Problemy z internetem - powolne ładowanie stron

**Posty:** 177 · przez **roonnii** 15 Wrz 2010, 19:24

Witam internet jeśli chodzi o ściąganie to działa prawidłowo( utorrent) a jeśli chce przegladać strony to strasznie powoli sie ładują w każdej z przegladarek ( chrome,opera,firefox,safari,) łącze mam dl 730kb up 60 i przeglądarki zajmuja dużo miejsca i jak uruchamiam gmer wyskakuje bład i jeśli zamkne firefoxa to w procesach dalej jest i zajmuje 99% procesora

Kod: Zaznacz wszystko: OTL logfile created on: 2010-09-15 19:09:30 - Run 1 OTL by OldTimer - Version 3.2.12.1 Folder = F:\programy Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1 023,00 Mb Total Physical Memory | 505,00 Mb Available Physical Memory | 49,00% Memory free 2,00 Gb Paging File | 2,00 Gb Available in Paging File | 84,00% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 30,34 Gb Total Space | 13,58 Gb Free Space | 44,76% Space Free | Partition Type: NTFS D: Drive not present or media not loaded E: Drive not present or media not loaded Drive F: | 96,83 Gb Total Space | 54,22 Gb Free Space | 55,99% Space Free | Partition Type: NTFS G: Drive not present or media not loaded Drive H: | 21,06 Gb Total Space | 20,66 Gb Free Space | 98,13% Space Free | Partition Type: NTFS Drive I: | 1397,26 Gb Total Space | 832,86 Gb Free Space | 59,61% Space Free | Partition Type: NTFS Drive J: | 1,91 Gb Total Space | 0,10 Gb Free Space | 5,01% Space Free | Partition Type: FAT Computer Name: PRIVATE-OH4VE3H Current User Name: Szymon Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-09-15 19:09:15 | 000,575,488 | ---- | M] (OldTimer Tools) -- F:\programy\OTL.exe PRC - [2010-08-24 11:38:16 | 000,247,144 | ---- | M] (TomTom) -- C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe PRC - [2010-07-27 18:37:24 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009-11-16 09:04:30 | 000,735,960 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe PRC - [2009-11-16 09:03:32 | 002,054,360 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe PRC - [2008-04-14 22:51:18 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007-04-30 01:00:00 | 000,032,768 | ---- | M] (Creative Technology Ltd.) -- C:\WINDOWS\V0420Mon.exe PRC - [2006-10-10 15:49:42 | 000,270,336 | ---- | M] () -- C:\WINDOWS\tsnp325.exe PRC - [2004-12-22 11:09:44 | 000,077,824 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-09-15 19:09:15 | 000,575,488 | ---- | M] (OldTimer Tools) -- F:\programy\OTL.exe MOD - [2008-04-14 22:46:34 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx MOD - [2006-05-03 23:53:54 | 000,174,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\framedyn.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Auto | Stopped] -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0) SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ) SRV - [2010-08-24 11:38:18 | 000,092,008 | ---- | M] (TomTom) [Auto | Stopped] -- C:\Program Files\TomTom HOME 2\TomTomHOMEService.exe -- (TomTomHOMEService) SRV - [2009-11-16 09:12:54 | 000,020,680 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv) SRV - [2009-11-16 09:04:30 | 000,735,960 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn) SRV - [2008-11-11 09:38:06 | 000,620,544 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2008-04-24 13:40:56 | 002,562,048 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Auto | Stopped] -- C:\WINDOWS\System32\hasplms.exe -- (hasplms) SRV - [2001-10-26 19:30:00 | 000,003,584 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\System32\regedt32.exe -- (NOD32FiXTemDono) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\System32\Drivers\ZDPSp50.sys -- (ZDPSp50) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\O4501U.sys -- (WN4501HLFZZ) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\wanatw4.sys -- (wanatw) WAN Miniport (ATW) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\DRIVERS\usbser_lowerflt.sys -- (upperdev) DRV - File not found [Kernel | On_Demand | Stopped] -- D:\INSTALL\GMSIPCI.SYS -- (GMSIPCI) DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\System32\drivers\EIO.sys -- (EIO) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\Szymon\USTAWI~1\Temp\cpuz130\cpuz_x32.sys -- (cpuz130) DRV - [2010-07-26 20:37:17 | 000,047,616 | ---- | M] (Aladdin Knowledge Systems) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Haspnt.sys -- (Haspnt) DRV - [2010-05-06 14:20:14 | 000,138,576 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PnkBstrK.sys -- (PnkBstrK) DRV - [2010-02-08 21:41:41 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd) DRV - [2010-01-12 06:03:33 | 010,276,768 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2010-01-04 20:48:09 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt) DRV - [2010-01-04 20:48:09 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt) DRV - [2010-01-01 19:20:34 | 000,026,024 | ---- | M] (Elaborate Bytes AG) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ElbyCDIO.sys -- (ElbyCDIO) DRV - [2009-11-16 09:06:50 | 000,096,408 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\epfwtdir.sys -- (epfwtdir) DRV - [2009-11-16 09:03:36 | 000,108,792 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv) DRV - [2009-11-16 08:56:12 | 000,116,520 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon) DRV - [2009-08-05 21:37:48 | 000,094,208 | ---- | M] (VSO Software) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ezplay.sys -- (ezplay) DRV - [2009-07-23 21:05:37 | 000,008,368 | ---- | M] (Alexey V.Voronin @ Hexy) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AMD64CAx86.sys -- (AMD64CA) DRV - [2009-03-16 21:46:44 | 000,004,096 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\gdrv.sys -- (gdrv) DRV - [2009-02-10 17:23:02 | 000,082,320 | ---- | M] (EZB Systems, Inc.) [File_System | System | Running] -- C:\Program Files\UltraISO\drivers\ISODrive.sys -- (ISODrive) DRV - [2008-11-22 23:42:24 | 000,215,616 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\truecrypt.sys -- (truecrypt) DRV - [2008-11-01 22:06:33 | 000,005,632 | ---- | M] () [File_System | System | Running] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen) DRV - [2008-08-26 09:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2008-07-07 09:40:49 | 000,056,108 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\scdemu.sys -- (SCDEmu) DRV - [2008-04-14 00:15:14 | 000,060,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\USBAUDIO.sys -- (usbaudio) Sterownik audio USB (WDM) DRV - [2008-03-18 16:09:16 | 000,350,720 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\aksfridge.sys -- (aksfridge) DRV - [2008-02-11 16:55:04 | 000,586,240 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\hardlock.sys -- (Hardlock) DRV - [2008-01-09 12:28:34 | 000,027,632 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\seehcri.sys -- (seehcri) DRV - [2007-11-02 12:47:38 | 000,109,992 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s916mdm.sys -- (s916mdm) DRV - [2007-11-02 12:47:38 | 000,103,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s916mgmt.sys -- (s916mgmt) Sony Ericsson Device 916 USB WMC Device Management Drivers (WDM) DRV - [2007-11-02 12:47:38 | 000,100,008 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s916obex.sys -- (s916obex) DRV - [2007-11-02 12:47:38 | 000,083,496 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s916bus.sys -- (s916bus) Sony Ericsson Device 916 driver (WDM) DRV - [2007-11-02 12:47:38 | 000,015,016 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\s916mdfl.sys -- (s916mdfl) DRV - [2007-05-31 09:32:34 | 000,099,648 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\V0420Vid.sys -- (V0420VID) Live! Cam Vista IM (VF0420) DRV - [2007-03-16 11:11:38 | 000,012,256 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS\System32\drivers\TBPanel.sys -- (TBPanel) DRV - [2007-03-16 11:11:38 | 000,012,256 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\TBPanel.sys -- (Cardex) DRV - [2007-02-16 02:57:04 | 000,034,760 | ---- | M] (SlySoft, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ElbyCDFL.sys -- (ElbyCDFL) DRV - [2006-11-20 09:48:40 | 000,506,112 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\PFC027.SYS -- (PAC207) DRV - [2006-09-28 14:10:52 | 000,011,648 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gggen.sys -- (gggen) DRV - [2006-09-24 15:28:46 | 000,005,248 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Boot | Running] -- C:\WINDOWS\system32\speedfan.sys -- (speedfan) DRV - [2006-07-01 23:32:26 | 000,043,520 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8) DRV - [2005-11-07 18:38:18 | 008,718,848 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\snpstd3.sys -- (SNPSTD3) USB PC Camera (SNPSTD3) DRV - [2005-08-30 18:59:00 | 000,094,000 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ss_mdm.sys -- (ss_mdm) DRV - [2005-08-30 18:58:56 | 000,008,304 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ss_mdfl.sys -- (ss_mdfl) DRV - [2005-08-30 18:57:18 | 000,058,320 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ss_bus.sys -- (ss_bus) SAMSUNG Mobile USB Device 1.0 driver (WDM) DRV - [2005-05-17 11:45:08 | 000,092,800 | R--- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\nvata.sys -- (nvata) DRV - [2005-04-05 21:22:30 | 000,012,928 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus) DRV - [2005-04-05 21:22:28 | 000,033,536 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD) DRV - [2005-02-11 10:24:24 | 000,079,488 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750obex.sys -- (k750obex) DRV - [2005-02-11 10:22:48 | 000,081,728 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750mgmt.sys -- (k750mgmt) DRV - [2005-02-11 10:21:10 | 000,089,872 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750mdm.sys -- (k750mdm) DRV - [2005-02-11 10:21:02 | 000,006,576 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750mdfl.sys -- (k750mdfl) DRV - [2005-02-11 10:19:20 | 000,055,216 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\k750bus.sys -- (k750bus) Sony Ericsson 750 driver (WDM) DRV - [2004-12-22 11:07:12 | 002,304,320 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM) DRV - [2004-09-21 01:09:10 | 000,186,584 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ET5Drv.sys -- (ET5Drv) DRV - [2001-10-26 01:40:02 | 000,031,776 | ---- | M] (Alfa Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\system32\Drivers\AFPAnsi.sys -- (AFPAnsi) DRV - [2001-08-17 22:51:32 | 000,018,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\irsir.sys -- (irsir) DRV - [1996-04-03 21:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\system32\giveio.sys -- (giveio) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl IE - HKCU\..\URLSearchHook: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfi1.dll (Conduit Ltd.) IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultenginename: "Winamp Search" FF - prefs.js..browser.search.defaultthis.engineName: "XfireXO Customized Web Search" FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://pl.start3.mozilla.com/firefox?client=firefox-a&rls=org.mozilla:pl:official" FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {E84D42CA-64EB-11DE-A65F-8C3656D89593}:3.0 FF - prefs.js..extensions.enabledItems: {eaf8a4ef-d221-45ca-9deb-d0934b45fa34}:1.3.0.3 FF - prefs.js..extensions.enabledItems: {AE93811A-5C9A-4d34-8462-F7B864FC4696}:3.62 FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.11.2 FF - prefs.js..extensions.enabledItems: {5e5ab302-7f65-44cd-8211-c1d4caaccea3}:2.5.6.0 FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&q=" FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010-09-14 22:58:41 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010-09-14 22:59:57 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010-09-12 19:36:39 | 000,000,000 | ---D | M] [2008-10-09 19:11:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Szymon\Dane aplikacji\Mozilla\Extensions [2008-10-09 19:11:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Szymon\Dane aplikacji\Mozilla\Extensions\home2@tomtom.com [2010-09-15 18:51:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Szymon\Dane aplikacji\Mozilla\Firefox\Profiles\wismkzo0.default\extensions [2009-07-17 19:50:25 | 000,000,000 | ---D | M] (Winamp Toolbar) -- C:\Documents and Settings\Szymon\Dane aplikacji\Mozilla\Firefox\Profiles\wismkzo0.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f} [2009-12-30 22:03:18 | 000,000,000 | ---D | M] (AniWeather) -- C:\Documents and Settings\Szymon\Dane aplikacji\Mozilla\Firefox\Profiles\wismkzo0.default\extensions\{4176DFF4-4698-11DE-BEEB-45DA55D89593} [2010-03-15 21:32:38 | 000,000,000 | ---D | M] (XfireXO Toolbar) -- C:\Documents and Settings\Szymon\Dane aplikacji\Mozilla\Firefox\Profiles\wismkzo0.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3} [2010-01-23 10:41:49 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Szymon\Dane aplikacji\Mozilla\Firefox\Profiles\wismkzo0.default\extensions\{AE93811A-5C9A-4d34-8462-F7B864FC4696} [2009-11-06 23:48:54 | 000,000,000 | ---D | M] (MediaBar) -- C:\Documents and Settings\Szymon\Dane aplikacji\Mozilla\Firefox\Profiles\wismkzo0.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593} [2009-04-18 22:13:34 | 000,000,000 | ---D | M] (OggX (powered by TIME S.A.)) -- C:\Documents and Settings\Szymon\Dane aplikacji\Mozilla\Firefox\Profiles\wismkzo0.default\extensions\{eaf8a4ef-d221-45ca-9deb-d0934b45fa34} [2009-07-18 01:02:48 | 000,002,476 | ---- | M] () -- C:\Documents and Settings\Szymon\Dane aplikacji\Mozilla\Firefox\Profiles\wismkzo0.default\searchplugins\BearShareWebSearch.xml [2010-01-20 13:14:16 | 000,000,917 | ---- | M] () -- C:\Documents and Settings\Szymon\Dane aplikacji\Mozilla\Firefox\Profiles\wismkzo0.default\searchplugins\conduit.xml [2010-02-08 21:41:59 | 000,002,055 | ---- | M] () -- C:\Documents and Settings\Szymon\Dane aplikacji\Mozilla\Firefox\Profiles\wismkzo0.default\searchplugins\daemon-search.xml [2009-07-17 19:50:42 | 000,001,196 | ---- | M] () -- C:\Documents and Settings\Szymon\Dane aplikacji\Mozilla\Firefox\Profiles\wismkzo0.default\searchplugins\winamp-search.xml [2010-09-12 14:36:39 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2008-11-11 09:38:54 | 000,663,552 | ---- | M] (BitComet) -- C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll [2010-07-12 18:33:56 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npwachk.dll [2010-03-12 00:01:41 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2009-07-18 01:02:48 | 000,002,476 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\BearShareWebSearch.xml [2010-03-12 00:01:41 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2010-03-12 00:01:41 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2010-03-12 00:01:41 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2010-03-12 00:01:41 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2010-03-12 00:01:41 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2010-06-14 14:21:58 | 000,161,364 | RHS- | M]) - C:\WINDOWS\system32\drivers\etc\HOSTS O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 abcsearch.com O1 - Hosts: 127.0.0.1 admin.abcsearch.com O1 - Hosts: 127.0.0.1 www3.abcsearch.com #[Browseraid] O1 - Hosts: 127.0.0.1 www.abcsearch.com O1 - Hosts: 127.0.0.1 abc517.net #[Trojan.Mitglieder.H] O1 - Hosts: 127.0.0.1 acestats.com O1 - Hosts: 127.0.0.1 www.acestats.com O1 - Hosts: 127.0.0.1 actualnames.com #[Parasite.ActualNames] O1 - Hosts: 127.0.0.1 www.actualnames.com O1 - Hosts: 127.0.0.1 ad-up.com O1 - Hosts: 127.0.0.1 www.ad-up.com O1 - Hosts: 127.0.0.1 adatom.com O1 - Hosts: 127.0.0.1 aesp.adatom.com O1 - Hosts: 127.0.0.1 adbest.com O1 - Hosts: 127.0.0.1 adserv.adbonus.com O1 - Hosts: 127.0.0.1 www.adbonus.com O1 - Hosts: 127.0.0.1 www.adblaster2.info #[Restricted Zone site] O1 - Hosts: 127.0.0.1 ad2.adcept.net O1 - Hosts: 127.0.0.1 ad3.adcept.net O1 - Hosts: 127.0.0.1 www.adcept.net O1 - Hosts: 127.0.0.1 adcomplete.com O1 - Hosts: 127.0.0.1 www.adcomplete.com O1 - Hosts: 127.0.0.1 www.adcopy.info O1 - Hosts: 127.0.0.1 ads.adcorps.com O1 - Hosts: 4674 more lines... O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) O2 - BHO: (HP Print Clips) - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll (Hewlett-Packard Co.) O2 - BHO: (MediaBar) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\Program Files\BearShareTb\BearShareDx.dll () O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) O2 - BHO: (no name) - {37B85A21-692B-4205-9CAD-2626E4993404} - No CLSID value found. O2 - BHO: (XfireXO Toolbar) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfi1.dll (Conduit Ltd.) O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10\_userdata\ggbho.2.dll (GG Network S.A.) O3 - HKLM\..\Toolbar: (MediaBar) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\Program Files\BearShareTb\BearShareDx.dll () O3 - HKLM\..\Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - No CLSID value found. O3 - HKLM\..\Toolbar: (XfireXO Toolbar) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfi1.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (XfireXO Toolbar) - {5E5AB302-7F65-44CD-8211-C1D4CAACCEA3} - C:\Program Files\XfireXO\tbXfi1.dll (Conduit Ltd.) O3 - HKCU\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) O4 - HKLM..\Run: [AMD64 CPU Assistant] File not found O4 - HKLM..\Run: [CloneCDTray] C:\Program Files\SlySoft\CloneCD\CloneCDTray.exe (SlySoft, Inc.) O4 - HKLM..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\GUI.exe () O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET) O4 - HKLM..\Run: [Hidder] C:\Program Files\G DATA Software\SekretNIK\Hidder.exe (G DATA Software Sp. z o.o.) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] File not found O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [tsnp325] C:\WINDOWS\tsnp325.exe () O4 - HKLM..\Run: [V0420Mon.exe] C:\WINDOWS\V0420Mon.exe (Creative Technology Ltd.) O4 - HKCU..\Run: [TomTomHOME.exe] C:\Program Files\TomTom HOME 2\TomTomHOMERunner.exe (TomTom) O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html () O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Kolekcja wycinków HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.) O9 - Extra Button: Zaznaczanie HP Smart - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll (Hewlett-Packard Co.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.) O15 - HKCU\..Trusted Domains: ([]msn in Mój komputer) O15 - HKCU\..Trusted Domains: aol.com ([objects] * is out of zone range - 5) O16 - DPF: {140E4DF8-9E14-4A34-9577-C77561ED7883} http://content.systemrequirementslab.com.s3.amazonaws.com/global/bin/srldetect_cyri_4.1.71.0.cab (SysInfo Class) O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\grooveLocalGWS {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\WgaLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\Szymon\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\Szymon\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008-02-29 11:01:25 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2009-10-09 17:27:12 | 000,000,089 | ---- | M] () - I:\Autorun.inf -- [ NTFS ] O32 - AutoRun File - [2009-07-07 13:00:26 | 000,000,186 | ---- | M] () - J:\autorun.inf -- [ FAT ] O33 - MountPoints2\{7e07e594-bc3f-11df-a294-000fea314897}\Shell\AutoRun\command - "" = J:\InstallTomTomHOME.exe -- [2009-06-12 10:53:34 | 000,348,160 | ---- | M] () O33 - MountPoints2\{ad2a6638-834f-11dd-bc39-000fea314897}\Shell\AutoRun\command - "" = J:\InstallTomTomHOME.exe -- [2009-06-12 10:53:34 | 000,348,160 | ---- | M] () O33 - MountPoints2\{ef5a645b-bc1d-11df-a293-000fea314897}\Shell\AutoRun\command - "" = J:\InstallTomTomHOME.exe -- [2009-06-12 10:53:34 | 000,348,160 | ---- | M] () O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-09-14 23:00:30 | 000,000,000 | ---D | C] -- C:\Program Files\Safari [2010-09-14 22:59:13 | 000,000,000 | ---D | C] -- C:\Program Files\QuickTime [2010-09-14 22:59:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer [2010-09-14 22:57:54 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour [2010-09-14 22:57:39 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple [2010-09-14 22:57:28 | 000,000,000 | ---D | C] -- C:\Program Files\Apple Software Update [2010-09-14 22:57:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Apple [2010-09-09 18:24:03 | 000,000,000 | ---D | C] -- C:\Program Files\TomTom International B.V [2010-09-09 18:23:22 | 000,000,000 | ---D | C] -- C:\Program Files\TomTom HOME 2 [2010-09-04 23:52:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Szymon\Dane aplikacji\ESET [2010-08-30 19:21:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Szymon\Ustawienia lokalne\Dane aplikacji\storage [2010-06-21 11:24:50 | 000,148,736 | ---- | C] (Avanquest Software) -- C:\Documents and Settings\All Users\Dane aplikacji\hpeF8.dll [2009-09-04 21:21:52 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\csnp325.dll [2009-09-04 21:21:51 | 000,147,456 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnp325.dll [2009-09-04 21:21:51 | 000,061,440 | ---- | C] ( ) -- C:\WINDOWS\System32\vsnp325.dll [2009-08-05 21:37:48 | 000,094,208 | ---- | C] (VSO Software) -- C:\Documents and Settings\Szymon\Dane aplikacji\ezplay.sys [2009-08-05 21:37:26 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Szymon\Dane aplikacji\pcouffin.sys [2008-04-26 20:13:43 | 000,061,440 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnpstd3.dll [2008-04-26 20:13:43 | 000,061,440 | ---- | C] ( ) -- C:\WINDOWS\System32\csnpstd3.dll [2008-04-26 20:13:43 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\vsnpstd3.dll [2008-04-26 20:13:43 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\vsnpstd3.dll [7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [10 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-09-15 18:42:37 | 000,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2010-09-15 18:39:38 | 000,055,584 | -H-- | M] () -- C:\WINDOWS\System32\mlfcache.dat [2010-09-15 17:20:42 | 000,267,725 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml [2010-09-15 17:20:11 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2010-09-15 17:20:03 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010-09-15 17:18:53 | 015,204,352 | ---- | M] () -- C:\Documents and Settings\Szymon\ntuser.dat [2010-09-15 17:18:53 | 000,000,292 | -HS- | M] () -- C:\Documents and Settings\Szymon\ntuser.ini [2010-09-14 23:00:40 | 000,001,854 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Safari.lnk [2010-09-14 22:59:36 | 000,001,617 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\QuickTime Player.lnk [2010-09-14 22:59:31 | 000,215,040 | ---- | M] () -- C:\Documents and Settings\Szymon\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010-09-14 22:57:32 | 000,000,284 | ---- | M] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2010-09-14 22:57:04 | 000,000,599 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Opera.lnk [2010-09-14 18:17:40 | 000,002,228 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010-09-13 20:21:07 | 000,000,124 | -HS- | M] () -- C:\Documents and Settings\All Users\Dane aplikacji\.zreglib [2010-09-12 19:52:03 | 000,416,026 | ---- | M] () -- C:\Documents and Settings\Szymon\Pulpit\martyana.jpg [2010-09-12 19:49:17 | 000,237,285 | ---- | M] () -- C:\Documents and Settings\Szymon\Pulpit\martyjna.jpg [2010-09-12 19:43:09 | 000,195,559 | ---- | M] () -- C:\Documents and Settings\Szymon\Pulpit\zdjecidasfewd.jpg [2010-09-12 19:40:53 | 000,316,390 | ---- | M] () -- C:\Documents and Settings\Szymon\Pulpit\naszaklasa.jpg [2010-09-09 20:43:41 | 000,054,056 | ---- | M] () -- C:\Documents and Settings\Szymon\Moje dokumenty\commerzbank_tan_empfangsbestaetigung.pdf [2010-09-07 18:59:07 | 000,000,032 | ---- | M] () -- C:\WINDOWS\Menu.INI [2010-09-04 14:03:30 | 000,000,735 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Call of Duty(R) 4 - Modern Warfare(TM) Wielu graczy.lnk [2010-09-04 14:03:30 | 000,000,735 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Call of Duty(R) 4 - Modern Warfare(TM) Jeden gracz.lnk [2010-09-04 14:03:28 | 000,000,319 | ---- | M] () -- C:\WINDOWS\game.ini [2010-08-30 15:08:56 | 000,000,020 | ---- | M] () -- C:\WINDOWS\naglos.INI [2010-08-29 12:59:29 | 000,001,145 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Tom Clancy's Splinter Cell Conviction.lnk [2010-08-23 19:03:27 | 000,000,661 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Winamp.lnk [2010-08-17 19:16:02 | 000,000,773 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\CloneCD.lnk [2010-08-17 18:30:29 | 000,000,859 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\CloneDVD2.lnk [7 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [10 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-09-15 18:39:38 | 000,055,584 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat [2010-09-14 23:00:40 | 000,001,854 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Safari.lnk [2010-09-14 22:59:36 | 000,001,617 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\QuickTime Player.lnk [2010-09-14 22:57:31 | 000,000,284 | ---- | C] () -- C:\WINDOWS\tasks\AppleSoftwareUpdate.job [2010-09-12 19:52:02 | 000,416,026 | ---- | C] () -- C:\Documents and Settings\Szymon\Pulpit\martyana.jpg [2010-09-12 19:49:17 | 000,237,285 | ---- | C] () -- C:\Documents and Settings\Szymon\Pulpit\martyjna.jpg [2010-09-12 19:43:09 | 000,195,559 | ---- | C] () -- C:\Documents and Settings\Szymon\Pulpit\zdjecidasfewd.jpg [2010-09-12 19:40:53 | 000,316,390 | ---- | C] () -- C:\Documents and Settings\Szymon\Pulpit\naszaklasa.jpg [2010-09-09 20:43:41 | 000,054,056 | ---- | C] () -- C:\Documents and Settings\Szymon\Moje dokumenty\commerzbank_tan_empfangsbestaetigung.pdf [2010-09-07 18:59:07 | 000,000,032 | ---- | C] () -- C:\WINDOWS\Menu.INI [2010-09-04 14:03:30 | 000,000,735 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Call of Duty(R) 4 - Modern Warfare(TM) Wielu graczy.lnk [2010-09-04 14:03:30 | 000,000,735 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Call of Duty(R) 4 - Modern Warfare(TM) Jeden gracz.lnk [2010-09-04 14:03:28 | 000,000,319 | ---- | C] () -- C:\WINDOWS\game.ini [2010-08-29 12:59:29 | 000,001,145 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Tom Clancy's Splinter Cell Conviction.lnk [2010-08-17 18:38:34 | 000,000,773 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\CloneCD.lnk [2010-08-17 18:30:29 | 000,000,859 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\CloneDVD2.lnk [2010-07-26 20:37:17 | 000,000,383 | ---- | C] () -- C:\WINDOWS\System32\haspdos.sys [2010-04-22 21:13:52 | 000,258,048 | ---- | C] () -- C:\WINDOWS\System32\libFLAC.dll [2010-03-05 02:15:32 | 000,041,872 | ---- | C] () -- C:\WINDOWS\System32\xfcodec.dll [2010-02-20 01:06:39 | 000,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini [2010-02-20 01:06:29 | 000,881,664 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2010-02-20 01:06:29 | 000,205,824 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2010-02-20 01:06:22 | 000,085,504 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2010-02-20 01:06:22 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009-12-19 22:40:42 | 000,000,124 | -HS- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\.zreglib [2009-12-19 22:19:58 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Szymon\Dane aplikacji\AVSMediaPlayer.m3u [2009-11-19 18:55:19 | 000,000,058 | ---- | C] () -- C:\Documents and Settings\Szymon\Ustawienia lokalne\Dane aplikacji\DonationCoder_ScreenshotCaptor_InstallInfo.dat [2009-11-06 23:49:02 | 000,076,407 | ---- | C] () -- C:\Documents and Settings\Szymon\Dane aplikacji\Smiley.ico [2009-11-06 11:58:04 | 000,178,975 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat [2009-09-26 23:13:29 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini [2009-09-04 21:21:57 | 000,015,498 | ---- | C] () -- C:\WINDOWS\snp325.ini [2009-08-05 21:37:58 | 000,000,033 | ---- | C] () -- C:\Documents and Settings\Szymon\Dane aplikacji\ezplay.log [2009-08-05 21:37:48 | 000,007,861 | ---- | C] () -- C:\Documents and Settings\Szymon\Dane aplikacji\ezplay.cat [2009-08-05 21:37:48 | 000,001,104 | ---- | C] () -- C:\Documents and Settings\Szymon\Dane aplikacji\ezplay.inf [2009-08-05 21:37:48 | 000,000,125 | ---- | C] () -- C:\Documents and Settings\Szymon\Dane aplikacji\ezplay.ini [2009-08-05 21:37:46 | 000,000,033 | ---- | C] () -- C:\Documents and Settings\Szymon\Dane aplikacji\pcouffin.log [2009-08-05 21:37:26 | 000,087,608 | ---- | C] () -- C:\Documents and Settings\Szymon\Dane aplikacji\inst.exe [2009-08-05 21:37:26 | 000,007,887 | ---- | C] () -- C:\Documents and Settings\Szymon\Dane aplikacji\pcouffin.cat [2009-08-05 21:37:26 | 000,001,144 | ---- | C] () -- C:\Documents and Settings\Szymon\Dane aplikacji\pcouffin.inf [2009-07-27 19:12:15 | 000,003,972 | ---- | C] () -- C:\WINDOWS\System32\drivers\PciBus.sys [2009-06-07 20:42:03 | 000,138,576 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2009-06-05 10:52:55 | 000,000,853 | ---- | C] () -- C:\WINDOWS\psdeval.INI [2009-06-04 22:50:16 | 000,001,439 | ---- | C] () -- C:\WINDOWS\unpsd.ini [2009-05-07 11:15:27 | 000,022,328 | ---- | C] () -- C:\Documents and Settings\Szymon\Dane aplikacji\PnkBstrK.sys [2009-03-21 19:30:55 | 000,000,020 | ---- | C] () -- C:\WINDOWS\naglos.INI [2009-03-16 21:47:32 | 000,000,264 | ---- | C] () -- C:\WINDOWS\_delis32.ini [2009-03-16 21:46:44 | 000,004,096 | ---- | C] () -- C:\WINDOWS\gdrv.sys [2009-01-20 22:09:20 | 000,164,712 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat [2009-01-20 17:39:04 | 000,178,176 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009-01-05 12:33:33 | 000,001,220 | ---- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\hpzinstall.log [2008-11-14 21:40:02 | 000,000,033 | ---- | C] () -- C:\WINDOWS\Multimedia manager.INI [2008-11-01 22:08:14 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\LauncherAccess.dt [2008-11-01 21:54:30 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys [2008-10-29 21:14:08 | 000,281,760 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys [2008-10-29 21:14:08 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys [2008-10-17 20:30:17 | 000,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2008-10-07 10:13:22 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelTraditionalChinese.dll [2008-10-07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSwedish.dll [2008-10-07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSpanish.dll [2008-10-07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelSimplifiedChinese.dll [2008-10-07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelPortugese.dll [2008-10-07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelKorean.dll [2008-10-07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelJapanese.dll [2008-10-07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelGerman.dll [2008-10-07 10:13:20 | 000,058,648 | ---- | C] () -- C:\WINDOWS\System32\AgCPanelFrench.dll [2008-09-21 18:03:24 | 000,000,863 | ---- | C] () -- C:\WINDOWS\WINCMD.INI [2008-08-26 14:10:53 | 000,000,048 | ---- | C] () -- C:\WINDOWS\scmate.ini [2008-04-26 20:23:11 | 000,000,032 | ---- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat [2008-04-26 20:13:46 | 000,015,498 | ---- | C] () -- C:\WINDOWS\snpstd3.ini [2008-04-26 20:13:45 | 008,718,848 | ---- | C] () -- C:\WINDOWS\System32\drivers\snpstd3.sys [2008-04-08 18:58:12 | 000,009,728 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll [2008-03-06 21:07:54 | 000,000,023 | ---- | C] () -- C:\WINDOWS\BlendSettings.ini [2008-03-05 19:39:13 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2008-03-03 19:12:59 | 000,691,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2008-02-29 16:39:52 | 000,215,040 | ---- | C] () -- C:\Documents and Settings\Szymon\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008-02-29 11:14:35 | 000,000,559 | ---- | C] () -- C:\WINDOWS\DFC.INI [2008-02-29 11:13:04 | 000,363,520 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2008-02-29 11:09:29 | 000,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini [2008-02-29 11:09:28 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll [2007-12-05 02:41:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2006-11-02 10:27:46 | 000,000,518 | ---- | C] () -- C:\WINDOWS\System32\SP207.INI [2005-07-12 15:44:42 | 000,015,872 | ---- | C] () -- C:\WINDOWS\System32\InsDrvZD64.DLL [2004-03-23 17:38:00 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\InsDrvZD.dll [1997-06-18 00:00:00 | 001,672,976 | ---- | C] () -- C:\WINDOWS\System32\MSO97V.DLL [1997-06-18 00:00:00 | 000,022,016 | ---- | C] () -- C:\WINDOWS\System32\DOCOBJ.DLL [1997-06-18 00:00:00 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\MSORFS.DLL [1997-06-18 00:00:00 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\HLINKPRX.DLL [1996-04-03 21:33:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS\System32\giveio.sys [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:466F9D5D < End of report >

**Posty:** 18165 · przez **wojtas** 15 Wrz 2010, 19:57

Logu z Gmera nie zrobisz bo nie czytasz przyklejonych ! brak też drugiego logu z OTL : extras.txt zaznacz tak jak na obrazku wszystkie opcje i będzie

[Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)

programy emulujące napędy

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
IE - HKCU\..\URLSearchHook: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfi1.dll (Conduit Ltd.)
FF - prefs.js..browser.search.defaultenginename: "Winamp Search"
FF - prefs.js..browser.search.defaultthis.engineName: "XfireXO Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&SearchSource=3&q={searchTerms}"
O2 - BHO: (MediaBar) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\Program Files\BearShareTb\BearShareDx.dll ()
O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O2 - BHO: (no name) - {37B85A21-692B-4205-9CAD-2626E4993404} - No CLSID value found.
O2 - BHO: (XfireXO Toolbar) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfi1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (MediaBar) - {0974BA1E-64EC-11DE-B2A5-E43756D89593} - C:\Program Files\BearShareTb\BearShareDx.dll ()
O3 - HKLM\..\Toolbar: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - No CLSID value found.
O3 - HKLM\..\Toolbar: (XfireXO Toolbar) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files\XfireXO\tbXfi1.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {37B85A29-692B-4205-9CAD-2626E4993404} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (XfireXO Toolbar) - {5E5AB302-7F65-44CD-8211-C1D4CAACCEA3} - C:\Program Files\XfireXO\tbXfi1.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.)
O4 - HKLM..\Run: [AMD64 CPU Assistant] File not found
O4 - HKLM..\Run: [nwiz] File not found
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html ()
O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O20 - Winlogon\Notify\WgaLogon: DllName - Reg Error: Value error. - Reg Error: Value error. File not found
O32 - AutoRun File - [2009-10-09 17:27:12 | 000,000,089 | ---- | M] () - I:\Autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-07-07 13:00:26 | 000,000,186 | ---- | M] () - J:\autorun.inf -- [ FAT ]
O33 - MountPoints2\{7e07e594-bc3f-11df-a294-000fea314897}\Shell\AutoRun\command - "" = J:\InstallTomTomHOME.exe -- [2009-06-12 10:53:34 | 000,348,160 | ---- | M] ()
O33 - MountPoints2\{ad2a6638-834f-11dd-bc39-000fea314897}\Shell\AutoRun\command - "" = J:\InstallTomTomHOME.exe -- [2009-06-12 10:53:34 | 000,348,160 | ---- | M] ()
O33 - MountPoints2\{ef5a645b-bc1d-11df-a293-000fea314897}\Shell\AutoRun\command - "" = J:\InstallTomTomHOME.exe -- [2009-06-12 10:53:34 | 000,348,160 | ---- | M] ()
@Alternate Data Stream - 123 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:466F9D5D

:Files
C:\Documents and Settings\Szymon\Dane aplikacji\Mozilla\Firefox\Profiles\wismkzo0.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
C:\Documents and Settings\Szymon\Dane aplikacji\Mozilla\Firefox\Profiles\wismkzo0.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}
C:\Documents and Settings\Szymon\Dane aplikacji\Mozilla\Firefox\Profiles\wismkzo0.default\extensions\{E84D42CA-64EB-11DE-A65F-8C3656D89593}
C:\Documents and Settings\Szymon\Dane aplikacji\Mozilla\Firefox\Profiles\wismkzo0.default\searchplugins\BearShareWebSearch.xml
C:\Documents and Settings\Szymon\Dane aplikacji\Mozilla\Firefox\Profiles\wismkzo0.default\searchplugins\conduit.xml
C:\Documents and Settings\Szymon\Dane aplikacji\Mozilla\Firefox\Profiles\wismkzo0.default\searchplugins\daemon-search.xml
C:\Documents and Settings\Szymon\Dane aplikacji\Mozilla\Firefox\Profiles\wismkzo0.default\searchplugins\winamp-search.xml
C:\Program Files\Mozilla Firefox\searchplugins\BearShareWebSearch.xml
C:\Program Files\Winamp Toolbar
C:\Program Files\BearShareTb

:Commands
[resethosts]
[emptytemp]
[emptyflash]
[clearallrestorepoints]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt i extras.txt oraz raport z czyszczenia (zawartość notatnika, która otworzy się po restarcie) + Gmer

**Posty:** 177 · przez **roonnii** 15 Wrz 2010, 20:11

http://wklej.to/jeWF dziwne dla mnie takie forum a brakuje znaków

Dodano 15.09.2010 20:06:17:

Kod: Zaznacz wszystko: GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-09-15 21:01:51 Windows 5.1.2600 Dodatek Service Pack 3 Running: sjv3pw94.exe; Driver: C:\DOCUME~1\Szymon\USTAWI~1\Temp\fgqiikoc.sys ---- System - GMER 1.0.15 ---- SSDT 8635C8A0 ZwAssignProcessToJobObject SSDT spxj.sys ZwEnumerateKey [0xF7441DA4] SSDT spxj.sys ZwEnumerateValueKey [0xF7442132] SSDT 8635BCB0 ZwOpenProcess SSDT 8635C0D0 ZwOpenThread SSDT spxj.sys ZwQueryKey [0xF744220A] SSDT spxj.sys ZwQueryValueKey [0xF744208A] SSDT spxj.sys ZwSetValueKey [0xF744229C] SSDT 8635C6D0 ZwSuspendProcess SSDT 8635C4F0 ZwSuspendThread SSDT 8635BEE0 ZwTerminateProcess SSDT 8635C310 ZwTerminateThread SSDT \WINDOWS\system32\ntkrnlpa.exe (Jądro i system NT/Microsoft Corporation) ZwCreateKey [0x80542C71] SSDT \WINDOWS\system32\ntkrnlpa.exe[unknown section] [80542C71] ZwCreateKey [0x80542C71] SSDT \WINDOWS\system32\ntkrnlpa.exe (Jądro i system NT/Microsoft Corporation) ZwOpenKey [0x80542C76] SSDT \WINDOWS\system32\ntkrnlpa.exe[unknown section] [80542C76] ZwOpenKey [0x80542C76] INT 0x03 \WINDOWS\system32\ntkrnlpa.exe[unknown section] 80542C7B INT 0x06 \??\C:\WINDOWS\system32\drivers\Haspnt.sys (HASP Kernel Device Driver for Windows NT/Aladdin Knowledge Systems) B7C2016D INT 0x0E \??\C:\WINDOWS\system32\drivers\Haspnt.sys (HASP Kernel Device Driver for Windows NT/Aladdin Knowledge Systems) B7C1FFC2 INT 0x62 ? 86FD8BF8 INT 0x63 ? 86EA7BF8 INT 0x73 ? 86FD8BF8 INT 0x82 ? 86FD8BF8 INT 0xB4 ? 86EA7BF8 ---- Kernel code sections - GMER 1.0.15 ---- ? spxj.sys Nie można odnaleźć określonego pliku. ! .text USBPORT.SYS!DllUnload F71D88AC 5 Bytes JMP 86EA71D8 .text C:\WINDOWS\System32\DRIVERS\nv4_mini.sys section is writeable [0xF6506380, 0x550AF5, 0xE8000020] .text C:\WINDOWS\system32\drivers\aksfridge.sys section is writeable [0xB79BC000, 0x48011, 0xE0000020] .init C:\WINDOWS\system32\drivers\aksfridge.sys entry point in ".init" section [0xB7A11224] .init C:\WINDOWS\system32\drivers\aksfridge.sys unknown last code section [0xB7A11000, 0x4000, 0xE20000E0] .text C:\WINDOWS\system32\DRIVERS\atksgt.sys section is writeable [0xB7978300, 0x3B6D8, 0xE8000020] .text C:\WINDOWS\system32\drivers\hardlock.sys section is writeable [0xB78C0400, 0x6E1B2, 0xE8000020] .protect˙˙˙˙hardlockentry point in ".protect˙˙˙˙hardlockentry point in ".protect˙˙˙˙hardlockentry point in ".p" section [0xB794A220] C:\WINDOWS\system32\drivers\hardlock.sys entry point in ".protect˙˙˙˙hardlockentry point in ".protect˙˙˙˙hardlockentry point in ".p" section [0xB794A220] .protect˙˙˙˙hardlockunknown last code section [0xB794A000, 0x50EA, 0xE0000020] C:\WINDOWS\system32\drivers\hardlock.sys unknown last code section [0xB794A000, 0x50EA, 0xE0000020] .text C:\WINDOWS\system32\DRIVERS\lirsgt.sys section is writeable [0xF790C300, 0x1BEE, 0xE8000020] ---- User code sections - GMER 1.0.15 ---- .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[196] kernel32.dll!SetUnhandledExceptionFilter 7C8449FD 4 Bytes [C2, 04, 00, 00] .text C:\Program Files\Mozilla Firefox\firefox.exe[284] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation) ---- Kernel IAT/EAT - GMER 1.0.15 ---- IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F742A042] spxj.sys IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F742A13E] spxj.sys IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F742A0C0] spxj.sys IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F742A800] spxj.sys IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F742A6D6] spxj.sys IAT \SystemRoot\System32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F7439B90] spxj.sys ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Ntfs \Ntfs 86FD71F8 AttachedDevice \FileSystem\Ntfs \Ntfs AFPAnsi.sys (Windows NT File System Protector Network Edition/Alfa Corporation) AttachedDevice \FileSystem\Ntfs \Ntfs eamon.sys (Amon monitor/ESET) Device \FileSystem\Fastfat \FatCdrom 85F0C1F8 Device \Driver\usbohci \Device\USBPDO-0 86F3D500 Device \Driver\dmio \Device\DmControl\DmIoDaemon 86FD91F8 Device \Driver\dmio \Device\DmControl\DmConfig 86FD91F8 Device \Driver\dmio \Device\DmControl\DmPnP 86FD91F8 Device \Driver\dmio \Device\DmControl\DmInfo 86FD91F8 Device \Driver\usbehci \Device\USBPDO-1 86EC11F8 AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdir.sys (ESET Antivirus Network Redirector/ESET) Device \Driver\Ftdisk \Device\HarddiskVolume1 86F6C1F8 Device \Driver\Cdrom \Device\CdRom0 86EC5500 Device \Driver\Ftdisk \Device\HarddiskVolume2 86F6C1F8 Device \Driver\Ftdisk \Device\HarddiskVolume3 86F6C1F8 Device \Driver\Ftdisk \Device\HarddiskVolume4 86F6C1F8 Device \Driver\USBSTOR \Device\00000082 863A91F8 Device \Driver\USBSTOR \Device\00000083 863A91F8 Device \Driver\NetBT \Device\NetBt_Wins_Export 85F0D1F8 Device \Driver\nvata \Device\00000079 86FD81F8 Device \Driver\USBSTOR \Device\00000085 863A91F8 Device \Driver\NetBT \Device\NetBT_Tcpip_{660E5A30-1811-47E0-B71F-8396BAEED7D8} 85F0D1F8 Device \Driver\USBSTOR \Device\00000088 863A91F8 Device \Driver\Disk \Device\Harddisk0\DR0 aksfridge.sys (Ancillary Function Driver/Aladdin Knowledge Systems Ltd.) Device \Driver\Disk \Device\Harddisk1\DR4 aksfridge.sys (Ancillary Function Driver/Aladdin Knowledge Systems Ltd.) Device \Driver\Disk \Device\Harddisk2\DR6 aksfridge.sys (Ancillary Function Driver/Aladdin Knowledge Systems Ltd.) Device \Driver\Disk \Device\Harddisk2\DP(1)0-0+7 aksfridge.sys (Ancillary Function Driver/Aladdin Knowledge Systems Ltd.) Device \Driver\usbohci \Device\USBFDO-0 86F3D500 Device \Driver\usbehci \Device\USBFDO-1 86EC11F8 Device \Driver\nvata \Device\NvAta0 86FD81F8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 85F141F8 Device \Driver\nvata \Device\0000007b 86FD81F8 Device \Driver\nvata \Device\NvAta1 86FD81F8 Device \FileSystem\MRxSmb \Device\LanmanRedirector 85F141F8 Device \Driver\Ftdisk \Device\FtControl 86F6C1F8 Device \FileSystem\Fastfat \Fat 85F0C1F8 AttachedDevice \FileSystem\Fastfat \Fat AFPAnsi.sys (Windows NT File System Protector Network Edition/Alfa Corporation) AttachedDevice \FileSystem\Fastfat \Fat eamon.sys (Amon monitor/ESET) Device \FileSystem\Cdfs \Cdfs 85F391F8 ---- Threads - GMER 1.0.15 ---- Thread System [4:420] 8635A930 ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 722685333 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 1721371613 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 3 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 2 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x06 0x0C 0x5F 0x9B ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x10 0x6E 0xD7 0xD6 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x87 0x43 0x94 0x99 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xB3 0xB5 0x1A 0x34 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x03 0x82 0x1C 0xC9 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x1B 0x40 0x9B 0x19 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0x52 0x12 0x25 0xFC ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x99 0xF3 0x4B 0x96 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xED 0x90 0xBB 0xF8 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xB5 0xDB 0xC6 0x05 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xD0 0x9D 0x83 0xCC ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x39 0xE3 0xD7 0x75 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0x52 0x12 0x25 0xFC ... Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 2 Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x06 0x0C 0x5F 0x9B ... Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1 Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x10 0x6E 0xD7 0xD6 ... Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ... Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x87 0x43 0x94 0x99 ... Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xB3 0xB5 0x1A 0x34 ... Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x03 0x82 0x1C 0xC9 ... Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x1B 0x40 0x9B 0x19 ... Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf42@khjeh 0x52 0x12 0x25 0xFC ... ---- Files - GMER 1.0.15 ---- File C:\WINDOWS\hide.conf 61 bytes ---- EOF - GMER 1.0.15 ----