Problm z agent.exe-żre całą pamięć-hijackthis

**Posty:** 2 · przez **kesal** 24 Maj 2011, 19:52

hej
mam prośbę.czy mozecie rzucić okiem na mój log z hijackthis?co powinieniem wyłączyć?

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 19:52:35, on 2011-05-24 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\cacaoweb\cacaoweb.exe C:\Documents and Settings\miszcz\Dane aplikacji\SanDisk\Sansa Updater\SansaDispatch.exe C:\Program Files\Immunet\3.0.0\agent.exe C:\Program Files\Opera\Opera.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = my.daemon-search.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll O3 - Toolbar: Foxit PDF Creator Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O4 - HKCU\..\Run: [cacaoweb] "C:\Program Files\cacaoweb\cacaoweb.exe" -noplayer O4 - HKCU\..\Run: [SansaDispatch] C:\Documents and Settings\miszcz\Dane aplikacji\SanDisk\Sansa Updater\SansaDispatch.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O22 - SharedTaskScheduler: Moduł wstępnego ładowania interfejsu Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Demon buforu kategorii składników - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Immunet 3.0 (ImmunetProtect) - Sourcefire, Inc. - C:\Program Files\Immunet\3.0.0\agent.exe -- End of file - 4390 bytes

**Posty:** 18165 · przez **wojtas** 24 Maj 2011, 20:20

Proszę zastosować się do obowiązkowych zasad w dziale bezpieczeństwo
- wstaw 3 wymagane logi
- opisz problem

**Posty:** 2 · przez **kesal** 24 Maj 2011, 22:20

Kod: Zaznacz wszystko: GMER 1.0.15.15627 - http://www.gmer.net Rootkit scan 2011-05-24 21:30:39 Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 ST310211A rev.3.54 Running: f8k70d6q.exe; Driver: C:\DOCUME~1\miszcz\USTAWI~1\Temp\kwgcqfoc.sys ---- System - GMER 1.0.15 ---- SSDT \SystemRoot\system32\DRIVERS\ImmunetSelfProtect.sys (Immunet Self Protect Driver/Windows (R) Codename Longhorn DDK provider) ZwCreateKey [0xF7B5EEA6] SSDT \SystemRoot\system32\DRIVERS\ImmunetSelfProtect.sys (Immunet Self Protect Driver/Windows (R) Codename Longhorn DDK provider) ZwDeleteKey [0xF7B5F1C2] SSDT \SystemRoot\system32\DRIVERS\ImmunetSelfProtect.sys (Immunet Self Protect Driver/Windows (R) Codename Longhorn DDK provider) ZwDeleteValueKey [0xF7B5F2CC] SSDT \SystemRoot\system32\DRIVERS\ImmunetSelfProtect.sys (Immunet Self Protect Driver/Windows (R) Codename Longhorn DDK provider) ZwOpenKey [0xF7B5F038] SSDT \SystemRoot\system32\DRIVERS\ImmunetSelfProtect.sys (Immunet Self Protect Driver/Windows (R) Codename Longhorn DDK provider) ZwOpenProcess [0xF7B5ECCE] SSDT \SystemRoot\system32\DRIVERS\ImmunetSelfProtect.sys (Immunet Self Protect Driver/Windows (R) Codename Longhorn DDK provider) ZwSetValueKey [0xF7B5F410] SSDT \SystemRoot\system32\DRIVERS\ImmunetSelfProtect.sys (Immunet Self Protect Driver/Windows (R) Codename Longhorn DDK provider) ZwTerminateProcess [0xF7B5EE6E] INT 0x01 \SystemRoot\system32\DRIVERS\ati2mtag.sys (ATI Radeon WindowsNT Miniport Driver/ATI Technologies Inc.) F74974F6 INT 0x03 \SystemRoot\system32\DRIVERS\ati2mtag.sys (ATI Radeon WindowsNT Miniport Driver/ATI Technologies Inc.) F749759C ---- Kernel code sections - GMER 1.0.15 ---- .text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xF7321000, 0x175176, 0xE8000020] ---- Devices - GMER 1.0.15 ---- AttachedDevice \FileSystem\Ntfs \Ntfs sisidex.sys (SISIDEX Driver/Windows (R) 2000 DDK provider) ---- EOF - GMER 1.0.15 ----

Dodano Dzisiaj, 22:33:

Kod: Zaznacz wszystko: OTL logfile created on: 2011-05-24 22:22:02 - Run 1 OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\miszcz\Pulpit Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1023,48 Mb Total Physical Memory | 657,63 Mb Available Physical Memory | 64,25% Memory free 2,40 Gb Paging File | 2,06 Gb Available in Paging File | 85,79% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 9,31 Gb Total Space | 0,74 Gb Free Space | 7,92% Space Free | Partition Type: NTFS Computer Name: PRYW-31575E86E8 | User Name: miszcz | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2011-05-24 21:05:42 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\miszcz\Pulpit\OTL.exe PRC - [2011-05-21 13:23:58 | 000,385,776 | ---- | M] () -- C:\Program Files\cacaoweb\cacaoweb.exe PRC - [2011-05-19 13:31:32 | 000,941,936 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe PRC - [2011-04-22 14:02:06 | 000,079,872 | ---- | M] (SanDisk Corporation) -- C:\Documents and Settings\miszcz\Dane aplikacji\SanDisk\Sansa Updater\SansaDispatch.exe PRC - [2011-02-16 19:28:07 | 000,729,424 | ---- | M] (Sourcefire, Inc.) -- C:\Program Files\Immunet\3.0.0\agent.exe PRC - [2008-04-14 19:21:16 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2011-05-24 21:05:42 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\miszcz\Pulpit\OTL.exe MOD - [2010-08-23 18:12:53 | 001,054,208 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.6028_x-ww_61e65202\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Disabled | Stopped] -- -- (HidServ) SRV - [2011-02-16 19:28:10 | 000,326,224 | ---- | M] (Immunet) [On_Demand | Stopped] -- C:\Program Files\Immunet\tetra\scan.dll -- (scan) SRV - [2011-02-16 19:28:07 | 000,729,424 | ---- | M] (Sourcefire, Inc.) [Auto | Running] -- C:\Program Files\Immunet\3.0.0\agent.exe -- (ImmunetProtect) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2011-02-16 19:28:19 | 000,047,440 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\ImmunetProtect.sys -- (ImmunetProtectDriver) DRV - [2011-02-16 19:28:19 | 000,031,952 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\ImmunetSelfProtect.sys -- (ImmunetSelfProtectDriver) DRV - [2008-04-13 20:45:29 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum) DRV - [2007-12-05 07:26:40 | 002,782,208 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2007-11-05 09:55:04 | 000,017,952 | ---- | M] () [Kernel | System | Running] -- C:\Program Files\Radeon Omega Drivers\v4.8.442\ATI Tray Tools\atitray.sys -- (atitray) DRV - [2002-08-20 11:19:08 | 000,009,472 | R--- | M] (Silicon Integrated Systems Corp.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\sisperf.sys -- (sisperf) DRV - [2002-07-30 10:46:28 | 000,005,760 | R--- | M] (Silicon Integrated Systems Corp.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\siside.sys -- (SiSide) DRV - [2002-07-10 17:39:34 | 000,032,256 | R--- | M] (SiS Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sisnic.sys -- (SISNIC) DRV - [2002-05-28 10:21:10 | 000,048,896 | R--- | M] (Windows (R) 2000 DDK provider) [File_System | Boot | Running] -- C:\WINDOWS\system32\drivers\sisidex.sys -- (sisidex) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = my.daemon-search.com IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011-05-10 12:51:41 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011-05-10 12:51:41 | 000,000,000 | ---D | M] O1 HOSTS File: ([2001-10-26 21:45:16 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC) O2 - BHO: (Foxit PDF Creator Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKLM\..\Toolbar: (Foxit PDF Creator Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O3 - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKCU\..\Toolbar\WebBrowser: (Foxit PDF Creator Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll (Ask) O4 - HKCU..\Run: [cacaoweb] C:\Program Files\cacaoweb\cacaoweb.exe () O4 - HKCU..\Run: [SansaDispatch] C:\Documents and Settings\miszcz\Dane aplikacji\SanDisk\Sansa Updater\SansaDispatch.exe (SanDisk Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 153.19.1.254 153.19.250.100 O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\miszcz\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\miszcz\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2011-02-16 19:08:58 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2011-05-24 21:05:42 | 000,580,096 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\miszcz\Pulpit\OTL.exe [2011-05-24 19:45:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\miszcz\Menu Start\Programy\HiJackThis [2011-05-24 19:45:43 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro [2011-05-23 00:39:58 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss [2011-05-18 12:14:32 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2011-05-17 21:51:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\miszcz\Dane aplikacji\Moje pliki Bitwy o Śródziemie™ II [2011-05-17 21:48:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Electronic Arts [2011-05-17 20:01:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\RegisteredPackages [2011-05-17 20:00:05 | 000,012,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ksolay.ax [2011-05-17 20:00:05 | 000,005,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mstee.sys [2011-05-17 20:00:03 | 001,798,144 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\qedit.dll [2011-05-17 20:00:03 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\qasf.dll [2011-05-17 20:00:02 | 000,470,528 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\qdvd.dll [2011-05-17 20:00:02 | 000,316,928 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\qdv.dll [2011-05-17 20:00:02 | 000,257,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\qcap.dll [2011-05-17 20:00:01 | 000,132,608 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\devenum.dll [2011-05-17 19:59:58 | 000,122,880 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dmusic.dll [2011-05-17 19:59:57 | 000,100,864 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dmsynth.dll [2011-05-17 19:59:56 | 000,181,248 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dmime.dll [2011-05-17 19:59:56 | 000,098,816 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dmstyle.dll [2011-05-17 19:59:56 | 000,058,368 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dmcompos.dll [2011-05-17 19:59:56 | 000,033,280 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dmloader.dll [2011-05-17 19:59:56 | 000,027,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dmband.dll [2011-05-17 19:59:55 | 000,018,432 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dswave.dll [2011-05-17 19:59:54 | 000,667,648 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dinput8.dll [2011-05-17 19:59:54 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dmscript.dll [2011-05-17 19:59:53 | 001,201,152 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\d3d8.dll [2011-05-17 19:59:53 | 000,974,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dxdiag.exe [2011-05-17 19:59:52 | 000,491,520 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dsdmoprp.dll [2011-05-17 19:59:52 | 000,186,880 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dsdmo.dll [2011-05-17 19:59:52 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpvvox.dll [2011-05-17 19:59:52 | 000,080,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpvsetup.exe [2011-05-17 19:59:52 | 000,063,696 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dxdllreg.exe [2011-05-17 19:59:51 | 000,381,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpvoice.dll [2011-05-17 19:59:51 | 000,019,968 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpvacm.dll [2011-05-17 19:59:48 | 000,016,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpnsvr.exe [2011-05-17 19:59:48 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpnlobby.dll [2011-05-17 19:59:47 | 001,189,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dx8vb.dll [2011-05-17 19:59:47 | 000,723,968 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpnet.dll [2011-05-17 19:59:47 | 000,068,096 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpnhupnp.dll [2011-05-17 19:59:47 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpnhpast.dll [2011-05-17 19:59:47 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\d3d8thk.dll [2011-05-17 19:59:47 | 000,003,072 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpnaddr.dll [2011-05-17 19:59:46 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\pid.dll [2011-05-17 19:59:45 | 001,294,336 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dsound3d.dll [2011-05-17 19:59:45 | 000,602,624 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dx7vb.dll [2011-05-17 19:59:45 | 000,208,896 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\joy.cpl [2011-05-17 19:59:44 | 000,648,704 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dinput.dll [2011-05-17 19:59:44 | 000,381,952 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dsound.dll [2011-05-17 19:59:44 | 000,230,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dplayx.dll [2011-05-17 19:59:44 | 000,079,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpwsockx.dll [2011-05-17 19:59:44 | 000,077,824 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dpmodemx.dll [2011-05-17 19:59:44 | 000,028,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dplaysvr.exe [2011-05-17 19:59:43 | 000,797,184 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\d3dim700.dll [2011-05-17 19:59:43 | 000,292,864 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ddraw.dll [2011-05-17 19:59:43 | 000,024,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ddrawex.dll [2011-05-17 19:47:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\miszcz\Dane aplikacji\My Battle for Middle-earth(tm) II Files [2011-05-14 18:15:04 | 000,000,000 | ---D | C] -- C:\Program Files\MSECache [2011-05-12 14:55:00 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Free M4a to MP3 Converter [2011-05-12 14:54:31 | 000,000,000 | ---D | C] -- C:\Program Files\Free M4a to MP3 Converter [2011-05-12 14:48:09 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\COMDLG32.OCX [2011-05-12 14:48:08 | 000,203,976 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\RICHTX32.OCX [2011-05-12 14:48:07 | 000,608,448 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\comctl32.ocx [2011-05-12 14:48:07 | 000,415,176 | ---- | C] (Microsoft Corporation ) -- C:\WINDOWS\System32\COMCT332.OCX [2011-05-12 14:48:06 | 000,344,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcr70.dll [2011-05-12 14:48:04 | 000,089,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\VB5DB.DLL [2011-05-12 14:47:48 | 000,000,000 | ---D | C] -- C:\Program Files\Cheetah Burner [2011-05-12 14:45:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\miszcz\Pulpit\Cheetah Audio Converter 1.1 [2011-05-11 13:12:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\miszcz\Pulpit\F5_VA_forum [2011-05-11 13:04:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\miszcz\Pulpit\FastAndFurious(OST)2009MTD [2011-05-10 12:52:03 | 000,000,000 | R--D | C] -- C:\Documents and Settings\miszcz\Moje dokumenty\Moje wideo [2011-05-10 12:51:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\miszcz\Dane aplikacji\DivX [2011-05-10 12:51:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\miszcz\Moje dokumenty\DivX Movies [2011-05-10 12:50:30 | 000,123,888 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxcpyi64.exe [2011-05-10 12:50:30 | 000,009,200 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\drivers\cdralw2k.sys [2011-05-10 12:50:30 | 000,009,072 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\drivers\cdr4_xp.sys [2011-05-10 12:50:29 | 000,068,080 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxcpya64.exe [2011-05-10 12:50:28 | 000,126,448 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxinsi64.exe [2011-05-10 12:50:28 | 000,068,592 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxinsa64.exe [2011-05-10 12:50:27 | 002,120,176 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxsfs.dll [2011-05-10 12:50:27 | 000,698,864 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\px.dll [2011-05-10 12:50:27 | 000,567,792 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxdrv.dll [2011-05-10 12:50:27 | 000,440,816 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxwave.dll [2011-05-10 12:50:27 | 000,219,632 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxmas.dll [2011-05-10 12:50:27 | 000,133,616 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxafs.dll [2011-05-10 12:50:27 | 000,100,848 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\vxblock.dll [2011-05-10 12:50:27 | 000,072,176 | ---- | C] (Sonic Solutions) -- C:\WINDOWS\System32\pxhpinst.exe [2011-05-10 12:49:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\DivX Plus [2011-05-10 12:48:22 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DivX Shared [2011-05-10 12:46:06 | 000,000,000 | ---D | C] -- C:\Program Files\DivX [2011-05-10 12:44:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\DivX [2011-04-29 17:27:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Microsoft Silverlight [2011-04-29 17:24:58 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2011-04-29 13:18:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\miszcz\Menu Start\Programy\Sacked - Your last day [2011-04-27 00:39:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\miszcz\Pulpit\sansaclip-sim-w32 [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2011-05-24 22:01:10 | 000,000,236 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job [2011-05-24 21:05:42 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\miszcz\Pulpit\OTL.exe [2011-05-24 21:05:20 | 000,302,080 | ---- | M] () -- C:\Documents and Settings\miszcz\Pulpit\f8k70d6q.exe [2011-05-24 21:02:06 | 000,385,776 | ---- | M] () -- C:\Documents and Settings\miszcz\Pulpit\cacaoweb.exe [2011-05-24 21:01:57 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011-05-24 19:54:51 | 000,002,445 | ---- | M] () -- C:\Documents and Settings\miszcz\Pulpit\HiJackThis.lnk [2011-05-24 17:05:47 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011-05-23 00:41:34 | 000,000,211 | -HS- | M] () -- C:\boot.ini [2011-05-18 12:14:32 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2011-05-17 21:50:44 | 000,000,594 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Bitwa o Śródziemie™ II.lnk [2011-05-15 00:08:52 | 000,134,072 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2011-05-13 12:35:54 | 000,005,431 | ---- | M] () -- C:\Documents and Settings\miszcz\Pulpit\wakacje pwc.gif [2011-05-12 14:48:42 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx [2011-05-12 14:48:01 | 000,000,523 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Cheetah Audio Converter.lnk [2011-05-10 12:41:40 | 000,069,336 | ---- | M] () -- C:\Documents and Settings\miszcz\Moje dokumenty\DW_3.jpg [2011-05-10 12:41:09 | 000,030,423 | ---- | M] () -- C:\Documents and Settings\miszcz\Moje dokumenty\DW_6.jpg [2011-05-10 12:40:59 | 000,014,953 | ---- | M] () -- C:\Documents and Settings\miszcz\Moje dokumenty\logo4DW.gif [2011-05-08 23:59:42 | 000,050,883 | ---- | M] () -- C:\Documents and Settings\miszcz\Moje dokumenty\1,113055,9556374,Namonciaku_pl_na_Monciaku_,,ga,,27.html [2011-05-05 11:48:03 | 000,000,421 | ---- | M] () -- C:\WINDOWS\ODBC.INI [2011-05-03 14:29:07 | 000,028,380 | ---- | M] () -- C:\Documents and Settings\miszcz\Pulpit\dm_080603_movie_stars.jpg [2011-05-02 19:56:19 | 011,497,260 | ---- | M] () -- C:\Documents and Settings\miszcz\Pulpit\sen.mp3 [2011-05-02 16:20:30 | 000,066,649 | ---- | M] () -- C:\Documents and Settings\miszcz\Pulpit\66711-czerwiec-juz-blisko.gif [2011-04-29 13:42:57 | 000,105,131 | ---- | M] () -- C:\Documents and Settings\miszcz\Pulpit\noname.gif [2011-04-29 13:42:46 | 000,205,052 | ---- | M] () -- C:\Documents and Settings\miszcz\Pulpit\Program Ambasador PwC 2011_2012.pdf [2011-04-26 23:32:12 | 000,079,667 | ---- | M] () -- C:\Documents and Settings\miszcz\Pulpit\225320_197747103599770_134033966637751_492979_7412874_n.jpg [2011-04-26 23:31:43 | 000,121,656 | ---- | M] () -- C:\Documents and Settings\miszcz\Moje dokumenty\photo (1).htm [5 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2011-05-24 21:05:20 | 000,302,080 | ---- | C] () -- C:\Documents and Settings\miszcz\Pulpit\f8k70d6q.exe [2011-05-24 19:45:44 | 000,002,445 | ---- | C] () -- C:\Documents and Settings\miszcz\Pulpit\HiJackThis.lnk [2011-05-17 21:50:44 | 000,000,594 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Bitwa o Śródziemie™ II.lnk [2011-05-17 20:00:04 | 000,733,184 | ---- | C] () -- C:\WINDOWS\System32\dllcache\qedwipes.dll [2011-05-17 20:00:03 | 000,013,312 | ---- | C] () -- C:\WINDOWS\System32\dllcache\msdmo.dll [2011-05-17 20:00:02 | 000,136,192 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mpg2splt.ax [2011-05-17 20:00:02 | 000,034,304 | ---- | C] () -- C:\WINDOWS\System32\dllcache\mciqtz32.dll [2011-05-17 20:00:01 | 000,064,512 | ---- | C] () -- C:\WINDOWS\System32\dllcache\amstream.dll [2011-05-13 12:35:54 | 000,005,431 | ---- | C] () -- C:\Documents and Settings\miszcz\Pulpit\wakacje pwc.gif [2011-05-12 14:48:01 | 000,000,529 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Start\Programy\Cheetah Audio Converter.lnk [2011-05-12 14:48:01 | 000,000,523 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Cheetah Audio Converter.lnk [2011-05-10 12:41:40 | 000,069,336 | ---- | C] () -- C:\Documents and Settings\miszcz\Moje dokumenty\DW_3.jpg [2011-05-10 12:41:08 | 000,030,423 | ---- | C] () -- C:\Documents and Settings\miszcz\Moje dokumenty\DW_6.jpg [2011-05-10 12:40:59 | 000,014,953 | ---- | C] () -- C:\Documents and Settings\miszcz\Moje dokumenty\logo4DW.gif [2011-05-08 23:59:42 | 000,050,883 | ---- | C] () -- C:\Documents and Settings\miszcz\Moje dokumenty\1,113055,9556374,Namonciaku_pl_na_Monciaku_,,ga,,27.html [2011-05-03 14:29:07 | 000,028,380 | ---- | C] () -- C:\Documents and Settings\miszcz\Pulpit\dm_080603_movie_stars.jpg [2011-05-02 19:55:56 | 011,497,260 | ---- | C] () -- C:\Documents and Settings\miszcz\Pulpit\sen.mp3 [2011-05-02 16:20:30 | 000,066,649 | ---- | C] () -- C:\Documents and Settings\miszcz\Pulpit\66711-czerwiec-juz-blisko.gif [2011-04-29 13:42:57 | 000,105,131 | ---- | C] () -- C:\Documents and Settings\miszcz\Pulpit\noname.gif [2011-04-29 13:42:46 | 000,205,052 | ---- | C] () -- C:\Documents and Settings\miszcz\Pulpit\Program Ambasador PwC 2011_2012.pdf [2011-04-26 23:32:12 | 000,079,667 | ---- | C] () -- C:\Documents and Settings\miszcz\Pulpit\225320_197747103599770_134033966637751_492979_7412874_n.jpg [2011-04-26 23:31:43 | 000,121,656 | ---- | C] () -- C:\Documents and Settings\miszcz\Moje dokumenty\photo (1).htm [2011-02-17 00:16:23 | 000,000,421 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2011-02-16 23:56:36 | 000,011,776 | ---- | C] () -- C:\Documents and Settings\miszcz\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011-02-16 19:53:06 | 000,004,293 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2011-02-16 19:51:23 | 000,134,072 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2011-02-16 19:46:44 | 000,593,920 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe [2011-02-16 19:38:11 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\atiiprxx.exe [2011-02-16 19:37:56 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativvaxx.dat [2011-02-16 19:37:55 | 000,887,724 | ---- | C] () -- C:\WINDOWS\System32\ativva6x.dat [2011-02-16 19:37:53 | 003,107,788 | ---- | C] () -- C:\WINDOWS\System32\ativva5x.dat [2011-02-16 19:37:53 | 000,158,080 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.dat [2011-02-16 19:37:48 | 000,000,011 | ---- | C] () -- C:\WINDOWS\System32\atiicdxx.ini [2011-02-16 19:37:28 | 000,472,576 | ---- | C] () -- C:\WINDOWS\Radeon Omega Drivers v4.8.442 Uninstall.exe [2011-02-16 19:23:24 | 000,000,092 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI [2011-02-16 19:23:23 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI [2011-02-16 19:23:20 | 000,237,568 | ---- | C] () -- C:\WINDOWS\CMIUninstall.exe [2011-02-16 19:23:20 | 000,212,992 | ---- | C] () -- C:\WINDOWS\CmiRmRedundDir.exe [2011-02-16 19:23:20 | 000,028,672 | ---- | C] () -- C:\WINDOWS\CMIRmDriver.dll [2011-02-16 19:21:43 | 000,032,768 | R--- | C] () -- C:\WINDOWS\SIS_LIB.DLL [2011-02-16 19:21:35 | 000,000,955 | ---- | C] () -- C:\WINDOWS\System32\2_ssetup.ini [2011-02-16 19:21:35 | 000,000,926 | ---- | C] () -- C:\WINDOWS\System32\1_ssetup.ini [2011-02-16 19:21:35 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\sunistlog.ini [2011-02-16 19:21:23 | 000,139,264 | R--- | C] () -- C:\WINDOWS\System32\IDEproperty.dll [2011-02-16 19:20:48 | 000,002,391 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2011-02-16 19:20:47 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2011-02-16 19:13:45 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2011-02-16 19:03:08 | 000,021,856 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2004-08-04 02:56:48 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin [2004-08-02 16:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2001-10-26 22:15:16 | 000,355,486 | ---- | C] () -- C:\WINDOWS\System32\perfh015.dat [2001-10-26 22:15:16 | 000,313,828 | ---- | C] () -- C:\WINDOWS\System32\perfi015.dat [2001-10-26 22:15:16 | 000,049,492 | ---- | C] () -- C:\WINDOWS\System32\perfc015.dat [2001-10-26 22:15:16 | 000,034,990 | ---- | C] () -- C:\WINDOWS\System32\perfd015.dat [2001-08-23 19:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2001-08-23 19:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2001-08-18 03:30:24 | 000,311,604 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2001-08-18 03:30:24 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2001-08-18 03:30:24 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2001-08-18 03:30:22 | 000,039,992 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2001-08-18 03:15:38 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2001-07-22 04:36:48 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2001-07-22 04:36:04 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2001-07-22 04:24:16 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat < End of report >

Dodano Dzisiaj, 22:33:

Kod: Zaznacz wszystko: OTL Extras logfile created on: 2011-05-24 22:22:02 - Run 1 OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\miszcz\Pulpit Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1023,48 Mb Total Physical Memory | 657,63 Mb Available Physical Memory | 64,25% Memory free 2,40 Gb Paging File | 2,06 Gb Available in Paging File | 85,79% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 9,31 Gb Total Space | 0,74 Gb Free Space | 7,92% Space Free | Partition Type: NTFS Computer Name: PRYW-31575E86E8 | User Name: miszcz | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* .html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software) [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* exefile [open] -- "%1" %* htmlfile [edit] -- Reg Error: Key error. http [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software) https [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [color=#E56717]========== System Restore Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore] "DisableSR" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr] "Start" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService] "Start" = 2 [color=#E56717]========== Firewall Settings ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software) "C:\Program Files\Garena\Garena.exe" = C:\Program Files\Garena\Garena.exe:*:Enabled:Garena "C:\Lord Of The Rings-War Of The Ring\Lord Of The Rings-War Of The Ring\Rings.exe" = C:\Lord Of The Rings-War Of The Ring\Lord Of The Rings-War Of The Ring\Rings.exe:*:Enabled:Rings "C:\Program Files\cacaoweb\cacaoweb.exe" = C:\Program Files\cacaoweb\cacaoweb.exe:*:Enabled:cacaoweb -- () "D:\władca pierścieni 2\game.dat" = D:\władca pierścieni 2\game.dat:*:Enabled:Bitwa o Śródziemie™ II [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{2A9F95AB-65A3-432c-8631-B8BC5BF7477A}" = Bitwa o Śródziemie™ II "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis "{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053 "{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{90110415-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003 "{90120000-0020-0415-0000-0000000FF1CE}" = Pakiet zgodności dla systemu Office 2007 "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{A6EE99EA-420C-4FA6-8A7C-FDB60D278855}" = VS10Runtime "{D88C3E7C-1DA6-4AD7-97FC-75BC8705B266}" = runtime "{E1734B74-68D7-4D39-960E-C38F0C1AC3BA}" = Cheetah Audio Converter "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "ATI Display Driver" = ATI Display Driver (Omega 3.8.442) "C-Media Audio" = C-Media Audio "DAEMON Tools Toolbar" = DAEMON Tools Toolbar "DivX Setup.divx.com" = DivX Setup "foobar2000" = foobar2000 v1.1.2 "Foxit Reader" = Foxit Reader "Free M4a to MP3 Converter_is1" = Free M4a to MP3 Converter 6.2 "Gadu-Gadu" = Gadu-Gadu 7.7 "Garena" = Garena 2010 "ie8" = Windows Internet Explorer 8 "Immunet Protect" = Immunet 3.0 "MultiRes (remove only)" = MultiRes (remove only) "Opera 11.11.2109" = Opera 11.11 "Radeon Omega Drivers for Windows XP/2kv4.8.442" = Radeon Omega Drivers v4.8.442 Setup Files and Tools "RealAlt_is1" = Real Alternative 1.9.0 Lite "Sacked" = Sacked - Your last day (Deinstallation) "SiSLan" = SiS 900 PCI Fast Ethernet Adapter Driver "SubEdit-Player_is1" = SubEdit-Player "ToonCar" = ToonCar "Warkeys" = Warkeys 1.18.1.0b "Windows XP Service Pack" = Windows XP Service Pack 3 "WinUHA_is1" = WinUHA 2.0 RC1 (2005.02.27) [color=#E56717]========== HKEY_CURRENT_USER Uninstall List ==========[/color] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Sansa Updater" = Sansa Updater "TeamSpeak 3 Client" = TeamSpeak 3 Client [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Application Events ] Error - 2011-02-16 18:03:05 | Computer Name = PRYW-31575E86E8 | Source = MsiInstaller | ID = 10005 Description = Produkt: Microsoft Office Professional Edition 2003 -- Błąd 2349. Wystąpił błąd wewnętrzny. ( ) Skontaktuj się z działem IT w celu uzyskania pomocy. Error - 2011-02-16 18:03:05 | Computer Name = PRYW-31575E86E8 | Source = MsiInstaller | ID = 10005 Description = Produkt: Microsoft Office Professional Edition 2003 -- Błąd 2349. Wystąpił błąd wewnętrzny. ( ) Skontaktuj się z działem IT w celu uzyskania pomocy. Error - 2011-02-16 18:03:08 | Computer Name = PRYW-31575E86E8 | Source = MsiInstaller | ID = 10005 Description = Produkt: Microsoft Office Professional Edition 2003 -- Błąd 2349. Wystąpił błąd wewnętrzny. ( ) Skontaktuj się z działem IT w celu uzyskania pomocy. Error - 2011-02-16 18:03:10 | Computer Name = PRYW-31575E86E8 | Source = MsiInstaller | ID = 10005 Description = Produkt: Microsoft Office Professional Edition 2003 -- Błąd 2349. Wystąpił błąd wewnętrzny. ( ) Skontaktuj się z działem IT w celu uzyskania pomocy. Error - 2011-02-17 15:05:06 | Computer Name = PRYW-31575E86E8 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd rings.exe, wersja 0.0.0.0, moduł powodujący błąd rings.exe, wersja 0.0.0.0, adres błędu 0x0000430c. Error - 2011-04-06 03:45:09 | Computer Name = PRYW-31575E86E8 | Source = MsiInstaller | ID = 11706 Description = Produkt: Microsoft Office Professional Edition 2003 -- Błąd 1706. Instalator nie może odnaleźć wymaganych plików. Sprawdź połączenie z siecią lub stację dysków CD-ROM. Inne potencjalne rozwiązania tego problemu można znaleźć w C:\Program Files\Microsoft Office\OFFICE11\1045\SETUP.CHM. Error - 2011-04-16 05:55:01 | Computer Name = PRYW-31575E86E8 | Source = Userenv | ID = 1068 Description = System Windows zakończył przetwarzanie obiektu GPO, ponieważ komputer został zamknięty lub użytkownik wylogował się. Error - 2011-05-17 13:47:41 | Computer Name = PRYW-31575E86E8 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd game.dat, wersja 1.1.2198.33078, moduł powodujący błąd kernel32.dll, wersja 5.1.2600.5781, adres błędu 0x00012afb. Error - 2011-05-17 15:37:47 | Computer Name = PRYW-31575E86E8 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd game.dat, wersja 1.1.2198.33078, moduł powodujący błąd kernel32.dll, wersja 5.1.2600.5781, adres błędu 0x00012afb. Error - 2011-05-24 13:39:35 | Computer Name = PRYW-31575E86E8 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca iexplore.exe, wersja 8.0.6001.18702, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. [ System Events ] Error - 2011-05-24 15:21:58 | Computer Name = PRYW-31575E86E8 | Source = ati2mtag | ID = 45062 Description = CRT invalid display type Error - 2011-05-24 15:22:23 | Computer Name = PRYW-31575E86E8 | Source = ati2mtag | ID = 45062 Description = CRT invalid display type Error - 2011-05-24 15:22:27 | Computer Name = PRYW-31575E86E8 | Source = ati2mtag | ID = 45062 Description = CRT invalid display type Error - 2011-05-24 15:22:30 | Computer Name = PRYW-31575E86E8 | Source = ati2mtag | ID = 45062 Description = CRT invalid display type Error - 2011-05-24 15:22:48 | Computer Name = PRYW-31575E86E8 | Source = ati2mtag | ID = 45062 Description = CRT invalid display type Error - 2011-05-24 15:23:13 | Computer Name = PRYW-31575E86E8 | Source = ati2mtag | ID = 45062 Description = CRT invalid display type Error - 2011-05-24 15:23:23 | Computer Name = PRYW-31575E86E8 | Source = ati2mtag | ID = 45062 Description = CRT invalid display type Error - 2011-05-24 15:30:33 | Computer Name = PRYW-31575E86E8 | Source = ati2mtag | ID = 45062 Description = CRT invalid display type Error - 2011-05-24 15:30:42 | Computer Name = PRYW-31575E86E8 | Source = ati2mtag | ID = 45062 Description = CRT invalid display type Error - 2011-05-24 16:20:34 | Computer Name = PRYW-31575E86E8 | Source = ati2mtag | ID = 45062 Description = CRT invalid display type < End of report >

**Posty:** 18165 · przez **wojtas** 25 Maj 2011, 22:52

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = my.daemon-search.com
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
[2011-05-24 22:01:10 | 000,000,236 | ---- | M] () -- C:\WINDOWS\tasks\Scheduled Update for Ask Toolbar.job

:Commands
[emptytemp]
[emptyflash]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

odinstaluj:

DAEMON Tools Toolbar, Foxit PDF Creator Toolbar, Ask Toolbar

napisz czy znasz:

O4 - HKCU..\Run: [cacaoweb] C:\Program Files\cacaoweb\cacaoweb.exe ()

Wykonaj czynności końcowe :
*Uruchom OTL z opcji sprzątanie.
* wykonaj optymalizację Windowsa ( instrukcja dla Windowsa XP, lecz w innych systemach jest podobnie )
* zrób pełny skan Malwarebytes Anti-Malware (zaktualizuj, usuń co znajdzie )
* Skasuj stan przywracania systemu

Zaktualizuj zabezpieczenia:

>>> Java™ 6

ten proces to od tego:

C:\Program Files\Immunet\3.0.0\agent.exe

napisz jak sytuacja.. i czy znasz Immunet