Svchost = wolny internet?

[spali]

Witam, mam od 2-3 dni problem z internetem. Po minucie od restartu systemu internet strasznie muli, doszedłem do wniosku że przyczyną może być svchost. Troche na necie poczytałem ale nic nie pomaga. Oto logi:

Rsit:

Kod: Zaznacz wszystko

Logfile of random's system information tool 1.06 (written by random/random)
Run by Spali at 2009-04-25 17:32:30
Microsoft Windows XP Professional Dodatek Service Pack 3
System drive C: has 158 GB (33%) free of 477 GB
Total RAM: 3326 MB (84% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:32:31, on 2009-04-25
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Documents and Settings\Spali.SPALI-EF51503BC\Pulpit\RSIT.exe
C:\Program Files\Trend Micro\HijackThis\Spali.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15106/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{72EF0ED3-F140-4691-9700-FCF97C193603}: NameServer = 194.204.152.34 217.98.63.164
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\SPALI~1.SPA\USTAWI~1\Temp\hpdj.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\ALO SOFT\ALO CD BURNER\NMSAccessU.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 4693 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-03-27 13684736]
"AdslTaskBar"=stmctrl.dll,TaskBar []

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcoholAutomount]
C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe /automount []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\jre6\bin\jusched.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\uTorrent]
C:\Program Files\uTorrent\uTorrent.exe [2009-02-11 270128]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\VolPanel]
C:\Program Files\Creative\Sound Blaster X-Fi\Volume Panel\VolPanlu.exe [2006-07-13 122880]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
C:\Program Files\Winamp\winampa.exe [2009-03-09 37888]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Spali.SPALI-EF51503BC^Menu Start^Programy^Autostart^Need for Speed™ Undercover Registration.lnk]
C:\PROGRA~1\EA Games\Need for Speed Undercover\Support\EAregister.exe /remind /language=ENU /PRID=GAME-NFSU09 /WHPR=Need for Speed™ Undercover /PRNM=Electronic Arts Product []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2009-03-10 265608]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL [2006-10-27 2210608]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"undockwithoutlogon"=1
"ShutdownWithoutLogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoFileAssociate"=
"NoResolveTrack"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Program Files\Xfire\Xfire.exe"="C:\Program Files\Xfire\Xfire.exe:*:Enabled:Xfire"
"C:\TEMP\Race.Driver.GRID.Multi-5.Full-Rip.Skullptura\Grid\GRID.exe"="C:\TEMP\Race.Driver.GRID.Multi-5.Full-Rip.Skullptura\Grid\GRID.exe:*:Enabled:GRID Executable"
"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE"="C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE"="C:\Program Files\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe"="C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
"C:\Program Files\Ubisoft\Prince of Persia\Prince of Persia.exe"="C:\Program Files\Ubisoft\Prince of Persia\Prince of Persia.exe:*:Enabled:Prince of Persia Dx"
"C:\Program Files\Ubisoft\Prince of Persia\PrinceOfPersia_Launcher.exe"="C:\Program Files\Ubisoft\Prince of Persia\PrinceOfPersia_Launcher.exe:*:Enabled:Prince of Persia Update"
"C:\Program Files\THQ\Company of Heroes\RelicCOH.exe"="C:\Program Files\THQ\Company of Heroes\RelicCOH.exe:*:Enabled:Company of Heroes - Opposing Fronts"
"C:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\s2gs.exe"="C:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\s2gs.exe:*:Enabled:Sacred 2 Game Server"
"C:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\sacred2.exe"="C:\Program Files\Deep Silver\Sacred 2 - Fallen Angel\system\sacred2.exe:*:Enabled:Sacred 2"
"C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe"="C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx9.exe:*:Enabled:Assassin's Creed Dx9"
"C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe"="C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Dx10.exe:*:Enabled:Assassin's Creed Dx10"
"C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe"="C:\Program Files\Ubisoft\Assassin's Creed\AssassinsCreed_Launcher.exe:*:Enabled:Assassin's Creed Update"
"C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2009\Polish\setup.exe"="C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Kaspersky Lab Setup Files\Kaspersky Anti-Virus 2009\Polish\setup.exe:*:Enabled:Kaspersky Anti-Virus 2009 Setup"
"C:\Program Files\id Software\Enemy Territory - QUAKE Wars\etqw.exe"="C:\Program Files\id Software\Enemy Territory - QUAKE Wars\etqw.exe:*:Enabled:Enemy Territory - QUAKE Wars(TM)"
"C:\Program Files\id Software\Enemy Territory - QUAKE Wars\etqwded.exe"="C:\Program Files\id Software\Enemy Territory - QUAKE Wars\etqwded.exe:*:Enabled:etqwded.exe"
"C:\Program Files\Saints Row 2\SR2_pc.exe"="C:\Program Files\Saints Row 2\SR2_pc.exe:*:Enabled:SR2_pc"
"C:\Program Files\THQ\Dawn of War - Soulstorm\Soulstorm.exe"="C:\Program Files\THQ\Dawn of War - Soulstorm\Soulstorm.exe:*:Enabled:Soulstorm"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
shell\AutoRun\command - D:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\M]
shell\AutoRun\command - M:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f1fb11f7-cb29-11dd-8be3-001fc67197fe}]
shell\AutoRun\command - E:\StartUp.exe


======List of files/folders created in the last 1 months======

2009-04-25 17:26:59 ----D---- C:\rsit
2009-04-25 16:59:01 ----D---- C:\Program Files\Trend Micro
2009-04-25 16:46:41 ----A---- C:\WINDOWS\system32\lsdelete.exe
2009-04-25 16:45:16 ----HDC---- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-04-25 16:45:13 ----D---- C:\Program Files\Lavasoft
2009-04-25 16:34:38 ----D---- C:\Program Files\Spybot - Search & Destroy
2009-04-25 16:26:49 ----D---- C:\Documents and Settings\Spali.SPALI-EF51503BC\Dane aplikacji\WinRAR
2009-04-25 16:19:19 ----D---- C:\WINDOWS\ERUNT
2009-04-25 16:18:11 ----A---- C:\WINDOWS\ntbtlog.txt
2009-04-24 15:01:12 ----D---- C:\Program Files\Winamp
2009-04-24 15:01:12 ----D---- C:\Documents and Settings\Spali.SPALI-EF51503BC\Dane aplikacji\Winamp
2009-04-24 08:52:50 ----HD---- C:\$AVG8.VAULT$
2009-04-24 01:43:53 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-04-24 01:43:49 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2009-04-24 01:43:45 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$
2009-04-24 01:43:41 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2009-04-24 01:43:38 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$
2009-04-24 01:43:35 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-04-24 01:43:31 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2009-04-24 01:43:22 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2009-04-24 01:43:17 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-04-24 01:43:13 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-04-24 01:43:04 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$
2009-04-24 01:42:59 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2$
2009-04-24 01:42:55 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$
2009-04-24 01:42:51 ----HDC---- C:\WINDOWS\$NtUninstallKB941569$
2009-04-24 01:42:41 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-04-24 01:42:38 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-04-24 01:42:34 ----HDC---- C:\WINDOWS\$NtUninstallKB960715$
2009-04-24 01:42:31 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-04-24 01:42:28 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2009-04-24 01:42:22 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2009-04-24 01:42:18 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$
2009-04-24 01:42:09 ----HDC---- C:\WINDOWS\$NtUninstallKB950760$
2009-04-24 01:42:06 ----HDC---- C:\WINDOWS\$NtUninstallKB939683$
2009-04-24 01:41:55 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-04-24 01:41:51 ----HDC---- C:\WINDOWS\$NtUninstallKB958690$
2009-04-24 01:41:44 ----HDC---- C:\WINDOWS\$NtUninstallKB959772_WM11$
2009-04-24 01:41:40 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2009-04-24 01:41:34 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2009-04-24 01:41:29 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-04-24 01:41:22 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$
2009-04-24 01:40:09 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2009-04-24 01:40:05 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-04-24 01:40:02 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-04-24 01:39:58 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-04-24 01:39:51 ----HDC---- C:\WINDOWS\$NtUninstallKB963027$
2009-04-24 01:39:46 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2009-04-24 01:39:42 ----HDC---- C:\WINDOWS\$NtUninstallKB936782_WMP11$
2009-04-24 01:39:15 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$
2009-04-23 23:46:45 ----A---- C:\WINDOWS\system32\PnkBstrB.exe
2009-04-23 23:46:44 ----A---- C:\WINDOWS\system32\PnkBstrA.exe
2009-04-23 23:38:31 ----D---- C:\Program Files\id Software
2009-04-23 23:31:02 ----D---- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Downloaded Installations
2009-04-23 23:30:22 ----D---- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\avg8
2009-04-23 23:02:54 ----AD---- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\TEMP
2009-04-23 23:00:11 ----D---- C:\Documents and Settings\Spali.SPALI-EF51503BC\Dane aplikacji\Uniblue
2009-04-23 22:48:28 ----D---- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Grisoft
2009-04-23 21:22:37 ----SHD---- C:\RECYCLER
2009-04-23 21:03:57 ----D---- C:\WINDOWS\temp
2009-04-23 20:58:14 ----RASHD---- C:\cmdcons
2009-04-23 20:54:45 ----D---- C:\WINDOWS\ERDNT
2009-04-23 18:10:48 ----D---- C:\WINDOWS\system32\InsFiles
2009-04-23 18:10:40 ----RA---- C:\WINDOWS\stmtrace.exe
2009-04-23 18:10:40 ----RA---- C:\WINDOWS\DSLTest.exe
2009-04-23 18:10:40 ----RA---- C:\WINDOWS\DSLSetup.ini
2009-04-23 18:10:38 ----RA---- C:\WINDOWS\system32\stmclean.exe
2009-04-23 18:09:49 ----RA---- C:\WINDOWS\system32\stmctrl.dll
2009-04-23 18:09:49 ----RA---- C:\WINDOWS\system32\stmcfg32.dll
2009-04-23 18:09:44 ----D---- C:\Program Files\ZTE ZXDSL 852
2009-04-23 16:49:17 ----D---- C:\Program Files\Alwil Software
2009-04-23 12:54:56 ----D---- C:\Program Files\Zeno Clash
2009-04-20 07:56:54 ----D---- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Kaspersky Lab Setup Files
2009-04-20 02:28:10 ----A---- C:\WINDOWS\process.txt
2009-04-17 12:34:16 ----D---- C:\Program Files\Saints Row 2
2009-04-16 13:28:10 ----A---- C:\WINDOWS\game.ini
2009-04-15 14:57:40 ----D---- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\DFX
2009-04-15 14:50:36 ----N---- C:\WINDOWS\system32\vxblock.dll
2009-04-15 14:50:36 ----N---- C:\WINDOWS\system32\pxwave.dll
2009-04-15 14:50:36 ----N---- C:\WINDOWS\system32\pxsfs.dll
2009-04-15 14:50:36 ----N---- C:\WINDOWS\system32\pxmas.dll
2009-04-15 14:50:36 ----N---- C:\WINDOWS\system32\pxinsa64.exe
2009-04-15 14:50:36 ----N---- C:\WINDOWS\system32\pxhpinst.exe
2009-04-15 14:50:36 ----N---- C:\WINDOWS\system32\pxdrv.dll
2009-04-15 14:50:36 ----N---- C:\WINDOWS\system32\pxcpya64.exe
2009-04-15 14:50:36 ----N---- C:\WINDOWS\system32\pxafs.dll
2009-04-15 14:50:36 ----N---- C:\WINDOWS\system32\px.dll
2009-04-14 13:01:07 ----D---- C:\Documents and Settings\Spali.SPALI-EF51503BC\Dane aplikacji\Ubisoft
2009-04-14 12:49:57 ----D---- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Ubisoft
2009-04-14 04:19:32 ----A---- C:\WINDOWS\system32\xfcodec.dll
2009-04-12 19:38:17 ----D---- C:\Documents and Settings\Spali.SPALI-EF51503BC\Dane aplikacji\360desktop
2009-04-10 12:58:08 ----D---- C:\WINDOWS\8AAB4176A747493AA42CB63CFADFD8E3.TMP
2009-04-08 00:34:27 ----D---- C:\WINDOWS\Left 4 Dead
2009-04-06 11:10:54 ----D---- C:\WINDOWS\DD1865F0AD7340FBB23E1822E02396FF.TMP
2009-04-06 11:10:34 ----D---- C:\WINDOWS\nview
2009-04-02 20:25:11 ----A---- C:\WINDOWS\system32\CmdLineExt.dll
2009-03-28 23:54:41 ----D---- C:\Program Files\Combined Community Codec Pack
2009-03-28 23:49:35 ----D---- C:\Program Files\Matroska Pack
2009-03-28 21:50:07 ----D---- C:\Program Files\Neverwinter Nights 2 - Rubinowa Edycja
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nwiz.exe
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwssr.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwss.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrszht.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrszhc.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrstr.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsth.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrssv.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrssl.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrssk.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsru.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsptb.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrspt.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrspl.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsno.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsnl.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsko.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsja.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsit.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrshu.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrshe.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsfr.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsfi.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsesm.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrses.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrseng.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsel.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsde.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsda.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrscs.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsar.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwimg.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwdmcpl.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwddi.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvvitvsr.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvvitvs.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvsvc32.exe
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvshell.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrszht.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrszhc.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrstr.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsth.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrssv.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrssl.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrssk.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsru.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsptb.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrspt.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrspl.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsno.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsnl.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsko.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsja.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsit.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrshu.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrshe.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsfr.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsfi.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsesm.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrses.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrseng.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsel.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsde.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsda.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrscs.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsar.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvoglnt.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvmoblsr.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvmobls.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvmctray.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvmccssr.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvmccss.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvmccsrs.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvmccs.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nview.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvgamesr.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvgames.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvdspsch.exe
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvdispsr.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvdisps.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvcuda.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvcpluir.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvcplui.exe
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvcpl.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvcolor.exe
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvcodins.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvcod.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvappbar.exe
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvapi.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\keystone.exe

======List of files/folders modified in the last 1 months======

2009-04-25 17:29:18 ----SHD---- C:\System Volume Information
2009-04-25 17:26:08 ----D---- C:\Program Files\Mozilla Firefox
2009-04-25 17:07:27 ----D---- C:\Documents and Settings\Spali.SPALI-EF51503BC\Dane aplikacji\Xfire
2009-04-25 17:06:41 ----D---- C:\Program Files\APV
2009-04-25 17:03:05 ----D---- C:\Documents and Settings\Spali.SPALI-EF51503BC\Dane aplikacji\uTorrent
2009-04-25 16:59:01 ----RD---- C:\Program Files
2009-04-25 16:46:41 ----D---- C:\WINDOWS\system32
2009-04-25 16:45:29 ----SD---- C:\WINDOWS\Tasks
2009-04-25 16:45:24 ----D---- C:\WINDOWS\system32\drivers
2009-04-25 16:45:24 ----D---- C:\WINDOWS
2009-04-25 16:45:23 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-04-25 16:45:23 ----D---- C:\WINDOWS\system32\CatRoot2
2009-04-25 16:45:16 ----SHD---- C:\WINDOWS\Installer
2009-04-25 16:45:13 ----D---- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Lavasoft
2009-04-25 16:44:47 ----D---- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Spybot - Search & Destroy
2009-04-25 16:20:28 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-04-25 16:18:32 ----D---- C:\Documents and Settings
2009-04-25 15:46:24 ----D---- C:\Program Files\Windows Media Connect 2
2009-04-25 15:19:34 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-04-25 15:18:21 ----D---- C:\WINDOWS\system32\Restore
2009-04-25 15:17:52 ----D---- C:\WINDOWS\Prefetch
2009-04-24 18:02:38 ----D---- C:\Program Files\CCleaner
2009-04-24 16:56:01 ----RASH---- C:\boot.ini
2009-04-24 16:56:01 ----A---- C:\WINDOWS\win.ini
2009-04-24 16:56:01 ----A---- C:\WINDOWS\system.ini
2009-04-24 16:01:45 ----SD---- C:\Program Files\Xfire
2009-04-24 15:46:50 ----D---- C:\Program Files\Steam
2009-04-24 14:23:03 ----D---- C:\TEMP
2009-04-24 08:37:52 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-04-24 01:47:45 ----HD---- C:\WINDOWS\inf
2009-04-24 01:45:25 ----D---- C:\WINDOWS\system32\wbem
2009-04-24 01:45:25 ----D---- C:\WINDOWS\AppPatch
2009-04-24 01:43:52 ----HD---- C:\WINDOWS\$hf_mig$
2009-04-24 01:43:43 ----D---- C:\Program Files\Messenger
2009-04-24 01:43:00 ----D---- C:\WINDOWS\WinSxS
2009-04-24 01:40:56 ----D---- C:\WINDOWS\Registration
2009-04-23 23:51:26 ----HD---- C:\Program Files\InstallShield Installation Information
2009-04-23 22:18:58 ----D---- C:\Program Files\Outlook Express
2009-04-23 22:18:58 ----D---- C:\Program Files\Movie Maker
2009-04-23 22:18:58 ----D---- C:\Program Files\Internet Explorer
2009-04-23 22:18:56 ----D---- C:\WINDOWS\system32\usmt
2009-04-23 21:21:53 ----D---- C:\Program Files\Common Files
2009-04-23 21:07:41 ----D---- C:\WINDOWS\SoftwareDistribution
2009-04-23 21:07:40 ----D---- C:\WINDOWS\Help
2009-04-23 20:59:46 ----D---- C:\WINDOWS\system32\config
2009-04-23 17:54:22 ----D---- C:\Program Files\neostrada tp
2009-04-23 15:09:09 ----D---- C:\Program Files\Valve
2009-04-23 13:48:25 ----D---- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Skype
2009-04-20 07:58:19 ----D---- C:\WINDOWS\system32\CatRoot
2009-04-20 02:37:59 ----RSD---- C:\WINDOWS\Fonts
2009-04-19 07:52:39 ----D---- C:\WINDOWS\Minidump
2009-04-19 07:52:39 ----D---- C:\WINDOWS\Debug
2009-04-15 15:06:48 ----D---- C:\Documents and Settings\Spali.SPALI-EF51503BC\Dane aplikacji\Adobe
2009-04-15 14:16:46 ----D---- C:\WINDOWS\Media
2009-04-15 14:16:46 ----D---- C:\WINDOWS\Cursors
2009-04-15 14:11:08 ----D---- C:\WINDOWS\BricoPacks
2009-04-14 12:49:38 ----RSD---- C:\WINDOWS\assembly
2009-04-14 12:49:20 ----D---- C:\WINDOWS\system32\DirectX
2009-04-14 12:43:55 ----D---- C:\Program Files\Ubisoft
2009-04-12 19:41:54 ----D---- C:\Program Files\Common Files\Wise Installation Wizard
2009-04-10 12:57:19 ----A---- C:\WINDOWS\system32\wrap_oal.dll
2009-04-10 12:57:19 ----A---- C:\WINDOWS\system32\OpenAL32.dll
2009-04-07 11:37:47 ----A---- C:\WINDOWS\If42le.ini
2009-03-31 06:48:37 ----A---- C:\WINDOWS\PSPICEEV.INI
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvudisp.exe
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvcuvid.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nv4_disp.dll
2009-03-27 08:14:42 ----A---- C:\WINDOWS\system32\NVUNINST.EXE

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AFS2K;AFS2k; C:\WINDOWS\system32\drivers\AFS2K.sys [2008-11-03 82380]
R1 intelppm;Sterownik procesora Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40448]
R1 kbdhid;Sterownik klawiatury HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
R1 VBoxDrv;VirtualBox Service; C:\WINDOWS\system32\DRIVERS\VBoxDrv.sys [2008-12-17 100368]
R1 VBoxUSBMon;VirtualBox USB Monitor Driver; C:\WINDOWS\system32\DRIVERS\VBoxUSBMon.sys [2008-12-17 41680]
R1 WS2IFSL;Środowisko wspomagające dostawcę usług innych niż IFS - Windows Socket 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2006-03-02 12032]
R3 ctac32k;Creative AC3 Software Decoder; C:\WINDOWS\system32\drivers\ctac32k.sys [2006-05-24 502272]
R3 ctaud2k;Creative Audio Driver (WDM); C:\WINDOWS\system32\drivers\ctaud2k.sys [2006-05-24 499584]
R3 ctprxy2k;Creative Proxy Driver; C:\WINDOWS\system32\drivers\ctprxy2k.sys [2006-05-24 7168]
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\system32\drivers\ctsfm2k.sys [2006-05-24 143872]
R3 emupia;E-mu Plug-in Architecture Driver; C:\WINDOWS\system32\drivers\emupia2k.sys [2006-05-24 78336]
R3 ha20x2k;Creative 20X HAL Driver; C:\WINDOWS\system32\drivers\ha20x2k.sys [2006-05-24 1110016]
R3 hidusb;Sterownik Microsoft klasy HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
R3 mouhid;Sterownik myszy HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-03-02 12160]
R3 MTsensor;ATK0110 ACPI UTILITY; C:\WINDOWS\system32\DRIVERS\ASACPI.sys [2004-08-13 5810]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-03-27 6280416]
R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\drivers\ctoss2k.sys [2006-05-24 116224]
R3 ROOTMODEM;Microsoft Legacy Modem Driver; C:\WINDOWS\System32\Drivers\RootMdm.sys [2006-03-02 5888]
R3 Stmatm;ATM/ADSL miniport; C:\WINDOWS\system32\DRIVERS\stmatm.sys [2003-08-12 60255]
R3 TaurusUsb;ADSL Modem USB Service; C:\WINDOWS\system32\DRIVERS\torususb.sys [2006-05-25 684265]
R3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbohci;Sterownik Miniport otwartego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-14 17152]
R3 VBoxNetFlt;VBoxNetFlt Service; C:\WINDOWS\system32\DRIVERS\VBoxNetFlt.sys [2008-12-17 81360]
R3 WinDriver6;WinDriver6; C:\WINDOWS\system32\drivers\windrvr6.sys [2008-02-11 194362]
S3 aqmh5fu6;aqmh5fu6; C:\WINDOWS\system32\drivers\aqmh5fu6.sys []
S3 Arp1394;Protokół klienta 1394 ARP; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800]
S3 ASPI;Advanced SCSI Programming Interface Driver; \??\C:\WINDOWS\System32\DRIVERS\ASPI32.sys []
S3 ATE_PROCMON;ATE_PROCMON; \??\C:\Program Files\Anti Trojan Elite\ATEPMon.sys []
S3 Cardex;Cardex; \??\C:\WINDOWS\system32\drivers\TBPANEL.SYS []
S3 COMMONFX.DLL;COMMONFX.DLL; C:\WINDOWS\system32\COMMONFX.DLL [2006-05-24 87552]
S3 CT20XUT.DLL;CT20XUT.DLL; C:\WINDOWS\system32\CT20XUT.DLL [2006-05-24 158720]
S3 CTAUDFX.DLL;CTAUDFX.DLL; C:\WINDOWS\system32\CTAUDFX.DLL [2006-05-24 536576]
S3 ctdvda2k;Creative DVD-Audio Device Driver; C:\WINDOWS\system32\drivers\ctdvda2k.sys [2005-11-10 340704]
S3 CTEAPSFX.DLL;CTEAPSFX.DLL; C:\WINDOWS\system32\CTEAPSFX.DLL [2006-05-24 160768]
S3 CTEDSPFX.DLL;CTEDSPFX.DLL; C:\WINDOWS\system32\CTEDSPFX.DLL [2006-05-24 269824]
S3 CTEDSPIO.DLL;CTEDSPIO.DLL; C:\WINDOWS\system32\CTEDSPIO.DLL [2006-05-24 115200]
S3 CTEDSPSY.DLL;CTEDSPSY.DLL; C:\WINDOWS\system32\CTEDSPSY.DLL [2006-05-24 317952]
S3 CTERFXFX.DLL;CTERFXFX.DLL; C:\WINDOWS\system32\CTERFXFX.DLL [2008-02-25 100888]
S3 CTEXFIFX.DLL;CTEXFIFX.DLL; C:\WINDOWS\system32\CTEXFIFX.DLL [2006-05-24 1170432]
S3 CTHWIUT.DLL;CTHWIUT.DLL; C:\WINDOWS\system32\CTHWIUT.DLL [2006-05-24 61952]
S3 CTSBLFX.DLL;CTSBLFX.DLL; C:\WINDOWS\system32\CTSBLFX.DLL [2006-05-24 548352]
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2008-11-03 25280]
S3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-11-15 4225920]
S3 NIC1394;Sterownik sieci 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824]
S3 NVENETFD;NVIDIA nForce 10/100/1000 Mbps Ethernet ; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2008-08-01 54784]
S3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2008-08-01 22016]
S3 rtl8139;Sterownik NT karty Realtek RTL8139(A/B/C)-based PCI Fast Ethernet; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2008-04-13 20992]
S3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856]
S3 usbscan;Sterownik skanera USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104]
S3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 Wdf01000;Wdf01000; C:\WINDOWS\system32\DRIVERS\Wdf01000.sys [2006-04-20 479200]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-15 82688]
S3 xusb21;Xbox 360 Wireless Receiver Driver Service 21; C:\WINDOWS\system32\DRIVERS\xusb21.sys [2007-02-27 61984]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-03-27 163908]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-04-23 66872]
S2 hpdj;hpdj; C:\DOCUME~1\SPALI~1.SPA\USTAWI~1\Temp\hpdj.exe -servicerunning=true -uninstall=hp deskjet 3600 series -product= []
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 921936]
S2 NMSAccessU;NMSAccessU; C:\Program Files\ALO SOFT\ALO CD BURNER\NMSAccessU.exe []
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240]
S3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service; C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2008-10-28 79360]
S3 Creative Service for CDROM Access;Creative Service for CDROM Access; C:\WINDOWS\system32\CTsvcCDA.exe [1999-12-12 44032]
S3 CTAudSvcService;Creative Audio Service; C:\Program Files\Creative\Shared Files\CTAudSvc.exe [2008-04-30 417792]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-12-29 655624]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2006-10-20 36864]
S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe [2004-10-22 73728]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2006-10-30 741376]
S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 WMPNetworkSvc;Usługa udostępniania w sieci programu Windows Media Player; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-12-01 918016]
S4 FAH@C:+Program Files+EA Games+Need for Speed Undercover+FAH.exe;FAH@C:+Program Files+EA Games+Need for Speed Undercover+FAH.exe; C:\Program Files\EA Games\Need for Speed Undercover\FAH.exe -svcstart []
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2006-10-30 122880]
S4 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

-----------------EOF-----------------


Hijack:

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:33:14, on 2009-04-25
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15106/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{72EF0ED3-F140-4691-9700-FCF97C193603}: NameServer = 194.204.152.34 217.98.63.164
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\SPALI~1.SPA\USTAWI~1\Temp\hpdj.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\ALO SOFT\ALO CD BURNER\NMSAccessU.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 4666 bytes


Z góry dziękuje za wszelką pomoc i zainteresowanie

[Okocza]

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

[spali]

SDFix

Kod: Zaznacz wszystko


scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


[b]Remaining Services [/b]:




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:µTorrent"
"C:\\Program Files\\Xfire\\Xfire.exe"="C:\\Program Files\\Xfire\\Xfire.exe:*:Enabled:Xfire"
"C:\\TEMP\\Race.Driver.GRID.Multi-5.Full-Rip.Skullptura\\Grid\\GRID.exe"="C:\\TEMP\\Race.Driver.GRID.Multi-5.Full-Rip.Skullptura\\Grid\\GRID.exe:*:Enabled:GRID Executable"
"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"
"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\\WINDOWS\\system32\\PnkBstrA.exe"="C:\\WINDOWS\\system32\\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\\WINDOWS\\system32\\PnkBstrB.exe"="C:\\WINDOWS\\system32\\PnkBstrB.exe:*:Enabled:PnkBstrB"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"="C:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
"C:\\Program Files\\Ubisoft\\Prince of Persia\\Prince of Persia.exe"="C:\\Program Files\\Ubisoft\\Prince of Persia\\Prince of Persia.exe:*:Enabled:Prince of Persia Dx"
"C:\\Program Files\\Ubisoft\\Prince of Persia\\PrinceOfPersia_Launcher.exe"="C:\\Program Files\\Ubisoft\\Prince of Persia\\PrinceOfPersia_Launcher.exe:*:Enabled:Prince of Persia Update"
"C:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"="C:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe:*:Enabled:Company of Heroes - Opposing Fronts"
"C:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\s2gs.exe"="C:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\s2gs.exe:*:Enabled:Sacred 2 Game Server"
"C:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\sacred2.exe"="C:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\sacred2.exe:*:Enabled:Sacred 2"
"C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"="C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe:*:Enabled:Assassin's Creed Dx9"
"C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"="C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe:*:Enabled:Assassin's Creed Dx10"
"C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"="C:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe:*:Enabled:Assassin's Creed Update"
"C:\\Documents and Settings\\All Users.WINDOWS\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\Polish\\setup.exe"="C:\\Documents and Settings\\All Users.WINDOWS\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\Polish\\setup.exe:*:Enabled:Kaspersky Anti-Virus 2009 Setup"
"C:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqw.exe"="C:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqw.exe:*:Enabled:Enemy Territory - QUAKE Wars(TM)"
"C:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqwded.exe"="C:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqwded.exe:*:Enabled:etqwded.exe"
"C:\\Program Files\\Saints Row 2\\SR2_pc.exe"="C:\\Program Files\\Saints Row 2\\SR2_pc.exe:*:Enabled:SR2_pc"
"C:\\Program Files\\THQ\\Dawn of War - Soulstorm\\Soulstorm.exe"="C:\\Program Files\\THQ\\Dawn of War - Soulstorm\\Soulstorm.exe:*:Enabled:Soulstorm"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[b]Remaining Files [/b]:



[b]Files with Hidden Attributes [/b]:

Mon  7 Jul 2008     1,429,840 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe"
Mon  7 Jul 2008     4,891,472 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe"
Mon  7 Jul 2008     2,156,368 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"
Sat 31 Jan 2009         4,348 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\DRMv1.bak"
Thu 27 Nov 2008             0 A.SH. --- "C:\Documents and Settings\All Users.WINDOWS\DRM\Cache\Indiv01.tmp"

[b]Finished![/b]



Hijack

Kod: Zaznacz wszystko

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 08:30:39, on 2009-04-26
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/softwareupdate/su2/ocx/15106/CTPID.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O23 - Service: Creative Audio Engine Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Creative Audio Service (CTAudSvcService) - Creative Technology Ltd - C:\Program Files\Creative\Shared Files\CTAudSvc.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\SPALI~1.SPA\USTAWI~1\Temp\hpdj.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\ALO SOFT\ALO CD BURNER\NMSAccessU.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

--
End of file - 4497 bytes


ComboFix

Kod: Zaznacz wszystko

ComboFix 09-04-25.A3 - Spali 2009-04-26  8:31.2 - NTFSx86
Microsoft Windows XP Professional  5.1.2600.3.1250.48.1045.18.3326.2909 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Spali.SPALI-EF51503BC\Pulpit\ComboFix.exe
AV: Kaspersky Anti-Virus *On-access scanning disabled* (Updated)
* Utworzono nowy punkt przywracania
.

(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\system32\drivers\ntndis.sys

.
(((((((((((((((((((((((((   Pliki utworzone od 2009-05-26 do 2009-4-26  )))))))))))))))))))))))))))))))
.

2009-04-26 06:15 . 2009-04-26 06:29   --------   d-----w   C:\SDFix
2009-04-25 15:26 . 2009-04-25 15:27   --------   d-----w   C:\rsit
2009-04-25 14:59 . 2009-04-25 14:59   --------   d-----w   c:\program files\Trend Micro
2009-04-25 14:46 . 2009-01-18 21:35   15688   ----a-w   c:\windows\system32\lsdelete.exe
2009-04-25 14:45 . 2009-01-18 21:30   64160   ----a-w   c:\windows\system32\drivers\Lbd.sys
2009-04-25 14:45 . 2009-04-25 14:45   --------   dc-h--w   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-04-25 14:45 . 2009-04-25 14:45   --------   d-----w   c:\program files\Lavasoft
2009-04-25 14:34 . 2009-04-25 14:34   --------   d-----w   c:\program files\Spybot - Search & Destroy
2009-04-25 14:20 . 2009-04-25 14:20   580096   -c--a-w   c:\windows\system32\dllcache\user32.dll
2009-04-25 14:19 . 2009-04-25 14:19   --------   d-----w   c:\windows\ERUNT
2009-04-24 13:01 . 2009-04-24 13:25   --------   d-----w   c:\documents and settings\Spali.SPALI-EF51503BC\Dane aplikacji\Winamp
2009-04-24 13:01 . 2009-04-24 13:01   --------   d-----w   c:\program files\Winamp
2009-04-24 06:52 . 2009-04-24 08:37   --------   d--h--w   C:\$AVG8.VAULT$
2009-04-23 21:46 . 2009-04-23 22:47   111928   ----a-w   c:\windows\system32\PnkBstrB.exe
2009-04-23 21:46 . 2009-04-23 21:54   66872   ----a-w   c:\windows\system32\PnkBstrA.exe
2009-04-23 21:38 . 2009-04-23 21:38   --------   d-----w   c:\program files\id Software
2009-04-23 21:31 . 2009-04-23 21:31   --------   d-----w   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Downloaded Installations
2009-04-23 21:30 . 2009-04-24 12:30   --------   d-----w   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\avg8
2009-04-23 21:02 . 2009-04-23 21:05   --------   d---a-w   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\TEMP
2009-04-23 21:00 . 2009-04-23 21:00   --------   d-----w   c:\documents and settings\Spali.SPALI-EF51503BC\Dane aplikacji\Uniblue
2009-04-23 20:53 . 2008-06-14 17:36   273024   -c----w   c:\windows\system32\dllcache\bthport.sys
2009-04-23 20:48 . 2009-04-23 20:48   --------   d-----w   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Grisoft
2009-04-23 20:25 . 2009-03-06 14:22   285696   -c----w   c:\windows\system32\dllcache\pdh.dll
2009-04-23 20:25 . 2009-02-09 11:26   2190336   -c----w   c:\windows\system32\dllcache\ntoskrnl.exe
2009-04-23 20:25 . 2009-02-09 11:25   111104   -c----w   c:\windows\system32\dllcache\services.exe
2009-04-23 20:25 . 2009-02-09 10:53   731136   -c----w   c:\windows\system32\dllcache\lsasrv.dll
2009-04-23 20:25 . 2009-02-09 10:53   686592   -c----w   c:\windows\system32\dllcache\advapi32.dll
2009-04-23 20:25 . 2009-02-09 10:53   473600   -c----w   c:\windows\system32\dllcache\fastprox.dll
2009-04-23 20:25 . 2009-02-09 10:53   401408   -c----w   c:\windows\system32\dllcache\rpcss.dll
2009-04-23 20:25 . 2009-02-09 10:53   722944   -c----w   c:\windows\system32\dllcache\ntdll.dll
2009-04-23 20:25 . 2009-02-09 10:53   453120   -c----w   c:\windows\system32\dllcache\wmiprvsd.dll
2009-04-23 20:25 . 2009-02-06 10:10   227840   -c----w   c:\windows\system32\dllcache\wmiprvse.exe
2009-04-23 20:25 . 2009-02-09 11:26   2025472   -c----w   c:\windows\system32\dllcache\ntkrpamp.exe
2009-04-23 20:25 . 2009-02-09 11:26   2146816   -c----w   c:\windows\system32\dllcache\ntkrnlmp.exe
2009-04-23 19:55 . 2008-05-08 14:02   203136   -c----w   c:\windows\system32\dllcache\rmcast.sys
2009-04-23 19:55 . 2008-10-24 11:21   455296   -c----w   c:\windows\system32\dllcache\mrxsmb.sys
2009-04-23 19:55 . 2008-12-11 10:57   333952   -c----w   c:\windows\system32\dllcache\srv.sys
2009-04-23 19:54 . 2008-05-01 14:37   331776   -c----w   c:\windows\system32\dllcache\msadce.dll
2009-04-23 19:54 . 2008-04-11 19:06   691712   -c----w   c:\windows\system32\dllcache\inetcomm.dll
2009-04-23 19:26 . 2009-04-23 22:47   138784   ----a-w   c:\windows\system32\drivers\PnkBstrK.sys
2009-04-23 19:25 . 2008-10-15 16:36   337408   -c----w   c:\windows\system32\dllcache\netapi32.dll
2009-04-23 19:25 . 2008-09-04 17:17   1106944   -c----w   c:\windows\system32\dllcache\msxml3.dll
2009-04-23 19:10 . 2009-03-27 06:58   1203922   -c----w   c:\windows\system32\dllcache\sysmain.sdb
2009-04-23 19:10 . 2008-04-21 21:16   218112   -c----w   c:\windows\system32\dllcache\wordpad.exe
2009-04-23 16:09 . 2006-06-02 20:38   425984   ----a-r   c:\windows\system32\stmcfg32.dll
2009-04-23 16:09 . 2006-06-02 13:01   151552   ----a-r   c:\windows\system32\stmctrl.dll
2009-04-23 16:09 . 2009-04-23 16:11   3242   ----a-w   c:\windows\stsetup.htm
2009-04-23 16:09 . 2009-04-23 16:09   --------   d-----w   c:\program files\ZTE ZXDSL 852
2009-04-23 14:49 . 2009-04-23 14:49   --------   d-----w   c:\program files\Alwil Software
2009-04-23 10:54 . 2009-04-23 11:02   --------   d-----w   c:\program files\Zeno Clash
2009-04-22 17:57 . 2009-04-23 10:50   --------   d-----w   c:\temp\Zeno.Clash-CPY
2009-04-20 06:08 . 2008-11-11 11:38   --------   d-----w   c:\temp\KAV8.0.0.357PL
2009-04-20 05:56 . 2009-04-20 06:09   --------   d-----w   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Kaspersky Lab Setup Files
2009-04-20 05:48 . 2009-04-20 05:48   --------   d-----w   c:\temp\Kaspersky Internet Security 2009 14 Kluczy 16-17.04.2009 - Selekty 4TG
2009-04-20 05:48 . 2009-04-20 05:48   --------   d-----w   c:\temp\Kaspersky Internet Security 2009 8.0.0.506 PL
2009-04-19 13:18 . 2009-04-19 13:18   213120   -c--a-w   c:\windows\system32\dllcache\ndis.sys
2009-04-17 15:21 . 2009-04-20 01:13   32   --s-a-w   c:\windows\system32\1290712190.dat
2009-04-17 10:57 . 2009-04-17 10:57   --------   d-----w   c:\documents and settings\Spali.SPALI-EF51503BC\Ustawienia lokalne\Dane aplikacji\THQ
2009-04-17 10:34 . 2009-04-17 10:52   --------   d-----w   c:\program files\Saints Row 2
2009-04-17 10:27 . 2009-04-17 10:27   --------   d-----w   c:\temp\sr2
2009-04-16 11:35 . 2009-04-16 11:35   --------   d-----w   c:\documents and settings\Spali.SPALI-EF51503BC\Ustawienia lokalne\Dane aplikacji\id Software
2009-04-16 11:28 . 2009-04-23 21:46   316   ----a-w   c:\windows\game.ini
2009-04-15 12:58 . 2009-04-15 12:58   --------   d-----w   c:\documents and settings\Spali.SPALI-EF51503BC\Ustawienia lokalne\Dane aplikacji\DFX
2009-04-15 12:57 . 2009-04-15 12:57   --------   d-----w   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\DFX
2009-04-14 20:49 . 2009-04-14 22:55   --------   d-----w   c:\temp\Wanted.2008.PL.DVDRip.XviD-DMX
2009-04-14 18:17 . 2009-04-14 20:36   --------   d-----w   c:\temp\Fast And Furious 4 TS XVID V2 NEW AUDIO - STG
2009-04-14 11:01 . 2009-04-14 11:01   --------   d-----w   c:\documents and settings\Spali.SPALI-EF51503BC\Dane aplikacji\Ubisoft
2009-04-14 10:49 . 2009-04-14 10:49   --------   d-----w   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Ubisoft
2009-04-14 02:19 . 2009-04-14 02:19   41808   ----a-w   c:\windows\system32\xfcodec.dll
2009-04-12 17:38 . 2009-04-12 17:38   --------   d-----w   c:\documents and settings\Spali.SPALI-EF51503BC\Dane aplikacji\360desktop
2009-04-10 15:46 . 2009-04-14 09:26   --------   d-----w   c:\temp\Assassins.Creed.PL-PROPHET
2009-04-10 10:58 . 2009-04-10 10:58   --------   d-----w   c:\windows\8AAB4176A747493AA42CB63CFADFD8E3.TMP
2009-04-07 22:34 . 2009-04-07 22:34   --------   d-----w   c:\windows\Left 4 Dead
2009-04-07 13:24 . 2009-04-07 22:29   --------   d-----w   c:\temp\Left.4.Dead-SKIDROW
2009-04-06 09:10 . 2009-04-06 09:10   --------   d-----w   c:\windows\DD1865F0AD7340FBB23E1822E02396FF.TMP
2009-04-06 09:10 . 2009-04-26 06:30   215383   ----a-w   c:\windows\system32\nvapps.xml
2009-04-06 09:10 . 2009-04-06 09:10   --------   d-----w   c:\windows\nview
2009-04-06 09:10 . 2009-03-27 08:03   19054   ----a-w   c:\windows\system32\nvdisp.nvu
2009-04-03 11:39 . 2009-04-05 16:36   --------   d-----w   c:\temp\Smallville.S08E18.HDTV.XviD-NoTV
2009-04-02 18:25 . 2009-04-02 18:25   107888   ----a-w   c:\windows\system32\CmdLineExt.dll
2009-04-01 17:52 . 2009-04-02 10:35   --------   d-----w   c:\temp\Mała.Moskwa.2008.DVDScreener
2009-04-01 15:09 . 2009-04-01 20:05   --------   d-----w   c:\temp\Twilight.2008.DVDRip.XviD-GetSeries
2009-03-31 23:32 . 2009-04-01 00:03   --------   d-----w   c:\temp\The.Unborn.2009.DvDrip-aXXo
2009-03-31 16:28 . 2009-03-31 21:19   --------   d-----w   c:\temp\The.Curious.Case.Of.Benjamin.Button.PROPER.DVDSCR.XviD-AzNiNVASiAN
2009-03-28 21:54 . 2009-03-28 21:54   --------   d-----w   c:\program files\Combined Community Codec Pack
2009-03-28 21:49 . 2009-03-28 21:49   --------   d-----w   c:\program files\Matroska Pack
2009-03-28 21:46 . 2008-06-12 19:37   6144   ----a-w   c:\windows\system32\ff_acm.acm
2009-03-28 19:53 . 2009-03-28 22:15   --------   d-----w   c:\temp\Szybcy.I.Wsciekli.Trylogia.720p.Lektor.PL.x264-WKS
2009-03-28 19:50 . 2009-03-29 11:51   --------   d-----w   c:\program files\Neverwinter Nights 2 - Rubinowa Edycja
2009-03-27 14:27 . 2009-03-28 18:36   --------   d-----w   c:\temp\Neverwinter.Nights.2.Rubinowa.Edycja.PL-NEFAROD

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-26 06:33 . 2009-04-25 14:52   2012   ----a-w   C:\aaw7boot.log
2009-04-25 15:54 . 2008-10-30 15:39   --------   d-----w   c:\documents and settings\Spali.SPALI-EF51503BC\Dane aplikacji\uTorrent
2009-04-25 15:46 . 2008-11-09 20:11   --------   d-----w   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Spybot - Search & Destroy
2009-04-25 15:07 . 2008-10-30 15:37   --------   d-----w   c:\documents and settings\Spali.SPALI-EF51503BC\Dane aplikacji\Xfire
2009-04-25 15:06 . 2008-10-21 09:44   --------   d-----w   c:\program files\APV
2009-04-25 14:45 . 2009-02-25 11:31   --------   d-----w   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Lavasoft
2009-04-25 13:46 . 2008-11-27 14:34   --------   d-----w   c:\program files\Windows Media Connect 2
2009-04-24 16:02 . 2008-10-29 12:37   --------   d-----w   c:\program files\CCleaner
2009-04-24 14:01 . 2008-10-21 11:41   --------   d-s---w   c:\program files\Xfire
2009-04-24 13:46 . 2009-02-20 15:51   --------   d-----w   c:\program files\Steam
2009-04-24 13:02 . 2006-03-02 12:00   361600   ----a-w   c:\windows\system32\drivers\tcpip.sys
2009-04-24 06:37 . 2006-03-02 12:00   88422   ----a-w   c:\windows\system32\perfc015.dat
2009-04-24 06:37 . 2006-03-02 12:00   497208   ----a-w   c:\windows\system32\perfh015.dat
2009-04-23 21:51 . 2008-10-21 08:41   --------   d--h--w   c:\program files\InstallShield Installation Information
2009-04-23 21:47 . 2008-10-30 23:47   22328   ----a-w   c:\documents and settings\Spali.SPALI-EF51503BC\Dane aplikacji\PnkBstrK.sys
2009-04-23 15:54 . 2009-02-23 16:51   --------   d-----w   c:\program files\neostrada tp
2009-04-23 13:09 . 2009-03-18 00:08   --------   d-----w   c:\program files\Valve
2009-04-23 11:48 . 2009-03-06 20:36   --------   d-----w   c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Skype
2009-04-20 20:54 . 2008-10-30 15:37   71440   ----a-w   c:\documents and settings\Spali.SPALI-EF51503BC\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-04-19 13:18 . 2006-03-02 12:00   213120   ----a-w   c:\windows\system32\drivers\ndis.sys
2009-04-14 10:43 . 2008-11-20 22:25   --------   d-----w   c:\program files\Ubisoft
2009-04-12 17:41 . 2008-11-27 13:51   --------   d-----w   c:\program files\Common Files\Wise Installation Wizard
2009-04-10 10:57 . 2008-10-30 16:00   418480   ----a-w   c:\windows\system32\wrap_oal.dll
2009-04-10 10:57 . 2008-10-30 16:00   115432   ----a-w   c:\windows\system32\OpenAL32.dll
2009-03-27 06:14 . 2008-10-30 15:33   453152   ----a-w   c:\windows\system32\NVUNINST.EXE
2009-03-23 17:40 . 2009-03-23 17:38   --------   d-----w   c:\documents and settings\Spali.SPALI-EF51503BC\Dane aplikacji\Xilinx
2009-03-17 18:04 . 2009-03-17 18:04   --------   d-----w   c:\documents and settings\Spali.SPALI-EF51503BC\Dane aplikacji\Red Alert 3 Uprising
2009-03-14 10:59 . 2009-03-14 10:59   --------   d-----w   c:\program files\Microsoft Xbox 360 Accessories
2009-03-13 18:54 . 2009-03-13 18:54   --------   d-----w   c:\program files\Deep Silver
2009-03-13 18:31 . 2009-03-13 18:31   0   ---ha-w   c:\windows\system32\drivers\Msft_Kernel_xusb21_01001.Wdf
2009-03-13 18:31 . 2009-03-13 18:31   0   ---ha-w   c:\windows\system32\drivers\MsftWdf_Kernel_01001_Coinstaller_Critical.Wdf
2009-03-13 11:41 . 2009-03-06 19:35   --------   d-----w   c:\program files\THQ
2009-03-07 18:20 . 2009-03-07 18:20   4096   ----a-w   c:\windows\d3dx.dat
2009-03-06 20:40 . 2009-03-06 20:40   --------   d-----w   c:\documents and settings\Spali.SPALI-EF51503BC\Dane aplikacji\skypePM
2009-03-06 14:22 . 2006-03-02 12:00   285696   ----a-w   c:\windows\system32\pdh.dll
2009-02-28 16:10 . 2009-02-28 16:10   --------   d-----w   c:\documents and settings\Spali.SPALI-EF51503BC\Dane aplikacji\Dev-Cpp
2009-02-25 11:46 . 2008-10-21 08:52   --------   d-----w   c:\program files\AGEIA Technologies
2009-02-25 11:28 . 2009-01-20 20:45   --------   d-----w   c:\program files\GnuWin32
2009-02-23 18:04 . 2009-02-23 16:52   502   ----a-w   c:\program files\neostrada
2009-02-20 08:12 . 2006-03-02 12:00   668672   ----a-w   c:\windows\system32\wininet.dll
2009-02-20 08:11 . 2006-03-02 12:00   81920   ----a-w   c:\windows\system32\ieencode.dll
2009-02-09 14:07 . 2006-03-02 12:00   1847040   ----a-w   c:\windows\system32\win32k.sys
2009-02-09 11:26 . 2004-08-04 00:39   2025472   ----a-w   c:\windows\system32\ntkrnlpa.exe
2009-02-09 11:26 . 2006-03-02 12:00   2146816   ----a-w   c:\windows\system32\ntoskrnl.exe
2009-02-09 11:25 . 2006-03-02 12:00   111104   ----a-w   c:\windows\system32\services.exe
2009-02-09 10:53 . 2006-03-02 12:00   731136   ----a-w   c:\windows\system32\lsasrv.dll
2009-02-09 10:53 . 2006-03-02 12:00   686592   ----a-w   c:\windows\system32\advapi32.dll
2009-02-09 10:53 . 2006-03-02 12:00   401408   ----a-w   c:\windows\system32\rpcss.dll
2009-02-09 10:53 . 2006-03-02 12:00   722944   ----a-w   c:\windows\system32\ntdll.dll
2009-02-06 10:39 . 2006-03-02 12:00   35328   ----a-w   c:\windows\system32\sc.exe
2009-02-03 19:58 . 2006-03-02 12:00   56832   ----a-w   c:\windows\system32\secur32.dll
2009-02-01 00:34 . 2008-11-07 16:33   1295096   ----a-w   c:\documents and settings\LocalService.ZARZĄDZANIE NT\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat
2009-02-01 00:34 . 2008-11-07 16:33   1295096   ----a-w   c:\documents and settings\LocalService.ZARZĄDZANIE NT\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat
2009-02-01 00:34 . 2008-11-07 16:33   1295096   ----a-w   c:\documents and settings\LocalService.ZARZĄDZANIE NT\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat
2008-12-20 11:48 . 2008-11-04 08:52   784   ----a-w   c:\documents and settings\Spali.SPALI-EF51503BC\Dane aplikacji\mpauth.dat
2008-11-07 12:55 . 2008-11-07 12:55   146   ----a-w   c:\documents and settings\Spali.SPALI-EF51503BC\Ustawienia lokalne\Dane aplikacji\fusioncache.dat
2008-10-24 10:28 . 2008-10-24 10:28   22328   ----a-w   c:\documents and settings\Spali\Dane aplikacji\PnkBstrK.sys
2008-10-22 19:44 . 2008-10-21 11:07   68456   ----a-w   c:\documents and settings\Spali\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
.

------- Sigcheck -------

[7] 2008-06-20 11:59   361600   AD978A1B783B5719720CFF204B666C8E   c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
[7] 2006-03-02 12:00   359040   9F4B36614A0FC234525BA224957DE55C   c:\windows\$NtServicePackUninstall$\tcpip.sys
[7] 2009-04-23 20:44   361344   93EA8D04EC73A85DB02EB8805988F733   c:\windows\$NtUninstallKB951748$\tcpip.sys
[7] 2008-04-13 23:50   361344   93EA8D04EC73A85DB02EB8805988F733   c:\windows\ServicePackFiles\i386\tcpip.sys
[7] 2008-06-20 11:51   361600   9AEFA14BD6B182D61E3119FA5F436D3D   c:\windows\SoftwareDistribution\Download\5cb56d26ae277f6fc62b86faa15488d1\sp3gdr\tcpip.sys
[7] 2008-06-20 11:59   361600   AD978A1B783B5719720CFF204B666C8E   c:\windows\SoftwareDistribution\Download\5cb56d26ae277f6fc62b86faa15488d1\sp3qfe\tcpip.sys
[-] 2009-04-24 13:02   361600   7B8A447B48DBBD481691E0F7BEC73260   c:\windows\system32\dllcache\tcpip.sys
[-] 2009-04-24 13:02   361600   7B8A447B48DBBD481691E0F7BEC73260   c:\windows\system32\drivers\tcpip.sys

[7] 2006-03-02 12:00   182912   558635D3AF1C7546D26067D5D9B6959E   c:\windows\$NtServicePackUninstall$\ndis.sys
[7] 2008-04-13 23:50   182656   1DF7F42665C94B825322FAE71721130D   c:\windows\ServicePackFiles\i386\ndis.sys
[-] 2009-04-19 13:18   213120   0EB23F8C2DADF7DB524C52FCF3522FC9   c:\windows\system32\dllcache\ndis.sys
[-] 2009-04-19 13:18   213120   0EB23F8C2DADF7DB524C52FCF3522FC9   c:\windows\system32\drivers\ndis.sys
.
(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane 
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-03-27 13684736]
"AdslTaskBar"="stmctrl.dll" - c:\windows\system32\stmctrl.dll [2006-06-02 151552]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoFileAssociate"= 0 (0x0)
"NoResolveTrack"= 1 (0x1)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]
@="Service"

[HKLM\~\startupfolder\C:^Documents and Settings^Spali.SPALI-EF51503BC^Menu Start^Programy^Autostart^Need for Speed™ Undercover Registration.lnk]
path=c:\documents and settings\Spali.SPALI-EF51503BC\Menu Start\Programy\Autostart\Need for Speed™ Undercover Registration.lnk
backup=c:\windows\pss\Need for Speed™ Undercover Registration.lnkStartup

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Xfire\\Xfire.exe"=
"c:\\TEMP\\Race.Driver.GRID.Multi-5.Full-Rip.Skullptura\\Grid\\GRID.exe"=
"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\WINDOWS\\system32\\PnkBstrA.exe"=
"c:\\WINDOWS\\system32\\PnkBstrB.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"=
"c:\\Program Files\\Ubisoft\\Prince of Persia\\Prince of Persia.exe"=
"c:\\Program Files\\Ubisoft\\Prince of Persia\\PrinceOfPersia_Launcher.exe"=
"c:\\Program Files\\THQ\\Company of Heroes\\RelicCOH.exe"=
"c:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\s2gs.exe"=
"c:\\Program Files\\Deep Silver\\Sacred 2 - Fallen Angel\\system\\sacred2.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx9.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Dx10.exe"=
"c:\\Program Files\\Ubisoft\\Assassin's Creed\\AssassinsCreed_Launcher.exe"=
"c:\\Documents and Settings\\All Users.WINDOWS\\Dane aplikacji\\Kaspersky Lab Setup Files\\Kaspersky Anti-Virus 2009\\Polish\\setup.exe"=
"c:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqw.exe"=
"c:\\Program Files\\id Software\\Enemy Territory - QUAKE Wars\\etqwded.exe"=
"c:\\Program Files\\Saints Row 2\\SR2_pc.exe"=
"c:\\Program Files\\THQ\\Dawn of War - Soulstorm\\Soulstorm.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"5353:TCP"= 5353:TCP:Adobe CSI CS4
"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 16512]
R3 ATE_PROCMON;ATE_PROCMON; [x]
R3 Creative Audio Engine Licensing Service;Creative Audio Engine Licensing Service;c:\program files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe [2008-10-28 79360]
R4 FAH@C:+Program Files+EA Games+Need for Speed Undercover+FAH.exe;FAH@C:+Program Files+EA Games+Need for Speed Undercover+FAH.exe; [x]
S0 Lbd;Lbd;c:\windows\system32\DRIVERS\Lbd.sys [2009-01-18 64160]
S1 VBoxDrv;VirtualBox Service;c:\windows\system32\DRIVERS\VBoxDrv.sys [2008-12-17 100368]
S1 VBoxUSBMon;VirtualBox USB Monitor Driver;c:\windows\system32\DRIVERS\VBoxUSBMon.sys [2008-12-17 41680]
S2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-01-18 921936]
S3 Stmatm;ATM/ADSL miniport;c:\windows\system32\DRIVERS\stmatm.sys [2003-08-12 60255]
S3 TaurusUsb;ADSL Modem USB Service;c:\windows\system32\DRIVERS\torususb.sys [2006-05-25 684265]
S3 VBoxNetFlt;VBoxNetFlt Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys [2008-12-17 81360]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
\Shell\AutoRun\command - D:\autorun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\M]
\Shell\AutoRun\command - M:\setup.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f1fb11f7-cb29-11dd-8be3-001fc67197fe}]
\Shell\AutoRun\command - E:\StartUp.exe
.
Zawartość folderu 'Zaplanowane zadania'

2009-04-25 c:\windows\Tasks\Ad-Aware Update (Weekly).job
- c:\program files\Lavasoft\Ad-Aware\Ad-AwareAdmin.exe [2009-01-18 21:34]
.
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.neostrada.pl
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
IE: { - c:\program files\Messenger\msmsgs.exe
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-26 08:34
Windows 5.1.2600 Dodatek Service Pack 3 NTFS

skanowanie ukrytych procesów ... 

skanowanie ukrytych wpisów autostartu ...

skanowanie ukrytych plików ... 

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
"ServiceDll"="c:\windows\system32\es.dll"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\FAH@C:+Program Files+EA Games+Need for Speed Undercover+FAH.exe]
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

[HKEY_USERS\S-1-5-21-1220945662-1085031214-725345543-1003\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:df,03,89,88,25,31,95,25,eb,7f,be,ac,a3,27,62,f8,12,ac,2f,4f,9c,77,1a,
   85,e8,90,8d,be,89,45,66,29,e8,f3,e8,2c,04,2e,f5,8d,0e,47,ab,10,28,d3,1f,93,\
"??"=hex:e2,06,90,c3,a9,ab,f7,ca,1c,f7,63,d7,3e,f2,89,5d

[HKEY_USERS\S-1-5-21-1220945662-1085031214-725345543-1003\Software\SecuROM\License information*]
"datasecu"=hex:31,fe,1b,17,53,41,99,8d,c5,67,c0,05,f3,e2,1e,41,e7,91,13,53,7e,
   71,29,0d,2c,90,9a,22,01,1a,76,6c,e3,52,6f,d2,2e,62,c4,01,50,09,f8,cc,70,09,\
"rkeysecu"=hex:b2,ce,31,15,b2,ac,40,2e,d7,2e,22,89,fe,50,38,18
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------

- - - - - - - > 'explorer.exe'(3976)
c:\windows\system32\msi.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\windows\system32\nvsvc32.exe
c:\windows\system32\PnkBstrA.exe
c:\windows\system32\wbem\unsecapp.exe
c:\windows\system32\rundll32.exe
c:\program files\Lavasoft\Ad-Aware\AAWTray.exe
c:\windows\system32\imapi.exe
.
**************************************************************************
.
Czas ukończenia: 2009-04-26  8:37 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt  2009-04-26 06:37

Przed: 165 165 645 824 bajtów wolnych
Po: 165 148 819 456 bajtów wolnych

302   --- E O F ---   2009-04-25 18:11


[wojtas]

skasuj:

O2 - BHO: (no name) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - (no file)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\SPALI~1.SPA\USTAWI~1\Temp\hpdj.exe (file missing)

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.