.>
2007-05-08 19:30:45 10330 -ra------ C:\windows\system32\drivers\DtvAudio.sys <Not Verified; TwinHan Provide; DTVAudio>
2007-05-08 13:50:54 0 d-------- C:\ATI
2007-05-07 22:26:49 0 d-------- C:\Program Files\Alwil Software
2007-05-07 21:03:53 0 d-------- C:\Program Files\Everest Ultimate Edition
2007-05-07 20:49:03 0 d-------- C:\Program Files\English Translator 3
2007-05-07 16:27:50 0 d-------- C:\Program Files\Yahoo!
2007-05-07 16:27:47 0 d-------- C:\Program Files\CCleaner
2007-05-07 16:27:23 0 d-------- C:\Temp
2007-05-07 16:27:04 0 d-------- C:\Program Files\ImTOO
2007-05-07 16:23:44 0 d-------- C:\Program Files\XP Tuning
2007-05-07 16:23:31 0 d-------- C:\Program Files\Debugging Tools for Windows
2007-05-07 16:21:27 0 d-------- C:\Program Files\Skype
2007-05-07 16:20:52 0 d-------- C:\Program Files\Common Files\xing shared
2007-05-07 16:20:40 0 d-------- C:\Program Files\Real
2007-05-07 16:20:40 0 d-------- C:\Program Files\Common Files\Real
2007-05-07 16:16:48 0 d-------- C:\Program Files\PhotoFiltre
2007-05-07 16:13:26 0 d-------- C:\Program Files\Nero
2007-05-07 16:13:26 0 d-------- C:\Program Files\Common Files\Ahead
2007-05-07 15:46:48 0 d-------- C:\windows\Sun
2007-05-07 15:31:13 0 d-------- C:\Program Files\Java
2007-05-07 15:28:00 0 d-------- C:\Program Files\Common Files\Java
2007-05-07 15:23:39 0 d-------- C:\Program Files\Deutsch Translator 2
2007-05-07 15:21:25 0 d-------- C:\Program Files\DAEMON Tools
2007-05-07 15:19:00 682232 --a------ C:\windows\system32\drivers\sptd.sys
2007-05-07 15:15:09 0 d-------- C:\Program Files\MegauploadToolbar
2007-05-07 15:09:06 0 d-------- C:\Program Files\Winamp
2007-05-07 15:07:23 0 d-------- C:\Program Files\Cream Software
2007-05-07 15:05:16 0 --a------ C:\windows\nsreg.dat
2007-05-07 15:05:12 107132 --a------ C:\windows\UninstallFirefox.exe
2007-05-07 15:05:07 3554 --a------ C:\windows\mozver.dat
2007-05-07 14:10:31 0 d-------- C:\Program Files\Google
2007-05-07 14:09:40 0 d-------- C:\Program Files\CyberLink
2007-05-07 14:09:02 0 d-------- C:\Program Files\SlySoft
2007-05-07 14:07:57 0 d-------- C:\Program Files\ARWizard3
2007-05-07 09:22:50 0 d-------- C:\My Downloads
2007-05-07 09:22:07 0 d-------- C:\Program Files\BearShare
2007-05-07 08:55:07 0 d-------- C:\Program Files\Microsoft Works
2007-05-07 08:54:59 0 d-------- C:\Program Files\MSBuild
2007-05-07 08:51:43 0 d-------- C:\windows\SHELLNEW
2007-05-07 00:31:57 0 d-------- C:\Program Files\Fic_Products
2007-05-07 00:21:02 0 d-------- C:\Program Files\BitComet
2007-05-07 00:20:44 0 d-------- C:\Program Files\eMule
2007-05-07 00:17:14 0 d-------- C:\Program Files\MSXML 4.0
2007-05-07 00:13:17 0 d-------- C:\windows\RegisteredPackages
2007-05-07 00:04:05 0 dr-h----- C:\MSOCache
2007-05-06 23:44:29 737280 --a------ C:\windows\iun6002.exe <Not Verified; Indigo Rose Corporation; Setup Factory 6.0 Runtime Module>
2007-05-06 23:44:27 0 d-------- C:\Program Files\Codec Pack - All In 1
2007-05-06 23:42:41 0 d-------- C:\Program Files\PowerQuest
2007-05-06 23:41:46 0 d-------- C:\Program Files\MarBit
2007-05-06 23:40:18 0 d-------- C:\Program Files\Aida32
2007-05-06 23:39:53 0 d-------- C:\Program Files\Common Files\Adobe
2007-05-06 23:33:36 0 d-------- C:\Program Files\Gadu-Gadu
2007-05-06 23:30:05 0 d-------- C:\windows\system32\PreInstall
2007-05-06 23:30:04 0 d--h----- C:\windows\$hf_mig$
2007-05-06 23:25:26 15781 --a------ C:\windows\system32\drivers\mdc8021x.sys <Not Verified; Meetinghouse Data Communications; AEGIS Client 2.3.1.9>
2007-05-06 23:25:14 36864 --a------ C:\windows\system32\WRLSetup.exe
2007-05-06 23:25:14 32768 --a------ C:\windows\system32\SmartInstallCfg2.dll <Not Verified; ; SmartInstallCfg2 Dynamic Link Library>
2007-05-06 23:25:14 86016 --a------ C:\windows\system32\install.dll
2007-05-06 23:25:14 45056 --a------ C:\windows\system32\DEDriverDLL.dll
2007-05-06 23:25:14 28672 --a------ C:\windows\system32\CCS24.exe <Not Verified; ; CCS Application>
2007-05-06 23:25:14 110592 --a------ C:\windows\system32\AegisI5.exe <Not Verified; ; AegisInstall Application>
2007-05-06 23:25:10 0 d-------- C:\Program Files\RALINK
2007-05-06 23:20:02 0 d-------- C:\windows\system32\ReinstallBackups
2007-05-06 23:17:20 0 d-------- C:\windows\system32\SoftwareDistribution
2007-05-06 23:14:19 0 d--hs---- C:\Recycled
2007-05-06 23:11:51 81920 --a------ C:\windows\W32N50.dll <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
2007-05-06 23:11:51 62848 --a------ C:\windows\system32\drivers\RT2400.sys <Not Verified; Ralink Technology Inc.; Ralink 802.11 Wireless PCI Adapters>
2007-05-06 23:11:51 40960 --a------ C:\windows\system32\_IsUser.dll
2007-05-06 23:11:51 32768 --a------ C:\windows\PCARmDrv.exe <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
2007-05-06 23:11:51 17134 --a------ C:\windows\PCANDIS5.SYS <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
2007-05-06 23:11:51 16848 --a------ C:\windows\PCANDIS4.SYS <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
2007-05-06 23:11:51 18189 --a------ C:\windows\PCAMPR5.SYS <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
2007-05-06 23:11:51 17936 --a------ C:\windows\PCAMPR4.SYS <Not Verified; Printing Communications Assoc., Inc. (PCAUSA); PCAUSA Rawether for Windows>
2007-05-06 23:11:51 0 d-------- C:\Program Files\Wireless 11Mbps Network
2007-05-06 23:05:25 82432 -ra------ C:\windows\system32\MSXML4r.dll <Not Verified; Microsoft Corporation; Microsoft(R) MSXML 4.0 SP1>
2007-05-06 23:05:25 44544 -ra------ C:\windows\system32\MSXML4a.dll <Not Verified; Microsoft Corporation; Microsoft(R) MSXML 4.0 SP1>
2007-05-06 23:05:25 626960 -ra------ C:\windows\system32\hpvaut32.dll <Not Verified; Microsoft Corporation; >
2007-05-06 23:05:20 0 d-------- C:\Program Files\Hewlett-Packard
2007-05-06 23:05:12 0 d-------- C:\Program Files\HP
2007-05-06 23:03:26 0 d-------- C:\Program Files\Common Files\ATI Technologies
2007-05-06 23:02:51 520192 -----n--- C:\windows\system32\ati2sgag.exe <Not Verified; ; ATI Smart>
2007-05-06 23:02:30 0 d-------- C:\Program Files\ATI Technologies
2007-05-06 23:02:27 0 d--h----- C:\Program Files\InstallShield Installation Information
2007-05-06 23:01:50 0 d-------- C:\Program Files\Common Files\InstallShield
2007-05-06 22:58:24 0 d--hs---- C:\System Volume Information
2007-05-06 22:58:20 0 d-------- C:\windows\SoftwareDistribution
2007-05-06 22:58:20 0 d-------- C:\windows\Prefetch
2007-05-06 22:58:19 0 d---s---- C:\windows\system32\Microsoft
2007-05-06 22:52:27 0 d-------- C:\windows\system32\xircom
2007-05-06 22:52:27 0 d-------- C:\Program Files\microsoft frontpage
2007-05-06 22:52:06 0 -rahs---- C:\MSDOS.SYS
2007-05-06 22:52:06 0 -rahs---- C:\IO.SYS
2007-05-06 22:50:58 0 dr------- C:\windows\Offline Web Pages
2007-05-06 22:50:58 0 d---s---- C:\windows\Downloaded Program Files
2007-05-06 22:50:48 0 d--h----- C:\Program Files\WindowsUpdate
2007-05-06 22:50:45 0 d-------- C:\Program Files\Usługi online
2007-05-06 22:50:31 0 d-------- C:\windows\system32\DirectX
2007-05-06 22:49:59 0 d---s---- C:\windows\Tasks
2007-05-06 22:49:58 0 d-------- C:\Program Files\Common Files\MSSoap
2007-05-06 22:49:54 0 d-------- C:\windows\system32\Macromed
2007-05-06 22:49:54 0 d-------- C:\windows\srchasst
2007-05-06 22:49:47 0 d-------- C:\Program Files\Movie Maker
2007-05-06 22:49:39 0 d-------- C:\windows\system32\Restore
2007-05-06 22:48:48 21856 --a------ C:\windows\system32\emptyregdb.dat
2007-05-06 22:48:31 0 d-------- C:\windows\Registration
2007-05-06 22:48:18 0 d-------- C:\Program Files\Messenger
2007-05-06 22:48:15 0 d-------- C:\Program Files\MSN Gaming Zone
2007-05-06 22:47:48 0 d-------- C:\Program Files\Windows NT
2007-05-06 22:47:45 0 d-------- C:\windows\system32\MsDtc
2007-05-06 22:47:44 0 d-------- C:\windows\system32\Com
2007-05-06 22:42:30 0 d--hs---- C:\windows\Installer
2007-05-06 22:42:29 0 d-------- C:\Program Files\Common Files\ODBC
2007-05-06 22:42:26 0 d-------- C:\Program Files
2007-05-06 22:42:26 0 d-------- C:\Program Files\Common Files\SpeechEngines
2007-05-06 22:41:48 0 d-------- C:\windows\system32\CatRoot2
2007-05-06 22:41:48 0 d-------- C:\windows\system32\CatRoot
2007-05-06 22:41:25 0 d-------- C:\Documents and Settings
2007-05-06 22:36:50 0 d-------- C:\WINDOWS
2007-05-06 22:36:50 0 d-------- C:\windows\WinSxS
2007-05-06 22:36:50 0 dr------- C:\windows\Web
2007-05-06 22:36:50 0 d-------- C:\windows\twain_32
2007-05-06 22:36:50 0 d-------- C:\windows\system32
2007-05-06 22:36:50 0 d-------- C:\windows\system32\wins
2007-05-06 22:36:50 0 d-------- C:\windows\system32\wbem
2007-05-06 22:36:50 0 d-------- C:\windows\system32\usmt
2007-05-06 22:36:50 0 d-------- C:\windows\system32\spool
2007-05-06 22:36:50 0 d-------- C:\windows\system32\ShellExt
2007-05-06 22:36:50 0 d-------- C:\windows\system32\Setup
2007-05-06 22:36:50 0 d-------- C:\windows\system32\ras
2007-05-06 22:36:50 0 d-------- C:\windows\system32\oobe
2007-05-06 22:36:50 0 d-------- C:\windows\system32\npp
2007-05-06 22:36:50 0 d-------- C:\windows\system32\mui
2007-05-06 22:36:50 0 d-------- C:\windows\system32\inetsrv
2007-05-06 22:36:50 0 d-------- C:\windows\system32\IME
2007-05-06 22:36:50 0 d-------- C:\windows\system32\icsxml
2007-05-06 22:36:50 0 d-------- C:\windows\system32\ias
2007-05-06 22:36:50 0 d-------- C:\windows\system32\export
2007-05-06 22:36:50 0 d-------- C:\windows\system32\drivers
2007-05-06 22:36:50 0 d-------- C:\windows\system32\drivers\etc
2007-05-06 22:36:50 0 d-------- C:\windows\system32\drivers\disdn
2007-05-06 22:36:50 0 dr-hs---- C:\windows\system32\dllcache
2007-05-06 22:36:50 0 d-------- C:\windows\system32\dhcp
2007-05-06 22:36:50 0 d-------- C:\windows\system32\config
2007-05-06 22:36:50 0 d-------- C:\windows\system32\3com_dmi
2007-05-06 22:36:50 0 d-------- C:\windows\system32\3076
2007-05-06 22:36:50 0 d-------- C:\windows\system32\2052
2007-05-06 22:36:50 0 d-------- C:\windows\system32\1054
2007-05-06 22:36:50 0 d-------- C:\windows\system32\1045
2007-05-06 22:36:50 0 d-------- C:\windows\system32\1042
2007-05-06 22:36:50 0 d-------- C:\windows\system32\1041
2007-05-06 22:36:50 0 d-------- C:\windows\system32\1037
2007-05-06 22:36:50 0 d-------- C:\windows\system32\1033
2007-05-06 22:36:50 0 d-------- C:\windows\system32\1031
2007-05-06 22:36:50 0 d-------- C:\windows\system32\1028
2007-05-06 22:36:50 0 d-------- C:\windows\system32\1025
2007-05-06 22:36:50 0 d-------- C:\windows\system
2007-05-06 22:36:50 0 d-------- C:\windows\security
2007-05-06 22:36:50 0 d-------- C:\windows\Resources
2007-05-06 22:36:50 0 d-------- C:\windows\repair
2007-05-06 22:36:50 0 d-------- C:\windows\Provisioning
2007-05-06 22:36:50 0 d-------- C:\windows\PeerNet
2007-05-06 22:36:50 0 d-------- C:\windows\pchealth
2007-05-06 22:36:50 0 d-------- C:\windows\mui
2007-05-06 22:36:50 0 d-------- C:\windows\msapps
2007-05-06 22:36:50 0 d-------- C:\windows\msagent
2007-05-06 22:36:50 0 d-------- C:\windows\Media
2007-05-06 22:36:50 0 d-------- C:\windows\java
2007-05-06 22:36:50 0 d--h----- C:\windows\inf
2007-05-06 22:36:50 0 d-------- C:\windows\ime
2007-05-06 22:36:50 0 d-------- C:\windows\Help
2007-05-06 22:36:50 0 dr--s---- C:\windows\Fonts
2007-05-06 22:36:50 0 d-------- C:\windows\ehome
2007-05-06 22:36:50 0 d-------- C:\windows\Driver Cache
2007-05-06 22:36:50 0 d-------- C:\windows\Debug
2007-05-06 22:36:50 0 d-------- C:\windows\Cursors
2007-05-06 22:36:50 0 d-------- C:\windows\Connection Wizard
2007-05-06 22:36:50 0 d-------- C:\windows\Config
2007-05-06 22:36:50 0 d-------- C:\windows\AppPatch
2007-05-06 22:36:50 0 d-------- C:\windows\addins

-- Find3M Report ---------------------------------------------------------------

2007-05-13 21:02:56 0 d-------- C:\Documents and Settings\Dominik\Dane aplikacji\FrostWire
2007-05-11 21:42:44 0 d-------- C:\Documents and Settings\Dominik\Dane aplikacji\Google
2007-05-09 16:48:50 0 d-------- C:\Documents and Settings\Dominik\Dane aplikacji\MusicIP
2007-05-09 16:00:34 0 d-------- C:\Documents and Settings\Dominik\Dane aplikacji\AdobeUM
2007-05-07 21:01:52 0 d-------- C:\Documents and Settings\Dominik\Dane aplikacji\Help
2007-05-07 16:21:36 0 d-------- C:\Documents and Settings\Dominik\Dane aplikacji\Skype
2007-05-07 16:20:34 0 d-------- C:\Documents and Settings\Dominik\Dane aplikacji\Real
2007-05-07 16:14:48 0 d-------- C:\Documents and Settings\Dominik\Dane aplikacji\Ahead
2007-05-07 15:46:48 0 d-------- C:\Documents and Settings\Dominik\Dane aplikacji\Sun
2007-05-07 15:15:10 0 d-------- C:\Documents and Settings\Dominik\Dane aplikacji\MegauploadToolbar
2007-05-07 15:10:28 0 d-------- C:\Documents and Settings\Dominik\Dane aplikacji\Talkback
2007-05-07 15:07:26 0 d-------- C:\Documents and Settings\Dominik\Dane aplikacji\Cream Software
2007-05-07 15:05:08 0 d-------- C:\Documents and Settings\Dominik\Dane aplikacji\Mozilla
2007-05-07 14:12:26 0 d-------- C:\Documents and Settings\Dominik\Dane aplikacji\CyberLink
2007-05-07 13:39:46 0 d-------- C:\Documents and Settings\Dominik\Dane aplikacji\Macromedia
2007-05-07 00:29:08 355486 --a------ C:\windows\system32\perfh015.dat
2007-05-07 00:29:08 49492 --a------ C:\windows\system32\perfc015.dat
2007-05-07 00:03:36 0 d-------- C:\Documents and Settings\Dominik\Dane aplikacji\Adobe
2007-05-06 23:34:02 0 d-------- C:\Documents and Settings\Dominik\Dane aplikacji\Gadu-Gadu
2007-05-06 22:59:18 0 d-------- C:\Documents and Settings\Dominik\Dane aplikacji\Identities
2007-05-06 22:42:02 62 --ahs---- C:\Documents and Settings\Dominik\Dane aplikacji\desktop.ini
2007-03-19 20:13:10 6422611 --a------ C:\Program Files\frostwire-4.13.1.6.windows.exe <Not Verified; FrostWire Group; FrostWire>

-- Registry Dump ---------------------------------------------------------------

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{02478D38-C3F9-4EFB-9B51-7695ECA05670} C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
{72853161-30C5-4D22-B7F9-0BBC1D38A37E} C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} c:\program files\google\googletoolbar2.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"C-Media Mixer"="Mixer.exe /startup"
"GrooveMonitor"="\"C:\\Program Files\\Microsoft Office\\Office12\\GrooveMonitor.exe\""
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0_01\\bin\\jusched.exe\""
"NeroFilterCheck"="C:\\Program Files\\Common Files\\Ahead\\Lib\\NeroCheck.exe"
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\""
"osCheck"="\"C:\\Program Files\\Norton AntiVirus\\osCheck.exe\""
"nod32kui"="\"C:\\Program Files\\Eset\\nod32kui.exe\" /WAITSERVICE"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\windows\\system32\\ctfmon.exe"
"DAEMON Tools"="\"C:\\Program Files\\DAEMON Tools\\daemon.exe\" -lang 1033"
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="\"C:\\Program Files\\Common Files\\Ahead\\Lib\\NMBgMonitor.exe\""
"Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe"
"BitComet"="\"C:\\Program Files\\BitComet\\BitComet.exe\""

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="Groove GFS Stub Execution Hook"

HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
"path"="C:\\Documents and Settings\\All Users\\Menu Start\\Programy\\Autostart\\Adobe Reader Speed Launch.lnk"
"backup"="C:\\WINDOWS\\pss\\Adobe Reader Speed Launch.lnkCommon Startup"
"location"="Common Startup"
"command"="C:\\PROGRA~1\\Adobe\\ACROBA~1.0\\Reader\\READER~1.EXE "
"item"="Adobe Reader Speed Launch"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="CloneCDTray"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\SlySoft\\CloneCD\\CloneCDTray.exe\" /s"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Component Manager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hpcmpmgr"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\HP\\hpcoretech\\hpcmpmgr.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="HPWuSchd2"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\Hewlett-Packard\\HP Software Update\\HPWuSchd2.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="hpztsb10"
"hkey"="HKLM"
"command"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb10.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="Language"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\CyberLink\\PowerDVD\\Language\\Language.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="PDVDServ"
"hkey"="HKLM"
"command"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\""
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SvcManager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="smss0"
"hkey"="HKLM"
"command"="smss0.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="winampa"
"hkey"="HKLM"
"command"="C:\\Program Files\\Winamp\\winampa.exe"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0

-- End of Deckard's System Scanner: finished at 2007-05-24 at 20:29:05 ---------

Deckard's System Scanner v20070426.43
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Professional (build 2600) SP 2.0
Architecture: X86; Language: Polish

CPU 0: AMD Sempron(tm) 2800+
Percentage of Memory in Use: 21%
Physical Memory (total/avail): 1023.48 MiB / 806.66 MiB
Pagefile Memory (total/avail): 2462.08 MiB / 2376.42 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1965.55 MiB

A: is Removable (No Media)
C: is Fixed (FAT32) - 14.63 GiB total, 2.24 GiB free.
D: is Fixed (NTFS) - 218.23 GiB total, 25.31 GiB free.
E: is Fixed (NTFS) - 74.5 GiB total, 51.1 GiB free.
F: is Fixed (NTFS) - 74.52 GiB total, 8.55 GiB free.
G: is CDROM (No Media)
H: is CDROM (No Media)

-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Dominik\Dane aplikacji
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=KOMP_DOMINA
ComSpec=C:\windows\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Dominik
LOGONSERVER=\\KOMP_DOMINA
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\windows\system32;C:\windows;C:\windows\System32\Wbem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 8 Stepping 1, AuthenticAMD
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0801
ProgramFiles=C:\Program Files
PROMPT=$P$G
SAFEBOOT_OPTION=NETWORK
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\windows
TEMP=C:\DOCUME~1\Dominik\USTAWI~1\Temp
TMP=C:\DOCUME~1\Dominik\USTAWI~1\Temp
USERDOMAIN=KOMP_DOMINA
USERNAME=Dominik
USERPROFILE=C:\Documents and Settings\Dominik
windir=C:\windows

-- User Profiles ---------------------------------------------------------------

Dominik (admin)

-- Add/Remove Programs ---------------------------------------------------------

--> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
--> C:\Program Files\Nero\Nero 7\nero\uninstall\UNNERO.exe /UNINSTALL
--> C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL
--> C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL
--> C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL
--> C:\WINDOWS\UNNeroVision.exe /UNINSTALL
--> C:\WINDOWS\UNRecode.exe /UNINSTALL
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Acala 3GP Movies Free 2.5.7 --> "C:\Program Files\Acala 3GP Movies Free\unins000.exe"
Adobe Flash Player 9 ActiveX --> C:\WINDOWS\system32\Macromed\Flash\FlashUtil9c.exe -uninstallUnlock
Adobe Reader 7.0.5 - Polish --> MsiExec.exe /I{AC76BA86-7AD7-1045-7B44-A70500000002}
Aida32 3.94.2 Preview PL --> C:\Program Files\Aida32\Uninstal.exe
Aktualizacja dla systemu Windows XP (KB894391) --> "C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"
Aktualizacja dla systemu Windows XP (KB898461) --> "C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Aktualizacja dla systemu Windows XP (KB900485) --> "C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
Aktualizacja dla systemu Windows XP (KB908531) --> "C:\WINDOWS\$NtUninstallKB908531$\spuninst\spuninst.exe"
Aktualizacja dla systemu Windows XP (KB910437) --> "C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
Aktualizacja dla systemu Windows XP (KB911280) --> "C:\WINDOWS\$NtUninstallKB911280$\spuninst\spuninst.exe"
Aktualizacja dla systemu Windows XP (KB916595) --> "C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
Aktualizacja dla systemu Windows XP (KB920872) --> "C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
Aktualizacja dla systemu Windows XP (KB922582) --> "C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
Aktualizacja dla systemu Windows XP (KB927891) --> "C:\windows\$NtUninstallKB927891$\spuninst\spuninst.exe"
Aktualizacja dla systemu Windows XP (KB930916) --> "C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
Aktualizacja dla systemu Windows XP (KB931836) --> "C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB893756) --> "C:\WINDOWS\$NtUninstallKB893756$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB896358) --> "C:\WINDOWS\$NtUninstallKB896358$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB896423) --> "C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB896428) --> "C:\WINDOWS\$NtUninstallKB896428$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB899587) --> "C:\WINDOWS\$NtUninstallKB899587$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB899591) --> "C:\WINDOWS\$NtUninstallKB899591$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB900725) --> "C:\WINDOWS\$NtUninstallKB900725$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB901017) --> "C:\WINDOWS\$NtUninstallKB901017$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB901214) --> "C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB902400) --> "C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB904706) --> "C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB905414) --> "C:\WINDOWS\$NtUninstallKB905414$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB905749) --> "C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB908519) --> "C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB911562) --> "C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB911927) --> "C:\WINDOWS\$NtUninstallKB911927$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB913580) --> "C:\WINDOWS\$NtUninstallKB913580$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB914388) --> "C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB914389) --> "C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB917344) --> "C:\WINDOWS\$NtUninstallKB917344$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB917422) --> "C:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB917953) --> "C:\WINDOWS\$NtUninstallKB917953$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB918118) --> "C:\WINDOWS\$NtUninstallKB918118$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB918439) --> "C:\WINDOWS\$NtUninstallKB918439$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB919007) --> "C:\WINDOWS\$NtUninstallKB919007$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB920213) --> "C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB920670) --> "C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB920683) --> "C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB920685) --> "C:\WINDOWS\$NtUninstallKB920685$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB922819) --> "C:\WINDOWS\$NtUninstallKB922819$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB923191) --> "C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB923414) --> "C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB923694) --> "C:\WINDOWS\$NtUninstallKB923694$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB923789) --> C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Aktualizacja zabezpieczeń dla systemu Windows XP (KB923980) --> "C:\WINDOWS\$NtUninstallKB923980$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB924191) --> "C:\WINDOWS\$NtUninstallKB924191$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB924270) --> "C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB924496) --> "C:\WINDOWS\$NtUninstallKB924496$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB924667) --> "C:\WINDOWS\$NtUninstallKB924667$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB925902) --> "C:\WINDOWS\$NtUninstallKB925902$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB926255) --> "C:\WINDOWS\$NtUninstallKB926255$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB926436) --> "C:\WINDOWS\$NtUninstallKB926436$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB927779) --> "C:\WINDOWS\$NtUninstallKB927779$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB927802) --> "C:\WINDOWS\$NtUninstallKB927802$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB928090) --> "C:\WINDOWS\$NtUninstallKB928090$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB928255) --> "C:\WINDOWS\$NtUninstallKB928255$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB928843) --> "C:\WINDOWS\$NtUninstallKB928843$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB929969) --> "C:\WINDOWS\$NtUninstallKB929969$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB930178) --> "C:\WINDOWS\$NtUninstallKB930178$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB931261) --> "C:\WINDOWS\$NtUninstallKB931261$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB931768) --> "C:\WINDOWS\$NtUninstallKB931768$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB931784) --> "C:\WINDOWS\$NtUninstallKB931784$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla systemu Windows XP (KB932168) --> "C:\WINDOWS\$NtUninstallKB932168$\spuninst\spuninst.exe"
Aktualizacja zabezpieczeń dla Windows XP (KB923689) --> "C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"
ALLPlayer V2.2 --> C:\Program Files\MarBit\ALLPlayer\UnGins.exe "C:\Program Files\MarBit\ALLPlayer\install.log"
Archiwizator WinRAR --> C:\Program Files\WinRAR\uninstall.exe
ATI - Software Uninstall Utility --> C:\Program Files\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Display Driver --> rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
ATI HYDRAVISION --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3EA9D975-BFDC-4E8E-B88B-0446FBC8CA66}\setup.exe"
ATI Parental Control & Encoder --> MsiExec.exe /I{90437E5F-0A9E-4B63-AD8B-D232897D18BF}
Audio Record Wizard v3.98 --> "C:\Program Files\ARWizard3\unins000.exe"
BearShare --> C:\PROGRA~1\BEARSH~1\\UNWISE.EXE C:\PROGRA~1\BEARSH~1\\INSTALL.LOG
BitComet 0.70 --> C:\Program Files\BitComet\uninst.exe
ccCommon --> MsiExec.exe /I{3CCAD2EF-CFF2-4637-82AA-AABF370282D3}
CCleaner (remove only) --> "C:\Program Files\CCleaner\uninst.exe"
CloneCD --> "C:\Program Files\SlySoft\CloneCD\ccd-uninst.exe" /D="C:\Program Files\SlySoft\CloneCD"
Codec Pack - All In 1 6.0.2.4 --> C:\WINDOWS\iun6002.exe "C:\Program Files\Codec Pack - All In 1\irunin.ini"
Debugging Tools for Windows --> MsiExec.exe /I{16F22B31-9893-414F-98E0-D02CBDC287C9}
Deutsch Translator 2 --> C:\Program Files\Deutsch Translator 2\setup.exe -uninstall
DoctorTweak XP v1.75 --> C:\Program Files\Fic_Products\DoctorTweak XP\Uninstall.exe
eMule --> "C:\Program Files\eMule\Uninstall.exe"
English Translator 3 --> C:\Program Files\English Translator 3\setup.exe -uninstall
FrostWire 4.13.1.6 BETA --> C:\Program Files\FrostWire\Uninstall.exe
Gadu-Gadu 7.7 --> C:\Program Files\Gadu-Gadu\Setup.exe
Google Toolbar for Internet Explorer --> regsvr32 /u /s "c:\program files\google\googletoolbar2.dll"
Grand Theft Auto Vice City --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{4B35F00C-E63D-40DC-9839-DF15A33EAC46}\Setup.exe" -l0x9
HijackThis 1.99.1 --> C:\DOCUME~1\Dominik\USTAWI~1\Temp\Rar$EX00.766\HijackThis.exe /uninstall
HP Deskjet 3740 --> msiexec /x{F901CA6D-A074-42D3-A11D-33AAE6FFD0C1}
HP Software Update --> MsiExec.exe /X{B81023A5-71ED-46EB-BE3B-9F974D1155F1}
Java(TM) SE Runtime Environment 6 Update 1 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160010}
John Deere American Farmer Deluxe --> "E:\John Deere American Farmer Deluxe\unins000.exe"
Megaupload Toolbar --> C:\Program Files\MegauploadToolbar\uninstall.exe
Microsoft Office Access MUI (Polish) 2007 --> MsiExec.exe /X{90120000-0015-0415-0000-0000000FF1CE}
Microsoft Office Enterprise 2007 --> "C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007 --> MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (Polish) 2007 --> MsiExec.exe /X{90120000-0016-0415-0000-0000000FF1CE}
Microsoft Office Groove MUI (Polish) 2007 --> MsiExec.exe /X{90120000-00BA-0415-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (Polish) 2007 --> MsiExec.exe /X{90120000-0044-0415-0000-0000000FF1CE}
Microsoft Office OneNote MUI (Polish) 2007 --> MsiExec.exe /X{90120000-00A1-0415-0000-0000000FF1CE}
Microsoft Office Outlook MUI (Polish) 2007 --> MsiExec.exe /X{90120000-001A-0415-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (Polish) 2007 --> MsiExec.exe /X{90120000-0018-0415-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007 --> MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007 --> MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Polish) 2007 --> MsiExec.exe /X{90120000-001F-0415-0000-0000000FF1CE}
Microsoft Office Proofing (Polish) 2007 --> MsiExec.exe /X{90120000-002C-0415-0000-0000000FF1CE}
Microsoft Office Publisher MUI (Polish) 2007 --> MsiExec.exe /X{90120000-0019-0415-0000-0000000FF1CE}
Microsoft Office Shared MUI (Polish) 2007 --> MsiExec.exe /X{90120000-006E-0415-0000-0000000FF1CE}
Microsoft Office Word MUI (Polish) 2007 --> MsiExec.exe /X{90120000-001B-0415-0000-0000000FF1CE}
Monster Garage --> C:\PROGRA~1\ACTIVI~1\MONSTE~1\UNWISE.EXE C:\PROGRA~1\ACTIVI~1\MONSTE~1\INSTALL.LOG
Motorola Handset USB Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{44B3522B-195C-488D-84AC-9526FA99CB73}\Setup.exe"
Mozilla Firefox (2.0.0.3) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
My Global Search Bar --> rundll32 C:\PROGRA~1\MYGLOB~1\bar\1.bin\mgsBar.dll,O
Nero 7 Premium --> MsiExec.exe /I{70AB1576-7883-2313-C650-7A71270B1045}
Norton AntiVirus (Symantec Corporation) --> "C:\Program Files\Common Files\Symantec Shared\SymSetup\{830D8CBD-C668-49e2-A969-C2C2106332E0}_14_0_0_89\{830D8CBD-C668-49e2-A969-C2C2106332E0}.exe" /X
Norton AntiVirus Parent MSI --> MsiExec.exe /I{E5EE9939-259F-4DE2-8023-5C49E16A4F43}
Pajączek 5 NxG PRO - Deinstalacja --> "C:\Program Files\Cream Software\Pajaczek 5 NxG\unins000.exe"
PCI Audio Driver --> cmuninst.exe
PhotoFiltre --> "C:\Program Files\PhotoFiltre\Uninst.exe"
Poprawka systemu Windows XP - KB873339 --> C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe
Poprawka systemu Windows XP - KB885835 --> C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe
Poprawka systemu Windows XP - KB885836 --> C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe
Poprawka systemu Windows XP - KB886185 --> C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
Poprawka systemu Windows XP - KB887472 --> C:\WINDOWS\$NtUninstallKB887472$\spuninst\spuninst.exe
Poprawka systemu Windows XP - KB888302 --> C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe
Poprawka systemu Windows XP - KB890859 --> "C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe"
Poprawka systemu Windows XP - KB891781 --> C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe
PornBot Shareware 1.05 --> C:\PROGRA~1\NORTHW~1\PORNBO~1\Setup.exe /remove
PowerDVD --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
PowerDVD 7 --> "C:\Program Files\CyberLink\PowerDVD\unins000.exe"
PowerQuest PartitionMagic 8.0 --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{6BE2A4A4-99FB-48ED-AE1E-4E850389F804}
ProgDVB --> C:\Program Files\ProgDVB\Uninstall.exe
RealPlayer --> C:\Program Files\Common Files\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
RT2400 Wireless LAN Card --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9198A23F-C33C-4907-9715-96DE7D4AF27D}\Setup.exe" -l0x9
Security Update for CAPICOM (KB931906) --> MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906) --> MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for Excel 2007 (KB934670) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {CD098537-8857-4065-B4B6-AC023CB2C48E}
Security Update for Office 2007 (KB934062) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {305D509B-F194-4638-9F0F-D9E4C05F9D33}
Skype 2.5 --> "C:\Program Files\Skype\Phone\unins000.exe"
Symantec --> MsiExec.exe /I{228F6876-A313-40A3-91C0-C3CBE6997D09}
System Antywirusowy NOD32 --> C:\Program Files\Eset\Setup\setup.exe /UNINSTALL
TwinhanDTV --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{C19DBE5E-712E-4F02-8380-ECEDD951B374}\setup.exe" -l0x15
Update for Office 2007 (KB932080) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {EDC9CA29-6BC1-471C-828C-7A36109005D7}
Update for Office 2007 (KB933688) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F6E692F1-63C2-4760-94C6-C689DCD053F1}
Update for Office 2007 (KB934393) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {92FBAD46-E7F6-49FA-89B5-C39FC5BFAD15}
Update for Outlook 2007 Junk Email Filter (KB934655) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {F7185592-E40D-476E-9BC4-38DF96EE176B}
Update for Word 2007 (KB934173) --> msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C6A89125-5473-45E3-B413-ED8186437475}
WinAVI VideoConverter --> "C:\Program Files\WinAVI VideoConverter\unins000.exe"
Wireless LAN Adapter --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9A9BA600-6ECF-401A-9AE4-67A835C960E4}\Setup.exe" -l0x9
WMV to AVI MPEG DVD WMV Converter 2.2.0 --> "C:\Program Files\WMV to AVI MPEG DVD WMV Converter\unins000.exe"
XP Tuning 2.0 beta #2 --> "C:\Program Files\XP Tuning\unins000.exe"
Yahoo! Toolbar --> C:\PROGRA~1\YAHOO!\COMMON\unyt.exe

-- End of Deckard's System Scanner: finished at 2007-05-24 at 20:29:05 ---------

**Posty:** 18165 · przez **wojtas** 24 Maj 2007, 21:24

wklej do notatnika:

gmer -del file C:\FOUND.020
gmer -del file C:\FOUND.019
gmer -del file C:\FOUND.018
gmer -del file C:\FOUND.017
gmer -del file C:\FOUND.016
gmer -del file C:\FOUND.015
gmer -del file C:\FOUND.014
gmer -del file C:\FOUND.011
gmer -del file C:\FOUND.010
gmer -del file C:\FOUND.009
gmer -del file C:\FOUND.013
gmer -del file C:\FOUND.007
gmer -del file C:\FOUND.008
gmer -del file C:\windows\g1465671.exe
gmer -del file C:\windows\g265296.exe
gmer -del file C:\windows\g149000.exe
gmer -del file C:\FOUND.006
gmer -del file C:\FOUND.005
gmer -del file C:\windows\g2798234.exe
gmer -del file C:\windows\g1467250.exe
gmer -del file C:\windows\g147078.exe
gmer -del file C:\FOUND.004
gmer -del file C:\FOUND.003
gmer -del file C:\FOUND.002
gmer -del file C:\FOUND.001
gmer -del file C:\FOUND.000
gmer –reboot

Plik >>> zapisz jako >>> zmien rozszerzenie z TXT na wszystkie typy plików >>> zapisz pod nazwa FIX.BAT

Uruchamiasz Gmera, w zakładce Procesy wybierasz opcje Gmer Awaryjny. Komputer się zresetuje i uruchomi się Gmer. Wybierasz znów zakładke Procesy i na dole w poleceniu przez trzy kropki wskaz plik FIX.BAT i go uruchom.

Przeskanuj ten plik na tych stronach i pokaz raporty

Kod: Zaznacz wszystko: C:\sysrun23.dll

http://virusscan.jotti.org/
http://www.virustotal.com/

potem nowe logi

**Posty:** 99 · przez **Dominik16** 24 Maj 2007, 22:31

nie wiem coś spieprzyłem nie idzie :roll:

komp się wyłacza.

komp się wyłacza.

Kto jest na forum