Wirusy zamulają komputer

**Posty:** 16 · przez **warek1234** 27 Cze 2010, 23:00

mam problem z tymi wirusami co chwile atakują i mula komputer jak sie ich pozbyć i od czego je mogo mieć:
-C:\Documents and Settings\uzytkownik\Ustawienia lokalne\Temp\jar_cache4942632382437401140.tmp » ZIP » myf/y/AppletX.class - prawdopodobnie odmiana wirusa Win32/Agent koń trojański
-C:\Documents and Settings\uzytkownik\Dane aplikacji\Sun\Java\Deployment\cache\6.0\57\4839f1b9-19048139 » ZIP » ________vload.class - odmiana wirusa Java/TrojanDownloader.Agent.NAI koń trojański
-C:\3dcs9.exe » ASPack v2.12 - odmiana wirusa Win32/Pacex.AE.Gen wirus
-C:\affi8l.exe » ASPack v2.12 - odmiana wirusa Win32/Pacex.AK wirus
z gory dziękuje
mam wersje testową eset smart seciuniti a wcześniej miałem noda 32

**Posty:** 12734 · przez **Mikou@j** 27 Cze 2010, 23:02

1. Zmień nazwę tematu.
2. Przeczytaj i zastosuj się do obowiazkowe-zasady-wstawiania-logow-wazne-vt117887.html
- log otl
- log extras
- log gmer z usuniętymi programami emulującymi i sterownikiem sptd

**Posty:** 16 · przez **warek1234** 30 Cze 2010, 22:47

To log z otl

Kod: Zaznacz wszystko: OTL logfile created on: 2010-06-30 21:28:34 - Run 1 OTL by OldTimer - Version 3.2.7.0 Folder = C:\Gry Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 72,00% Memory free 4,00 Gb Paging File | 3,00 Gb Available in Paging File | 75,00% Paging File free Paging file location(s): c:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 146,48 Gb Total Space | 59,64 Gb Free Space | 40,72% Space Free | Partition Type: NTFS Drive D: | 151,61 Gb Total Space | 143,34 Gb Free Space | 94,54% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: XP-SPECIAL Current User Name: uzytkownik Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-06-29 12:06:37 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Gry\OTL.exe PRC - [2010-06-18 21:14:22 | 000,031,232 | ---- | M] () -- C:\Documents and Settings\uzytkownik\Menu Start\Programy\Autostart\wnr3.exe PRC - [2010-04-07 21:07:24 | 000,810,120 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe PRC - [2010-04-07 21:07:04 | 002,145,000 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe PRC - [2009-09-23 14:38:18 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe PRC - [2009-03-28 23:11:38 | 003,325,952 | ---- | M] (Electronic Arts) -- C:\Program Files\Electronic Arts\EADM\Core.exe PRC - [2008-04-14 22:51:18 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2007-05-03 17:17:50 | 000,172,032 | ---- | M] () -- C:\Genius\ioCentre\gKbdTask.exe PRC - [2007-04-20 18:53:38 | 000,294,912 | ---- | M] () -- C:\Genius\ioCentre\gMouseTask.exe PRC - [2007-04-18 10:44:40 | 000,188,416 | ---- | M] () -- C:\Genius\ioCentre\gDeskMgm.exe PRC - [2007-04-13 16:04:44 | 000,061,440 | ---- | M] () -- C:\Genius\ioCentre\gTaskBar.exe PRC - [2007-03-21 16:39:00 | 000,049,152 | ---- | M] () -- C:\Genius\ioCentre\gTaskSwitch.exe PRC - [2007-02-26 17:16:30 | 000,188,416 | ---- | M] () -- C:\Genius\ioCentre\gZoom.exe PRC - [2007-02-26 16:56:18 | 000,180,224 | ---- | M] () -- C:\Genius\ioCentre\gAutoPan.exe PRC - [2007-01-19 20:26:14 | 000,045,056 | ---- | M] () -- C:\Genius\ioCentre\gMGlass.exe PRC - [2007-01-19 20:20:52 | 000,049,152 | ---- | M] () -- C:\Genius\ioCentre\gIMMgm.exe PRC - [2007-01-19 20:03:24 | 000,061,440 | ---- | M] () -- C:\Genius\ioCentre\gAutoScroll.exe PRC - [2005-12-06 14:53:30 | 000,819,200 | ---- | M] (France Télécom R&D) -- C:\Program Files\neostrada tp\neostradatp.exe PRC - [2005-11-22 12:54:18 | 000,249,856 | ---- | M] (France Télécom R&D) -- C:\Program Files\neostrada tp\ComComp.exe PRC - [2004-11-02 15:31:20 | 000,069,632 | ---- | M] (France Telecom R&D) -- C:\Program Files\neostrada tp\Toaster.exe PRC - [2004-10-27 11:30:44 | 000,032,768 | ---- | M] () -- C:\Program Files\neostrada tp\Inactivity.exe PRC - [2004-10-27 11:07:06 | 000,069,632 | ---- | M] () -- C:\Program Files\neostrada tp\PollingModule.exe PRC - [2004-10-21 08:50:52 | 000,045,056 | ---- | M] () -- C:\WINDOWS\system32\AlertModule\AlertModule.exe PRC - [2004-10-05 17:00:12 | 000,061,440 | ---- | M] (France Télécom R&D) -- C:\Program Files\neostrada tp\TaskBarIcon.exe PRC - [2004-08-23 14:49:56 | 000,040,960 | ---- | M] (France Telecom) -- C:\WINDOWS\system32\FTRTSVC.exe PRC - [2004-08-23 14:49:56 | 000,020,480 | ---- | M] (France Télécom R&D) -- C:\Program Files\neostrada tp\Watch.exe PRC - [2004-07-30 19:50:24 | 000,286,720 | ---- | M] () -- C:\WINDOWS\vsnpstd3.exe PRC - [2003-04-06 02:17:18 | 000,147,456 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe PRC - [2003-04-06 02:06:58 | 000,028,672 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe PRC - [2003-04-06 01:55:04 | 000,311,296 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposts08.exe PRC - [2003-04-06 01:45:10 | 000,286,720 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-06-30 18:41:49 | 000,071,680 | RHS- | M] () -- C:\Documents and Settings\uzytkownik\Ustawienia lokalne\Temp\nodqq0.dll MOD - [2010-06-29 12:06:37 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Gry\OTL.exe MOD - [2008-04-14 22:46:34 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx MOD - [2004-10-26 09:49:34 | 000,028,672 | ---- | M] () -- C:\Program Files\neostrada tp\Inactivity.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Auto | Stopped] -- -- (NMSAccessU) SRV - File not found [On_Demand | Stopped] -- -- (KodakCCS) SRV - [2010-04-07 21:10:38 | 000,033,560 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv) SRV - [2010-04-07 21:07:24 | 000,810,120 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn) SRV - [2009-09-23 14:38:18 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0) SRV - [2005-11-17 15:18:52 | 001,527,900 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance) SRV - [2004-08-23 14:49:56 | 000,040,960 | ---- | M] (France Telecom) [Auto | Running] -- C:\WINDOWS\system32\FTRTSVC.exe -- (FTRTSVC) SRV - [2003-04-07 08:21:46 | 000,065,795 | R--- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12) SRV - [2001-10-26 19:30:00 | 000,003,584 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\System32\regedt32.exe -- (NOD32FiXTemDono) SRV - [2001-10-26 19:30:00 | 000,003,584 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\System32\regedt32.exe -- (.EsetTrialReset) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2010-04-07 21:08:08 | 000,055,232 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\epfwtdi.sys -- (epfwtdi) DRV - [2010-04-07 21:08:06 | 000,032,584 | ---- | M] (ESET) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\epfwndis.sys -- (Epfwndis) DRV - [2010-04-07 21:08:04 | 000,134,488 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\epfw.sys -- (epfw) DRV - [2010-04-07 21:07:08 | 000,114,984 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv) DRV - [2010-04-07 21:03:44 | 000,139,192 | ---- | M] (ESET) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon) DRV - [2010-01-05 19:30:24 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt) DRV - [2010-01-05 19:30:23 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt) DRV - [2009-04-23 21:10:25 | 000,058,752 | ---- | M] () [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\koiujnygig.sys -- (wktanqlvlygji) DRV - [2008-12-13 19:51:54 | 000,082,380 | ---- | M] (Oak Technology Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AFS2K.SYS -- (AFS2K) DRV - [2008-05-16 20:31:00 | 006,557,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2008-05-02 08:48:55 | 000,062,208 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\si3112.sys -- (Si3112) DRV - [2008-04-17 10:33:26 | 004,707,328 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2008-04-13 22:06:06 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus) DRV - [2008-01-03 16:10:16 | 000,105,856 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp) DRV - [2006-09-19 12:03:28 | 000,116,992 | ---- | M] (Analog Devices Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\e4usbaw.sys -- (e4usbaw) DRV - [2006-09-15 12:07:54 | 000,064,000 | ---- | M] (Analog Deivces) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\e4ldr.sys -- (IKANLOADER2) General Purpose USB Driver (e4ldr.sys) DRV - [2006-08-29 00:54:56 | 000,010,664 | ---- | M] (Applied Networking Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gan_adapter.sys -- (hamachi_oem) DRV - [2006-07-12 05:48:46 | 000,017,408 | ---- | M] ( Mouse Upfilter Driver ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gMouPS2.sys -- (gMouPS2) DRV - [2006-07-02 00:32:26 | 000,043,520 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8) DRV - [2004-11-25 18:36:06 | 000,077,248 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\prohlp02.sys -- (prohlp02) DRV - [2004-11-25 18:32:01 | 000,054,368 | ---- | M] (Protection Technology) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\prodrv06.sys -- (prodrv06) DRV - [2004-10-29 14:52:48 | 000,413,696 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\snpstd3.sys -- (SNPSTD3) USB PC Camera (SNPSTD3) DRV - [2003-12-01 17:20:52 | 000,004,832 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfhlp01.sys -- (sfhlp01) DRV - [2003-09-06 14:22:08 | 000,006,944 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\prosync1.sys -- (prosync1) DRV - [2003-08-04 14:22:44 | 000,016,128 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\PCANDIS5.SYS -- (PCANDIS5) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local> IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=localhost:7171 IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\S-1-5-21-1343024091-963894560-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie IE - HKU\S-1-5-21-1343024091-963894560-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKU\S-1-5-21-1343024091-963894560-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ IE - HKU\S-1-5-21-1343024091-963894560-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKU\S-1-5-21-1343024091-963894560-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKU\S-1-5-21-1343024091-963894560-682003330-1003\..\URLSearchHook: {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\neostrada tp\SearchPageURL.dll () IE - HKU\S-1-5-21-1343024091-963894560-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010-06-27 22:09:02 | 000,000,000 | ---D | M] O1 HOSTS File: ([2010-04-04 22:17:06 | 000,001,223 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: 127.0.0.1 serial.alcohol-soft.com O1 - Hosts: 127.0.0.1 www.alcohol-soft.com O1 - Hosts: 127.0.0.1 images.alcohol-soft.com O1 - Hosts: 127.0.0.1 trial.alcohol-soft.com O1 - Hosts: 127.0.0.1 alcohol-soft.com O1 - Hosts: 127.0.0.1 static3.cdn.ubi.com O1 - Hosts: 127.0.0.1 ubisoft-orbit.s3.amazonaws.com O1 - Hosts: 127.0.0.1 onlineconfigservice.ubi.com O1 - Hosts: 127.0.0.1 orbitservice.ubi.com O1 - Hosts: 127.0.0.1 ubisoft-orbit-savegames.s3.amazonaws.com O1 - Hosts: 0.0.0.0 www.metin2.pl O1 - Hosts: 0.0.0.0 metin2.pl O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O2 - BHO: (no name) - {5B291E6C-9A74-4034-971B-A4B007A0B313} - No CLSID value found. O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O3 - HKLM\..\Toolbar: (no name) - {5B291E6C-9A74-4034-971B-A4B007A0B313} - No CLSID value found. O3 - HKU\S-1-5-21-1343024091-963894560-682003330-1003\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll () O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [DelReg] C:\Program Files\MSI\DualCoreCenter\DelReg.exe () O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET) O4 - HKLM..\Run: [ioCentre] C:\Genius\ioCentre\gTaskBar.exe () O4 - HKLM..\Run: [KernelFaultCheck] File not found O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe () O4 - HKLM..\Run: [TrayServer] C:\Program Files\MAGIX\Movie_Edit_Pro_14_PLUS_Download_version\Trayserver.exe (MAGIX AG) O4 - HKLM..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe File not found O4 - HKLM..\Run: [WOOWATCH] C:\Program Files\neostrada tp\Watch.exe (France Télécom R&D) O4 - HKU\S-1-5-21-1343024091-963894560-682003330-1003..\Run: [cdoosoft] C:\Documents and Settings\uzytkownik\Ustawienia lokalne\Temp\herss.exe () O4 - HKU\S-1-5-21-1343024091-963894560-682003330-1003..\Run: [dso32] C:\Documents and Settings\uzytkownik\Ustawienia lokalne\Temp\dsoqq.exe () O4 - HKU\S-1-5-21-1343024091-963894560-682003330-1003..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe (Electronic Arts) O4 - HKU\S-1-5-21-1343024091-963894560-682003330-1003..\Run: [Expressivo] C:\Program Files\ivo\Expressivo\expressivo.exe File not found O4 - HKU\S-1-5-21-1343024091-963894560-682003330-1003..\Run: [Gadu-Gadu 10] C:\Program Files\Gadu-Gadu 10\gg.exe (GG Network S.A.) O4 - HKU\S-1-5-21-1343024091-963894560-682003330-1003..\Run: [nod32] C:\Documents and Settings\uzytkownik\Ustawienia lokalne\Temp\nodqq.exe () O4 - HKU\.DEFAULT..\RunOnce: [nltide_2] File not found O4 - HKU\.DEFAULT..\RunOnce: [tscuninstall] C:\WINDOWS\System32\tscupgrd.exe File not found O4 - HKU\S-1-5-18..\RunOnce: [nltide_2] File not found O4 - HKU\S-1-5-18..\RunOnce: [tscuninstall] C:\WINDOWS\System32\tscupgrd.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [nltide_2] File not found O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\DualCoreCenter.lnk = C:\Program Files\MSI\DualCoreCenter\StartUpDualCoreCenter.exe () O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\hp psc 1000 series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe (Hewlett-Packard Co.) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard) O4 - Startup: C:\Documents and Settings\uzytkownik\Menu Start\Programy\Autostart\wnr3.dll () O4 - Startup: C:\Documents and Settings\uzytkownik\Menu Start\Programy\Autostart\wnr3.exe () O4 - Startup: C:\Documents and Settings\uzytkownik\Menu Start\Programy\Autostart\Xfire.lnk = C:\Program Files\Xfire\xfire.exe (Xfire Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeAnimation = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStrCmpLogical = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1343024091-963894560-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1343024091-963894560-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: MemCheckBoxInRunDlg = 1 O7 - HKU\S-1-5-21-1343024091-963894560-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStrCmpLogical = 1 O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} http://www.eska.pl/streamplayers/OggX.ocx (OggX Control) O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\uzytkownik\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\uzytkownik\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010-06-30 21:28:19 | 000,000,059 | RHS- | M] () - C:\autorun.inf -- [ NTFS ] O32 - AutoRun File - [2010-06-30 21:28:21 | 000,000,059 | RHS- | M] () - D:\autorun.inf -- [ NTFS ] O33 - MountPoints2\{12184520-5dd2-11df-9ff8-4d6564696130}\Shell\AutoRun\command - "" = L:\vi8f.exe -- File not found O33 - MountPoints2\{12184520-5dd2-11df-9ff8-4d6564696130}\Shell\open\Command - "" = L:\vi8f.exe -- File not found O33 - MountPoints2\{12184527-5dd2-11df-9ff8-4d6564696130}\Shell\AutoRun\command - "" = L:\wyskq6lt.exe -- File not found O33 - MountPoints2\{12184527-5dd2-11df-9ff8-4d6564696130}\Shell\open\Command - "" = L:\wyskq6lt.exe -- File not found O33 - MountPoints2\{3424ed40-e271-11dd-9af2-0021856eaeca}\Shell\AutoRun\command - "" = L:\mh.exe -- File not found O33 - MountPoints2\{3424ed40-e271-11dd-9af2-0021856eaeca}\Shell\open\Command - "" = L:\mh.exe -- File not found O33 - MountPoints2\{3e9bb94d-cd40-11de-9e59-4d6564696130}\Shell\AutoRun\command - "" = L:\8xcrbho6.exe -- File not found O33 - MountPoints2\{3e9bb94d-cd40-11de-9e59-4d6564696130}\Shell\open\Command - "" = L:\8xcrbho6.exe -- File not found O33 - MountPoints2\{9f635442-c8ac-11dd-8d75-806d6172696f}\Shell\AutoRun\command - "" = C:\qhbfqx.exe -- [2010-05-10 22:29:41 | 000,112,640 | RHS- | M] () O33 - MountPoints2\{9f635442-c8ac-11dd-8d75-806d6172696f}\Shell\open\Command - "" = C:\qhbfqx.exe -- [2010-05-10 22:29:41 | 000,112,640 | RHS- | M] () O33 - MountPoints2\{a6ea5e3f-5ea9-11df-9ffb-4d6564696130}\Shell\AutoRun\command - "" = L:\wyskq6lt.exe -- File not found O33 - MountPoints2\{a6ea5e3f-5ea9-11df-9ffb-4d6564696130}\Shell\open\Command - "" = L:\wyskq6lt.exe -- File not found O33 - MountPoints2\{a81ff031-eeea-11dd-9b11-0021856eaeca}\Shell\AutoRun\command - "" = L:\wyskq6lt.exe -- File not found O33 - MountPoints2\{a81ff031-eeea-11dd-9b11-0021856eaeca}\Shell\open\Command - "" = L:\wyskq6lt.exe -- File not found O33 - MountPoints2\{c65b5f40-c887-11dd-9a7a-806d6172696f}\Shell\AutoRun\command - "" = D:\qhbfqx.exe -- [2010-05-10 22:29:41 | 000,112,640 | RHS- | M] () O33 - MountPoints2\{c65b5f40-c887-11dd-9a7a-806d6172696f}\Shell\open\Command - "" = D:\qhbfqx.exe -- [2010-05-10 22:29:41 | 000,112,640 | RHS- | M] () O33 - MountPoints2\{f68d7ac0-dea9-11de-9e8b-4d6564696130}\Shell\AutoRun\command - "" = L:\9xf8.exe -- File not found O33 - MountPoints2\{f68d7ac0-dea9-11de-9e8b-4d6564696130}\Shell\open\Command - "" = L:\9xf8.exe -- File not found O33 - MountPoints2\J\Shell - "" = AutoRun O33 - MountPoints2\J\Shell\AutoRun\command - "" = J:\Autorun.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-06-27 22:17:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\ESET [2010-06-27 22:06:22 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2010-06-27 15:30:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\uzytkownik\Pulpit\Inne [2010-06-27 15:30:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\uzytkownik\Pulpit\Programy [2010-06-27 15:30:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\uzytkownik\Pulpit\Gry [2010-06-27 14:26:59 | 000,000,000 | ---D | C] -- C:\Program Files\S [2010-06-24 11:41:34 | 000,000,000 | ---D | C] -- C:\Program Files\Juz w szkole klasa 3a [2010-06-24 11:41:14 | 000,327,168 | ---- | C] (InstallShield Software Corporation) -- C:\WINDOWS\IsUn0415.exe [2010-06-18 14:28:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\Ubisoft [2010-06-18 14:28:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft [2009-03-08 12:35:06 | 000,061,440 | ---- | C] ( ) -- C:\WINDOWS\System32\csnpstd3.dll [2009-03-08 12:35:06 | 000,057,344 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnpstd3.dll [2009-03-08 12:35:06 | 000,036,864 | ---- | C] ( ) -- C:\WINDOWS\System32\vsnpstd3.dll [8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-06-30 21:28:47 | 000,000,059 | RHS- | M] () -- C:\autorun.inf [2010-06-30 18:41:49 | 000,051,240 | ---- | M] () -- C:\Documents and Settings\uzytkownik\Menu Start\Programy\Autostart\wnr3.dll [2010-06-30 18:41:39 | 000,186,500 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml [2010-06-30 16:14:26 | 009,175,040 | -H-- | M] () -- C:\Documents and Settings\uzytkownik\NTUSER.DAT [2010-06-30 16:14:26 | 000,000,292 | -HS- | M] () -- C:\Documents and Settings\uzytkownik\ntuser.ini [2010-06-29 19:50:16 | 014,460,204 | -H-- | M] () -- C:\Documents and Settings\uzytkownik\Ustawienia lokalne\Dane aplikacji\IconCache.db [2010-06-27 16:23:53 | 000,281,336 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2010-06-27 15:29:53 | 000,079,152 | ---- | M] () -- C:\Documents and Settings\uzytkownik\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT [2010-06-27 15:29:45 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn [2010-06-27 15:29:45 | 000,001,409 | ---- | M] () -- C:\WINDOWS\QTFont.for [2010-06-27 11:40:00 | 000,000,004 | ---- | M] () -- C:\WINDOWS\Twain001.Mtx [2010-06-27 11:39:08 | 000,132,608 | ---- | M] () -- C:\Documents and Settings\uzytkownik\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010-06-26 16:24:40 | 000,116,736 | RHS- | M] () -- C:\vi8f.exe [2010-06-25 23:43:12 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\uzytkownik\Menu Start\Programy\Autostart\Xfire.lnk [2010-06-24 11:38:49 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010-06-19 09:16:55 | 000,116,224 | RHS- | M] () -- C:\09lf.exe [2010-06-18 21:14:22 | 000,031,232 | ---- | M] () -- C:\Documents and Settings\uzytkownik\Menu Start\Programy\Autostart\wnr3.exe [2010-06-08 17:34:55 | 000,114,688 | RHS- | M] () -- C:\n0qls.exe [2010-06-07 20:33:38 | 000,000,523 | ---- | M] () -- C:\hpfr3420.xml [2010-06-07 08:24:26 | 000,116,224 | RHS- | M] () -- C:\yqq8eqil.exe [2010-06-03 11:07:45 | 000,115,200 | RHS- | M] () -- C:\iuvvl9f3.exe [2010-06-01 10:54:08 | 000,113,664 | RHS- | M] () -- C:\cgaqyi.exe [8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-06-28 18:16:00 | 000,126,976 | RHS- | C] () -- C:\wyskq6lt.exe [2010-06-27 22:21:47 | 000,116,736 | RHS- | C] () -- C:\vi8f.exe [2010-06-27 15:29:45 | 000,054,156 | -H-- | C] () -- C:\WINDOWS\QTFont.qfn [2010-06-27 15:29:45 | 000,001,409 | ---- | C] () -- C:\WINDOWS\QTFont.for [2010-06-25 23:43:12 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\uzytkownik\Menu Start\Programy\Autostart\Xfire.lnk [2010-06-19 09:17:06 | 000,116,224 | RHS- | C] () -- C:\09lf.exe [2010-06-18 21:14:22 | 000,051,240 | ---- | C] () -- C:\Documents and Settings\uzytkownik\Menu Start\Programy\Autostart\wnr3.dll [2010-06-18 21:14:22 | 000,031,232 | ---- | C] () -- C:\Documents and Settings\uzytkownik\Menu Start\Programy\Autostart\wnr3.exe [2010-06-17 20:48:23 | 000,076,407 | ---- | C] () -- C:\Documents and Settings\uzytkownik\Dane aplikacji\Smiley.ico [2010-06-08 17:35:25 | 000,114,688 | RHS- | C] () -- C:\n0qls.exe [2010-06-06 12:32:09 | 000,116,224 | RHS- | C] () -- C:\yqq8eqil.exe [2010-06-03 11:08:14 | 000,115,200 | RHS- | C] () -- C:\iuvvl9f3.exe [2010-06-01 10:54:37 | 000,113,664 | RHS- | C] () -- C:\cgaqyi.exe [2010-05-28 02:09:00 | 000,041,872 | ---- | C] () -- C:\WINDOWS\System32\xfcodec.dll [2010-05-10 11:40:50 | 000,000,060 | ---- | C] () -- C:\WINDOWS\wininit.ini [2010-02-10 19:52:13 | 000,120,200 | ---- | C] () -- C:\WINDOWS\System32\DLLDEV32i.dll [2010-02-10 19:51:57 | 000,005,937 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini [2010-02-09 20:05:14 | 000,000,000 | ---- | C] () -- C:\WINDOWS\msicpl.ini [2010-01-05 19:30:24 | 000,281,760 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys [2010-01-05 19:30:23 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys [2009-12-18 14:04:21 | 000,069,632 | R--- | C] () -- C:\WINDOWS\System32\xmltok.dll [2009-12-18 14:04:21 | 000,036,864 | R--- | C] () -- C:\WINDOWS\System32\xmlparse.dll [2009-11-21 17:03:03 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009-11-04 09:20:52 | 000,139,128 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2009-07-14 18:15:00 | 000,178,432 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat [2009-04-23 21:10:25 | 000,058,752 | ---- | C] () -- C:\WINDOWS\System32\drivers\koiujnygig.sys [2009-03-08 12:35:07 | 000,413,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\snpstd3.sys [2009-03-08 12:35:07 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\dsnpstd3.dll [2009-03-08 12:35:07 | 000,015,498 | ---- | C] () -- C:\WINDOWS\snpstd3.ini [2009-02-01 14:32:25 | 000,126,976 | ---- | C] () -- C:\WINDOWS\System32\coclassfast.dll [2009-02-01 14:32:24 | 000,046,892 | ---- | C] () -- C:\WINDOWS\System32\ADADIX16.DLL [2009-01-15 18:58:18 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2008-12-13 20:14:12 | 000,000,091 | ---- | C] () -- C:\WINDOWS\System32\logon.ini [2008-12-13 19:47:58 | 000,561,152 | R--- | C] () -- C:\WINDOWS\System32\hpotscl.dll [2008-12-12 22:18:09 | 000,131,072 | R--- | C] () -- C:\WINDOWS\System32\smdll.dll [2008-12-12 22:18:07 | 000,262,144 | R--- | C] () -- C:\WINDOWS\System32\HookShield.dll [2008-12-12 22:18:07 | 000,258,048 | R--- | C] () -- C:\WINDOWS\System32\HookMAp.dll [2008-12-12 22:18:07 | 000,032,768 | R--- | C] () -- C:\WINDOWS\System32\Auxiliary.dll [2008-05-16 20:31:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2008-05-16 20:31:00 | 001,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2008-05-16 20:31:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2008-05-16 20:31:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2008-05-16 20:31:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2008-05-03 09:24:01 | 000,000,082 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2005-01-14 03:49:01 | 000,014,848 | ---- | C] () -- C:\WINDOWS\System32\gxLame.dll [2004-09-27 20:19:04 | 000,371,200 | ---- | C] () -- C:\WINDOWS\System32\tvqdec.dll [2004-09-24 23:10:25 | 000,045,960 | ---- | C] () -- C:\WINDOWS\System32\bass_ape.dll [2004-09-22 14:53:38 | 000,028,032 | ---- | C] () -- C:\WINDOWS\System32\bass_wv.dll [2004-09-18 10:00:24 | 000,007,048 | ---- | C] () -- C:\WINDOWS\System32\bass_ofr.dll [2004-07-28 00:31:00 | 000,051,200 | ---- | C] () -- C:\WINDOWS\System32\bass_winamp.dll [2004-07-14 18:35:00 | 000,052,224 | ---- | C] () -- C:\WINDOWS\System32\bass_vis.dll [2004-03-05 12:39:48 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\unacev2.dll [2004-01-12 17:22:00 | 000,074,244 | ---- | C] () -- C:\WINDOWS\System32\gxDBEngine2.DLL [2003-08-10 00:00:00 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\bass_fx.dll [2003-04-08 12:40:22 | 000,005,679 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI [color=#E56717]========== LOP Check ==========[/color] [2009-02-02 13:29:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\3536B [2010-03-27 12:50:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Age of Empires 3 [2009-04-23 15:51:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite [2009-06-06 11:00:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Electronic Arts [2008-12-12 23:07:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ESET [2009-03-25 16:42:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\FarmFrenzyPizzaParty [2010-01-09 17:40:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Firefly Studios [2010-04-07 15:35:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10 [2010-05-22 11:20:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ipla [2010-02-10 19:54:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\MAGIX [2010-06-17 20:45:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\OpenFM [2010-04-13 22:17:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Pinnacle [2009-05-25 22:18:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Tlen.pl [2010-06-18 18:36:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft [2009-12-06 17:20:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\3DFA [2010-03-25 20:00:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\Ashampoo [2009-09-05 20:17:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\Canneverbe_Limited [2009-04-23 15:52:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\DAEMON Tools [2009-04-23 15:52:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\DAEMON Tools Lite [2009-04-23 15:52:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\DAEMON Tools Pro [2009-10-28 17:38:26 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\Dark Sector [2010-03-08 23:55:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\Desktopicon [2009-05-20 17:09:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\Disney Interactive Studios [2010-06-27 22:17:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\ESET [2009-07-07 12:23:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\FarmingSimulator2008 [2009-02-01 20:17:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\Gadu-Gadu [2010-04-07 15:35:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\Gadu-Gadu 10 [2010-03-07 00:14:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\GetRightToGo [2010-05-23 13:41:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\ipla [2009-02-25 15:01:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\Jasc [2010-02-10 19:57:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\MAGIX [2010-04-13 22:06:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\Mazaika [2009-10-01 11:41:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\Nowe Gadu-Gadu [2009-06-14 17:56:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\OpenFM [2010-04-17 14:49:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\RadioBar [2010-06-18 18:36:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\Ubisoft [2010-06-29 13:48:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\uTorrent [2009-02-14 19:53:03 | 000,000,400 | ---- | M] () -- C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1229190789.job [color=#E56717]========== Purity Check ==========[/color] < End of report >

Dodano Dzisiaj, 22:52:
2 log z otl oto link
http://www.wklej.org/id/358685/

**Posty:** 2183 · przez **NieWiem** 30 Cze 2010, 23:09

Mikou@j napisał(a):1. Zmień nazwę tematu.

Brakuje co prawda loga z gmera, ale rootkita widzę gołym okiem <lol>

= = = = = C O M B O F I X = = = = =
Zamknij wszystko nad czym aktualnie pracujesz, także wyłšcz swój program antywirusowy, zaporę, programy antyspyware. To ważne. Jak to zrobić, opisane tutaj.

Pamiętaj także o wyinstalowaniu wirtualnych napędów i usunięciu ich sterownika: klik

Pobierz ComboFixa od sUBs'a:
stšd lub stšd

ZANIM UŻYJESZ - Przeczytaj dokładnie jego instrukcję:
http://www.bleepingcomputer.com/combofix/pl/instrukcja-uzycia-combofix

Zalecam instalowanie Konsoli Odzyskiwania (XP, 2000), lub zaopatrzenie się w płytę WinRE (Vista, Se7en). Mimo wszystko ComboFix nie jest doskonały.

Przeklej na forum wyniki pracy narzędzia. Będš automatycznie otwarte w notatniku, znajdziesz je także w pliku C:\ComboFix.txt

**Posty:** 16 · przez **warek1234** 01 Lip 2010, 18:57

no wchodze w tego kombofixa i wyskakuje że brakuje pliku systemowego jakiegoś na regedit.exe i pisze skopjuj z innego komputera

**Posty:** 2183 · przez **NieWiem** 01 Lip 2010, 22:51

Może jakoś jaśniej?

Spróbuj tak... Tylko czytaj to dokładnie i wykonuj starannie, krok po kroku.

= = = = = O T H & C o m b o F i x = = = = =

Pobierz na pulpit OTH i nową wersję ComboFixa, ale zapisz ją pod zmienioną nazwą, np. LOL.exe
Obydwa narzędzia muszš być zapisane na pulpicie!

Uruchom OTH i wybierz opcję Kill All Processes. Zniknie pulpit.
Wybierz opcję Start Misc Program -> wyszukaj tego zapisanego ComboFixa i uruchom.

Powiedz co i jak.

**Posty:** 16 · przez **warek1234** 02 Lip 2010, 10:55

no zrobiłem tak jak muwisz włączylem combofixa i mi sie zaaktualizował wyskoczyła komenda że zaczyna prace i wyskoczył błąd krytyczny brakuje pliku C/windows/regedit.exe

**Posty:** 2183 · przez **NieWiem** 02 Lip 2010, 11:09

Niedobrze. A przynajmniej niezbyt dobrze.

Uruchom ponownie OTL, u góry kliknij none, w dolnym oknie wklej

/md5start
regedit.exe
/md5stop

kliknij Run Scan i przeklej wyniki.

**Posty:** 16 · przez **warek1234** 02 Lip 2010, 22:31

no mam

Kod: Zaznacz wszystko: OTL logfile created on: 2010-07-02 22:27:31 - Run 2 OTL by OldTimer - Version 3.2.7.0 Folder = C:\Gry Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 68,00% Memory free 4,00 Gb Paging File | 2,00 Gb Available in Paging File | 60,00% Paging File free Paging file location(s): c:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 146,48 Gb Total Space | 59,56 Gb Free Space | 40,66% Space Free | Partition Type: NTFS Drive D: | 151,61 Gb Total Space | 143,33 Gb Free Space | 94,54% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: XP-SPECIAL Current User Name: uzytkownik Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Custom Scans ==========[/color] [color=#A23BEC]< MD5 for: REGEDIT.EXE >[/color] [2004-08-04 01:44:28 | 000,149,504 | ---- | M] (Microsoft Corporation) MD5=C1FD2A565973DE555A36B335644402EB -- C:\Documents and Settings\uzytkownik\Pulpit\Inne\i386\regedit.exe < End of report >

Dodano Dzisiaj, 22:32:

Kod: Zaznacz wszystko: E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded

tego pod uwage nie bierz czytnik kart pamięci

**Posty:** 2183 · przez **NieWiem** 04 Lip 2010, 02:27

Nie masz w systemie edytora rejestru i to jest problem krytyczny, bez rozwiązania którego nie zaczniemy.

Co to jest za katalog?

C:\Documents and Settings\uzytkownik\Pulpit\Inne

Bo tutaj jest jakiś regedit, tylko nie wiem czy montowany przez Ciebie.

Masz płytę instalacyną systemu?

**Posty:** 16 · przez **warek1234** 05 Lip 2010, 23:55

nie mam płyty

Dodano Dzisiaj, 23:59:
miałem syf an pulpicie i nie wiedziałem co to jest ten folder i wkleiłem go do folderu inne

**Posty:** 18165 · przez **wojtas** 06 Lip 2010, 00:16

zapisz to http://www.sendspace.com/file/zlj7mo sobie na partycji C:

Uruchom OTL i w sekcji własne opcje skanowania / skrypt (Custom Scans/Fixes) wklej:

:OTL
O2 - BHO: (no name) - {5B291E6C-9A74-4034-971B-A4B007A0B313} - No CLSID value found.
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKLM\..\Toolbar: (no name) - {5B291E6C-9A74-4034-971B-A4B007A0B313} - No CLSID value found.
O3 - HKU\S-1-5-21-1343024091-963894560-682003330-1003\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKLM..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe File not found
O4 - HKU\S-1-5-21-1343024091-963894560-682003330-1003..\Run: [cdoosoft] C:\Documents and Settings\uzytkownik\Ustawienia lokalne\Temp\herss.exe ()
O4 - HKU\S-1-5-21-1343024091-963894560-682003330-1003..\Run: [dso32] C:\Documents and Settings\uzytkownik\Ustawienia lokalne\Temp\dsoqq.exe ()
O4 - HKU\S-1-5-21-1343024091-963894560-682003330-1003..\Run: [Expressivo] C:\Program Files\ivo\Expressivo\expressivo.exe File not found
O4 - HKU\S-1-5-21-1343024091-963894560-682003330-1003..\Run: [nod32] C:\Documents and Settings\uzytkownik\Ustawienia lokalne\Temp\nodqq.exe ()
O4 - HKU\.DEFAULT..\RunOnce: [nltide_2] File not found
O4 - HKU\.DEFAULT..\RunOnce: [tscuninstall] C:\WINDOWS\System32\tscupgrd.exe File not found
O4 - HKU\S-1-5-18..\RunOnce: [nltide_2] File not found
O4 - HKU\S-1-5-18..\RunOnce: [tscuninstall] C:\WINDOWS\System32\tscupgrd.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [nltide_2] File not found
O4 - Startup: C:\Documents and Settings\uzytkownik\Menu Start\Programy\Autostart\wnr3.dll ()
O4 - Startup: C:\Documents and Settings\uzytkownik\Menu Start\Programy\Autostart\wnr3.exe ()
O32 - AutoRun File - [2010-06-30 21:28:19 | 000,000,059 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010-06-30 21:28:21 | 000,000,059 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{12184520-5dd2-11df-9ff8-4d6564696130}\Shell\AutoRun\command - "" = L:\vi8f.exe -- File not found
O33 - MountPoints2\{12184520-5dd2-11df-9ff8-4d6564696130}\Shell\open\Command - "" = L:\vi8f.exe -- File not found
O33 - MountPoints2\{12184527-5dd2-11df-9ff8-4d6564696130}\Shell\AutoRun\command - "" = L:\wyskq6lt.exe -- File not found
O33 - MountPoints2\{12184527-5dd2-11df-9ff8-4d6564696130}\Shell\open\Command - "" = L:\wyskq6lt.exe -- File not found
O33 - MountPoints2\{3424ed40-e271-11dd-9af2-0021856eaeca}\Shell\AutoRun\command - "" = L:\mh.exe -- File not found
O33 - MountPoints2\{3424ed40-e271-11dd-9af2-0021856eaeca}\Shell\open\Command - "" = L:\mh.exe -- File not found
O33 - MountPoints2\{3e9bb94d-cd40-11de-9e59-4d6564696130}\Shell\AutoRun\command - "" = L:\8xcrbho6.exe -- File not found
O33 - MountPoints2\{3e9bb94d-cd40-11de-9e59-4d6564696130}\Shell\open\Command - "" = L:\8xcrbho6.exe -- File not found
O33 - MountPoints2\{9f635442-c8ac-11dd-8d75-806d6172696f}\Shell\AutoRun\command - "" = C:\qhbfqx.exe -- [2010-05-10 22:29:41 | 000,112,640 | RHS- | M] ()
O33 - MountPoints2\{9f635442-c8ac-11dd-8d75-806d6172696f}\Shell\open\Command - "" = C:\qhbfqx.exe -- [2010-05-10 22:29:41 | 000,112,640 | RHS- | M] ()
O33 - MountPoints2\{a6ea5e3f-5ea9-11df-9ffb-4d6564696130}\Shell\AutoRun\command - "" = L:\wyskq6lt.exe -- File not found
O33 - MountPoints2\{a6ea5e3f-5ea9-11df-9ffb-4d6564696130}\Shell\open\Command - "" = L:\wyskq6lt.exe -- File not found
O33 - MountPoints2\{a81ff031-eeea-11dd-9b11-0021856eaeca}\Shell\AutoRun\command - "" = L:\wyskq6lt.exe -- File not found
O33 - MountPoints2\{a81ff031-eeea-11dd-9b11-0021856eaeca}\Shell\open\Command - "" = L:\wyskq6lt.exe -- File not found
O33 - MountPoints2\{c65b5f40-c887-11dd-9a7a-806d6172696f}\Shell\AutoRun\command - "" = D:\qhbfqx.exe -- [2010-05-10 22:29:41 | 000,112,640 | RHS- | M] ()
O33 - MountPoints2\{c65b5f40-c887-11dd-9a7a-806d6172696f}\Shell\open\Command - "" = D:\qhbfqx.exe -- [2010-05-10 22:29:41 | 000,112,640 | RHS- | M] ()
O33 - MountPoints2\{f68d7ac0-dea9-11de-9e8b-4d6564696130}\Shell\AutoRun\command - "" = L:\9xf8.exe -- File not found
O33 - MountPoints2\{f68d7ac0-dea9-11de-9e8b-4d6564696130}\Shell\open\Command - "" = L:\9xf8.exe -- File not found

:Files
C:\Documents and Settings\uzytkownik\Menu Start\Programy\Autostart\wnr3.exe
C:\Documents and Settings\uzytkownik\Ustawienia lokalne\Temp\nodqq0.dll
C:\WINDOWS\system32\drivers\koiujnygig.sys
C:\Program Files\DAEMON Tools Toolbar
C:\vi8f.exe
C:\autorun.inf
C:\09lf.exe
C:\n0qls.exe
C:\yqq8eqil.exe
C:\iuvvl9f3.exe
C:\cgaqyi.exe
d:\vi8f.exe
d:\autorun.inf
d:\09lf.exe
d:\n0qls.exe
d:\yqq8eqil.exe
d:\iuvvl9f3.exe
d:\cgaqyi.exe
C:\WINDOWS/Regedit.exe|C:\Regedit.exe /replace

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""

:Services
wktanqlvlygji

:Commands
[emptytemp]
[emptyflash]
[clearallrestorepoints]

Kliknij wykonaj skrypt (Run Fix). I potwierdź reset komputera .

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia komputera + Przy podpiętym urządzeniu przenośnym (pendrive itp) , uruchom USBFIX z opcji Listing i pokaż raport na forum oraz log z Gmera

**Posty:** 16 · przez **warek1234** 06 Lip 2010, 11:13

busbfix

Kod: Zaznacz wszystko: ############################## | UsbFix 7.016 | [Listing] User: uzytkownik (Administrator) # XP-SPECIAL [ ] Updated 05/07/10 by El Desaparecido / C_XX Started at 11:10:40 | 06/07/2010 Website: http://pagesperso-orange.fr/NosTools/index.html Contact: FindyKill.Contact@gmail.com CPU: AMD Athlon(tm) 64 X2 Dual Core Processor 4000+ CPU 2: AMD Athlon(tm) 64 X2 Dual Core Processor 4000+ Microsoft Windows XP Professional (5.1.2600 32-Bit) # Dodatek Service Pack 3 Internet Explorer 7.0.5730.13 Windows Firewall: Disabled /!\ Antivirus: ESET Smart Security 4.2 4.2 [(!) Disabled | Updated] Firewall: Zapora osobista 4.2.40.10 [Enabled] RAM -> 2047 Mb C:\ (%systemdrive%) -> Fixed drive # 146 Gb (69 Mb free - 47%) [] # NTFS D:\ -> Fixed drive # 152 Gb (143 Mb free - 95%) [] # NTFS H:\ -> CD-ROM J:\ -> Removable drive # 487 Mb (176 Mb free - 36%) [] # FAT ################## | Listing | [05/05/2010 - 07:44:31 | RSH | 111616] C:\1thes92p.exe [10/05/2010 - 11:35:18 | RSH | 111616] C:\9rfpp.exe [27/03/2010 - 12:32:39 | RSH | 132608] C:\affi8l.exe [01/09/2009 - 13:39:21 | A | 34308] C:\BASSMOD.DLL [17/04/2010 - 23:03:31 | D ] C:\boilsoft_tmp [18/11/2009 - 22:29:42 | RSH | 223] C:\boot.ini [22/07/2001 - 00:13:54 | RASH | 4952] C:\Bootfont.bin [28/05/2010 - 17:46:02 | RSH | 114688] C:\bu8.exe [01/05/2010 - 09:09:34 | RSH | 110592] C:\ca.exe [27/06/2010 - 22:16:44 | SHD ] C:\Config.Msi [13/12/2008 - 03:55:11 | A | 0] C:\CONFIG.SYS [27/03/2010 - 20:21:20 | A | 216] C:\DebugTrace-RockallDLL.log [17/03/2009 - 18:48:14 | D ] C:\Documents and Settings [11/01/2009 - 15:09:34 | D ] C:\Genius [06/07/2010 - 11:08:25 | D ] C:\Gry [07/06/2010 - 20:33:38 | A | 523] C:\hpfr3420.xml [07/06/2010 - 20:33:38 | A | 117677] C:\hpfr3425.log [08/05/2010 - 07:50:37 | RSH | 111616] C:\i8ikdjwt.exe [13/12/2008 - 03:55:11 | RASH | 0] C:\IO.SYS [15/04/2009 - 13:07:35 | A | 150] C:\ldx.bat [18/04/2010 - 11:56:33 | RSH | 127488] C:\lhhr8.exe [15/09/2009 - 22:19:59 | A | 126007] C:\logfile [06/07/2010 - 10:37:36 | SD ] C:\lol [02/04/2010 - 20:53:07 | A | 109] C:\mbam-error.txt [29/03/2010 - 08:36:46 | RSH | 132608] C:\mi9al8rs.exe [13/12/2008 - 03:55:11 | RASH | 0] C:\MSDOS.SYS [12/12/2008 - 23:19:29 | RHD ] C:\MSOCache [17/05/2009 - 13:15:27 | D ] C:\Nexon [13/04/2008 - 22:13:04 | RASH | 47564] C:\NTDETECT.COM [14/04/2008 - 00:02:00 | RASH | 251152] C:\ntldr [17/05/2010 - 19:46:12 | RSH | 112640] C:\p6xebrnt.exe [15/05/2010 - 09:35:31 | RSH | 112640] C:\p9rs.exe [06/07/2010 - 10:46:28 | ASH | 2145386496] C:\pagefile.sys [15/04/2009 - 13:09:37 | A | 150] C:\pch.bat [25/09/2009 - 20:59:33 | A | 13030] C:\PDOXUSRS.NET [06/07/2010 - 10:44:36 | D ] C:\Program Files [06/06/2009 - 11:00:45 | D ] C:\ProgramData [22/05/2010 - 00:51:37 | RSH | 114688] C:\q0wfr.exe [06/07/2010 - 00:00:05 | D ] C:\Qoobox [19/04/2010 - 20:38:23 | RSH | 128512] C:\r3fhr.exe [12/12/2008 - 22:26:17 | SHD ] C:\RECYCLER [02/07/2010 - 10:41:45 | RSH | 116224] C:\rxf.exe [24/03/2009 - 15:48:16 | D ] C:\sr [27/12/2008 - 17:20:46 | SHD ] C:\System Volume Information [10/02/2010 - 13:12:30 | A | 234399] C:\test.txt [23/04/2010 - 23:07:05 | RSH | 128000] C:\twhvna.exe [06/07/2010 - 11:08:37 | D ] C:\UsbFix [06/07/2010 - 11:10:45 | A | 3298] C:\UsbFix.txt [22/04/2010 - 12:54:20 | RSH | 128512] C:\vgyn6ewc.exe [27/05/2010 - 14:04:07 | RSH | 114176] C:\wa.exe [06/07/2010 - 10:23:26 | D ] C:\WINDOWS [15/04/2010 - 13:42:29 | RSH | 126976] C:\wyskq6lt.exe [27/03/2009 - 21:08:47 | D ] C:\YDP [06/07/2010 - 10:44:32 | D ] C:\_OTL [05/05/2010 - 07:44:31 | RSH | 111616] D:\1thes92p.exe [14/03/2010 - 14:10:33 | RSH | 116736] D:\3dcs9.exe [11/02/2010 - 14:52:25 | RSH | 91648] D:\9qqigqwf.exe [10/05/2010 - 11:35:18 | RSH | 111616] D:\9rfpp.exe [27/03/2010 - 12:32:39 | RSH | 132608] D:\affi8l.exe [01/01/2010 - 13:06:35 | RSH | 109568] D:\anoataly.exe [24/03/2010 - 20:45:59 | RSH | 125440] D:\bbjl2g.exe [28/05/2010 - 17:46:02 | RSH | 114688] D:\bu8.exe [10/03/2010 - 12:55:55 | D ] D:\c00c2e99b8c13ed4fe [01/05/2010 - 09:09:34 | RSH | 110592] D:\ca.exe [05/06/2010 - 20:43:27 | D ] D:\Filmy [08/05/2010 - 07:50:37 | RSH | 111616] D:\i8ikdjwt.exe [23/03/2010 - 15:07:03 | RSH | 121344] D:\ji83j.exe [14/01/2010 - 18:24:30 | RSH | 116736] D:\kmj.exe [18/04/2010 - 11:56:33 | RSH | 127488] D:\lhhr8.exe [01/12/2009 - 20:48:44 | RSH | 115905] D:\mbdm.exe [17/01/2010 - 10:08:58 | RSH | 118784] D:\mh.exe [29/03/2010 - 08:36:46 | RSH | 132608] D:\mi9al8rs.exe [20/03/2010 - 13:26:38 | HD ] D:\msdownld.tmp [01/04/2009 - 22:07:31 | D ] D:\Muza [17/05/2010 - 19:46:12 | RSH | 112640] D:\p6xebrnt.exe [15/05/2010 - 09:35:31 | RSH | 112640] D:\p9rs.exe [22/05/2010 - 00:51:37 | RSH | 114688] D:\q0wfr.exe [19/04/2010 - 20:38:23 | RSH | 128512] D:\r3fhr.exe [13/12/2008 - 20:13:24 | SHD ] D:\RECYCLER [02/07/2010 - 10:41:45 | RSH | 116224] D:\rxf.exe [13/12/2008 - 19:53:04 | SHD ] D:\System Volume Information [19/01/2010 - 18:39:56 | RSH | 123392] D:\sywyrl0q.exe [23/04/2010 - 23:07:05 | RSH | 128000] D:\twhvna.exe [22/04/2010 - 12:54:20 | RSH | 128512] D:\vgyn6ewc.exe [27/05/2010 - 14:04:07 | RSH | 114176] D:\wa.exe [08/02/2010 - 16:01:18 | RSH | 91648] D:\ws.exe [15/04/2010 - 13:42:29 | RSH | 126976] D:\wyskq6lt.exe [27/06/2010 - 15:32:58 | D ] D:\Zdjęcia [19/06/2010 - 15:15:00 | RSH | 59] J:\autorun.inf [01/01/2004 - 00:02:56 | D ] J:\MICIN.DIR [01/01/2004 - 00:02:58 | D ] J:\FMIN.DIR [06/01/2009 - 23:11:46 | A | 7034223] J:\!!Benny Benassi - Every single day.mp3 [15/05/2010 - 09:35:32 | RASH | 112640] J:\p9rs.exe [15/05/2010 - 23:04:08 | A | 6216160] J:\Benny_Benassi_-_Satisfaction.mp3 [15/05/2010 - 23:07:20 | A | 2238171] J:\Karamba_-kurde,cenzura!,_dziwka,_szmata.mp3 [15/04/2010 - 13:42:30 | RASH | 126976] J:\wyskq6lt.exe [29/05/2010 - 19:40:48 | A | 6607730] J:\disco_polo-_toples_-_zaproĹ›_mnie_do_swego_domu490361.mp3 [29/05/2010 - 19:34:50 | A | 3757546] J:\disco_polo-weekend_-_najarana_anka.mp3 [10/05/2010 - 22:29:42 | RSH | 112640] J:\qhbfqx.exe [09/08/2008 - 12:48:06 | A | 5572859] J:\Step Up 2 Soundtrack - Enrique Iglesias ft. Lil Wayne - Push.mp3 [29/05/2010 - 19:34:48 | A | 4943080] J:\piosenki_biesiadne_-_polskie_-_4_razy_po_2_razy.mp3 [29/05/2010 - 19:42:20 | A | 3608745] J:\akcent_-_disco_polo_-_dziewczyna_z_klubu_disco.mp3 [25/12/2008 - 11:42:32 | A | 4473449] J:\aa1.mp3 [29/05/2010 - 19:27:10 | A | 10152704] J:\Boys_-_BÄ™dziesz_Moja.Mp3 [29/05/2010 - 19:32:12 | A | 3260544] J:\Boys_-_Kochana_uwierz_mi.mp3 [29/05/2010 - 19:33:36 | A | 4108539] J:\disco_polo_-_akcent_-_pszczĂłĹ‚ka_maja.mp3 [29/05/2010 - 19:35:00 | A | 3979392] J:\disco_polo_-_bo_ja_taĹ„czyc_chce.mp3 [29/05/2010 - 19:35:06 | A | 5683086] J:\disco_polo_-_boys_-_jestes_szalona.mp3 [29/05/2010 - 19:41:32 | A | 3627467] J:\disco_polo_-_viper_impreza.mp3 [16/06/2010 - 17:31:52 | A | 4806029] J:\Steve_Aoki_-_I'm_In_The_House_(Killafornia_Simple_Edit).mp3 [18/05/2010 - 18:02:04 | A | 3753767] J:\the_rasmus_feat._anette_olzon_-_october_&_april.mp3 [19/05/2010 - 18:41:02 | A | 4196804] J:\djs_explode_vs._smerfy_-_loczek_blond_(club_tec(1).mp3 [18/05/2010 - 16:43:58 | A | 7008216] J:\Krzysztof_KubiĹ›-_Lovely_Place.mp3 [17/06/2010 - 20:58:58 | A | 4761973] J:\I Will love you Monday (365).wma [17/06/2010 - 20:54:46 | A | 5383284] J:\03 - Within Temptation, Chris Jones - Utopia.mp3 [17/06/2010 - 23:10:38 | A | 2819179] J:\Gypsy - Shakira.mp3 [21/12/2008 - 11:48:28 | A | 5290008] J:\INNA - Hot.mp3 [04/01/2009 - 14:05:26 | A | 7126808] J:\Justin Timberlake - Senorita.mp3 [30/01/2009 - 18:02:20 | A | 3082911] J:\Red & Spinache - Chcę Poznać Twoją Matkę.mp3 [03/03/2008 - 23:49:02 | A | 4588387] J:\Russian Boys - Dziewczonka.mp3 [04/01/2009 - 14:08:32 | A | 6383744] J:\Sash! Feat. Stunt - Raindrops (Encore Une Fois) (Sascha Vs. Picco Mix) (www.DJ-News.eu).mp3 [05/03/2009 - 20:38:20 | A | 4062221] J:\Pink - Sober(www.sciagnijto.pl).mp3gfg.mp3 [06/03/2009 - 12:03:10 | A | 5282619] J:\Stefanie_Heinzmann_-_The_Unforgiven.mp3 [06/03/2009 - 12:56:20 | A | 1606248] J:\RoZmowa babci.mp3 [06/03/2009 - 13:04:44 | A | 3490618] J:\kawaly.mp3 [06/03/2009 - 13:27:50 | A | 795826] J:\Maryja.mp3 [06/03/2009 - 13:32:36 | A | 4577938] J:\Piniondze za los.mp3 [06/03/2009 - 13:32:38 | A | 693217] J:\RadioMaryjaUla.mp3 [06/03/2009 - 13:07:20 | A | 2180734] J:\Blondiii13.mp3 [06/03/2009 - 13:24:34 | A | 383343] J:\Ivona.mp3 [07/04/2009 - 18:32:38 | A | 3382202] J:\Sanchia_-_Are_You_ready.mp3 [25/04/2009 - 15:07:00 | A | 3265128] J:\Bel-Mondo%20-%20The%20Club%20Is%20Mine%205Bmuzikum%2epl%205D%20[www%2eempety%2epl]%2emp3.mp3 [21/09/2009 - 15:50:48 | A | 6472538] J:\Youngbloodz__-__Imma_Shine.mp3 [24/09/2009 - 21:38:58 | A | 4315044] J:\Natalia_Lesz__-__CoĹ›_za_coĹ›.mp3 [26/09/2009 - 12:02:50 | A | 4991104] J:\Shaggy_feat._Gary_Nesta_Pine__-__Fly_High_[la_-_musica.info].mp3 [19/09/2009 - 19:48:34 | A | 2796223] J:\Green_Day__-__American_Idiot.mp3 [14/08/2009 - 20:11:48 | A | 5448266] J:\lustra__-__scotty_doesnt_know.mp3 [13/08/2009 - 13:25:26 | A | 3512685] J:\East_Clubbers__-__Sextasy.mp3 [08/08/2009 - 17:41:24 | A | 9787604] J:\Black_Eyed_Peas__-__I_Gotta_Feeling.mp3 [25/07/2009 - 21:28:36 | A | 4186741] J:\Eminem__-__The_Real_Slim_Shady.mp3 [27/07/2009 - 16:15:44 | A | 4735980] J:\Eminem__-__Without_Me.mp3 [07/08/2009 - 20:07:32 | A | 4597627] J:\Chris_Cornell__-__Part_Of_Me.mp3 [30/09/2009 - 17:38:50 | A | 8696994] J:\Eddy_Wata__-__My_dream.mp3 [28/10/2009 - 19:13:22 | A | 3780099] J:\Agnieszka_Chylinska__-__Winna.mp3 [12/10/2009 - 18:40:32 | A | 9852928] J:\12._Warszafski_Deszcz__-__Robi_sie_przester.mp3 [30/10/2009 - 15:56:02 | A | 2914891] J:\Mika_-_Grace_Kelly.mp3 [17/10/2009 - 16:56:08 | A | 3823148] J:\Lales__-__Pamietam_O_Tobie.mp3 [20/10/2009 - 17:07:06 | A | 3501320] J:\Busta_Rhymes__-__Don_t_Touch_Me.mp3 [24/12/2009 - 11:02:14 | A | 6130207] J:\Christmas_Songs_-_Britney_Spears_-_My_Only_Wish_(This_Year)(.mp3 [24/12/2009 - 11:03:48 | A | 3863280] J:\Mariah_Carey-All_I_Want_For_Christmas_Is_You.mp3 [01/12/2009 - 19:48:44 | RSH | 115905] J:\mbdm.exe [01/05/2010 - 12:19:44 | A | 13637213] J:\Junior Caldera Ft. Sophie Ellis Bextor - Can't Fight This Feeling [JUSTFM.LT].mp3 [27/04/2010 - 16:54:02 | A | 4221464] J:\Lady_Gaga_-_Bad_Romance.mp3 [27/04/2010 - 16:38:48 | A | 8957162] J:\09._Soulja_Boy_Tell'em_-_Crank_That_(Soulja_Boy).mp3 [12/03/2010 - 22:12:32 | A | 3941013] J:\Grubson_-_Na_Szczycie.mp3 [27/04/2010 - 16:08:14 | A | 3716075] J:\outhere_brothers_-_i_wanna_fuck_you_in_the_ass.mp3 [02/05/2010 - 14:11:08 | A | 5675008] J:\Smoothie - Human (smp electro remix).mp3 [28/04/2010 - 16:55:28 | A | 4892800] J:\Fannypack_-_Hey_Mami.mp3 [02/05/2010 - 14:12:50 | A | 4598689] J:\Smoothie - Human (Raindropz Remix Cut).mp3 [27/04/2010 - 17:40:58 | A | 3321598] J:\la_roux_-_bulletproof_(tiborg_radio_mix).mp3 [10/03/2010 - 21:13:54 | A | 6063163] J:\Black_Eyed_Peas_-_Let's_Get_It_Started.mp3 [15/05/2010 - 17:11:26 | A | 4886326] J:\Shaggy_-_2006_Mega_Beat_Dance_Club_No.1_-_Hey_Sexy_Lady.mp3 [15/05/2010 - 20:50:06 | A | 870013] J:\Kurze_techno_-_techno_chicken_(orginal_mix).mp3 [15/05/2010 - 21:04:22 | A | 2959227] J:\Kurze_Techno_-_Chicken_Satisfaction_(by_Walor).mp3 ################## | E.O.F |

**Posty:** 18165 · przez **wojtas** 06 Lip 2010, 11:43

a gdzie reszta logów ? Gmera , nowy OTL , raport z czyszczenia?

**Posty:** 16 · przez **warek1234** 06 Lip 2010, 13:44

Kod: Zaznacz wszystko: GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-07-06 13:42:17 Windows 5.1.2600 Dodatek Service Pack 3 Running: 2cdojjjw.exe; Driver: C:\DOCUME~1\UZYTKO~1\USTAWI~1\Temp\uwtiyuoc.sys ---- System - GMER 1.0.15 ---- SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwAssignProcessToJobObject [0xB39A5610] SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwDebugActiveProcess [0xB39A5C10] SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwDuplicateObject [0xB39A5730] SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwOpenProcess [0xB39A54B0] SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwOpenThread [0xB39A5570] SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwProtectVirtualMemory [0xB39A56D0] SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwSetContextThread [0xB39A5690] SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwSetInformationThread [0xB39A5650] SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwSetSecurityObject [0xB39A57D0] SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwSuspendProcess [0xB39A5510] SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwSuspendThread [0xB39A5590] SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwTerminateProcess [0xB39A54D0] SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwTerminateThread [0xB39A55D0] SSDT \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET) ZwWriteVirtualMemory [0xB39A5750] ---- Kernel code sections - GMER 1.0.15 ---- .text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB9648360, 0x37388D, 0xE8000020] .text C:\WINDOWS\system32\DRIVERS\atksgt.sys section is writeable [0xB3471300, 0x3B6D8, 0xE8000020] .text C:\WINDOWS\system32\DRIVERS\lirsgt.sys section is writeable [0xB3F1A300, 0x1BEE, 0xE8000020] ---- User code sections - GMER 1.0.15 ---- .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1580] kernel32.dll!SetUnhandledExceptionFilter 7C8449FD 4 Bytes [C2, 04, 00, 00] .text C:\Program Files\Internet Explorer\iexplore.exe[3032] USER32.dll!DialogBoxParamW 7E3747AB 5 Bytes JMP 4391F301 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3032] USER32.dll!DialogBoxIndirectParamW 7E382072 5 Bytes JMP 43AB1712 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3032] USER32.dll!MessageBoxIndirectA 7E38A082 5 Bytes JMP 43AB1693 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3032] USER32.dll!DialogBoxParamA 7E38B144 5 Bytes JMP 43AB16D7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3032] USER32.dll!MessageBoxExW 7E3A0838 5 Bytes JMP 43AB161F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3032] USER32.dll!MessageBoxExA 7E3A085C 5 Bytes JMP 43AB1659 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3032] USER32.dll!DialogBoxIndirectParamA 7E3A6D7D 5 Bytes JMP 43AB174D C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3032] USER32.dll!MessageBoxIndirectW 7E3B64D5 5 Bytes JMP 439416B6 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) ---- Devices - GMER 1.0.15 ---- AttachedDevice \Driver\Tcpip \Device\Ip epfwtdi.sys (ESET Personal Firewall TDI filter/ESET) AttachedDevice \Driver\Tcpip \Device\Tcp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET) Device \Driver\prodrv06 \Device\ProDrv06 E1B5AC30 Device \Driver\atapi \Device\Ide\IdePort0 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology) Device \Driver\atapi \Device\Ide\IdePort1 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology) Device \Driver\atapi \Device\Ide\IdePort2 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology) Device \Driver\atapi \Device\Ide\IdePort3 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology) Device \Driver\atapi \Device\Ide\IdeDeviceP3T1L0-10 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology) Device \Driver\atapi \Device\Ide\IdeDeviceP2T1L0-5 prosync1.sys (StarForce Protection Synchronization Driver/Protection Technology) Device \Driver\prohlp02 \Device\ProHlp02 E151EC90 AttachedDevice \Driver\Tcpip \Device\Udp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET) AttachedDevice \Driver\Tcpip \Device\RawIp epfwtdi.sys (ESET Personal Firewall TDI filter/ESET) AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x88 0x54 0x31 0x2D ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x88 0x54 0x31 0x2D ... Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32@cd042efbbd7f7af1647644e76e06692b 0xC8 0x28 0x51 0xAF ... Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32@bca643cdc5c2726b20d2ecedcc62c59b 0x6A 0x9C 0xD6 0x61 ... Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32@2c81e34222e8052573023a60d06dd016 0x25 0xDA 0xEC 0x7E ... Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32@2582ae41fb52324423be06337561aa48 0x3E 0x1E 0x9E 0xE0 ... Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32@caaeda5fd7a9ed7697d9686d4b818472 0xCD 0x44 0xCD 0xB9 ... Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32@a4a1bcf2cc2b8bc3716b74b2b4522f5d 0xB0 0x18 0xED 0xA7 ... Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32@4d370831d2c43cd13623e232fed27b7b 0xFB 0xA7 0x78 0xE6 ... Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32@1d68fe701cdea33e477eb204b76f993d 0x83 0x6C 0x56 0x8B ... Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32@1fac81b91d8e3c5aa4b0a51804d844a3 0x51 0xFA 0x6E 0x91 ... Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32@f5f62a6129303efb32fbe080bb27835b 0x3D 0xCE 0xEA 0x26 ... Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32@fd4e2e1a3940b94dceb5a6a021f2e3c6 0x2A 0xB7 0xCC 0xB5 ... Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ThreadingModel Apartment Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@ C:\WINDOWS\system32\OLE32.DLL Reg HKLM\SOFTWARE\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32@8a8aec57dd6508a385616fbc86791ec2 0xFA 0xEA 0x66 0x7F ... ---- EOF - GMER 1.0.15 ----

Dodano Dzisiaj, 13:45:
nie lotej myslisz że to tak szybko z gamera mi sie robił prawie 2 h

Dodano Dzisiaj, 13:48:

Kod: Zaznacz wszystko: OTL logfile created on: 2010-07-06 10:50:41 - Run 3 OTL by OldTimer - Version 3.2.7.0 Folder = C:\Gry Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 2,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 78,00% Memory free 4,00 Gb Paging File | 4,00 Gb Available in Paging File | 92,00% Paging File free Paging file location(s): c:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 146,48 Gb Total Space | 68,87 Gb Free Space | 47,01% Space Free | Partition Type: NTFS Drive D: | 151,61 Gb Total Space | 143,33 Gb Free Space | 94,54% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: XP-SPECIAL Current User Name: uzytkownik Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-07-05 22:42:13 | 000,073,728 | -HS- | M] (Mbgjhn) -- C:\Documents and Settings\uzytkownik\Dane aplikacji\SystemProc\lsass.exe PRC - [2010-06-29 12:06:37 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Gry\OTL.exe PRC - [2010-04-07 21:07:24 | 000,810,120 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe PRC - [2010-04-07 21:07:04 | 002,145,000 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe PRC - [2009-09-23 14:38:18 | 000,935,208 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe PRC - [2009-03-28 23:11:38 | 003,325,952 | ---- | M] (Electronic Arts) -- C:\Program Files\Electronic Arts\EADM\Core.exe PRC - [2008-04-14 22:51:18 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2008-01-11 23:16:00 | 000,039,792 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe PRC - [2007-05-03 17:17:50 | 000,172,032 | ---- | M] () -- C:\Genius\ioCentre\gKbdTask.exe PRC - [2007-04-20 18:53:38 | 000,294,912 | ---- | M] () -- C:\Genius\ioCentre\gMouseTask.exe PRC - [2007-04-18 10:44:40 | 000,188,416 | ---- | M] () -- C:\Genius\ioCentre\gDeskMgm.exe PRC - [2007-04-13 16:04:44 | 000,061,440 | ---- | M] () -- C:\Genius\ioCentre\gTaskBar.exe PRC - [2007-03-21 16:39:00 | 000,049,152 | ---- | M] () -- C:\Genius\ioCentre\gTaskSwitch.exe PRC - [2007-02-26 17:16:30 | 000,188,416 | ---- | M] () -- C:\Genius\ioCentre\gZoom.exe PRC - [2007-02-26 16:56:18 | 000,180,224 | ---- | M] () -- C:\Genius\ioCentre\gAutoPan.exe PRC - [2007-01-19 20:26:14 | 000,045,056 | ---- | M] () -- C:\Genius\ioCentre\gMGlass.exe PRC - [2007-01-19 20:20:52 | 000,049,152 | ---- | M] () -- C:\Genius\ioCentre\gIMMgm.exe PRC - [2007-01-19 20:03:24 | 000,061,440 | ---- | M] () -- C:\Genius\ioCentre\gAutoScroll.exe PRC - [2004-08-23 14:49:56 | 000,040,960 | ---- | M] (France Telecom) -- C:\WINDOWS\system32\FTRTSVC.exe PRC - [2004-07-30 19:50:24 | 000,286,720 | ---- | M] () -- C:\WINDOWS\vsnpstd3.exe PRC - [2003-04-06 02:17:18 | 000,147,456 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe PRC - [2003-04-06 02:06:58 | 000,028,672 | ---- | M] (Hewlett-Packard) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe PRC - [2003-04-06 01:55:04 | 000,311,296 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposts08.exe PRC - [2003-04-06 01:45:10 | 000,286,720 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-06-29 12:06:37 | 000,574,464 | ---- | M] (OldTimer Tools) -- C:\Gry\OTL.exe MOD - [2008-04-14 22:46:34 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Auto | Stopped] -- -- (NMSAccessU) SRV - File not found [On_Demand | Stopped] -- -- (KodakCCS) SRV - [2010-04-07 21:10:38 | 000,033,560 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv) SRV - [2010-04-07 21:07:24 | 000,810,120 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn) SRV - [2009-09-23 14:38:18 | 000,935,208 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe -- (Nero BackItUp Scheduler 4.0) SRV - [2005-11-17 15:18:52 | 001,527,900 | ---- | M] (MAGIX®) [On_Demand | Stopped] -- C:\Program Files\MAGIX\Common\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance) SRV - [2004-08-23 14:49:56 | 000,040,960 | ---- | M] (France Telecom) [Auto | Running] -- C:\WINDOWS\system32\FTRTSVC.exe -- (FTRTSVC) SRV - [2003-04-07 08:21:46 | 000,065,795 | R--- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12) SRV - [2001-10-26 19:30:00 | 000,003,584 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\System32\regedt32.exe -- (NOD32FiXTemDono) SRV - [2001-10-26 19:30:00 | 000,003,584 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\System32\regedt32.exe -- (.EsetTrialReset) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2010-04-07 21:08:08 | 000,055,232 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\epfwtdi.sys -- (epfwtdi) DRV - [2010-04-07 21:08:06 | 000,032,584 | ---- | M] (ESET) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\epfwndis.sys -- (Epfwndis) DRV - [2010-04-07 21:08:04 | 000,134,488 | ---- | M] (ESET) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\epfw.sys -- (epfw) DRV - [2010-04-07 21:07:08 | 000,114,984 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv) DRV - [2010-04-07 21:03:44 | 000,139,192 | ---- | M] (ESET) [File_System | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon) DRV - [2010-01-05 19:30:24 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt) DRV - [2010-01-05 19:30:23 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt) DRV - [2008-12-13 19:51:54 | 000,082,380 | ---- | M] (Oak Technology Inc.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AFS2K.SYS -- (AFS2K) DRV - [2008-05-16 20:31:00 | 006,557,408 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv) DRV - [2008-05-02 08:48:55 | 000,062,208 | ---- | M] (Silicon Image, Inc.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\si3112.sys -- (Si3112) DRV - [2008-04-17 10:33:26 | 004,707,328 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2008-04-13 22:06:06 | 000,144,384 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hdaudbus.sys -- (HDAudBus) DRV - [2008-01-03 16:10:16 | 000,105,856 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp) DRV - [2006-09-19 12:03:28 | 000,116,992 | ---- | M] (Analog Devices Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\e4usbaw.sys -- (e4usbaw) DRV - [2006-09-15 12:07:54 | 000,064,000 | ---- | M] (Analog Deivces) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\e4ldr.sys -- (IKANLOADER2) General Purpose USB Driver (e4ldr.sys) DRV - [2006-08-29 00:54:56 | 000,010,664 | ---- | M] (Applied Networking Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\gan_adapter.sys -- (hamachi_oem) DRV - [2006-07-12 05:48:46 | 000,017,408 | ---- | M] ( Mouse Upfilter Driver ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gMouPS2.sys -- (gMouPS2) DRV - [2006-07-02 00:32:26 | 000,043,520 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8) DRV - [2004-11-25 18:36:06 | 000,077,248 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\prohlp02.sys -- (prohlp02) DRV - [2004-11-25 18:32:01 | 000,054,368 | ---- | M] (Protection Technology) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\prodrv06.sys -- (prodrv06) DRV - [2004-10-29 14:52:48 | 000,413,696 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\snpstd3.sys -- (SNPSTD3) USB PC Camera (SNPSTD3) DRV - [2003-12-01 17:20:52 | 000,004,832 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfhlp01.sys -- (sfhlp01) DRV - [2003-09-06 14:22:08 | 000,006,944 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\prosync1.sys -- (prosync1) DRV - [2003-08-04 14:22:44 | 000,016,128 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\PCANDIS5.SYS -- (PCANDIS5) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;<local> IE - HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=localhost:7171 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKCU\..\URLSearchHook: {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\neostrada tp\SearchPageURL.dll () IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010-06-27 22:09:02 | 000,000,000 | ---D | M] [2010-07-05 22:42:15 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2010-07-05 22:42:15 | 000,000,000 | ---D | M] (Firefox security) -- C:\Program Files\Mozilla Firefox\extensions\{9CE11043-9A15-4207-A565-0C94C42D590D} O1 HOSTS File: ([2010-04-04 22:17:06 | 000,001,223 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 activate.adobe.com O1 - Hosts: 127.0.0.1 serial.alcohol-soft.com O1 - Hosts: 127.0.0.1 www.alcohol-soft.com O1 - Hosts: 127.0.0.1 images.alcohol-soft.com O1 - Hosts: 127.0.0.1 trial.alcohol-soft.com O1 - Hosts: 127.0.0.1 alcohol-soft.com O1 - Hosts: 127.0.0.1 static3.cdn.ubi.com O1 - Hosts: 127.0.0.1 ubisoft-orbit.s3.amazonaws.com O1 - Hosts: 127.0.0.1 onlineconfigservice.ubi.com O1 - Hosts: 127.0.0.1 orbitservice.ubi.com O1 - Hosts: 127.0.0.1 ubisoft-orbit-savegames.s3.amazonaws.com O1 - Hosts: 0.0.0.0 www.metin2.pl O1 - Hosts: 0.0.0.0 metin2.pl O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {5B291E6C-9A74-4034-971B-A4B007A0B313} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {5B291E6C-9A74-4034-971B-A4B007A0B315} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O4 - HKLM..\Run: [Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\Alcmtr.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [DelReg] C:\Program Files\MSI\DualCoreCenter\DelReg.exe () O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET) O4 - HKLM..\Run: [ioCentre] C:\Genius\ioCentre\gTaskBar.exe () O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe () O4 - HKLM..\Run: [TrayServer] C:\Program Files\MAGIX\Movie_Edit_Pro_14_PLUS_Download_version\Trayserver.exe (MAGIX AG) O4 - HKLM..\Run: [WOOWATCH] C:\Program Files\neostrada tp\Watch.exe (France Télécom R&D) O4 - HKCU..\Run: [EA Core] C:\Program Files\Electronic Arts\EADM\Core.exe (Electronic Arts) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\DualCoreCenter.lnk = C:\Program Files\MSI\DualCoreCenter\StartUpDualCoreCenter.exe () O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\hp psc 1000 series.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpohmr08.exe (Hewlett-Packard Co.) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\hpoddt01.exe.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe (Hewlett-Packard) O4 - Startup: C:\Documents and Settings\uzytkownik\Menu Start\Programy\Autostart\Xfire.lnk = C:\Program Files\Xfire\xfire.exe (Xfire Inc.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeAnimation = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStrCmpLogical = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: RTHDBPL = C:\Documents and Settings\uzytkownik\Dane aplikacji\SystemProc\lsass.exe (Mbgjhn) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: MemCheckBoxInRunDlg = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStrCmpLogical = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.) O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {1E53EA77-34F2-474E-9046-B2B0C86F1821} http://www.eska.pl/streamplayers/OggX.ocx (OggX Control) O16 - DPF: {233C1507-6A77-46A4-9443-F871F945D258} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07) O16 - DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_12-windows-i586.cab (Java Plug-in 1.6.0_12) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\uzytkownik\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\uzytkownik\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-07-06 10:44:32 | 000,000,000 | ---D | C] -- C:\_OTL [2010-07-06 10:37:32 | 000,000,000 | --SD | C] -- C:\lol [2010-07-05 22:42:16 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\SystemProc [2010-07-05 22:42:15 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox [2010-07-04 19:27:42 | 000,000,000 | ---D | C] -- C:\Program Files\Farming-Simulator 2009 [2010-07-02 10:36:38 | 000,258,560 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\uzytkownik\Pulpit\OTH.scr [2010-07-01 18:53:34 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2010-07-01 18:53:34 | 000,161,792 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2010-07-01 18:53:34 | 000,136,704 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2010-07-01 18:53:34 | 000,031,232 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2010-07-01 18:53:31 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2010-07-01 18:53:02 | 000,000,000 | ---D | C] -- C:\Qoobox [2010-06-27 22:17:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\ESET [2010-06-27 22:06:22 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2010-06-27 15:30:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\uzytkownik\Pulpit\Inne [2010-06-27 15:30:14 | 000,000,000 | ---D | C] -- C:\Documents and Settings\uzytkownik\Pulpit\Programy [2010-06-27 15:30:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\uzytkownik\Pulpit\Gry [2010-06-27 14:26:59 | 000,000,000 | ---D | C] -- C:\Program Files\S [2010-06-24 11:41:34 | 000,000,000 | ---D | C] -- C:\Program Files\Juz w szkole klasa 3a [2010-06-24 11:41:14 | 000,327,168 | ---- | C] (InstallShield Software Corporation) -- C:\WINDOWS\IsUn0415.exe [2010-06-18 14:28:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\uzytkownik\Dane aplikacji\Ubisoft [2010-06-18 14:28:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft [2009-03-08 12:35:06 | 000,061,440 | ---- | C] ( ) -- C:\WINDOWS\System32\csnpstd3.dll [2009-03-08 12:35:06 | 000,057,344 | ---- | C] ( ) -- C:\WINDOWS\System32\rsnpstd3.dll [2009-03-08 12:35:06 | 000,036,864 | ---- | C] ( ) -- C:\WINDOWS\System32\vsnpstd3.dll [8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-07-06 10:49:33 | 000,186,500 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml [2010-07-06 10:45:35 | 009,175,040 | -H-- | M] () -- C:\Documents and Settings\uzytkownik\NTUSER.DAT [2010-07-06 08:43:48 | 000,000,292 | -HS- | M] () -- C:\Documents and Settings\uzytkownik\ntuser.ini [2010-07-06 00:00:56 | 015,525,102 | -H-- | M] () -- C:\Documents and Settings\uzytkownik\Ustawienia lokalne\Dane aplikacji\IconCache.db [2010-07-05 23:59:33 | 003,726,382 | R--- | M] () -- C:\Documents and Settings\uzytkownik\Pulpit\lol.exe [2010-07-02 10:41:45 | 000,116,224 | RHS- | M] () -- C:\rxf.exe [2010-07-02 10:36:39 | 000,258,560 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\uzytkownik\Pulpit\OTH.scr [2010-06-30 22:38:37 | 2145,386,496 | ---- | M] () -- C:\WINDOWS\MEMORY.DMP [2010-06-27 16:23:53 | 000,281,336 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2010-06-27 15:29:53 | 000,079,152 | ---- | M] () -- C:\Documents and Settings\uzytkownik\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT [2010-06-27 15:29:45 | 000,054,156 | -H-- | M] () -- C:\WINDOWS\QTFont.qfn [2010-06-27 15:29:45 | 000,001,409 | ---- | M] () -- C:\WINDOWS\QTFont.for [2010-06-27 11:40:00 | 000,000,004 | ---- | M] () -- C:\WINDOWS\Twain001.Mtx [2010-06-27 11:39:08 | 000,132,608 | ---- | M] () -- C:\Documents and Settings\uzytkownik\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010-06-25 23:43:12 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\uzytkownik\Menu Start\Programy\Autostart\Xfire.lnk [2010-06-24 11:38:49 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010-06-07 20:33:38 | 000,000,523 | ---- | M] () -- C:\hpfr3420.xml [8 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-07-02 10:42:12 | 000,116,224 | RHS- | C] () -- C:\rxf.exe [2010-07-01 18:53:34 | 000,256,512 | ---- | C] () -- C:\WINDOWS\PEV.exe [2010-07-01 18:53:34 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2010-07-01 18:53:34 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2010-07-01 18:53:34 | 000,077,312 | ---- | C] () -- C:\WINDOWS\MBR.exe [2010-07-01 18:53:34 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2010-07-01 15:16:20 | 003,726,382 | R--- | C] () -- C:\Documents and Settings\uzytkownik\Pulpit\lol.exe [2010-06-28 18:16:00 | 000,126,976 | RHS- | C] () -- C:\wyskq6lt.exe [2010-06-27 15:29:45 | 000,054,156 | -H-- | C] () -- C:\WINDOWS\QTFont.qfn [2010-06-27 15:29:45 | 000,001,409 | ---- | C] () -- C:\WINDOWS\QTFont.for [2010-06-25 23:43:12 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\uzytkownik\Menu Start\Programy\Autostart\Xfire.lnk [2010-06-17 20:48:23 | 000,076,407 | ---- | C] () -- C:\Documents and Settings\uzytkownik\Dane aplikacji\Smiley.ico [2010-05-28 02:09:00 | 000,041,872 | ---- | C] () -- C:\WINDOWS\System32\xfcodec.dll [2010-05-10 11:40:50 | 000,000,060 | ---- | C] () -- C:\WINDOWS\wininit.ini [2010-02-10 19:52:13 | 000,120,200 | ---- | C] () -- C:\WINDOWS\System32\DLLDEV32i.dll [2010-02-10 19:51:57 | 000,005,937 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini [2010-02-09 20:05:14 | 000,000,000 | ---- | C] () -- C:\WINDOWS\msicpl.ini [2010-01-05 19:30:24 | 000,281,760 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys [2010-01-05 19:30:23 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys [2009-12-18 14:04:21 | 000,069,632 | R--- | C] () -- C:\WINDOWS\System32\xmltok.dll [2009-12-18 14:04:21 | 000,036,864 | R--- | C] () -- C:\WINDOWS\System32\xmlparse.dll [2009-11-21 17:03:03 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009-11-04 09:20:52 | 000,139,128 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2009-07-14 18:15:00 | 000,178,432 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat [2009-03-08 12:35:07 | 000,413,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\snpstd3.sys [2009-03-08 12:35:07 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\dsnpstd3.dll [2009-03-08 12:35:07 | 000,015,498 | ---- | C] () -- C:\WINDOWS\snpstd3.ini [2009-02-01 14:32:25 | 000,126,976 | ---- | C] () -- C:\WINDOWS\System32\coclassfast.dll [2009-02-01 14:32:24 | 000,046,892 | ---- | C] () -- C:\WINDOWS\System32\ADADIX16.DLL [2009-01-15 18:58:18 | 000,354,816 | ---- | C] () -- C:\WINDOWS\System32\psisdecd.dll [2008-12-13 20:14:12 | 000,000,091 | ---- | C] () -- C:\WINDOWS\System32\logon.ini [2008-12-13 19:47:58 | 000,561,152 | R--- | C] () -- C:\WINDOWS\System32\hpotscl.dll [2008-12-12 22:18:09 | 000,131,072 | R--- | C] () -- C:\WINDOWS\System32\smdll.dll [2008-12-12 22:18:07 | 000,262,144 | R--- | C] () -- C:\WINDOWS\System32\HookShield.dll [2008-12-12 22:18:07 | 000,258,048 | R--- | C] () -- C:\WINDOWS\System32\HookMAp.dll [2008-12-12 22:18:07 | 000,032,768 | R--- | C] () -- C:\WINDOWS\System32\Auxiliary.dll [2008-05-16 20:31:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2008-05-16 20:31:00 | 001,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2008-05-16 20:31:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2008-05-16 20:31:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2008-05-16 20:31:00 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2008-05-03 09:24:01 | 000,000,082 | ---- | C] () -- C:\WINDOWS\System32\oeminfo.ini [2005-01-14 03:49:01 | 000,014,848 | ---- | C] () -- C:\WINDOWS\System32\gxLame.dll [2004-09-27 20:19:04 | 000,371,200 | ---- | C] () -- C:\WINDOWS\System32\tvqdec.dll [2004-09-24 23:10:25 | 000,045,960 | ---- | C] () -- C:\WINDOWS\System32\bass_ape.dll [2004-09-22 14:53:38 | 000,028,032 | ---- | C] () -- C:\WINDOWS\System32\bass_wv.dll [2004-09-18 10:00:24 | 000,007,048 | ---- | C] () -- C:\WINDOWS\System32\bass_ofr.dll [2004-07-28 00:31:00 | 000,051,200 | ---- | C] () -- C:\WINDOWS\System32\bass_winamp.dll [2004-07-14 18:35:00 | 000,052,224 | ---- | C] () -- C:\WINDOWS\System32\bass_vis.dll [2004-03-05 12:39:48 | 000,073,728 | ---- | C] () -- C:\WINDOWS\System32\unacev2.dll [2004-01-12 17:22:00 | 000,074,244 | ---- | C] () -- C:\WINDOWS\System32\gxDBEngine2.DLL [2003-08-10 00:00:00 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\bass_fx.dll [2003-04-08 12:40:22 | 000,005,679 | ---- | C] () -- C:\WINDOWS\System32\OUTLPERF.INI < End of report >

**Posty:** 2183 · przez **NieWiem** 06 Lip 2010, 14:18

djkamil09061991, skrypt niepełny, tutaj jest trochę więcej świństwa niż pozostałości do których się przymierzasz.

warek1234, nie wykonuj tego, zaraz dam Ci kompletną instrukcję.

Dodano Dzisiaj, 14:24:
warek1234,

= = = = = O T L = = = = =

Uruchom OTL

W oknie na dole wklej:

Kod: Zaznacz wszystko: :processes killallprocesses :services NMSAccessU KodakCCS :files C:\Documents and Settings\uzytkownik\Dane aplikacji\SystemProc /D :otl O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/polarbear/ultrashim.cab (Reg Error: Key error.) [2010-07-02 10:41:45 | 000,116,224 | RHS- | M] () -- C:\rxf.exe [2010-06-28 18:16:00 | 000,126,976 | RHS- | C] () -- C:\wyskq6lt.exe :reg :commands [purity] [emptytemp] [emptyflash] [clearallrestorepoints]

Wciśnij Run Fix (Wykonaj skrypt) i zatwierdź restart

Do wglądu raport z czyszczenia i nowy log z OTL, ale zanim go zrobisz w oknie na dole wklej

C:\*
D:\*

**Posty:** 16 · przez **warek1234** 06 Lip 2010, 19:38

dobra ok ale jak ten raport z czycsz czenia zrobić

Dodano Dzisiaj, 20:01:
"

Kod: Zaznacz wszystko: AntiVirusOverride" = 0 "FirewallOverride" = 0 "UpdatesDisableNotify" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DoNotAllowExceptions" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DoNotAllowExceptions" = 0 "EnableFirewall" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "80:TCP" = 80:TCP:*:Enabled:mon32 "7171:TCP" = 7171:TCP:*:Enabled:mon32 "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008 [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe" = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare -- (Eastman Kodak Company) "C:\Gry\Warrior Ten Hammers\fsw2.exe" = C:\Gry\Warrior Ten Hammers\fsw2.exe:*:Disabled:"Full Spectrum Warrrior 2: Ten Hammers" Game -- File not found "C:\Gry\Capcom\MotoGP 08 Demo\MotoGP 08\Launcher.exe" = C:\Gry\Capcom\MotoGP 08 Demo\MotoGP 08\Launcher.exe:*:Enabled:MotoGP 08 -- File not found "C:\Gry\Railroad Tycoon 3\rt3.exe" = C:\Gry\Railroad Tycoon 3\rt3.exe:*:Disabled:Railroad Tycoon 3 -- File not found "C:\Program Files\BearShare Applications\BearShare\BearShare.exe" = C:\Program Files\BearShare Applications\BearShare\BearShare.exe:*:Enabled:BearShare -- File not found "C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.) "C:\Gry\WORMS 3D\Worms3D.exe" = C:\Gry\WORMS 3D\Worms3D.exe:*:Enabled:Worms3D -- File not found "C:\Program Files\Nowe Gadu-Gadu\gg.exe" = C:\Program Files\Nowe Gadu-Gadu\gg.exe:*:Enabled:Nowe Gadu-Gadu -- File not found "C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe" = [String data over 1000 bytes] "C:\Gry\Tlen\Tlen.pl\tlen.exe" = C:\Gry\Tlen\Tlen.pl\tlen.exe:*:Enabled:Komunikator Tlen.pl -- File not found "C:\Gry\Kozacy II\Data\engine.exe" = C:\Gry\Kozacy II\Data\engine.exe:*:Enabled:Cossacks 2: Napoleonic Wars -- File not found "C:\Program Files\Electronic Arts\EADM\Core.exe" = C:\Program Files\Electronic Arts\EADM\Core.exe:*:Enabled:EA Download Manager -- (Electronic Arts) "C:\Gry\DreamCatcher\Painkiller Czarna Edycja\Bin\Editor\PainEditor.exe" = C:\Gry\DreamCatcher\Painkiller Czarna Edycja\Bin\Editor\PainEditor.exe:*:Disabled:Painkiller -- File not found "C:\Gry\GSC Game World\Kozacy II\Data\engine.exe" = C:\Gry\GSC Game World\Kozacy II\Data\engine.exe:*:Enabled:Cossacks 2: Napoleonic Wars -- File not found "C:\Program Files\THQ\MX vs ATV Unleashed\MXvsATV.exe" = C:\Program Files\THQ\MX vs ATV Unleashed\MXvsATV.exe:*:Disabled:MXvsATV -- File not found "C:\Program Files\Ubisoft\XIII\system\XIII.exe" = C:\Program Files\Ubisoft\XIII\system\XIII.exe:*:Disabled:XIII -- File not found "C:\Program Files\Warcraft III\Warcraft III.exe" = C:\Program Files\Warcraft III\Warcraft III.exe:*:Disabled:Warcraft III -- File not found "C:\Gry\Postal 2 STP\System\Postal2.exe" = C:\Gry\Postal 2 STP\System\Postal2.exe:*:Enabled:Postal2 -- File not found "C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.) "C:\Program Files\WnP\GameMp.exe" = C:\Program Files\WnP\GameMp.exe:*:Disabled:Cultures -- File not found "C:\Program Files\Xfire\Xfire.exe" = C:\Program Files\Xfire\Xfire.exe:*:Disabled:Xfire -- (Xfire Inc.) "C:\Program Files\Counter-Strike\hl.exe" = C:\Program Files\Counter-Strike\hl.exe:*:Enabled:Half-Life Launcher -- File not found "C:\Program Files\Sierra\Empire Earth II\EE2.exe" = C:\Program Files\Sierra\Empire Earth II\EE2.exe:*:Enabled:Empire Earth II -- File not found "C:\Program Files\BitTorrent\bittorrent.exe" = C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent -- File not found "C:\Program Files\Steam\Steam.exe" = C:\Program Files\Steam\Steam.exe:*:Enabled:Steam -- File not found "C:\Program Files\Firefly Studios\Stronghold 2\Stronghold2.exe" = C:\Program Files\Firefly Studios\Stronghold 2\Stronghold2.exe:*:Enabled:Stronghold 2 -- File not found "C:\Program Files\Pinnacle\VideoSpin\Programs\RM.exe" = C:\Program Files\Pinnacle\VideoSpin\Programs\RM.exe:*:Enabled:Render Manager -- File not found "C:\Program Files\Pinnacle\VideoSpin\Programs\umi.exe" = C:\Program Files\Pinnacle\VideoSpin\Programs\umi.exe:*:Enabled:umi -- File not found "C:\Program Files\Pinnacle\VideoSpin\Programs\VideoSpin.exe" = C:\Program Files\Pinnacle\VideoSpin\Programs\VideoSpin.exe:*:Enabled:Pinnacle VideoSpin -- File not found "C:\Program Files\Electronic Arts\Battlefield Bad Company 2\BFBC2Updater.exe" = C:\Program Files\Electronic Arts\Battlefield Bad Company 2\BFBC2Updater.exe:*:Enabled:Battlefield: Bad Company™ 2 -- File not found "C:\Program Files\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe" = C:\Program Files\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe:*:Enabled:Ubisoft Game Launcher -- (Ubisoft) "C:\Program Files\Ubisoft\Assassin's Creed II\AssassinsCreedIIGame.exe" = C:\Program Files\Ubisoft\Assassin's Creed II\AssassinsCreedIIGame.exe:*:Enabled:Assassin's Creed II -- () "C:\Program Files\Ubisoft\Assassin's Creed II\AssassinsCreedII.exe" = C:\Program Files\Ubisoft\Assassin's Creed II\AssassinsCreedII.exe:*:Enabled:Assassin's Creed II Update -- (Ubisoft) "C:\Program Files\Ubisoft\Assassin's Creed II\UPlayBrowser.exe" = C:\Program Files\Ubisoft\Assassin's Creed II\UPlayBrowser.exe:*:Enabled:Assassin's Creed II Uplay -- (Ubisoft Entertainment) [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{02627ee5-eaca-4742-a9cc-e687631773e4}" = Nero ShowTime "{03EDED24-8375-407D-A721-4643D9768BE1}" = kgchlwn "{073F22CE-9A5B-4A40-A604-C7270AC6BF34}" = ESSSONIC "{086a7d8c-0a38-4c7f-819a-620275550d5c}" = Nero Burning ROM Help "{0EDD2971-E213-44B8-8329-ABF1FB1433B9}" = THE SETTLERS - Heritage of Kings Demo "{11F3F858-4131-4FFA-A560-3FE282933B6E}" = kgchday "{14D4ED84-6A9A-45A0-96F6-1753768C3CB5}" = ESSPCD "{1c00c7c5-e615-4139-b817-7f4003de68c0}" = Nero PhotoSnap Help "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{20400dbd-e6db-45b8-9b6b-1dd7033818ec}" = Nero InfoTool "{2348b586-c9ae-46ce-936c-a68e9426e214}" = Nero StartSmart Help "{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0 "{26A24AE4-039D-4CA4-87B4-2F83216012FF}" = Java(TM) 6 Update 12 "{2D03B6F8-DF36-4980-B7B6-5B93D5BA3A8F}" = essvatgt "{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7 "{33CF58F5-48D8-4575-83D6-96F574E4D83A}" = Nero DriveSpeed "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{359CFC0A-BEB1-440D-95BA-CF63A86DA34F}" = Nero Recode "{368BA326-73AD-4351-84ED-3C0A7A52CC53}" = Nero Rescue Agent "{42938595-0D83-404D-9F73-F8177FDD531A}" = ESScore "{43E39830-1826-415D-8BAE-86845787B54B}" = Nero Vision "{4537EA4B-F603-4181-89FB-2953FC695AB1}" = netbrdg "{4AE3A0CB-87B0-4F51-BECD-3D1F8DFDD62F}" = SAGEM F@st 800-840 "{4DFF1415-4C29-44A8-BFD4-2BCE249C4991}" = SpPhones "{5316DFC9-CE99-4458-9AB3-E8726EDE0210}" = skin0001 "{54194F60-988C-4D03-B922-C2B00EFDA39A}" = NVIDIA PhysX "{560F47F7-EB23-44B1-AAFC-667F1CD8FE5C}" = Sp5 "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml "{595A3116-40BB-4E0F-A2E8-D7951DA56270}" = NeroExpress "{5d9be3c1-8ba4-4e7e-82fd-9f74fa6815d1}" = Nero Vision "{5e08ecd1-c98e-4711-bf65-8fd736b3f969}" = Nero RescueAgent Help "{605A4E39-613C-4A12-B56F-DEFBE6757237}" = SHASTA "{608D2A3C-6889-4C11-9B54-A42F45ACBFDB}" = fflink "{60c731fb-c951-41ce-ad41-8e54c8594609}" = Nero Disc Copy Gadget Help "{62AC81F6-BDD3-4110-9D36-3E9EAAB40999}" = Nero CoverDesigner "{643EAE81-920C-4931-9F0B-4B343B225CA6}" = ESSBrwr "{693C08A7-9E76-43FF-B11E-9A58175474C4}" = kgckids "{6C3959C6-943E-44B3-BAAD-570B04B134E5}" = SpCommon "{6ECB39BD-73C2-44DD-B1A0-898207C58D8B}" = Nawigator obrazów i fotografii HP 2.0 - All-in-One Series Sterowniki "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{7748AC8C-18E3-43BB-959B-088FAEA16FB2}" = Nero StartSmart "{77e33d87-255e-413e-9c8d-eed2a7f9bebf}" = Nero Live Help "{7829DB6F-A066-4E40-8912-CB07887C20BB}" = Nero BurnRights "{7AC15160-A49B-4A89-B181-D4619C025FFF}" = Samsung Samples Installer "{83202942-84b3-4c50-8622-b8c0aa2d2885}" = Nero Express Help "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{85243696-5e58-4357-9cf8-3498c609941d}" = NeroLiveGadget Help "{8570BEE8-0CA3-4977-9AB1-80ED93F0513C}" = Assassin's Creed II "{869200DB-287A-4DC0-B02B-2B6787FBCD4C}" = Nero DiscSpeed "{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher "{8943CE61-53BD-475E-90E1-A580869E98A2}" = staticcr "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8A502E38-29C9-49FA-BCFA-D727CA062589}" = ESSTOOLS "{8A8664E1-84C8-4936-891C-BC1F07797549}" = kgcvday "{8E92D746-CD9F-4B90-9668-42B74C14F765}" = ESSini "{90110415-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003 "{910F4A29-1134-49E0-AD8B-56E4A3152BD1}" = The Sims™ 3 Kariera "{91517631-A9F3-4B7C-B482-43E0068FD55A}" = ESSgui "{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC}" = QuickTime "{9867A917-5D17-40DE-83BA-BEA5293194B1}" = Nawigator obrazów i fotografii HP 2.0 - All-in-One "{98a67610-a3b5-4098-a423-3708040026d3}" = "Nero SoundTrax Help "{999D43F4-9709-4887-9B1A-83EBB15A8370}" = VPRINTOL "{9BD54685-1496-46A5-AB62-357CD140ED8B}" = kgcinvt "{9E82B934-9A25-445B-B8DF-8012808074AC}" = Nero PhotoSnap "{9e9fdde6-2c26-492a-85a0-05646b3f2795}" = NeroLiveGadget "{A1588373-1D86-4D44-86C9-78ABD190F9CC}" = kgcmove "{A209525B-3377-43F4-B886-32F6B6E7356F}" = Nero WaveEditor "{A2B4621B-CEB9-4E44-95FD-3500D4DB3727}" = ioCentre "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2 "{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress "{AC76BA86-7AD7-1045-7B44-A81200000003}" = Adobe Reader 8 - Polish "{ad6bc5cc-2ef0-49c4-b33d-cdc8b2c4dc80}" = Nero Recode Help "{AE1FA02D-E6A4-4EA0-8E58-6483CAC016DD}" = ESSCDBK "{B162D0A6-9A1D-4B7C-91A5-88FB48113C45}" = OfotoXMI "{B1ADF008-E898-4FE2-8A1F-690D9A06ACAF}" = DolbyFiles "{B2EC4A38-B545-4A00-8214-13FE0E915E6D}" = Advertising Center "{B376402D-58EA-45EA-BD50-DD924EB67A70}" = Dysk wspomnieniowy HP "{B45FABE7-D101-4D99-A671-E16DA40AF7F0}" = Microsoft Games for Windows - LIVE "{B4B44FE7-41FF-4DAD-8C0A-E406DDA72992}" = CCScore "{B578C85A-A84C-4230-A177-C5B2AF565B8C}" = Microsoft Games for Windows - LIVE Redistributable "{B78120A0-CF84-4366-A393-4D0A59BC546C}" = Menu Templates - Starter Kit "{BD5CA0DA-71AD-43DA-B19E-6EEE0C9ADC9A}" = Nero ControlCenter "{bdceaead-9511-4bfe-9ac5-242207e70b3c}" = Nero 9 Trial "{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = The Sims™ 3 "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2 "{C151CE54-E7EA-4804-854B-F515368B0798}" = AMD Processor Driver "{C5A7CB6C-E76D-408F-BA0E-85605420FE9D}" = SoundTrax "{C900EF06-2E76-49C7-8DB0-41F629B21DC5}" = hp psc 1200 series "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{cc019e3f-59d2-4486-8d4b-878105b62a71}" = Nero DiscSpeed "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{ce96f5a5-584d-4f8f-aa3e-9baed413db72}" = Nero CoverDesigner Help "{D025A639-B9C9-417D-8531-208859000AF8}" = NeroBurningROM "{D32470A1-B10C-4059-BA53-CF0486F68EBC}" = Oprogramowanie Kodak EasyShare "{D9DCF92E-72EB-412D-AC71-3B01276E5F8B}" = Nero ShowTime "{DB02F716-6275-42E9-B8D2-83BA2BF5100B}" = SFR "{df6a95f5-adc1-406a-bdc6-2aa7cc0182aa}" = Nero Live "{E18B549C-5D15-45DA-8D8F-8FD2BD946344}" = kgcbaby "{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime "{E415C943-37E5-473F-8BAE-043C56734124}" = Sp5TTInt "{E498385E-1C51-459A-B45F-1721E37AA1A0}" = Movie Templates - Starter Kit "{e5c7d048-f9b4-4219-b323-8bdb01a2563d}" = Nero DriveSpeed "{E79987F0-0E34-42CC-B8FF-6C860AEEB26A}" = tooltips "{e8631efb-6b9a-426c-b1ce-e7173ca26bf8}" = Nero WaveEditor Help "{E8A80433-302B-4FF1-815D-FCC8EAC482FF}" = Nero Installer "{ECD03DA7-5952-406A-8156-5F0C93618D1F}" = USB PC CAM-168 "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F22C222C-3CE2-4A4B-A83F-AF4681371ABE}" = kgcbase "{f4041dce-3fe1-4e18-8a9e-9de65231ee36}" = Nero ControlCenter "{F4A2E7CC-60CA-4AFA-B67F-AD5E58173C3F}" = SKINXSDK "{f6bdd7c5-89ed-4569-9318-469aa9732572}" = Nero BurnRights "{F9593CFB-D836-49BC-BFF1-0E669A411D9F}" = WIRELESS "{FBCDFD61-7DCF-4E71-9226-873BA0053139}" = Nero InfoTool "{FCDB1C92-03C6-4C76-8625-371224256091}" = ESSPDock "{FD4B33E1-24AE-4535-AA7B-162B30FB57CD}" = Sp5Intl "{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 "{FFAB5ABB-8AAB-42E2-847F-1743E51E01E9}" = Disc2Phone "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe Shockwave Player" = Adobe Shockwave Player 11.5 "ALZip_is1" = ALZip "Assassin's Creed Loader by Kurak" = Assassin's Creed Loader by Kurak "DualCoreCenter_is1" = DualCoreCenter "EADM" = EA Download Manager "FarmingSimulator2009PL_is1" = Symulator-Farmy 2009 "Firebird SQL Server US" = Firebird SQL Server - MAGIX Edition "Gadu-Gadu 10" = Gadu-Gadu 10 "HP PSC 1200 Series" = Nawigator obrazów i fotografii HP 2.0 - hp psc 1200 series "InstallShield_{E03B44A3-9237-4B55-B7A5-DB1DD46920D3}" = Wolfenstein(TM) 1.1 Patch "Już w szkole, klasa 3, semestr 1" = Już w szkole, klasa 3, semestr 1 "MAGIX Movie Edit Pro 14 PLUS Trial US" = MAGIX Movie Edit Pro 14 PLUS Trial 7.5.2.12 (US) "MAGIX Screenshare US" = MAGIX Screenshare 4.3.6.1987 (US) "MAGIX Xtreme Photo Designer 6 US" = MAGIX Xtreme Photo Designer 6 6.0.24.0 (US) "Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware "Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1 "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "neostradatp.exe" = neostrada tp "NVIDIA Drivers" = NVIDIA Drivers "PunkBusterSvc" = PunkBuster Services "RealAlt_is1" = Real Alternative 1.8.0 "SubEdit-Player_is1" = SubEdit-Player "The KMPlayer" = The KMPlayer (remove only) "Usbfix" = Usbfix By C_XX & El Desaparecido "WinRAR archiver" = Archiwizator WinRAR "Xfire" = Xfire (remove only) [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-21-1343024091-963894560-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "uTorrent" = µTorrent [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Application Events ] Error - 2010-04-21 05:51:46 | Computer Name = XP-SPECIAL | Source = EventSystem | ID = 4609 Description = Podczas wewnętrznego przetwarzania system zdarzeń modelu COM+ wykrył zły kod powrotu. HRESULT to 80070422 z w wierszu 44 z f:\xpsp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Skontaktuj się z Pomocą techniczną firmy Microsoft i zgłoś ten błą Error - 2010-04-21 09:20:20 | Computer Name = XP-SPECIAL | Source = EventSystem | ID = 4609 Description = Podczas wewnętrznego przetwarzania system zdarzeń modelu COM+ wykrył zły kod powrotu. HRESULT to 80070422 z w wierszu 44 z f:\xpsp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Skontaktuj się z Pomocą techniczną firmy Microsoft i zgłoś ten błą Error - 2010-04-21 09:28:55 | Computer Name = XP-SPECIAL | Source = EventSystem | ID = 4609 Description = Podczas wewnętrznego przetwarzania system zdarzeń modelu COM+ wykrył zły kod powrotu. HRESULT to 80070422 z w wierszu 44 z f:\xpsp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Skontaktuj się z Pomocą techniczną firmy Microsoft i zgłoś ten błą Error - 2010-04-21 09:31:14 | Computer Name = XP-SPECIAL | Source = EventSystem | ID = 4609 Description = Podczas wewnętrznego przetwarzania system zdarzeń modelu COM+ wykrył zły kod powrotu. HRESULT to 80070422 z w wierszu 44 z f:\xpsp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Skontaktuj się z Pomocą techniczną firmy Microsoft i zgłoś ten błą Error - 2010-04-21 10:23:55 | Computer Name = XP-SPECIAL | Source = EventSystem | ID = 4609 Description = Podczas wewnętrznego przetwarzania system zdarzeń modelu COM+ wykrył zły kod powrotu. HRESULT to 80070422 z w wierszu 44 z f:\xpsp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Skontaktuj się z Pomocą techniczną firmy Microsoft i zgłoś ten błą Error - 2010-04-21 16:51:16 | Computer Name = XP-SPECIAL | Source = EventSystem | ID = 4609 Description = Podczas wewnętrznego przetwarzania system zdarzeń modelu COM+ wykrył zły kod powrotu. HRESULT to 80070422 z w wierszu 44 z f:\xpsp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Skontaktuj się z Pomocą techniczną firmy Microsoft i zgłoś ten błą Error - 2010-04-22 06:52:50 | Computer Name = XP-SPECIAL | Source = EventSystem | ID = 4609 Description = Podczas wewnętrznego przetwarzania system zdarzeń modelu COM+ wykrył zły kod powrotu. HRESULT to 80070422 z w wierszu 44 z f:\xpsp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Skontaktuj się z Pomocą techniczną firmy Microsoft i zgłoś ten błą Error - 2010-04-22 06:52:50 | Computer Name = XP-SPECIAL | Source = VSS | ID = 8193 Description = Błąd Usługi kopiowania woluminów w tle: nieoczekiwany błąd podczas wywoływania procedury CoCreateInstance. hr = 0x80040206. Error - 2010-04-22 06:53:57 | Computer Name = XP-SPECIAL | Source = EventSystem | ID = 4609 Description = Podczas wewnętrznego przetwarzania system zdarzeń modelu COM+ wykrył zły kod powrotu. HRESULT to 80070422 z w wierszu 44 z f:\xpsp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Skontaktuj się z Pomocą techniczną firmy Microsoft i zgłoś ten błą Error - 2010-04-22 07:01:11 | Computer Name = XP-SPECIAL | Source = EventSystem | ID = 4609 Description = Podczas wewnętrznego przetwarzania system zdarzeń modelu COM+ wykrył zły kod powrotu. HRESULT to 80070422 z w wierszu 44 z f:\xpsp3\com\com1x\src\events\tier1\eventsystemobj.cpp. Skontaktuj się z Pomocą techniczną firmy Microsoft i zgłoś ten błą [ System Events ] Error - 2010-07-06 13:50:07 | Computer Name = XP-SPECIAL | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą Eset Trial Reset. Error - 2010-07-06 13:50:07 | Computer Name = XP-SPECIAL | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Eset Trial Reset z powodu następującego błędu: %%1053 Error - 2010-07-06 13:50:07 | Computer Name = XP-SPECIAL | Source = Service Control Manager | ID = 7001 Description = Usługa Zawiadomienie o zdarzeniu systemowym zależy od usługi System zdarzeń COM+, której nie można uruchomić z powodu następującego błędu: %%1058 Error - 2010-07-06 13:53:02 | Computer Name = XP-SPECIAL | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd „%1058” podczas próby uruchomienia usługi EventSystem z argumentami „” w celu uruchomienia serwera: {1BE1F766-5536-11D1-B726-00C04FB926AF} Error - 2010-07-06 13:54:45 | Computer Name = XP-SPECIAL | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd „%1058” podczas próby uruchomienia usługi EventSystem z argumentami „” w celu uruchomienia serwera: {1BE1F766-5536-11D1-B726-00C04FB926AF} Error - 2010-07-06 13:54:54 | Computer Name = XP-SPECIAL | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd „%1058” podczas próby uruchomienia usługi EventSystem z argumentami „” w celu uruchomienia serwera: {1BE1F766-5536-11D1-B726-00C04FB926AF} Error - 2010-07-06 13:54:58 | Computer Name = XP-SPECIAL | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi General Purpose USB Driver (e4ldr.sys) z powodu następującego błędu: %%1058 Error - 2010-07-06 13:54:58 | Computer Name = XP-SPECIAL | Source = Service Control Manager | ID = 7009 Description = Limit czasu (30000 milisekund) podczas oczekiwania na połączenie się z usługą Eset Trial Reset. Error - 2010-07-06 13:54:58 | Computer Name = XP-SPECIAL | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Eset Trial Reset z powodu następującego błędu: %%1053 Error - 2010-07-06 13:54:58 | Computer Name = XP-SPECIAL | Source = Service Control Manager | ID = 7001 Description = Usługa Zawiadomienie o zdarzeniu systemowym zależy od usługi System zdarzeń COM+, której nie można uruchomić z powodu następującego błędu: %%1058 < End of report >

Dodano Dzisiaj, 20:05:
nowy log otl
http://www.wklej.org/id/361139/

**Posty:** 2183 · przez **NieWiem** 06 Lip 2010, 22:56

Idź do folderu c:\_OTL\MovedFiles, wyszukaj tam plik najpóźniej utworzony. To powinien być ten raport. Przeklej mi go.

Potem

= = = = = O T L = = = = =

Uruchom OTL

W oknie na dole wklej:

Kod: Zaznacz wszystko: :processes killallprocesses :OTL O3 - HKU\S-1-5-21-1343024091-963894560-682003330-1003\..\Toolbar\WebBrowser: (no name) - {5B291E6C-9A74-4034-971B-A4B007A0B313} - No CLSID value found. O3 - HKU\S-1-5-21-1343024091-963894560-682003330-1003\..\Toolbar\WebBrowser: (no name) - {5B291E6C-9A74-4034-971B-A4B007A0B315} - No CLSID value found. O3 - HKU\S-1-5-21-1343024091-963894560-682003330-1003\..\Toolbar\WebBrowser: (no name) - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - No CLSID value found. O3 - HKU\S-1-5-21-1343024091-963894560-682003330-1003\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run: RTHDBPL = C:\Documents and Settings\uzytkownik\Dane aplikacji\SystemProc\lsass.exe File not found O33 - MountPoints2\{a81ff031-eeea-11dd-9b11-0021856eaeca}\Shell\AutoRun\command - "" = J:\qhbfqx.exe -- File not found O33 - MountPoints2\{a81ff031-eeea-11dd-9b11-0021856eaeca}\Shell\open\Command - "" = J:\qhbfqx.exe -- File not found [2010-07-01 15:16:20 | 003,726,382 | R--- | C] () -- C:\Documents and Settings\uzytkownik\Pulpit\lol.exe [2009-02-02 13:29:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\3536B [2010-05-08 07:50:37 | 000,111,616 | RHS- | M] () -- C:\i8ikdjwt.exe [2010-04-02 20:53:07 | 000,000,109 | ---- | M] () -- C:\mbam-error.txt [2010-03-29 08:36:46 | 000,132,608 | RHS- | M] () -- C:\mi9al8rs.exe [2010-05-17 19:46:12 | 000,112,640 | RHS- | M] () -- C:\p6xebrnt.exe [2010-05-15 09:35:31 | 000,112,640 | RHS- | M] () -- C:\p9rs.exe [2010-05-22 00:51:37 | 000,114,688 | RHS- | M] () -- C:\q0wfr.exe [2010-04-19 20:38:23 | 000,128,512 | RHS- | M] () -- C:\r3fhr.exe [2010-04-23 23:07:05 | 000,128,000 | RHS- | M] () -- C:\twhvna.exe [2010-07-06 11:10:45 | 000,011,477 | ---- | M] () -- C:\UsbFix.txt [2010-04-22 12:54:20 | 000,128,512 | RHS- | M] () -- C:\vgyn6ewc.exe [2010-05-27 14:04:07 | 000,114,176 | RHS- | M] () -- C:\wa.exe [2010-05-05 07:44:31 | 000,111,616 | RHS- | M] () -- D:\1thes92p.exe [2010-03-14 14:10:33 | 000,116,736 | RHS- | M] () -- D:\3dcs9.exe [2010-02-11 14:52:25 | 000,091,648 | RHS- | M] () -- D:\9qqigqwf.exe [2010-05-10 11:35:18 | 000,111,616 | RHS- | M] () -- D:\9rfpp.exe [2010-03-27 12:32:39 | 000,132,608 | RHS- | M] () -- D:\affi8l.exe [2010-01-01 13:06:35 | 000,109,568 | RHS- | M] () -- D:\anoataly.exe [2010-03-24 20:45:59 | 000,125,440 | RHS- | M] () -- D:\bbjl2g.exe [2010-05-28 17:46:02 | 000,114,688 | RHS- | M] () -- D:\bu8.exe [2010-05-01 09:09:34 | 000,110,592 | RHS- | M] () -- D:\ca.exe [2010-05-08 07:50:37 | 000,111,616 | RHS- | M] () -- D:\i8ikdjwt.exe [2010-03-23 15:07:03 | 000,121,344 | RHS- | M] () -- D:\ji83j.exe [2010-01-14 18:24:30 | 000,116,736 | RHS- | M] () -- D:\kmj.exe [2010-04-18 11:56:33 | 000,127,488 | RHS- | M] () -- D:\lhhr8.exe [2009-12-01 20:48:44 | 000,115,905 | RHS- | M] () -- D:\mbdm.exe [2010-01-17 10:08:58 | 000,118,784 | RHS- | M] () -- D:\mh.exe [2010-03-29 08:36:46 | 000,132,608 | RHS- | M] () -- D:\mi9al8rs.exe [2010-05-17 19:46:12 | 000,112,640 | RHS- | M] () -- D:\p6xebrnt.exe [2010-05-15 09:35:31 | 000,112,640 | RHS- | M] () -- D:\p9rs.exe [2010-05-22 00:51:37 | 000,114,688 | RHS- | M] () -- D:\q0wfr.exe [2010-04-19 20:38:23 | 000,128,512 | RHS- | M] () -- D:\r3fhr.exe [2010-07-02 10:41:45 | 000,116,224 | RHS- | M] () -- D:\rxf.exe [2010-01-19 18:39:56 | 000,123,392 | RHS- | M] () -- D:\sywyrl0q.exe [2010-04-23 23:07:05 | 000,128,000 | RHS- | M] () -- D:\twhvna.exe [2010-04-22 12:54:20 | 000,128,512 | RHS- | M] () -- D:\vgyn6ewc.exe [2010-05-27 14:04:07 | 000,114,176 | RHS- | M] () -- D:\wa.exe [2010-02-08 16:01:18 | 000,091,648 | RHS- | M] () -- D:\ws.exe [2010-04-15 13:42:29 | 000,126,976 | RHS- | M] () -- D:\wyskq6lt.exe [1 D:\*.tmp files -> D:\*.tmp -> ] [2010-04-18 11:56:33 | 000,127,488 | RHS- | M] () -- C:\lhhr8.exe

Wciśnij Run Fix (Wykonaj skrypt) i zatwierdź restart

Do wglądu raport z czyszczenia i nowy log z OTL, robiony jak poprzednio.

Potem
znajdź pliki

[2009-04-15 13:07:35 | 000,000,150 | ---- | M] () -- C:\ldx.bat
[2009-04-15 13:09:37 | 000,000,150 | ---- | M] () -- C:\pch.bat

Tylko ich nie odpalaj.
Prawoklik -> otwórz ich zawartość za pomocą notatnika, przeklej ich zawartość.

**Posty:** 16 · przez **warek1234** 08 Lip 2010, 10:47

Kod: Zaznacz wszystko: ========== PROCESSES ========== All processes killed ========== OTL ========== Registry value HKEY_USERS\S-1-5-21-1343024091-963894560-682003330-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{5B291E6C-9A74-4034-971B-A4B007A0B313} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B291E6C-9A74-4034-971B-A4B007A0B313}\ not found. Registry value HKEY_USERS\S-1-5-21-1343024091-963894560-682003330-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{5B291E6C-9A74-4034-971B-A4B007A0B315} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5B291E6C-9A74-4034-971B-A4B007A0B315}\ deleted successfully. Registry value HKEY_USERS\S-1-5-21-1343024091-963894560-682003330-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A}\ not found. Registry value HKEY_USERS\S-1-5-21-1343024091-963894560-682003330-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\\RTHDBPL deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a81ff031-eeea-11dd-9b11-0021856eaeca}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a81ff031-eeea-11dd-9b11-0021856eaeca}\ not found. File J:\qhbfqx.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a81ff031-eeea-11dd-9b11-0021856eaeca}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a81ff031-eeea-11dd-9b11-0021856eaeca}\ not found. File J:\qhbfqx.exe not found. C:\Documents and Settings\uzytkownik\Pulpit\lol.exe moved successfully. C:\Documents and Settings\All Users\Dane aplikacji\3536B folder moved successfully. C:\i8ikdjwt.exe moved successfully. C:\mbam-error.txt moved successfully. C:\mi9al8rs.exe moved successfully. C:\p6xebrnt.exe moved successfully. C:\p9rs.exe moved successfully. C:\q0wfr.exe moved successfully. C:\r3fhr.exe moved successfully. C:\twhvna.exe moved successfully. C:\UsbFix.txt moved successfully. C:\vgyn6ewc.exe moved successfully. C:\wa.exe moved successfully. D:\1thes92p.exe moved successfully. D:\3dcs9.exe moved successfully. D:\9qqigqwf.exe moved successfully. D:\9rfpp.exe moved successfully. D:\affi8l.exe moved successfully. D:\anoataly.exe moved successfully. D:\bbjl2g.exe moved successfully. D:\bu8.exe moved successfully. D:\ca.exe moved successfully. D:\i8ikdjwt.exe moved successfully. D:\ji83j.exe moved successfully. D:\kmj.exe moved successfully. D:\lhhr8.exe moved successfully. D:\mbdm.exe moved successfully. D:\mh.exe moved successfully. D:\mi9al8rs.exe moved successfully. D:\p6xebrnt.exe moved successfully. D:\p9rs.exe moved successfully. D:\q0wfr.exe moved successfully. D:\r3fhr.exe moved successfully. D:\rxf.exe moved successfully. D:\sywyrl0q.exe moved successfully. D:\twhvna.exe moved successfully. D:\vgyn6ewc.exe moved successfully. D:\wa.exe moved successfully. D:\ws.exe moved successfully. D:\wyskq6lt.exe moved successfully. D:\msdownld.tmp folder deleted successfully. C:\lhhr8.exe moved successfully. OTL by OldTimer - Version 3.2.7.1 log created on 07082010_104215 Files\Folders moved on Reboot... Registry entries deleted on Reboot...

Dodano Dzisiaj, 10:48:
to oto chodziło obok mam jeszcze folder z takimi notatnikami

**Posty:** 2183 · przez **NieWiem** 08 Lip 2010, 10:50

no to jest ten aktualny log z czyszczenia, a ja chciałbym ten poprzedni jeszcze zobaczyć