Wnqtlyjr co to jest?

**Posty:** 176 · przez **peterka** 29 Maj 2011, 13:15

Witam, od pewnego czasu po starcie systemu wyskakuje mi coś takiego :

Logd hijackthis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.4 Scan saved at 13:12:00, on 2011-05-29 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Common Files\Java\Java Update\jusched.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\system32\lxdecoms.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\msiexec.exe C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [Skrót do strony właściwości High Definition Audio] HDAShCut.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [AlcWzrd] ALCWZRD.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun O4 - HKCU\..\Run: [{A94A885A-BEDE-426B-758C-86738A7EC24E}] "C:\Documents and Settings\x\Dane aplikacji\Ockohi\dutu.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - .DEFAULT User Startup: faixyc.exe (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O22 - SharedTaskScheduler: Moduł wstępnego ładowania interfejsu Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll O22 - SharedTaskScheduler: Demon buforu kategorii składników - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: lxdeCATSCustConnectService - Lexmark International, Inc. - C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdeserv.exe O23 - Service: lxde_device - - C:\WINDOWS\system32\lxdecoms.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 4403 bytes

Skanowałem mbamem wykryło to usunąłem w dysku c jest plik exe o nazwie readme.exe gdy go usuwam to na next starcei systemu wszystkie pliki exe ktore otwieram się zamykają po restarcie plik powraca i znów wyskakuje okienko, w niektórych momentach wyskakuje mi z win rar-a że błąd archiwum O.O

Nie oge dodac loga z otl i gmera bo caly czas jak proboje to w firefoxie pisze polaczenie zresetowane nie wiem co jest

**Posty:** 18165 · przez **wojtas** 29 Maj 2011, 14:59

to wyłącz FF gdy tworzysz loga

spróbuj w awaryjnym odpalić w/w programy

**Posty:** 176 · przez **peterka** 29 Maj 2011, 17:57

Chodzi o to ze log juz mam ale czy chce go dodac na wlekj albo po prostu kopiujac przekroczonoe limit polaczenia pisze

**Posty:** 18165 · przez **wojtas** 29 Maj 2011, 23:40

to wrzuć może na jakiś serwer

albo przeklej mi na PW

**Posty:** 176 · przez **peterka** 30 Maj 2011, 16:15

Ok Logi z OTL

Kod: Zaznacz wszystko: http://www.speedyshare.com/files/28717542/OTL.Txt http://www.speedyshare.com/files/28717573/Extras.Txt

**Posty:** 18165 · przez **wojtas** 30 Maj 2011, 17:15

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL
O4 - Startup: C:\Documents and Settings\Default User\Menu Start\Programy\Autostart\faixyc.exe ()
O4 - HKU\S-1-5-21-682003330-1004336348-839522115-1004..\Run: [{A94A885A-BEDE-426B-758C-86738A7EC24E}] C:\Documents and Settings\x\Dane aplikacji\Ockohi\dutu.exe ()
@Alternate Data Stream - 231 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:6BE50C2B

:Files
C:\Documents and Settings\x\Dane aplikacji\Ockohi
C:\Readme.exe

:Commands
[emptytemp]
[emptyflash]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia (zawartość notatnika, która otworzy się po restarcie).

**Posty:** 176 · przez **peterka** 30 Maj 2011, 22:26

Kod: Zaznacz wszystko: All processes killed ========== OTL ========== C:\Documents and Settings\Default User\Menu Start\Programy\Autostart\faixyc.exe moved successfully. Registry value HKEY_USERS\S-1-5-21-682003330-1004336348-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Run\\{A94A885A-BEDE-426B-758C-86738A7EC24E} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{A94A885A-BEDE-426B-758C-86738A7EC24E}\ not found. File C:\Documents and Settings\x\Dane aplikacji\Ockohi\dutu.exe not found. ADS C:\Documents and Settings\All Users\Dane aplikacji\TEMP:6BE50C2B deleted successfully. ========== FILES ========== File\Folder C:\Documents and Settings\x\Dane aplikacji\Ockohi not found. C:\Readme.exe moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: x ->Temp folder emptied: 63363411 bytes ->Temporary Internet Files folder emptied: 1097752 bytes ->Java cache emptied: 2378626 bytes ->FireFox cache emptied: 161011131 bytes ->Flash cache emptied: 4156 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2114584 bytes %systemroot%\System32 .tmp files removed: 2596 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 97792 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 220,00 mb [EMPTYFLASH] User: All Users User: Default User User: LocalService User: NetworkService User: x ->Flash cache emptied: 0 bytes Total Flash Files Cleaned = 0,00 mb OTL by OldTimer - Version 3.2.23.0 log created on 05302011_221947 Files\Folders moved on Reboot... Registry entries deleted on Reboot...

Teraz Skan po zabiegu

Kod: Zaznacz wszystko: OTL logfile created on: 2011-05-30 22:22:29 - Run 2 OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\x\Moje dokumenty\Pobieranie Windows XP Home Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 2,00 Gb Total Physical Memory | 1,57 Gb Available Physical Memory | 78,42% Memory free 3,35 Gb Paging File | 3,06 Gb Available in Paging File | 91,47% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 48,83 Gb Total Space | 35,47 Gb Free Space | 72,64% Space Free | Partition Type: NTFS Drive D: | 117,19 Gb Total Space | 63,48 Gb Free Space | 54,17% Space Free | Partition Type: NTFS Drive F: | 132,07 Gb Total Space | 63,52 Gb Free Space | 48,10% Space Free | Partition Type: NTFS Drive G: | 2,53 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: X-C60DE7B3A3C14 | User Name: x | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2011-05-29 13:16:27 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\x\Moje dokumenty\Pobieranie\OTL.exe PRC - [2011-04-29 22:11:33 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2007-05-29 15:07:58 | 000,598,960 | ---- | M] ( ) -- C:\WINDOWS\system32\lxdecoms.exe PRC - [2005-09-24 07:05:26 | 000,029,696 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe PRC - [2005-03-23 00:00:00 | 000,090,112 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE PRC - [2004-08-04 13:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2011-05-29 13:16:27 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\x\Moje dokumenty\Pobieranie\OTL.exe MOD - [2004-08-04 13:00:00 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt) SRV - [2011-01-28 16:11:20 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2007-05-29 15:07:58 | 000,598,960 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\lxdecoms.exe -- (lxde_device) SRV - [2007-05-29 15:06:43 | 000,099,248 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdeserv.exe -- (lxdeCATSCustConnectService) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2011-05-10 15:16:51 | 000,132,608 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\ethepoig.sys -- (ethepoig) DRV - [2011-03-27 13:00:47 | 000,218,688 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV - [2005-09-12 00:00:00 | 003,298,432 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Sterownik karty Intel(R) DRV - [2005-05-26 18:19:18 | 000,839,724 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smserial.sys -- (smserial) DRV - [2005-03-23 00:00:00 | 002,547,008 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2005-01-07 17:07:16 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService) DRV - [2004-02-12 00:00:00 | 000,070,912 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.startup.homepage: "about:home" FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011-04-29 22:11:37 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011-04-01 13:15:11 | 000,000,000 | ---D | M] [2008-10-09 07:04:17 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\x\Dane aplikacji\Mozilla\Extensions [2011-05-24 16:42:44 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\x\Dane aplikacji\Mozilla\Firefox\Profiles\2k7d3jdr.default\extensions [2011-05-09 21:17:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2011-05-09 21:17:40 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011-01-17 22:03:45 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011-03-06 11:47:56 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} File not found (No name found) -- () (No name found) -- C:\DOCUMENTS AND SETTINGS\X\DANE APLIKACJI\MOZILLA\FIREFOX\PROFILES\2K7D3JDR.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI [2011-01-17 22:03:34 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2011-04-29 22:11:33 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll [2009-12-31 11:05:32 | 000,040,960 | ---- | M] (BYOND) -- C:\Program Files\Mozilla Firefox\plugins\npbyond.dll [2011-02-02 22:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll [2011-04-01 13:15:03 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2011-04-01 13:15:03 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2011-04-01 13:15:03 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2011-04-01 13:15:03 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2011-04-01 13:15:03 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2011-04-01 13:15:03 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml Hosts file not found O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [Skrót do strony właściwości High Definition Audio] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider) O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.) O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008-10-09 06:29:27 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2010-08-16 14:57:50 | 000,000,154 | R--- | M] () - G:\autorun.cfg -- [ UDF ] O32 - AutoRun File - [2010-10-05 16:53:16 | 000,214,344 | R--- | M] (Sports Interactive) - G:\autorun.exe -- [ UDF ] O32 - AutoRun File - [2006-09-11 15:26:42 | 000,000,027 | R--- | M] () - G:\autorun.inf -- [ UDF ] O33 - MountPoints2\{4845bef3-5860-11e0-a8ff-00150028a536}\Shell - "" = AutoRun O33 - MountPoints2\{4845bef3-5860-11e0-a8ff-00150028a536}\Shell\AutoRun\command - "" = G:\autorun.exe -- [2010-10-05 16:53:16 | 000,214,344 | R--- | M] (Sports Interactive) O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2011-05-30 22:19:47 | 000,000,000 | ---D | C] -- C:\_OTL [2011-05-30 16:29:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\Uhleq [2011-05-29 13:11:50 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro [2011-05-29 13:11:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Menu Start\Programy\HiJackThis [2011-05-29 12:58:34 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\x\Recent [2011-05-29 10:44:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Ventrilo [2011-05-29 10:44:25 | 000,000,000 | ---D | C] -- C:\Program Files\Ventrilo [2011-05-29 10:44:07 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard [2011-05-29 10:10:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\Ventrilo [2011-05-27 19:00:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP [2011-05-27 18:59:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\ElfBot NG [2011-05-22 00:02:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Sports Interactive [2011-05-22 00:01:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Moje dokumenty\Sports Interactive [2011-05-22 00:01:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dokumenty\Sports Interactive [2011-05-22 00:01:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Sports Interactive [2011-05-22 00:01:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\Sports Interactive [2011-05-21 23:58:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Menu Start\Programy\Sports Interactive [2011-05-21 23:51:21 | 000,000,000 | -H-D | C] -- C:\Program Files\Zero G Registry [2011-05-21 23:50:45 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\x\InstallAnywhere [2011-05-19 10:26:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Application Data [2011-05-19 10:24:38 | 000,000,000 | ---D | C] -- C:\glassfish3 [2011-05-19 10:09:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\.minecraft [2011-05-16 16:07:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump [2011-05-15 16:49:11 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2011-05-12 21:19:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\.gstreamer-0.10 [2011-05-12 21:18:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\OpenFM [2011-05-12 21:18:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\OpenFM [2011-05-12 21:18:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10 [2011-05-12 21:16:10 | 000,000,000 | ---D | C] -- C:\Program Files\Gadu-Gadu 10 [2011-05-11 19:01:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Pulpit\Niemiec [2011-05-10 15:16:51 | 000,132,608 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\WINDOWS\System32\drivers\ethepoig.sys [2011-05-09 21:17:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Skype Extras [2011-05-09 21:16:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Skype [2011-05-09 21:16:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype [2011-05-08 22:52:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Microsoft Silverlight [2011-05-08 22:52:06 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2011-05-07 15:16:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\SKIDROW [2011-05-07 15:14:25 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft XNA [2011-05-07 10:58:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Adobe [2011-05-07 10:42:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Deployment [2011-05-07 09:29:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\WinUHA [2011-05-07 09:29:33 | 000,000,000 | ---D | C] -- C:\Program Files\WinUHA [2011-05-03 12:35:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Moje dokumenty\Heroes of Newerth [2011-01-17 21:00:05 | 000,434,176 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdehcp.dll [2011-01-17 21:00:05 | 000,356,352 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeinpa.dll [2011-01-17 21:00:04 | 001,200,128 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeserv.dll [2011-01-17 21:00:04 | 000,950,272 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeusb1.dll [2011-01-17 21:00:04 | 000,339,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeiesc.dll [2011-01-17 21:00:04 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeprox.dll [2011-01-17 21:00:03 | 000,647,168 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdepmui.dll [2011-01-17 21:00:03 | 000,565,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdelmpm.dll [2011-01-17 21:00:03 | 000,320,432 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeih.exe [2011-01-17 21:00:02 | 000,663,552 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdehbn3.dll [2011-01-17 21:00:01 | 000,860,160 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecomc.dll [2011-01-17 21:00:01 | 000,598,960 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecoms.exe [2011-01-17 21:00:01 | 000,364,544 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecomm.dll [2011-01-17 21:00:00 | 000,365,488 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecfg.exe [2004-11-24 20:25:52 | 000,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\drvc.dll [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2011-05-30 22:20:43 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011-05-30 22:20:37 | 2146,881,536 | -HS- | M] () -- C:\hiberfil.sys [2011-05-30 21:14:42 | 000,002,265 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk [2011-05-30 16:31:34 | 000,002,435 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\HiJackThis.lnk [2011-05-29 13:01:50 | 000,000,020 | ---- | M] () -- C:\Documents and Settings\x\__rar_00.313 [2011-05-29 10:44:26 | 000,000,630 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Ventrilo.lnk [2011-05-28 23:07:08 | 000,000,095 | ---- | M] () -- C:\WINDOWS\winamp.ini [2011-05-28 10:33:37 | 000,000,866 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\Skrót do tibialoader.exe.lnk [2011-05-27 18:40:38 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011-05-21 23:58:41 | 000,000,644 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Football Manager 2011.lnk [2011-05-21 23:49:16 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2011-05-21 23:49:14 | 000,005,120 | ---- | M] () -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011-05-19 10:37:51 | 000,000,096 | ---- | M] () -- C:\Documents and Settings\x\.asadminpass [2011-05-19 10:25:58 | 000,000,680 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\Skrót do MinecraftSP.exe.lnk [2011-05-18 10:38:57 | 000,001,986 | ---- | M] () -- C:\Documents and Settings\All Users\lxde [2011-05-15 16:49:11 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2011-05-12 21:18:08 | 000,000,791 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\OpenFM.lnk [2011-05-10 16:33:06 | 000,000,211 | -HS- | M] () -- C:\boot.ini [2011-05-10 15:16:51 | 000,132,608 | ---- | M] (Windows (R) Codename Longhorn DDK provider) -- C:\WINDOWS\System32\drivers\ethepoig.sys [color=#E56717]========== Files Created - No Company Name ==========[/color] [2011-05-29 22:09:25 | 000,422,244 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-S-1-5-21-682003330-1004336348-839522115-1004-0.dat [2011-05-29 22:09:25 | 000,199,294 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-System.dat [2011-05-29 13:11:50 | 000,002,435 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\HiJackThis.lnk [2011-05-29 13:03:24 | 000,141,993 | ---- | C] () -- C:\Documents and Settings\x\Menu Start\Programy\Autostarthello.exe [2011-05-29 13:01:41 | 000,000,020 | ---- | C] () -- C:\Documents and Settings\x\__rar_00.313 [2011-05-29 10:44:26 | 000,000,630 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Ventrilo.lnk [2011-05-28 10:33:37 | 000,000,866 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\Skrót do tibialoader.exe.lnk [2011-05-23 21:15:37 | 000,011,264 | ---- | C] () -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\mekomdo.dll [2011-05-21 23:58:41 | 000,000,644 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Football Manager 2011.lnk [2011-05-19 10:37:51 | 000,000,096 | ---- | C] () -- C:\Documents and Settings\x\.asadminpass [2011-05-19 10:25:58 | 000,000,680 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\Skrót do MinecraftSP.exe.lnk [2011-05-12 21:18:08 | 000,000,791 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\OpenFM.lnk [2011-05-12 21:16:22 | 000,000,680 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Start\Programy\Gadu-Gadu 10.lnk [2011-05-09 21:16:56 | 000,002,265 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk [2011-02-20 13:26:53 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe [2011-02-20 13:25:42 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2011-02-19 17:38:13 | 000,000,064 | ---- | C] () -- C:\WINDOWS\System32\tcfg.ini [2011-01-28 22:23:28 | 000,005,120 | ---- | C] () -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011-01-28 22:23:23 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2011-01-18 20:52:49 | 000,062,304 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat [2011-01-17 21:21:17 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat [2011-01-17 21:07:28 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxdevs.dll [2011-01-17 21:07:27 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\lxdecoin.dll [2011-01-17 21:06:48 | 000,692,224 | ---- | C] () -- C:\WINDOWS\System32\lxdedrs.dll [2011-01-17 21:06:48 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\lxdecnv4.dll [2011-01-17 21:06:48 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\lxdecaps.dll [2011-01-17 21:06:24 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\LXF3PMON.DLL [2011-01-17 21:06:24 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\lxf3oem.dll [2011-01-17 21:06:24 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXF3FXPU.DLL [2011-01-17 21:06:24 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\LXF3PMRC.DLL [2011-01-17 21:00:17 | 000,000,060 | -H-- | C] () -- C:\WINDOWS\System32\lxderwrd.ini [2011-01-17 21:00:05 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\lxdeinst.dll [2011-01-17 21:00:02 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lxdegrd.dll [2008-10-09 08:22:26 | 000,004,293 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2008-10-09 08:21:03 | 001,420,280 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2008-10-09 07:04:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2008-10-09 07:00:23 | 000,000,095 | ---- | C] () -- C:\WINDOWS\winamp.ini [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56spn.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56itl.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56ger.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56fra.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56eng.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56brz.dll [2008-10-09 06:54:16 | 000,049,152 | ---- | C] () -- C:\WINDOWS\sm56jpn.dll [2008-10-09 06:54:16 | 000,045,056 | ---- | C] () -- C:\WINDOWS\sm56cht.dll [2008-10-09 06:54:16 | 000,045,056 | ---- | C] () -- C:\WINDOWS\sm56chs.dll [2008-10-09 06:53:36 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll [2008-10-09 06:53:36 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe [2008-10-09 06:31:53 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2008-10-09 06:27:10 | 000,021,856 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2008-07-05 12:14:48 | 000,456,192 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll [2008-07-05 12:14:44 | 003,591,168 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll [2008-07-05 12:13:16 | 000,708,096 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll [2008-06-22 18:34:00 | 000,177,664 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll [2008-06-13 12:39:38 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll [2008-06-12 19:36:38 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2006-11-02 17:10:16 | 000,080,912 | ---- | C] () -- C:\WINDOWS\System32\sherlock2.exe [2005-05-25 22:02:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2005-05-25 22:02:00 | 001,626,112 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe [2005-05-25 22:02:00 | 001,478,656 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2005-05-25 22:02:00 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe [2005-05-25 22:02:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2005-05-25 22:02:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2005-05-25 22:02:00 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe [2004-10-03 18:50:54 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll [2004-08-04 13:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2004-08-04 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2004-08-04 13:00:00 | 000,555,962 | ---- | C] () -- C:\WINDOWS\System32\perfh015.dat [2004-08-04 13:00:00 | 000,493,638 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2004-08-04 13:00:00 | 000,313,828 | ---- | C] () -- C:\WINDOWS\System32\perfi015.dat [2004-08-04 13:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2004-08-04 13:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2004-08-04 13:00:00 | 000,104,856 | ---- | C] () -- C:\WINDOWS\System32\perfc015.dat [2004-08-04 13:00:00 | 000,084,056 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2004-08-04 13:00:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2004-08-04 13:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2004-08-04 13:00:00 | 000,034,990 | ---- | C] () -- C:\WINDOWS\System32\perfd015.dat [2004-08-04 13:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2004-08-04 13:00:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2004-08-04 13:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2004-08-04 13:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2004-08-04 13:00:00 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin [2004-08-04 13:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat < End of report >

**Posty:** 18165 · przez **wojtas** 30 Maj 2011, 23:16

ten plik/i :

C:\WINDOWS\system32\drivers\ethepoig.sys

przeskanuj tu
http://virusscan.jotti.org/
i tu :
http://www.virustotal.com/

i daj raporty ze skanu w następnym poście

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL

:Files
C:\Documents and Settings\x\Dane aplikacji\Uhleq

:Commands
[emptytemp]
[emptyflash]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia (zawartość notatnika, która otworzy się po restarcie). daj loga z Gmera pamiętaj o emulacji, odinstaluj Deamona

**Posty:** 176 · przez **peterka** 30 Maj 2011, 23:26

Kod: Zaznacz wszystko: Antivirus Version Last Update Result AhnLab-V3 2011.05.31.00 2011.05.30 - AntiVir 7.11.8.172 2011.05.30 Worm/Bymot.A.107 Antiy-AVL 2.0.3.7 2011.05.30 Backdoor/Win32.IEbooot.gen Avast 4.8.1351.0 2011.05.30 Win32:Malware-gen Avast5 5.0.677.0 2011.05.30 Win32:Malware-gen AVG 10.0.0.1190 2011.05.30 Worm/Generic2.AQZI BitDefender 7.2 2011.05.30 - CAT-QuickHeal 11.00 2011.05.30 - ClamAV 0.97.0.0 2011.05.30 - Commtouch 5.3.2.6 2011.05.30 - Comodo 8896 2011.05.30 - DrWeb 5.0.2.03300 2011.05.30 - Emsisoft 5.1.0.5 2011.05.30 Worm.Win32.Bymot!IK eSafe 7.0.17.0 2011.05.26 - eTrust-Vet 36.1.8357 2011.05.30 - F-Prot 4.6.2.117 2011.05.30 - F-Secure 9.0.16440.0 2011.05.30 - Fortinet 4.2.257.0 2011.05.30 - GData 22 2011.05.30 Win32:Malware-gen Ikarus T3.1.1.104.0 2011.05.30 Worm.Win32.Bymot Jiangmin 13.0.900 2011.05.30 - K7AntiVirus 9.104.4740 2011.05.30 - Kaspersky 9.0.0.837 2011.05.30 - McAfee 5.400.0.1158 2011.05.30 - McAfee-GW-Edition 2010.1D 2011.05.30 - Microsoft 1.6903 2011.05.30 Worm:Win32/Bymot.A NOD32 6166 2011.05.30 a variant of Win32/Bubnix.BM Norman 6.07.07 2011.05.30 - nProtect 2011-05-30.02 2011.05.30 - Panda 10.0.3.5 2011.05.30 - PCTools 7.0.3.5 2011.05.19 - Prevx 3.0 2011.05.30 - Rising 23.60.00.03 2011.05.30 - Sophos 4.65.0 2011.05.30 Mal/Bubnix-E SUPERAntiSpyware 4.40.0.1006 2011.05.30 - Symantec 20111.1.0.186 2011.05.30 - TheHacker 6.7.0.1.212 2011.05.28 Backdoor/IEbooot.fmm TrendMicro 9.200.0.1012 2011.05.30 - TrendMicro-HouseCall 9.200.0.1012 2011.05.30 - VBA32 3.12.16.0 2011.05.30 Backdoor.IEbooot.fmm VIPRE 9437 2011.05.30 Trojan.Win32.Generic!BT ViRobot 2011.5.30.4486 2011.05.30 - VirusBuster 14.0.57.0 2011.05.30 -

Kod: Zaznacz wszystko: 2011-05-30 Nic nie znaleziono [F-Secure Anti-Virus] 2011-05-30 Nic nie znaleziono [Avast! antivirus] 2011-05-30 Win32:Malware-gen [G DATA] 2011-05-30 Win32:Malware-gen [Grisoft AVG Anti-Virus] 2011-05-30 Worm/Generic2.AQZI [Ikarus] 2011-05-30 Worm.Win32.Bymot [Avira AntiVir] 2011-05-30 Worm/Bymot.A.107 [Kaspersky Anti-Virus] 2011-05-30 Nic nie znaleziono [Softwin BitDefender] 2011-05-30 Nic nie znaleziono [ESET NOD32] 2011-05-30 Win32/Bubnix.BM [ClamAV] 2011-05-30 Nic nie znaleziono [Panda Antivirus] 2011-05-30 Nic nie znaleziono [CPsecure] 2011-05-30 Nic nie znaleziono [Quick Heal] 2011-05-30 Nic nie znaleziono [Dr.Web] 2011-05-30 Nic nie znaleziono [Sophos] 2011-05-30 Mal/Bubnix-E [Emsisoft Anti-Malware] 2011-05-30 Worm.Win32.Bymot!IK [VirusBlokAda VBA32] 2011-05-29 Backdoor.IEbooot.fmm [Frisk F-Prot Antivirus] 2011-05-30 Nic nie znaleziono [VirusBuster] 2011-05-30 Nic nie znaleziono

Za 2 min będą logi z OTL bo robię to teraz
Ok są logi

Kod: Zaznacz wszystko: All processes killed ========== OTL ========== ========== FILES ========== C:\Documents and Settings\x\Dane aplikacji\Uhleq folder moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: x ->Temp folder emptied: 401 bytes ->Temporary Internet Files folder emptied: 314663 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 59633670 bytes ->Flash cache emptied: 1042 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 0 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 57,00 mb [EMPTYFLASH] User: All Users User: Default User User: LocalService User: NetworkService User: x ->Flash cache emptied: 0 bytes Total Flash Files Cleaned = 0,00 mb OTL by OldTimer - Version 3.2.23.0 log created on 05302011_232653 Files\Folders moved on Reboot... Registry entries deleted on Reboot...

Skan po wykonaniu skryptu

Kod: Zaznacz wszystko: OTL logfile created on: 2011-05-30 23:28:59 - Run 3 OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\x\Moje dokumenty\Pobieranie Windows XP Home Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 2,00 Gb Total Physical Memory | 1,61 Gb Available Physical Memory | 80,46% Memory free 3,35 Gb Paging File | 3,11 Gb Available in Paging File | 92,75% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 48,83 Gb Total Space | 35,47 Gb Free Space | 72,64% Space Free | Partition Type: NTFS Drive D: | 117,19 Gb Total Space | 63,48 Gb Free Space | 54,17% Space Free | Partition Type: NTFS Drive F: | 132,07 Gb Total Space | 63,52 Gb Free Space | 48,10% Space Free | Partition Type: NTFS Drive G: | 2,53 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: X-C60DE7B3A3C14 | User Name: x | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2011-05-29 13:16:27 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\x\Moje dokumenty\Pobieranie\OTL.exe PRC - [2011-04-29 22:11:33 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2007-05-29 15:07:58 | 000,598,960 | ---- | M] ( ) -- C:\WINDOWS\system32\lxdecoms.exe PRC - [2005-09-24 07:05:26 | 000,029,696 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe PRC - [2005-03-23 00:00:00 | 000,090,112 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE PRC - [2004-08-04 13:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2011-05-29 13:16:27 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\x\Moje dokumenty\Pobieranie\OTL.exe MOD - [2004-08-04 13:00:00 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt) SRV - [2011-01-28 16:11:20 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2007-05-29 15:07:58 | 000,598,960 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\lxdecoms.exe -- (lxde_device) SRV - [2007-05-29 15:06:43 | 000,099,248 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdeserv.exe -- (lxdeCATSCustConnectService) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2011-05-10 15:16:51 | 000,132,608 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\ethepoig.sys -- (ethepoig) DRV - [2011-03-27 13:00:47 | 000,218,688 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV - [2005-09-12 00:00:00 | 003,298,432 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Sterownik karty Intel(R) DRV - [2005-05-26 18:19:18 | 000,839,724 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smserial.sys -- (smserial) DRV - [2005-03-23 00:00:00 | 002,547,008 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2005-01-07 17:07:16 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService) DRV - [2004-02-12 00:00:00 | 000,070,912 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.startup.homepage: "about:home" FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011-04-29 22:11:37 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011-04-01 13:15:11 | 000,000,000 | ---D | M] [2008-10-09 07:04:17 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\x\Dane aplikacji\Mozilla\Extensions [2011-05-24 16:42:44 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\x\Dane aplikacji\Mozilla\Firefox\Profiles\2k7d3jdr.default\extensions [2011-05-09 21:17:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2011-05-09 21:17:40 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011-01-17 22:03:45 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011-03-06 11:47:56 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} File not found (No name found) -- () (No name found) -- C:\DOCUMENTS AND SETTINGS\X\DANE APLIKACJI\MOZILLA\FIREFOX\PROFILES\2K7D3JDR.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI [2011-01-17 22:03:34 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2011-04-29 22:11:33 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll [2009-12-31 11:05:32 | 000,040,960 | ---- | M] (BYOND) -- C:\Program Files\Mozilla Firefox\plugins\npbyond.dll [2011-02-02 22:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll [2011-04-01 13:15:03 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2011-04-01 13:15:03 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2011-04-01 13:15:03 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2011-04-01 13:15:03 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2011-04-01 13:15:03 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2011-04-01 13:15:03 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml Hosts file not found O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [Skrót do strony właściwości High Definition Audio] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider) O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.) O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008-10-09 06:29:27 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2010-08-16 14:57:50 | 000,000,154 | R--- | M] () - G:\autorun.cfg -- [ UDF ] O32 - AutoRun File - [2010-10-05 16:53:16 | 000,214,344 | R--- | M] (Sports Interactive) - G:\autorun.exe -- [ UDF ] O32 - AutoRun File - [2006-09-11 15:26:42 | 000,000,027 | R--- | M] () - G:\autorun.inf -- [ UDF ] O33 - MountPoints2\{4845bef3-5860-11e0-a8ff-00150028a536}\Shell - "" = AutoRun O33 - MountPoints2\{4845bef3-5860-11e0-a8ff-00150028a536}\Shell\AutoRun\command - "" = G:\autorun.exe -- [2010-10-05 16:53:16 | 000,214,344 | R--- | M] (Sports Interactive) O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2011-05-30 22:19:47 | 000,000,000 | ---D | C] -- C:\_OTL [2011-05-29 13:11:50 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro [2011-05-29 13:11:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Menu Start\Programy\HiJackThis [2011-05-29 12:58:34 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\x\Recent [2011-05-29 10:44:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Ventrilo [2011-05-29 10:44:25 | 000,000,000 | ---D | C] -- C:\Program Files\Ventrilo [2011-05-29 10:44:07 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard [2011-05-29 10:10:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\Ventrilo [2011-05-27 19:00:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP [2011-05-27 18:59:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\ElfBot NG [2011-05-22 00:02:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Sports Interactive [2011-05-22 00:01:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Moje dokumenty\Sports Interactive [2011-05-22 00:01:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dokumenty\Sports Interactive [2011-05-22 00:01:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Sports Interactive [2011-05-22 00:01:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\Sports Interactive [2011-05-21 23:58:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Menu Start\Programy\Sports Interactive [2011-05-21 23:51:21 | 000,000,000 | -H-D | C] -- C:\Program Files\Zero G Registry [2011-05-21 23:50:45 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\x\InstallAnywhere [2011-05-19 10:26:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Application Data [2011-05-19 10:24:38 | 000,000,000 | ---D | C] -- C:\glassfish3 [2011-05-19 10:09:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\.minecraft [2011-05-16 16:07:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump [2011-05-15 16:49:11 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2011-05-12 21:19:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\.gstreamer-0.10 [2011-05-12 21:18:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\OpenFM [2011-05-12 21:18:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\OpenFM [2011-05-12 21:18:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10 [2011-05-12 21:16:10 | 000,000,000 | ---D | C] -- C:\Program Files\Gadu-Gadu 10 [2011-05-11 19:01:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Pulpit\Niemiec [2011-05-10 15:16:51 | 000,132,608 | ---- | C] (Windows (R) Codename Longhorn DDK provider) -- C:\WINDOWS\System32\drivers\ethepoig.sys [2011-05-09 21:17:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Skype Extras [2011-05-09 21:16:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Skype [2011-05-09 21:16:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype [2011-05-08 22:52:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Microsoft Silverlight [2011-05-08 22:52:06 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2011-05-07 15:16:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\SKIDROW [2011-05-07 15:14:25 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft XNA [2011-05-07 10:58:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Adobe [2011-05-07 10:42:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Deployment [2011-05-07 09:29:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\WinUHA [2011-05-07 09:29:33 | 000,000,000 | ---D | C] -- C:\Program Files\WinUHA [2011-05-03 12:35:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Moje dokumenty\Heroes of Newerth [2011-01-17 21:00:05 | 000,434,176 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdehcp.dll [2011-01-17 21:00:05 | 000,356,352 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeinpa.dll [2011-01-17 21:00:04 | 001,200,128 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeserv.dll [2011-01-17 21:00:04 | 000,950,272 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeusb1.dll [2011-01-17 21:00:04 | 000,339,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeiesc.dll [2011-01-17 21:00:04 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeprox.dll [2011-01-17 21:00:03 | 000,647,168 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdepmui.dll [2011-01-17 21:00:03 | 000,565,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdelmpm.dll [2011-01-17 21:00:03 | 000,320,432 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeih.exe [2011-01-17 21:00:02 | 000,663,552 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdehbn3.dll [2011-01-17 21:00:01 | 000,860,160 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecomc.dll [2011-01-17 21:00:01 | 000,598,960 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecoms.exe [2011-01-17 21:00:01 | 000,364,544 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecomm.dll [2011-01-17 21:00:00 | 000,365,488 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecfg.exe [2004-11-24 20:25:52 | 000,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\drvc.dll [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2011-05-30 23:27:41 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011-05-30 23:27:35 | 2146,881,536 | -HS- | M] () -- C:\hiberfil.sys [2011-05-30 21:14:42 | 000,002,265 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk [2011-05-30 16:31:34 | 000,002,435 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\HiJackThis.lnk [2011-05-29 13:01:50 | 000,000,020 | ---- | M] () -- C:\Documents and Settings\x\__rar_00.313 [2011-05-29 10:44:26 | 000,000,630 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Ventrilo.lnk [2011-05-28 23:07:08 | 000,000,095 | ---- | M] () -- C:\WINDOWS\winamp.ini [2011-05-28 10:33:37 | 000,000,866 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\Skrót do tibialoader.exe.lnk [2011-05-27 18:40:38 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011-05-21 23:58:41 | 000,000,644 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Football Manager 2011.lnk [2011-05-21 23:49:16 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2011-05-21 23:49:14 | 000,005,120 | ---- | M] () -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011-05-19 10:37:51 | 000,000,096 | ---- | M] () -- C:\Documents and Settings\x\.asadminpass [2011-05-19 10:25:58 | 000,000,680 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\Skrót do MinecraftSP.exe.lnk [2011-05-18 10:38:57 | 000,001,986 | ---- | M] () -- C:\Documents and Settings\All Users\lxde [2011-05-15 16:49:11 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2011-05-12 21:18:08 | 000,000,791 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\OpenFM.lnk [2011-05-10 16:33:06 | 000,000,211 | -HS- | M] () -- C:\boot.ini [2011-05-10 15:16:51 | 000,132,608 | ---- | M] (Windows (R) Codename Longhorn DDK provider) -- C:\WINDOWS\System32\drivers\ethepoig.sys [color=#E56717]========== Files Created - No Company Name ==========[/color] [2011-05-29 22:09:25 | 000,422,244 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-S-1-5-21-682003330-1004336348-839522115-1004-0.dat [2011-05-29 22:09:25 | 000,199,294 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-System.dat [2011-05-29 13:11:50 | 000,002,435 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\HiJackThis.lnk [2011-05-29 13:03:24 | 000,141,993 | ---- | C] () -- C:\Documents and Settings\x\Menu Start\Programy\Autostarthello.exe [2011-05-29 13:01:41 | 000,000,020 | ---- | C] () -- C:\Documents and Settings\x\__rar_00.313 [2011-05-29 10:44:26 | 000,000,630 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Ventrilo.lnk [2011-05-28 10:33:37 | 000,000,866 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\Skrót do tibialoader.exe.lnk [2011-05-23 21:15:37 | 000,011,264 | ---- | C] () -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\mekomdo.dll [2011-05-21 23:58:41 | 000,000,644 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Football Manager 2011.lnk [2011-05-19 10:37:51 | 000,000,096 | ---- | C] () -- C:\Documents and Settings\x\.asadminpass [2011-05-19 10:25:58 | 000,000,680 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\Skrót do MinecraftSP.exe.lnk [2011-05-12 21:18:08 | 000,000,791 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\OpenFM.lnk [2011-05-12 21:16:22 | 000,000,680 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Start\Programy\Gadu-Gadu 10.lnk [2011-05-09 21:16:56 | 000,002,265 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk [2011-02-20 13:26:53 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe [2011-02-20 13:25:42 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2011-02-19 17:38:13 | 000,000,064 | ---- | C] () -- C:\WINDOWS\System32\tcfg.ini [2011-01-28 22:23:28 | 000,005,120 | ---- | C] () -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011-01-28 22:23:23 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2011-01-18 20:52:49 | 000,062,304 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat [2011-01-17 21:21:17 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat [2011-01-17 21:07:28 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxdevs.dll [2011-01-17 21:07:27 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\lxdecoin.dll [2011-01-17 21:06:48 | 000,692,224 | ---- | C] () -- C:\WINDOWS\System32\lxdedrs.dll [2011-01-17 21:06:48 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\lxdecnv4.dll [2011-01-17 21:06:48 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\lxdecaps.dll [2011-01-17 21:06:24 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\LXF3PMON.DLL [2011-01-17 21:06:24 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\lxf3oem.dll [2011-01-17 21:06:24 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXF3FXPU.DLL [2011-01-17 21:06:24 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\LXF3PMRC.DLL [2011-01-17 21:00:17 | 000,000,060 | -H-- | C] () -- C:\WINDOWS\System32\lxderwrd.ini [2011-01-17 21:00:05 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\lxdeinst.dll [2011-01-17 21:00:02 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lxdegrd.dll [2008-10-09 08:22:26 | 000,004,293 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2008-10-09 08:21:03 | 001,420,280 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2008-10-09 07:04:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2008-10-09 07:00:23 | 000,000,095 | ---- | C] () -- C:\WINDOWS\winamp.ini [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56spn.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56itl.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56ger.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56fra.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56eng.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56brz.dll [2008-10-09 06:54:16 | 000,049,152 | ---- | C] () -- C:\WINDOWS\sm56jpn.dll [2008-10-09 06:54:16 | 000,045,056 | ---- | C] () -- C:\WINDOWS\sm56cht.dll [2008-10-09 06:54:16 | 000,045,056 | ---- | C] () -- C:\WINDOWS\sm56chs.dll [2008-10-09 06:53:36 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll [2008-10-09 06:53:36 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe [2008-10-09 06:31:53 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2008-10-09 06:27:10 | 000,021,856 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2008-07-05 12:14:48 | 000,456,192 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll [2008-07-05 12:14:44 | 003,591,168 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll [2008-07-05 12:13:16 | 000,708,096 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll [2008-06-22 18:34:00 | 000,177,664 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll [2008-06-13 12:39:38 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll [2008-06-12 19:36:38 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2006-11-02 17:10:16 | 000,080,912 | ---- | C] () -- C:\WINDOWS\System32\sherlock2.exe [2005-05-25 22:02:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2005-05-25 22:02:00 | 001,626,112 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe [2005-05-25 22:02:00 | 001,478,656 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2005-05-25 22:02:00 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe [2005-05-25 22:02:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2005-05-25 22:02:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2005-05-25 22:02:00 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe [2004-10-03 18:50:54 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll [2004-08-04 13:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2004-08-04 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2004-08-04 13:00:00 | 000,555,962 | ---- | C] () -- C:\WINDOWS\System32\perfh015.dat [2004-08-04 13:00:00 | 000,493,638 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2004-08-04 13:00:00 | 000,313,828 | ---- | C] () -- C:\WINDOWS\System32\perfi015.dat [2004-08-04 13:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2004-08-04 13:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2004-08-04 13:00:00 | 000,104,856 | ---- | C] () -- C:\WINDOWS\System32\perfc015.dat [2004-08-04 13:00:00 | 000,084,056 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2004-08-04 13:00:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2004-08-04 13:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2004-08-04 13:00:00 | 000,034,990 | ---- | C] () -- C:\WINDOWS\System32\perfd015.dat [2004-08-04 13:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2004-08-04 13:00:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2004-08-04 13:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2004-08-04 13:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2004-08-04 13:00:00 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin [2004-08-04 13:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 231 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:6BE50C2B < End of report >

**Posty:** 18165 · przez **wojtas** 30 Maj 2011, 23:40

nie wiem co sądzić o tym pliku:

C:\WINDOWS\system32\drivers\ethepoig.sys

czy masz oryginalny system , czy może jakąś modyfikację ? gdzie log z Gmera? pamiętaj o Deamonie

**Posty:** 176 · przez **peterka** 30 Maj 2011, 23:42

Tak mam oryginalnego xp, dostałem go razem z laptopem, log z Gmera zaraz włoże tylko odinstaluje deamona itd

**Posty:** 18165 · przez **wojtas** 30 Maj 2011, 23:46

tak więc uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:Processes
killallprocesses

:Files
C:\WINDOWS\System32\drivers\ethepoig.sys

:Commands
[emptytemp]
[emptyflash]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia (zawartość notatnika, która otworzy się po restarcie). + Gmer

**Posty:** 176 · przez **peterka** 31 Maj 2011, 00:04

Po wykonaniu skryptu i po restarcie wyskoczyło okno, że microsoft windows odzyskał sprawność po błędzie.
Logi

Kod: Zaznacz wszystko: All processes killed ========== PROCESSES ========== ========== FILES ========== C:\WINDOWS\System32\drivers\ethepoig.sys moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: x ->Temp folder emptied: 401 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 35912146 bytes ->Flash cache emptied: 1603 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 16384 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 34,00 mb [EMPTYFLASH] User: All Users User: Default User User: LocalService User: NetworkService User: x ->Flash cache emptied: 0 bytes Total Flash Files Cleaned = 0,00 mb OTL by OldTimer - Version 3.2.23.0 log created on 05302011_234952 Files\Folders moved on Reboot... Registry entries deleted on Reboot...

Scan z OTL po wykonaniu skryptu

Kod: Zaznacz wszystko: OTL logfile created on: 2011-05-30 23:51:37 - Run 4 OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\x\Moje dokumenty\Pobieranie Windows XP Home Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 2,00 Gb Total Physical Memory | 1,68 Gb Available Physical Memory | 84,14% Memory free 3,35 Gb Paging File | 3,18 Gb Available in Paging File | 94,82% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 48,83 Gb Total Space | 35,46 Gb Free Space | 72,61% Space Free | Partition Type: NTFS Drive D: | 117,19 Gb Total Space | 63,48 Gb Free Space | 54,17% Space Free | Partition Type: NTFS Drive F: | 132,07 Gb Total Space | 63,52 Gb Free Space | 48,10% Space Free | Partition Type: NTFS Computer Name: X-C60DE7B3A3C14 | User Name: x | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2011-05-29 13:16:27 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\x\Moje dokumenty\Pobieranie\OTL.exe PRC - [2007-05-29 15:07:58 | 000,598,960 | ---- | M] ( ) -- C:\WINDOWS\system32\lxdecoms.exe PRC - [2005-09-24 07:05:26 | 000,029,696 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe PRC - [2005-03-23 00:00:00 | 000,090,112 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE PRC - [2004-08-04 13:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2011-05-29 13:16:27 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\x\Moje dokumenty\Pobieranie\OTL.exe MOD - [2004-08-04 13:00:00 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt) SRV - [2011-01-28 16:11:20 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2007-05-29 15:07:58 | 000,598,960 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\lxdecoms.exe -- (lxde_device) SRV - [2007-05-29 15:06:43 | 000,099,248 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdeserv.exe -- (lxdeCATSCustConnectService) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2011-05-30 23:45:35 | 000,443,448 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd) DRV - [2005-09-12 00:00:00 | 003,298,432 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Sterownik karty Intel(R) DRV - [2005-05-26 18:19:18 | 000,839,724 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smserial.sys -- (smserial) DRV - [2005-03-23 00:00:00 | 002,547,008 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2005-01-07 17:07:16 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService) DRV - [2004-02-12 00:00:00 | 000,070,912 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.startup.homepage: "about:home" FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011-04-29 22:11:37 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011-04-01 13:15:11 | 000,000,000 | ---D | M] [2008-10-09 07:04:17 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\x\Dane aplikacji\Mozilla\Extensions [2011-05-24 16:42:44 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\x\Dane aplikacji\Mozilla\Firefox\Profiles\2k7d3jdr.default\extensions [2011-05-09 21:17:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2011-05-09 21:17:40 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011-01-17 22:03:45 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011-03-06 11:47:56 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} File not found (No name found) -- () (No name found) -- C:\DOCUMENTS AND SETTINGS\X\DANE APLIKACJI\MOZILLA\FIREFOX\PROFILES\2K7D3JDR.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI [2011-01-17 22:03:34 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2011-04-29 22:11:33 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll [2009-12-31 11:05:32 | 000,040,960 | ---- | M] (BYOND) -- C:\Program Files\Mozilla Firefox\plugins\npbyond.dll [2011-02-02 22:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll [2011-04-01 13:15:03 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2011-04-01 13:15:03 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2011-04-01 13:15:03 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2011-04-01 13:15:03 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2011-04-01 13:15:03 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2011-04-01 13:15:03 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml Hosts file not found O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [Skrót do strony właściwości High Definition Audio] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider) O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008-10-09 06:29:27 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{4845bef3-5860-11e0-a8ff-00150028a536}\Shell - "" = AutoRun O33 - MountPoints2\{4845bef3-5860-11e0-a8ff-00150028a536}\Shell\AutoRun\command - "" = G:\autorun.exe O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2011-05-30 22:19:47 | 000,000,000 | ---D | C] -- C:\_OTL [2011-05-29 13:11:50 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro [2011-05-29 13:11:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Menu Start\Programy\HiJackThis [2011-05-29 12:58:34 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\x\Recent [2011-05-29 10:44:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Ventrilo [2011-05-29 10:44:25 | 000,000,000 | ---D | C] -- C:\Program Files\Ventrilo [2011-05-29 10:44:07 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard [2011-05-29 10:10:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\Ventrilo [2011-05-27 19:00:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP [2011-05-27 18:59:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\ElfBot NG [2011-05-22 00:02:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Sports Interactive [2011-05-22 00:01:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Moje dokumenty\Sports Interactive [2011-05-22 00:01:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dokumenty\Sports Interactive [2011-05-22 00:01:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Sports Interactive [2011-05-22 00:01:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\Sports Interactive [2011-05-21 23:58:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Menu Start\Programy\Sports Interactive [2011-05-21 23:51:21 | 000,000,000 | -H-D | C] -- C:\Program Files\Zero G Registry [2011-05-21 23:50:45 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\x\InstallAnywhere [2011-05-19 10:26:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Application Data [2011-05-19 10:24:38 | 000,000,000 | ---D | C] -- C:\glassfish3 [2011-05-19 10:09:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\.minecraft [2011-05-16 16:07:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump [2011-05-15 16:49:11 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2011-05-12 21:19:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\.gstreamer-0.10 [2011-05-12 21:18:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\OpenFM [2011-05-12 21:18:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\OpenFM [2011-05-12 21:18:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10 [2011-05-12 21:16:10 | 000,000,000 | ---D | C] -- C:\Program Files\Gadu-Gadu 10 [2011-05-11 19:01:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Pulpit\Niemiec [2011-05-09 21:17:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Skype Extras [2011-05-09 21:16:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Skype [2011-05-09 21:16:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype [2011-05-08 22:52:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Microsoft Silverlight [2011-05-08 22:52:06 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2011-05-07 15:16:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\SKIDROW [2011-05-07 15:14:25 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft XNA [2011-05-07 10:58:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Adobe [2011-05-07 10:42:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Deployment [2011-05-07 09:29:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\WinUHA [2011-05-07 09:29:33 | 000,000,000 | ---D | C] -- C:\Program Files\WinUHA [2011-05-03 12:35:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Moje dokumenty\Heroes of Newerth [2011-01-17 21:00:05 | 000,434,176 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdehcp.dll [2011-01-17 21:00:05 | 000,356,352 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeinpa.dll [2011-01-17 21:00:04 | 001,200,128 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeserv.dll [2011-01-17 21:00:04 | 000,950,272 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeusb1.dll [2011-01-17 21:00:04 | 000,339,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeiesc.dll [2011-01-17 21:00:04 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeprox.dll [2011-01-17 21:00:03 | 000,647,168 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdepmui.dll [2011-01-17 21:00:03 | 000,565,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdelmpm.dll [2011-01-17 21:00:03 | 000,320,432 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeih.exe [2011-01-17 21:00:02 | 000,663,552 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdehbn3.dll [2011-01-17 21:00:01 | 000,860,160 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecomc.dll [2011-01-17 21:00:01 | 000,598,960 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecoms.exe [2011-01-17 21:00:01 | 000,364,544 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecomm.dll [2011-01-17 21:00:00 | 000,365,488 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecfg.exe [2004-11-24 20:25:52 | 000,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\drvc.dll [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2011-05-30 23:50:40 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011-05-30 23:50:34 | 2146,881,536 | -HS- | M] () -- C:\hiberfil.sys [2011-05-30 23:44:40 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011-05-30 21:14:42 | 000,002,265 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk [2011-05-30 16:31:34 | 000,002,435 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\HiJackThis.lnk [2011-05-29 13:01:50 | 000,000,020 | ---- | M] () -- C:\Documents and Settings\x\__rar_00.313 [2011-05-29 10:44:26 | 000,000,630 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Ventrilo.lnk [2011-05-28 23:07:08 | 000,000,095 | ---- | M] () -- C:\WINDOWS\winamp.ini [2011-05-28 10:33:37 | 000,000,866 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\Skrót do tibialoader.exe.lnk [2011-05-21 23:58:41 | 000,000,644 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Football Manager 2011.lnk [2011-05-21 23:49:16 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2011-05-21 23:49:14 | 000,005,120 | ---- | M] () -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011-05-19 10:37:51 | 000,000,096 | ---- | M] () -- C:\Documents and Settings\x\.asadminpass [2011-05-19 10:25:58 | 000,000,680 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\Skrót do MinecraftSP.exe.lnk [2011-05-18 10:38:57 | 000,001,986 | ---- | M] () -- C:\Documents and Settings\All Users\lxde [2011-05-15 16:49:11 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2011-05-12 21:18:08 | 000,000,791 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\OpenFM.lnk [2011-05-10 16:33:06 | 000,000,211 | -HS- | M] () -- C:\boot.ini [color=#E56717]========== Files Created - No Company Name ==========[/color] [2011-05-29 22:09:25 | 000,422,244 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-S-1-5-21-682003330-1004336348-839522115-1004-0.dat [2011-05-29 22:09:25 | 000,199,294 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-System.dat [2011-05-29 13:11:50 | 000,002,435 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\HiJackThis.lnk [2011-05-29 13:03:24 | 000,141,993 | ---- | C] () -- C:\Documents and Settings\x\Menu Start\Programy\Autostarthello.exe [2011-05-29 13:01:41 | 000,000,020 | ---- | C] () -- C:\Documents and Settings\x\__rar_00.313 [2011-05-29 10:44:26 | 000,000,630 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Ventrilo.lnk [2011-05-28 10:33:37 | 000,000,866 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\Skrót do tibialoader.exe.lnk [2011-05-23 21:15:37 | 000,011,264 | ---- | C] () -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\mekomdo.dll [2011-05-21 23:58:41 | 000,000,644 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Football Manager 2011.lnk [2011-05-19 10:37:51 | 000,000,096 | ---- | C] () -- C:\Documents and Settings\x\.asadminpass [2011-05-19 10:25:58 | 000,000,680 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\Skrót do MinecraftSP.exe.lnk [2011-05-12 21:18:08 | 000,000,791 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\OpenFM.lnk [2011-05-12 21:16:22 | 000,000,680 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Start\Programy\Gadu-Gadu 10.lnk [2011-05-09 21:16:56 | 000,002,265 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk [2011-02-20 13:26:53 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe [2011-02-20 13:25:42 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2011-02-19 17:38:13 | 000,000,064 | ---- | C] () -- C:\WINDOWS\System32\tcfg.ini [2011-01-28 22:23:28 | 000,005,120 | ---- | C] () -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011-01-28 22:23:23 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2011-01-18 20:52:49 | 000,062,304 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat [2011-01-17 21:21:17 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat [2011-01-17 21:07:28 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxdevs.dll [2011-01-17 21:07:27 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\lxdecoin.dll [2011-01-17 21:06:48 | 000,692,224 | ---- | C] () -- C:\WINDOWS\System32\lxdedrs.dll [2011-01-17 21:06:48 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\lxdecnv4.dll [2011-01-17 21:06:48 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\lxdecaps.dll [2011-01-17 21:06:24 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\LXF3PMON.DLL [2011-01-17 21:06:24 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\lxf3oem.dll [2011-01-17 21:06:24 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXF3FXPU.DLL [2011-01-17 21:06:24 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\LXF3PMRC.DLL [2011-01-17 21:00:17 | 000,000,060 | -H-- | C] () -- C:\WINDOWS\System32\lxderwrd.ini [2011-01-17 21:00:05 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\lxdeinst.dll [2011-01-17 21:00:02 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lxdegrd.dll [2008-10-09 08:22:26 | 000,004,293 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2008-10-09 08:21:03 | 001,420,280 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2008-10-09 07:04:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2008-10-09 07:00:23 | 000,000,095 | ---- | C] () -- C:\WINDOWS\winamp.ini [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56spn.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56itl.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56ger.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56fra.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56eng.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56brz.dll [2008-10-09 06:54:16 | 000,049,152 | ---- | C] () -- C:\WINDOWS\sm56jpn.dll [2008-10-09 06:54:16 | 000,045,056 | ---- | C] () -- C:\WINDOWS\sm56cht.dll [2008-10-09 06:54:16 | 000,045,056 | ---- | C] () -- C:\WINDOWS\sm56chs.dll [2008-10-09 06:53:36 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll [2008-10-09 06:53:36 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe [2008-10-09 06:31:53 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2008-10-09 06:27:10 | 000,021,856 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2008-07-05 12:14:48 | 000,456,192 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll [2008-07-05 12:14:44 | 003,591,168 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll [2008-07-05 12:13:16 | 000,708,096 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll [2008-06-22 18:34:00 | 000,177,664 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll [2008-06-13 12:39:38 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll [2008-06-12 19:36:38 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2006-11-02 17:10:16 | 000,080,912 | ---- | C] () -- C:\WINDOWS\System32\sherlock2.exe [2005-05-25 22:02:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2005-05-25 22:02:00 | 001,626,112 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe [2005-05-25 22:02:00 | 001,478,656 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2005-05-25 22:02:00 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe [2005-05-25 22:02:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2005-05-25 22:02:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2005-05-25 22:02:00 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe [2004-10-03 18:50:54 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll [2004-08-04 13:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2004-08-04 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2004-08-04 13:00:00 | 000,555,962 | ---- | C] () -- C:\WINDOWS\System32\perfh015.dat [2004-08-04 13:00:00 | 000,493,638 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2004-08-04 13:00:00 | 000,313,828 | ---- | C] () -- C:\WINDOWS\System32\perfi015.dat [2004-08-04 13:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2004-08-04 13:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2004-08-04 13:00:00 | 000,104,856 | ---- | C] () -- C:\WINDOWS\System32\perfc015.dat [2004-08-04 13:00:00 | 000,084,056 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2004-08-04 13:00:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2004-08-04 13:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2004-08-04 13:00:00 | 000,034,990 | ---- | C] () -- C:\WINDOWS\System32\perfd015.dat [2004-08-04 13:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2004-08-04 13:00:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2004-08-04 13:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2004-08-04 13:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2004-08-04 13:00:00 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin [2004-08-04 13:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 231 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:6BE50C2B < End of report >

Log z GMERA

Kod: Zaznacz wszystko: GMER 1.0.15.15640 - http://www.gmer.net Rootkit scan 2011-05-31 00:04:20 Windows 5.1.2600 Dodatek Service Pack 2 Harddisk0\DR0 -> \Device\Scsi\VIAMRAID1 SAMSUNG_ rev.2SS0 Running: upy99m47.exe; Driver: C:\DOCUME~1\x\USTAWI~1\Temp\uwxcykog.sys ---- System - GMER 1.0.15 ---- SSDT sptd.sys ZwCreateKey [0xBA6CEFA0] SSDT sptd.sys ZwEnumerateKey [0xBA703018] SSDT sptd.sys ZwEnumerateValueKey [0xBA7033A6] SSDT sptd.sys ZwOpenKey [0xBA6CEF80] SSDT sptd.sys ZwQueryKey [0xBA70347E] SSDT sptd.sys ZwQueryValueKey [0xBA7032FE] SSDT sptd.sys ZwSetValueKey [0xBA703510] INT 0x62 ? 89E58CB8 INT 0x63 ? 89A5EF00 INT 0x82 ? 89E58CB8 INT 0x83 ? 89E16CB8 INT 0x83 ? 89A5EF00 INT 0x83 ? 89E16CB8 INT 0xB4 ? 89A5EF00 ---- Kernel code sections - GMER 1.0.15 ---- .text sptd.sys BA692000 32 Bytes [E0, 06, 6D, 80, 5C, 57, 6D, ...] .text sptd.sys BA692024 40 Bytes [90, 0B, 53, 80, 80, 40, 54, ...] .text sptd.sys BA69204D 79 Bytes CALL B4E9726F .text sptd.sys BA69209D 272 Bytes [4C, 53, 80, A0, 4D, 53, 80, ...] .text sptd.sys BA6921AE 30 Bytes [54, 80, B0, 5A, 53, 80, AC, ...] .text ... .sptd2 C:\WINDOWS\system32\drivers\sptd.sys entry point in ".sptd2" section [0xBA73C9E3] ? C:\WINDOWS\system32\drivers\sptd.sys Proces nie może uzyskać dostępu do pliku, ponieważ jest on używany przez inny proces. .text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB8EBD360, 0x305AC7, 0xE8000020] .text USBPORT.SYS!DllUnload B8E7962C 5 Bytes JMP 89A5E410 ---- User code sections - GMER 1.0.15 ---- .text C:\WINDOWS\Explorer.EXE[288] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 00AB000A .text C:\WINDOWS\Explorer.EXE[288] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 00AC000A .text C:\WINDOWS\Explorer.EXE[288] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 00A5000C .text C:\WINDOWS\System32\svchost.exe[1296] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 00A2000A .text C:\WINDOWS\System32\svchost.exe[1296] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 00A3000A .text C:\WINDOWS\System32\svchost.exe[1296] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 00A1000C .text C:\WINDOWS\System32\svchost.exe[1296] ole32.dll!CoCreateInstance 774F055E 5 Bytes JMP 00F5000A .text C:\Program Files\Mozilla Firefox\firefox.exe[2244] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 0111000A .text C:\Program Files\Mozilla Firefox\firefox.exe[2244] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 0112000A .text C:\Program Files\Mozilla Firefox\firefox.exe[2244] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 0110000C .text C:\WINDOWS\system32\wuauclt.exe[2264] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 0116000A .text C:\WINDOWS\system32\wuauclt.exe[2264] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 0117000A .text C:\WINDOWS\system32\wuauclt.exe[2264] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 010C000C .text C:\Program Files\Mozilla Firefox\plugin-container.exe[2892] USER32.dll!SetWindowLongA 77D3DED3 5 Bytes JMP 10698DD9 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation) .text C:\Program Files\Mozilla Firefox\plugin-container.exe[2892] USER32.dll!SetWindowLongW 77D3DEF1 5 Bytes JMP 10698D6B C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation) .text C:\Program Files\Mozilla Firefox\plugin-container.exe[2892] USER32.dll!GetWindowInfo 77D3F122 5 Bytes JMP 104C7187 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation) .text C:\Program Files\Mozilla Firefox\plugin-container.exe[2892] USER32.dll!TrackPopupMenu 77D84F16 5 Bytes JMP 104C7781 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation) ---- Kernel IAT/EAT - GMER 1.0.15 ---- IAT \WINDOWS\system32\DRIVERS\PCIIDEX.SYS[HAL.dll!WRITE_PORT_ULONG] [BA69420E] sptd.sys IAT \WINDOWS\system32\DRIVERS\PCIIDEX.SYS[HAL.dll!READ_PORT_UCHAR] [BA69370C] sptd.sys IAT \WINDOWS\system32\DRIVERS\PCIIDEX.SYS[HAL.dll!WRITE_PORT_UCHAR] [BA693EEE] sptd.sys IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [BA69370C] sptd.sys IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [BA6938F0] sptd.sys IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [BA693832] sptd.sys IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [BA6940CC] sptd.sys IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [BA693EEE] sptd.sys IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [BA6A7F56] sptd.sys ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Ntfs \Ntfs 89E111E8 Device \Driver\NetBT \Device\NetBT_Tcpip_{15A09A22-0B7B-48EF-B226-56A9A3BAE310} 88EE51E8 AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) Device \Driver\usbuhci \Device\USBPDO-0 89A5F430 Device \Driver\NetBT \Device\NetBT_Tcpip_{F008FA0B-DF5A-4DED-80CF-00EF7E9A945F} 88EE51E8 Device \Driver\usbuhci \Device\USBPDO-1 89A5F430 Device \Driver\usbehci \Device\USBPDO-2 89B7F430 Device \Driver\usbuhci \Device\USBPDO-3 89A5F430 Device \Driver\usbuhci \Device\USBPDO-4 89A5F430 Device \Driver\Cdrom \Device\CdRom0 89A9D430 Device \Driver\atapi \Device\Ide\IdePort0 89E581E8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 89E581E8 Device \Driver\atapi \Device\Ide\IdePort1 89E581E8 Device \Driver\NetBT \Device\NetBt_Wins_Export 88EE51E8 Device \Driver\usbuhci \Device\USBFDO-0 89A5F430 Device \Driver\usbuhci \Device\USBFDO-1 89A5F430 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 88EA4430 Device \Driver\usbuhci \Device\USBFDO-2 89A5F430 Device \FileSystem\MRxSmb \Device\LanmanRedirector 88EA4430 Device \Driver\usbuhci \Device\USBFDO-3 89A5F430 Device \Driver\usbehci \Device\USBFDO-4 89B7F430 Device \Driver\VIAMRAID -> DriverStartIo \Device\Scsi\VIAMRAID1 89BEF3E5 Device \Driver\VIAMRAID \Device\Scsi\VIAMRAID1 89E121E8 Device \FileSystem\Cdfs \Cdfs 88E301E8 Device \Device\Scsi\VIAMRAID1Port2Path0Target0Lun0 -> \??\SCSI#Disk&Ven_SAMSUNG&Prod_HM320JI&Rev_2SS0#5&14bf2cac&0&000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792 ---- Disk sectors - GMER 1.0.15 ---- Disk \Device\Harddisk0\DR0 TDL4@MBR code has been found <-- ROOTKIT !!! Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior ---- EOF - GMER 1.0.15 ----

**Posty:** 18165 · przez **wojtas** 31 Maj 2011, 09:31

log z Gmera robiony w nieodpowiednich warunkach :

[Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)

poczytaj i zastosuj się do tego,

wykonaj skan: Kaspersky TDSSKiller, jeśli coś znajdzie dajesz Skip. po tym dajesz 3 nowe logi + raport z TDSSKiller'a

**Posty:** 176 · przez **peterka** 31 Maj 2011, 15:37

Log z GMERA po odinstalowaniu tym porgramme

Kod: Zaznacz wszystko: GMER 1.0.15.15640 - http://www.gmer.net Rootkit scan 2011-05-31 15:32:14 Windows 5.1.2600 Dodatek Service Pack 2 Harddisk0\DR0 -> \Device\Scsi\VIAMRAID1 SAMSUNG_ rev.2SS0 Running: upy99m47.exe; Driver: C:\DOCUME~1\x\USTAWI~1\Temp\uwxcykog.sys ---- Kernel code sections - GMER 1.0.15 ---- .text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB8FD3360, 0x305AC7, 0xE8000020] ---- User code sections - GMER 1.0.15 ---- .text C:\WINDOWS\System32\svchost.exe[1272] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 00C0000A .text C:\WINDOWS\System32\svchost.exe[1272] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 00C1000A .text C:\WINDOWS\System32\svchost.exe[1272] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 00BF000C .text C:\WINDOWS\System32\svchost.exe[1272] ole32.dll!CoCreateInstance 774F055E 5 Bytes JMP 00A8000A .text C:\Program Files\Mozilla Firefox\firefox.exe[1844] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 0112000A .text C:\Program Files\Mozilla Firefox\firefox.exe[1844] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 0113000A .text C:\Program Files\Mozilla Firefox\firefox.exe[1844] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 0111000C .text C:\WINDOWS\Explorer.EXE[2024] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 00AB000A .text C:\WINDOWS\Explorer.EXE[2024] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 00AC000A .text C:\WINDOWS\Explorer.EXE[2024] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 00A5000C .text C:\WINDOWS\system32\wuauclt.exe[2836] ntdll.dll!NtProtectVirtualMemory 7C90DEB6 5 Bytes JMP 0109000A .text C:\WINDOWS\system32\wuauclt.exe[2836] ntdll.dll!NtWriteVirtualMemory 7C90EA32 5 Bytes JMP 0175000A .text C:\WINDOWS\system32\wuauclt.exe[2836] ntdll.dll!KiUserExceptionDispatcher 7C90EAEC 5 Bytes JMP 0108000C ---- Devices - GMER 1.0.15 ---- AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) Device \Driver\VIAMRAID -> DriverStartIo \Device\Scsi\VIAMRAID1 89BDA3E5 Device \Device\Scsi\VIAMRAID1Port2Path0Target0Lun0 -> \??\SCSI#Disk&Ven_SAMSUNG&Prod_HM320JI&Rev_2SS0#5&14bf2cac&0&000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} device not found ---- Disk sectors - GMER 1.0.15 ---- Disk \Device\Harddisk0\DR0 TDL4@MBR code has been found <-- ROOTKIT !!! Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior ---- EOF - GMER 1.0.15 ----

Log z Kasperskiego

Kod: Zaznacz wszystko: 2011/05/31 15:33:19.0828 3184 TDSS rootkit removing tool 2.5.3.0 May 25 2011 07:09:24 2011/05/31 15:33:19.0984 3184 ================================================================================ 2011/05/31 15:33:19.0984 3184 SystemInfo: 2011/05/31 15:33:19.0984 3184 2011/05/31 15:33:19.0984 3184 OS Version: 5.1.2600 ServicePack: 2.0 2011/05/31 15:33:19.0984 3184 Product type: Workstation 2011/05/31 15:33:19.0984 3184 ComputerName: X-C60DE7B3A3C14 2011/05/31 15:33:19.0984 3184 UserName: x 2011/05/31 15:33:19.0984 3184 Windows directory: C:\WINDOWS 2011/05/31 15:33:19.0984 3184 System windows directory: C:\WINDOWS 2011/05/31 15:33:19.0984 3184 Processor architecture: Intel x86 2011/05/31 15:33:19.0984 3184 Number of processors: 1 2011/05/31 15:33:19.0984 3184 Page size: 0x1000 2011/05/31 15:33:19.0984 3184 Boot type: Normal boot 2011/05/31 15:33:19.0984 3184 ================================================================================ 2011/05/31 15:33:20.0468 3184 Initialize success 2011/05/31 15:33:21.0562 3256 ================================================================================ 2011/05/31 15:33:21.0562 3256 Scan started 2011/05/31 15:33:21.0562 3256 Mode: Manual; 2011/05/31 15:33:21.0562 3256 ================================================================================ 2011/05/31 15:33:22.0093 3256 ACPI (a966410ecf83b81f3b0b8e07a71957d4) C:\WINDOWS\system32\DRIVERS\ACPI.sys 2011/05/31 15:33:22.0140 3256 ACPIEC (66a42b7db194e24b973bbcce840a0f3f) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys 2011/05/31 15:33:22.0250 3256 aec (841f385c6cfaf66b58fbd898722bb4f0) C:\WINDOWS\system32\drivers\aec.sys 2011/05/31 15:33:22.0312 3256 AFD (5ac495f4cb807b2b98ad2ad591e6d92e) C:\WINDOWS\System32\drivers\afd.sys 2011/05/31 15:33:22.0531 3256 Arp1394 (f0d692b0bffb46e30eb3cea168bbc49f) C:\WINDOWS\system32\DRIVERS\arp1394.sys 2011/05/31 15:33:22.0718 3256 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 2011/05/31 15:33:22.0765 3256 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys 2011/05/31 15:33:22.0843 3256 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 2011/05/31 15:33:23.0156 3256 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 2011/05/31 15:33:23.0250 3256 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 2011/05/31 15:33:23.0500 3256 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 2011/05/31 15:33:23.0625 3256 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 2011/05/31 15:33:24.0000 3256 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 2011/05/31 15:33:24.0015 3256 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys 2011/05/31 15:33:24.0093 3256 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys 2011/05/31 15:33:24.0250 3256 CmBatt (4266be808f85826aedf3c64c1e240203) C:\WINDOWS\system32\DRIVERS\CmBatt.sys 2011/05/31 15:33:24.0312 3256 Compbatt (df1b1a24bf52d0ebc01ed4ece8979f50) C:\WINDOWS\system32\DRIVERS\compbatt.sys 2011/05/31 15:33:24.0515 3256 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys 2011/05/31 15:33:24.0687 3256 dmboot (3b809ffad55dcebdb156d5ca1bd3da65) C:\WINDOWS\system32\drivers\dmboot.sys 2011/05/31 15:33:24.0765 3256 dmio (27725b6501201c3080ba73048bce389a) C:\WINDOWS\system32\drivers\dmio.sys 2011/05/31 15:33:24.0812 3256 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 2011/05/31 15:33:24.0890 3256 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys 2011/05/31 15:33:25.0000 3256 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys 2011/05/31 15:33:25.0140 3256 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys 2011/05/31 15:33:25.0187 3256 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\drivers\Fdc.sys 2011/05/31 15:33:25.0234 3256 Fips (c5fb298257c0a6514ea17835e774ea0a) C:\WINDOWS\system32\drivers\Fips.sys 2011/05/31 15:33:25.0281 3256 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\drivers\Flpydisk.sys 2011/05/31 15:33:25.0343 3256 FltMgr (157754f0df355a9e0a6f54721914f9c6) C:\WINDOWS\system32\DRIVERS\fltMgr.sys 2011/05/31 15:33:25.0375 3256 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 2011/05/31 15:33:25.0421 3256 Ftdisk (ed6d921d8ab423138fb35beee6d6a6cb) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 2011/05/31 15:33:25.0468 3256 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys 2011/05/31 15:33:25.0531 3256 HdAudAddService (2a013e7530beab6e569faa83f517e836) C:\WINDOWS\system32\drivers\HdAudio.sys 2011/05/31 15:33:25.0578 3256 HDAudBus (3fcc124b6e08ee0e9351f717dd136939) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 2011/05/31 15:33:25.0625 3256 hidusb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys 2011/05/31 15:33:25.0765 3256 HTTP (c19b522a9ae0bbc3293397f3055e80a1) C:\WINDOWS\system32\Drivers\HTTP.sys 2011/05/31 15:33:25.0921 3256 i8042prt (2656fdfe0a7916c3a16f374454c55dd9) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 2011/05/31 15:33:25.0968 3256 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys 2011/05/31 15:33:26.0156 3256 IntcAzAudAddService (e7d8f417a4cfe7f1eaca6ae6256347e8) C:\WINDOWS\system32\drivers\RtkHDAud.sys 2011/05/31 15:33:26.0250 3256 IntelIde (dc6c33fd296a037556f87d3b923c02b3) C:\WINDOWS\system32\DRIVERS\intelide.sys 2011/05/31 15:33:26.0796 3256 intelppm (78a353438791c6d04c64013a5abec6bd) C:\WINDOWS\system32\DRIVERS\intelppm.sys 2011/05/31 15:33:26.0843 3256 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys 2011/05/31 15:33:26.0890 3256 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 2011/05/31 15:33:26.0921 3256 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys 2011/05/31 15:33:26.0968 3256 IpNat (b5a8e215ac29d24d60b4d1250ef05ace) C:\WINDOWS\system32\DRIVERS\ipnat.sys 2011/05/31 15:33:27.0015 3256 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys 2011/05/31 15:33:27.0078 3256 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys 2011/05/31 15:33:27.0140 3256 isapnp (01a9e68528f4f34e5702123d27c67bd4) C:\WINDOWS\system32\DRIVERS\isapnp.sys 2011/05/31 15:33:27.0203 3256 Kbdclass (cc13db862f929ae33f64c3bedc01cd31) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 2011/05/31 15:33:27.0234 3256 kbdhid (831be9197bdace6bdcac1bfdbe1c380f) C:\WINDOWS\system32\DRIVERS\kbdhid.sys 2011/05/31 15:33:27.0312 3256 kmixer (d93cad07c5683db066b0b2d2d3790ead) C:\WINDOWS\system32\drivers\kmixer.sys 2011/05/31 15:33:27.0343 3256 KSecDD (eb7ffe87fd367ea8fca0506f74a87fbb) C:\WINDOWS\system32\drivers\KSecDD.sys 2011/05/31 15:33:27.0484 3256 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 2011/05/31 15:33:27.0546 3256 Modem (15f33d12d604d0198ce5561f102cd9c5) C:\WINDOWS\system32\drivers\Modem.sys 2011/05/31 15:33:27.0578 3256 Mouclass (69c12b99ae8b6b99ec314e9b99833728) C:\WINDOWS\system32\DRIVERS\mouclass.sys 2011/05/31 15:33:27.0625 3256 mouhid (ecec1e6cd558ab80f944f31326e9d3b5) C:\WINDOWS\system32\DRIVERS\mouhid.sys 2011/05/31 15:33:27.0671 3256 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys 2011/05/31 15:33:27.0734 3256 MRxDAV (46edcc8f2db2f322c24f48785cb46366) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 2011/05/31 15:33:27.0781 3256 MRxSmb (1fd607fc67f7f7c633c3da65bfc53d18) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 2011/05/31 15:33:27.0859 3256 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys 2011/05/31 15:33:27.0906 3256 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys 2011/05/31 15:33:27.0937 3256 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 2011/05/31 15:33:27.0968 3256 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys 2011/05/31 15:33:28.0046 3256 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 2011/05/31 15:33:28.0140 3256 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys 2011/05/31 15:33:28.0187 3256 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys 2011/05/31 15:33:28.0218 3256 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 2011/05/31 15:33:28.0250 3256 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys 2011/05/31 15:33:28.0296 3256 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys 2011/05/31 15:33:28.0343 3256 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 2011/05/31 15:33:28.0390 3256 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 2011/05/31 15:33:28.0421 3256 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 2011/05/31 15:33:28.0453 3256 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys 2011/05/31 15:33:28.0484 3256 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys 2011/05/31 15:33:28.0531 3256 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys 2011/05/31 15:33:28.0640 3256 NIC1394 (5c5c53db4fef16cf87b9911c7e8c6fbc) C:\WINDOWS\system32\DRIVERS\nic1394.sys 2011/05/31 15:33:28.0703 3256 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys 2011/05/31 15:33:28.0781 3256 Ntfs (b78be402c3f63dd55521f73876951cdd) C:\WINDOWS\system32\drivers\Ntfs.sys 2011/05/31 15:33:28.0859 3256 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 2011/05/31 15:33:29.0140 3256 nv (71d5ae11bf1a595d987be8ea36365e83) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys 2011/05/31 15:33:29.0343 3256 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 2011/05/31 15:33:29.0375 3256 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 2011/05/31 15:33:29.0437 3256 ohci1394 (0951db8e5823ea366b0e408d71e1ba2a) C:\WINDOWS\system32\DRIVERS\ohci1394.sys 2011/05/31 15:33:29.0484 3256 Parport (2ff48d8fdc815a8492fb2bd81e6999c2) C:\WINDOWS\system32\drivers\Parport.sys 2011/05/31 15:33:29.0515 3256 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys 2011/05/31 15:33:29.0593 3256 ParVdm (453ec2c2a20a1382f564541918520eeb) C:\WINDOWS\system32\drivers\ParVdm.sys 2011/05/31 15:33:29.0671 3256 PCI (5fd05c92ec56f696eaa50b68cef1b84a) C:\WINDOWS\system32\DRIVERS\pci.sys 2011/05/31 15:33:29.0750 3256 PCIIde (548cf2d6369eae441a4c6baa75bc4f0a) C:\WINDOWS\system32\DRIVERS\pciide.sys 2011/05/31 15:33:29.0812 3256 Pcmcia (2849812217ecec059cb45f80eb6e52d4) C:\WINDOWS\system32\drivers\Pcmcia.sys 2011/05/31 15:33:30.0093 3256 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys 2011/05/31 15:33:30.0140 3256 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys 2011/05/31 15:33:30.0187 3256 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 2011/05/31 15:33:30.0234 3256 QCDonner (fddd1aeb9f81ef1e6e48ae1edc2a97d6) C:\WINDOWS\system32\DRIVERS\OVCD.sys 2011/05/31 15:33:30.0453 3256 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 2011/05/31 15:33:30.0515 3256 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 2011/05/31 15:33:30.0546 3256 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 2011/05/31 15:33:30.0593 3256 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 2011/05/31 15:33:30.0656 3256 Rdbss (29d66245adba878fff574cd66abd2884) C:\WINDOWS\system32\DRIVERS\rdbss.sys 2011/05/31 15:33:30.0703 3256 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 2011/05/31 15:33:30.0796 3256 RDPWD (d4f5643d7714ef499ae9527fdcd50894) C:\WINDOWS\system32\drivers\RDPWD.sys 2011/05/31 15:33:30.0875 3256 redbook (bddcece9acdad26841c987d10376f6f7) C:\WINDOWS\system32\DRIVERS\redbook.sys 2011/05/31 15:33:30.0968 3256 RTL8023xp (4a0ae7891fcf74acc848b109294cb80f) C:\WINDOWS\system32\DRIVERS\Rtlnicxp.sys 2011/05/31 15:33:31.0062 3256 Secdrv (d26e26ea516450af9d072635c60387f4) C:\WINDOWS\system32\DRIVERS\secdrv.sys 2011/05/31 15:33:31.0125 3256 Serial (859bc6f8c3d58cfda9181e9926c7ddb9) C:\WINDOWS\system32\drivers\Serial.sys 2011/05/31 15:33:31.0218 3256 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys 2011/05/31 15:33:31.0343 3256 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys 2011/05/31 15:33:31.0453 3256 smserial (34d634366fc57524f5932eaec40e4fcb) C:\WINDOWS\system32\DRIVERS\smserial.sys 2011/05/31 15:33:31.0546 3256 splitter (8e186b8f23295d1e42c573b82b80d548) C:\WINDOWS\system32\drivers\splitter.sys 2011/05/31 15:33:31.0640 3256 sr (6145ca23bccda679a772ec0af42d6eb5) C:\WINDOWS\system32\DRIVERS\sr.sys 2011/05/31 15:33:31.0703 3256 Srv (20b7e396720353e4117d64d9dcb926ca) C:\WINDOWS\system32\DRIVERS\srv.sys 2011/05/31 15:33:31.0765 3256 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys 2011/05/31 15:33:31.0812 3256 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys 2011/05/31 15:33:31.0843 3256 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys 2011/05/31 15:33:32.0171 3256 SynTP (59e9d90d6373f8ad4e3ebd0ecdedd35e) C:\WINDOWS\system32\DRIVERS\SynTP.sys 2011/05/31 15:33:32.0218 3256 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys 2011/05/31 15:33:32.0296 3256 Tcpip (9f4b36614a0fc234525ba224957de55c) C:\WINDOWS\system32\DRIVERS\tcpip.sys 2011/05/31 15:33:32.0484 3256 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys 2011/05/31 15:33:32.0515 3256 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys 2011/05/31 15:33:32.0609 3256 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys 2011/05/31 15:33:32.0859 3256 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys 2011/05/31 15:33:33.0015 3256 Update (aff2e5045961bbc0a602bb6f95eb1345) C:\WINDOWS\system32\DRIVERS\update.sys 2011/05/31 15:33:33.0187 3256 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys 2011/05/31 15:33:33.0296 3256 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys 2011/05/31 15:33:33.0375 3256 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys 2011/05/31 15:33:33.0484 3256 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys 2011/05/31 15:33:33.0546 3256 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 2011/05/31 15:33:33.0578 3256 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys 2011/05/31 15:33:33.0640 3256 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys 2011/05/31 15:33:33.0718 3256 VIAMRAID (1b7b0954af54e716f697c511d68c150e) C:\WINDOWS\system32\DRIVERS\viamraid.sys 2011/05/31 15:33:33.0750 3256 VolSnap (ecd173739b8ec10a814cc18653df5a36) C:\WINDOWS\system32\drivers\VolSnap.sys 2011/05/31 15:33:33.0937 3256 w29n51 (9ee38ffcb4cbe5bee6c305700ddc4725) C:\WINDOWS\system32\DRIVERS\w29n51.sys 2011/05/31 15:33:34.0078 3256 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys 2011/05/31 15:33:34.0250 3256 wdmaud (2797f33ebf50466020c430ee4f037933) C:\WINDOWS\system32\drivers\wdmaud.sys 2011/05/31 15:33:34.0453 3256 WmiAcpi (ae2c8544e747c20062db27456ea2d67a) C:\WINDOWS\system32\DRIVERS\wmiacpi.sys 2011/05/31 15:33:34.0578 3256 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 2011/05/31 15:33:34.0765 3256 MBR (0x1B8) (56f7af5114617a5ed4000a95e1af1b06) \Device\Harddisk0\DR0 2011/05/31 15:33:34.0781 3256 \Device\Harddisk0\DR0 - detected Rootkit.Win32.TDSS.tdl4 (0) 2011/05/31 15:33:34.0781 3256 ================================================================================ 2011/05/31 15:33:34.0781 3256 Scan finished 2011/05/31 15:33:34.0781 3256 ================================================================================ 2011/05/31 15:33:34.0843 3244 Detected object count: 1 2011/05/31 15:33:34.0843 3244 Actual detected object count: 1 2011/05/31 15:33:39.0000 3244 Rootkit.Win32.TDSS.tdl4(\Device\Harddisk0\DR0) - User select action: Skip

Log z OTL

Kod: Zaznacz wszystko: OTL logfile created on: 2011-05-31 15:34:03 - Run 5 OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\x\Moje dokumenty\Pobieranie Windows XP Home Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 2,00 Gb Total Physical Memory | 1,43 Gb Available Physical Memory | 71,30% Memory free 3,35 Gb Paging File | 2,95 Gb Available in Paging File | 88,10% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 48,83 Gb Total Space | 35,40 Gb Free Space | 72,49% Space Free | Partition Type: NTFS Drive D: | 117,19 Gb Total Space | 63,48 Gb Free Space | 54,17% Space Free | Partition Type: NTFS Drive F: | 132,07 Gb Total Space | 63,52 Gb Free Space | 48,10% Space Free | Partition Type: NTFS Computer Name: X-C60DE7B3A3C14 | User Name: x | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2011-05-29 13:16:27 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\x\Moje dokumenty\Pobieranie\OTL.exe PRC - [2011-04-29 22:11:33 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2007-05-29 15:07:58 | 000,598,960 | ---- | M] ( ) -- C:\WINDOWS\system32\lxdecoms.exe PRC - [2005-03-23 00:00:00 | 000,090,112 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE PRC - [2004-08-04 13:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2011-05-29 13:16:27 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\x\Moje dokumenty\Pobieranie\OTL.exe MOD - [2004-08-04 13:00:00 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt) SRV - [2011-01-28 16:11:20 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2007-05-29 15:07:58 | 000,598,960 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\lxdecoms.exe -- (lxde_device) SRV - [2007-05-29 15:06:43 | 000,099,248 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdeserv.exe -- (lxdeCATSCustConnectService) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2005-09-12 00:00:00 | 003,298,432 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Sterownik karty Intel(R) DRV - [2005-05-26 18:19:18 | 000,839,724 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smserial.sys -- (smserial) DRV - [2005-03-23 00:00:00 | 002,547,008 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2005-01-07 17:07:16 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService) DRV - [2004-02-12 00:00:00 | 000,070,912 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.startup.homepage: "about:home" FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011-04-29 22:11:37 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011-04-01 13:15:11 | 000,000,000 | ---D | M] [2008-10-09 07:04:17 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\x\Dane aplikacji\Mozilla\Extensions [2011-05-24 16:42:44 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\x\Dane aplikacji\Mozilla\Firefox\Profiles\2k7d3jdr.default\extensions [2011-05-09 21:17:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2011-05-09 21:17:40 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011-01-17 22:03:45 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011-03-06 11:47:56 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} File not found (No name found) -- () (No name found) -- C:\DOCUMENTS AND SETTINGS\X\DANE APLIKACJI\MOZILLA\FIREFOX\PROFILES\2K7D3JDR.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI [2011-01-17 22:03:34 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2011-04-29 22:11:33 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll [2009-12-31 11:05:32 | 000,040,960 | ---- | M] (BYOND) -- C:\Program Files\Mozilla Firefox\plugins\npbyond.dll [2011-02-02 22:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll [2011-04-01 13:15:03 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2011-04-01 13:15:03 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2011-04-01 13:15:03 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2011-04-01 13:15:03 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2011-04-01 13:15:03 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2011-04-01 13:15:03 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml Hosts file not found O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [Skrót do strony właściwości High Definition Audio] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider) O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008-10-09 06:29:27 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{4845bef3-5860-11e0-a8ff-00150028a536}\Shell - "" = AutoRun O33 - MountPoints2\{4845bef3-5860-11e0-a8ff-00150028a536}\Shell\AutoRun\command - "" = G:\autorun.exe O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2011-05-30 22:19:47 | 000,000,000 | ---D | C] -- C:\_OTL [2011-05-29 13:11:50 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro [2011-05-29 13:11:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Menu Start\Programy\HiJackThis [2011-05-29 12:58:34 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\x\Recent [2011-05-29 10:44:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Ventrilo [2011-05-29 10:44:25 | 000,000,000 | ---D | C] -- C:\Program Files\Ventrilo [2011-05-29 10:44:07 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard [2011-05-29 10:10:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\Ventrilo [2011-05-27 19:00:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP [2011-05-27 18:59:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\ElfBot NG [2011-05-22 00:02:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Sports Interactive [2011-05-22 00:01:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Moje dokumenty\Sports Interactive [2011-05-22 00:01:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dokumenty\Sports Interactive [2011-05-22 00:01:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Sports Interactive [2011-05-22 00:01:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\Sports Interactive [2011-05-21 23:58:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Menu Start\Programy\Sports Interactive [2011-05-21 23:51:21 | 000,000,000 | -H-D | C] -- C:\Program Files\Zero G Registry [2011-05-21 23:50:45 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\x\InstallAnywhere [2011-05-19 10:26:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Application Data [2011-05-19 10:24:38 | 000,000,000 | ---D | C] -- C:\glassfish3 [2011-05-19 10:09:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\.minecraft [2011-05-16 16:07:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump [2011-05-15 16:49:11 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2011-05-12 21:19:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\.gstreamer-0.10 [2011-05-12 21:18:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\OpenFM [2011-05-12 21:18:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\OpenFM [2011-05-12 21:18:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10 [2011-05-12 21:16:10 | 000,000,000 | ---D | C] -- C:\Program Files\Gadu-Gadu 10 [2011-05-11 19:01:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Pulpit\Niemiec [2011-05-09 21:17:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Skype Extras [2011-05-09 21:16:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Skype [2011-05-09 21:16:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype [2011-05-08 22:52:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Microsoft Silverlight [2011-05-08 22:52:06 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2011-05-07 15:16:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\SKIDROW [2011-05-07 15:14:25 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft XNA [2011-05-07 10:58:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Adobe [2011-05-07 10:42:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Deployment [2011-05-07 09:29:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\WinUHA [2011-05-07 09:29:33 | 000,000,000 | ---D | C] -- C:\Program Files\WinUHA [2011-05-03 12:35:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Moje dokumenty\Heroes of Newerth [2011-01-17 21:00:05 | 000,434,176 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdehcp.dll [2011-01-17 21:00:05 | 000,356,352 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeinpa.dll [2011-01-17 21:00:04 | 001,200,128 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeserv.dll [2011-01-17 21:00:04 | 000,950,272 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeusb1.dll [2011-01-17 21:00:04 | 000,339,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeiesc.dll [2011-01-17 21:00:04 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeprox.dll [2011-01-17 21:00:03 | 000,647,168 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdepmui.dll [2011-01-17 21:00:03 | 000,565,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdelmpm.dll [2011-01-17 21:00:03 | 000,320,432 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeih.exe [2011-01-17 21:00:02 | 000,663,552 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdehbn3.dll [2011-01-17 21:00:01 | 000,860,160 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecomc.dll [2011-01-17 21:00:01 | 000,598,960 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecoms.exe [2011-01-17 21:00:01 | 000,364,544 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecomm.dll [2011-01-17 21:00:00 | 000,365,488 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecfg.exe [2004-11-24 20:25:52 | 000,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\drvc.dll [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2011-05-31 15:16:04 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011-05-31 15:15:58 | 2146,881,536 | -HS- | M] () -- C:\hiberfil.sys [2011-05-30 23:44:40 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011-05-30 21:14:42 | 000,002,265 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk [2011-05-30 16:31:34 | 000,002,435 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\HiJackThis.lnk [2011-05-29 13:01:50 | 000,000,020 | ---- | M] () -- C:\Documents and Settings\x\__rar_00.313 [2011-05-29 10:44:26 | 000,000,630 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Ventrilo.lnk [2011-05-28 23:07:08 | 000,000,095 | ---- | M] () -- C:\WINDOWS\winamp.ini [2011-05-28 10:33:37 | 000,000,866 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\Skrót do tibialoader.exe.lnk [2011-05-21 23:58:41 | 000,000,644 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Football Manager 2011.lnk [2011-05-21 23:49:16 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2011-05-21 23:49:14 | 000,005,120 | ---- | M] () -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011-05-19 10:37:51 | 000,000,096 | ---- | M] () -- C:\Documents and Settings\x\.asadminpass [2011-05-19 10:25:58 | 000,000,680 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\Skrót do MinecraftSP.exe.lnk [2011-05-18 10:38:57 | 000,001,986 | ---- | M] () -- C:\Documents and Settings\All Users\lxde [2011-05-15 16:49:11 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2011-05-12 21:18:08 | 000,000,791 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\OpenFM.lnk [2011-05-10 16:33:06 | 000,000,211 | -HS- | M] () -- C:\boot.ini [color=#E56717]========== Files Created - No Company Name ==========[/color] [2011-05-29 22:09:25 | 000,422,244 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-S-1-5-21-682003330-1004336348-839522115-1004-0.dat [2011-05-29 22:09:25 | 000,199,294 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-System.dat [2011-05-29 13:11:50 | 000,002,435 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\HiJackThis.lnk [2011-05-29 13:03:24 | 000,141,993 | ---- | C] () -- C:\Documents and Settings\x\Menu Start\Programy\Autostarthello.exe [2011-05-29 13:01:41 | 000,000,020 | ---- | C] () -- C:\Documents and Settings\x\__rar_00.313 [2011-05-29 10:44:26 | 000,000,630 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Ventrilo.lnk [2011-05-28 10:33:37 | 000,000,866 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\Skrót do tibialoader.exe.lnk [2011-05-23 21:15:37 | 000,011,264 | ---- | C] () -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\mekomdo.dll [2011-05-21 23:58:41 | 000,000,644 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Football Manager 2011.lnk [2011-05-19 10:37:51 | 000,000,096 | ---- | C] () -- C:\Documents and Settings\x\.asadminpass [2011-05-19 10:25:58 | 000,000,680 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\Skrót do MinecraftSP.exe.lnk [2011-05-12 21:18:08 | 000,000,791 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\OpenFM.lnk [2011-05-12 21:16:22 | 000,000,680 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Start\Programy\Gadu-Gadu 10.lnk [2011-05-09 21:16:56 | 000,002,265 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk [2011-02-20 13:26:53 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe [2011-02-20 13:25:42 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2011-02-19 17:38:13 | 000,000,064 | ---- | C] () -- C:\WINDOWS\System32\tcfg.ini [2011-01-28 22:23:28 | 000,005,120 | ---- | C] () -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011-01-28 22:23:23 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2011-01-18 20:52:49 | 000,062,304 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat [2011-01-17 21:21:17 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat [2011-01-17 21:07:28 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxdevs.dll [2011-01-17 21:07:27 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\lxdecoin.dll [2011-01-17 21:06:48 | 000,692,224 | ---- | C] () -- C:\WINDOWS\System32\lxdedrs.dll [2011-01-17 21:06:48 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\lxdecnv4.dll [2011-01-17 21:06:48 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\lxdecaps.dll [2011-01-17 21:06:24 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\LXF3PMON.DLL [2011-01-17 21:06:24 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\lxf3oem.dll [2011-01-17 21:06:24 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXF3FXPU.DLL [2011-01-17 21:06:24 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\LXF3PMRC.DLL [2011-01-17 21:00:17 | 000,000,060 | -H-- | C] () -- C:\WINDOWS\System32\lxderwrd.ini [2011-01-17 21:00:05 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\lxdeinst.dll [2011-01-17 21:00:02 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lxdegrd.dll [2008-10-09 08:22:26 | 000,004,293 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2008-10-09 08:21:03 | 001,420,280 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2008-10-09 07:04:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2008-10-09 07:00:23 | 000,000,095 | ---- | C] () -- C:\WINDOWS\winamp.ini [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56spn.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56itl.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56ger.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56fra.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56eng.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56brz.dll [2008-10-09 06:54:16 | 000,049,152 | ---- | C] () -- C:\WINDOWS\sm56jpn.dll [2008-10-09 06:54:16 | 000,045,056 | ---- | C] () -- C:\WINDOWS\sm56cht.dll [2008-10-09 06:54:16 | 000,045,056 | ---- | C] () -- C:\WINDOWS\sm56chs.dll [2008-10-09 06:53:36 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll [2008-10-09 06:53:36 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe [2008-10-09 06:31:53 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2008-10-09 06:27:10 | 000,021,856 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2008-07-05 12:14:48 | 000,456,192 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll [2008-07-05 12:14:44 | 003,591,168 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll [2008-07-05 12:13:16 | 000,708,096 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll [2008-06-22 18:34:00 | 000,177,664 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll [2008-06-13 12:39:38 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll [2008-06-12 19:36:38 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2006-11-02 17:10:16 | 000,080,912 | ---- | C] () -- C:\WINDOWS\System32\sherlock2.exe [2005-05-25 22:02:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2005-05-25 22:02:00 | 001,626,112 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe [2005-05-25 22:02:00 | 001,478,656 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2005-05-25 22:02:00 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe [2005-05-25 22:02:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2005-05-25 22:02:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2005-05-25 22:02:00 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe [2004-10-03 18:50:54 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll [2004-08-04 13:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2004-08-04 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2004-08-04 13:00:00 | 000,555,962 | ---- | C] () -- C:\WINDOWS\System32\perfh015.dat [2004-08-04 13:00:00 | 000,493,638 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2004-08-04 13:00:00 | 000,313,828 | ---- | C] () -- C:\WINDOWS\System32\perfi015.dat [2004-08-04 13:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2004-08-04 13:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2004-08-04 13:00:00 | 000,104,856 | ---- | C] () -- C:\WINDOWS\System32\perfc015.dat [2004-08-04 13:00:00 | 000,084,056 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2004-08-04 13:00:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2004-08-04 13:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2004-08-04 13:00:00 | 000,034,990 | ---- | C] () -- C:\WINDOWS\System32\perfd015.dat [2004-08-04 13:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2004-08-04 13:00:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2004-08-04 13:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2004-08-04 13:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2004-08-04 13:00:00 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin [2004-08-04 13:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 231 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:6BE50C2B < End of report >

**Posty:** 18165 · przez **wojtas** 31 Maj 2011, 19:37

teraz wykonaj skan i jak coś znajdzie daj Cure, reset kompa i zestaw nowych logów

**Posty:** 176 · przez **peterka** 01 Cze 2011, 23:32

OTL

Kod: Zaznacz wszystko: OTL logfile created on: 2011-06-01 23:15:11 - Run 6 OTL by OldTimer - Version 3.2.23.0 Folder = C:\Documents and Settings\x\Moje dokumenty\Pobieranie Windows XP Home Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 2,00 Gb Total Physical Memory | 1,60 Gb Available Physical Memory | 80,23% Memory free 3,35 Gb Paging File | 3,13 Gb Available in Paging File | 93,41% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 48,83 Gb Total Space | 35,21 Gb Free Space | 72,09% Space Free | Partition Type: NTFS Drive D: | 117,19 Gb Total Space | 63,48 Gb Free Space | 54,17% Space Free | Partition Type: NTFS Drive F: | 132,07 Gb Total Space | 50,80 Gb Free Space | 38,47% Space Free | Partition Type: NTFS Computer Name: X-C60DE7B3A3C14 | User Name: x | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2011-05-29 13:16:27 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\x\Moje dokumenty\Pobieranie\OTL.exe PRC - [2011-03-18 22:10:21 | 000,399,736 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\uTorrent\uTorrent.exe PRC - [2011-02-20 15:22:39 | 000,073,728 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\ALCFDRTM.EXE PRC - [2007-05-29 15:07:58 | 000,598,960 | ---- | M] ( ) -- C:\WINDOWS\system32\lxdecoms.exe PRC - [2005-03-23 00:00:00 | 009,691,136 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTLCPL.EXE PRC - [2005-03-23 00:00:00 | 000,090,112 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE PRC - [2005-03-18 15:35:46 | 000,098,393 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\SynTP\SynTPLpr.exe PRC - [2004-08-04 13:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2011-05-29 13:16:27 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\x\Moje dokumenty\Pobieranie\OTL.exe MOD - [2004-08-04 13:00:00 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [On_Demand | Stopped] -- -- (AppMgmt) SRV - [2011-01-28 16:11:20 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2007-05-29 15:07:58 | 000,598,960 | ---- | M] ( ) [Auto | Running] -- C:\WINDOWS\System32\lxdecoms.exe -- (lxde_device) SRV - [2007-05-29 15:06:43 | 000,099,248 | ---- | M] () [Auto | Stopped] -- C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\\lxdeserv.exe -- (lxdeCATSCustConnectService) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2005-09-12 00:00:00 | 003,298,432 | ---- | M] (Intel® Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Sterownik karty Intel(R) DRV - [2005-05-26 18:19:18 | 000,839,724 | ---- | M] (Motorola Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\smserial.sys -- (smserial) DRV - [2005-03-23 00:00:00 | 002,547,008 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2005-01-07 17:07:16 | 000,145,920 | ---- | M] (Windows (R) Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Hdaudio.sys -- (HdAudAddService) DRV - [2004-02-12 00:00:00 | 000,070,912 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.startup.homepage: "about:home" FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6906 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.3 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011-04-29 22:11:37 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011-04-01 13:15:11 | 000,000,000 | ---D | M] [2008-10-09 07:04:17 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\x\Dane aplikacji\Mozilla\Extensions [2011-05-24 16:42:44 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\x\Dane aplikacji\Mozilla\Firefox\Profiles\2k7d3jdr.default\extensions [2011-05-09 21:17:37 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2011-05-09 21:17:40 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011-01-17 22:03:45 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011-03-06 11:47:56 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} File not found (No name found) -- () (No name found) -- C:\DOCUMENTS AND SETTINGS\X\DANE APLIKACJI\MOZILLA\FIREFOX\PROFILES\2K7D3JDR.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI [2011-01-17 22:03:34 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2011-04-29 22:11:33 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll [2009-12-31 11:05:32 | 000,040,960 | ---- | M] (BYOND) -- C:\Program Files\Mozilla Firefox\plugins\npbyond.dll [2011-02-02 22:40:24 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll [2011-04-01 13:15:03 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2011-04-01 13:15:03 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2011-04-01 13:15:03 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2011-04-01 13:15:03 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2011-04-01 13:15:03 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2011-04-01 13:15:03 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml Hosts file not found O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O4 - HKLM..\Run: [Alcmtr] C:\WINDOWS\ALCMTR.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [AlcWzrd] C:\WINDOWS\ALCWZRD.EXE (RealTek Semicoductor Corp.) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe () O4 - HKLM..\Run: [Skrót do strony właściwości High Definition Audio] C:\WINDOWS\System32\HdAShCut.exe (Windows (R) Server 2003 DDK provider) O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe (Synaptics, Inc.) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe (Adobe Systems Incorporated) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008-10-09 06:29:27 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O33 - MountPoints2\{4845bef3-5860-11e0-a8ff-00150028a536}\Shell - "" = AutoRun O33 - MountPoints2\{4845bef3-5860-11e0-a8ff-00150028a536}\Shell\AutoRun\command - "" = G:\autorun.exe O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2011-06-01 19:33:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\TS3Client [2011-06-01 19:33:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\TeamSpeak 3 Client [2011-06-01 19:32:53 | 000,000,000 | ---D | C] -- C:\Program Files\TeamSpeak 3 Client [2011-05-30 22:19:47 | 000,000,000 | ---D | C] -- C:\_OTL [2011-05-29 13:11:50 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro [2011-05-29 13:11:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Menu Start\Programy\HiJackThis [2011-05-29 12:58:34 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\x\Recent [2011-05-29 10:44:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Ventrilo [2011-05-29 10:44:25 | 000,000,000 | ---D | C] -- C:\Program Files\Ventrilo [2011-05-29 10:44:07 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard [2011-05-29 10:10:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\Ventrilo [2011-05-27 19:00:16 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP [2011-05-27 18:59:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\ElfBot NG [2011-05-22 00:02:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Sports Interactive [2011-05-22 00:01:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Moje dokumenty\Sports Interactive [2011-05-22 00:01:27 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dokumenty\Sports Interactive [2011-05-22 00:01:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Sports Interactive [2011-05-22 00:01:23 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\Sports Interactive [2011-05-21 23:58:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Menu Start\Programy\Sports Interactive [2011-05-21 23:51:21 | 000,000,000 | -H-D | C] -- C:\Program Files\Zero G Registry [2011-05-21 23:50:45 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\x\InstallAnywhere [2011-05-19 10:26:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Application Data [2011-05-19 10:24:38 | 000,000,000 | ---D | C] -- C:\glassfish3 [2011-05-19 10:09:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\.minecraft [2011-05-16 16:07:48 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump [2011-05-15 16:49:11 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2011-05-12 21:19:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\.gstreamer-0.10 [2011-05-12 21:18:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\OpenFM [2011-05-12 21:18:41 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Dane aplikacji\OpenFM [2011-05-12 21:18:08 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10 [2011-05-12 21:16:10 | 000,000,000 | ---D | C] -- C:\Program Files\Gadu-Gadu 10 [2011-05-11 19:01:38 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Pulpit\Niemiec [2011-05-09 21:17:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Skype Extras [2011-05-09 21:16:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Skype [2011-05-09 21:16:54 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype [2011-05-08 22:52:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Microsoft Silverlight [2011-05-08 22:52:06 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2011-05-07 15:16:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\SKIDROW [2011-05-07 15:14:25 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft XNA [2011-05-07 10:58:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\Adobe [2011-05-07 10:42:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\Deployment [2011-05-07 09:29:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\WinUHA [2011-05-07 09:29:33 | 000,000,000 | ---D | C] -- C:\Program Files\WinUHA [2011-05-03 12:35:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\x\Moje dokumenty\Heroes of Newerth [2011-01-17 21:00:05 | 000,434,176 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdehcp.dll [2011-01-17 21:00:05 | 000,356,352 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeinpa.dll [2011-01-17 21:00:04 | 001,200,128 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeserv.dll [2011-01-17 21:00:04 | 000,950,272 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeusb1.dll [2011-01-17 21:00:04 | 000,339,968 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeiesc.dll [2011-01-17 21:00:04 | 000,053,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeprox.dll [2011-01-17 21:00:03 | 000,647,168 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdepmui.dll [2011-01-17 21:00:03 | 000,565,248 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdelmpm.dll [2011-01-17 21:00:03 | 000,320,432 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdeih.exe [2011-01-17 21:00:02 | 000,663,552 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdehbn3.dll [2011-01-17 21:00:01 | 000,860,160 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecomc.dll [2011-01-17 21:00:01 | 000,598,960 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecoms.exe [2011-01-17 21:00:01 | 000,364,544 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecomm.dll [2011-01-17 21:00:00 | 000,365,488 | ---- | C] ( ) -- C:\WINDOWS\System32\lxdecfg.exe [2004-11-24 20:25:52 | 000,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\drvc.dll [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2011-06-01 23:15:06 | 000,073,728 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\ALCFDRTM.VER [2011-06-01 19:33:02 | 000,000,837 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\TeamSpeak 3 Client.lnk [2011-06-01 19:16:06 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011-06-01 19:16:00 | 2146,881,536 | -HS- | M] () -- C:\hiberfil.sys [2011-06-01 16:00:54 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011-05-31 19:53:51 | 000,002,265 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk [2011-05-30 16:31:34 | 000,002,435 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\HiJackThis.lnk [2011-05-29 13:01:50 | 000,000,020 | ---- | M] () -- C:\Documents and Settings\x\__rar_00.313 [2011-05-29 10:44:26 | 000,000,630 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Ventrilo.lnk [2011-05-28 23:07:08 | 000,000,095 | ---- | M] () -- C:\WINDOWS\winamp.ini [2011-05-28 10:33:37 | 000,000,866 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\Skrót do tibialoader.exe.lnk [2011-05-21 23:58:41 | 000,000,644 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Football Manager 2011.lnk [2011-05-21 23:49:16 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2011-05-21 23:49:14 | 000,005,120 | ---- | M] () -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011-05-19 10:37:51 | 000,000,096 | ---- | M] () -- C:\Documents and Settings\x\.asadminpass [2011-05-19 10:25:58 | 000,000,680 | ---- | M] () -- C:\Documents and Settings\x\Pulpit\Skrót do MinecraftSP.exe.lnk [2011-05-18 10:38:57 | 000,001,986 | ---- | M] () -- C:\Documents and Settings\All Users\lxde [2011-05-15 16:49:11 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2011-05-12 21:18:08 | 000,000,791 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\OpenFM.lnk [2011-05-10 16:33:06 | 000,000,211 | -HS- | M] () -- C:\boot.ini [color=#E56717]========== Files Created - No Company Name ==========[/color] [2011-06-01 19:33:02 | 000,000,837 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\TeamSpeak 3 Client.lnk [2011-05-29 22:09:25 | 000,422,244 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-S-1-5-21-682003330-1004336348-839522115-1004-0.dat [2011-05-29 22:09:25 | 000,199,294 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-System.dat [2011-05-29 13:11:50 | 000,002,435 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\HiJackThis.lnk [2011-05-29 13:03:24 | 000,141,993 | ---- | C] () -- C:\Documents and Settings\x\Menu Start\Programy\Autostarthello.exe [2011-05-29 13:01:41 | 000,000,020 | ---- | C] () -- C:\Documents and Settings\x\__rar_00.313 [2011-05-29 10:44:26 | 000,000,630 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Ventrilo.lnk [2011-05-28 10:33:37 | 000,000,866 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\Skrót do tibialoader.exe.lnk [2011-05-23 21:15:37 | 000,011,264 | ---- | C] () -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\mekomdo.dll [2011-05-21 23:58:41 | 000,000,644 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Football Manager 2011.lnk [2011-05-19 10:37:51 | 000,000,096 | ---- | C] () -- C:\Documents and Settings\x\.asadminpass [2011-05-19 10:25:58 | 000,000,680 | ---- | C] () -- C:\Documents and Settings\x\Pulpit\Skrót do MinecraftSP.exe.lnk [2011-05-12 21:18:08 | 000,000,791 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\OpenFM.lnk [2011-05-12 21:16:22 | 000,000,680 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Start\Programy\Gadu-Gadu 10.lnk [2011-05-09 21:16:56 | 000,002,265 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk [2011-02-20 13:26:53 | 000,425,984 | ---- | C] () -- C:\WINDOWS\System32\keystone.exe [2011-02-20 13:25:42 | 000,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2011-02-19 17:38:13 | 000,000,064 | ---- | C] () -- C:\WINDOWS\System32\tcfg.ini [2011-01-28 22:23:28 | 000,005,120 | ---- | C] () -- C:\Documents and Settings\x\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011-01-28 22:23:23 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2011-01-18 20:52:49 | 000,062,304 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat [2011-01-17 21:21:17 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat [2011-01-17 21:07:28 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\lxdevs.dll [2011-01-17 21:07:27 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\lxdecoin.dll [2011-01-17 21:06:48 | 000,692,224 | ---- | C] () -- C:\WINDOWS\System32\lxdedrs.dll [2011-01-17 21:06:48 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\lxdecnv4.dll [2011-01-17 21:06:48 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\lxdecaps.dll [2011-01-17 21:06:24 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\LXF3PMON.DLL [2011-01-17 21:06:24 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\lxf3oem.dll [2011-01-17 21:06:24 | 000,032,768 | ---- | C] () -- C:\WINDOWS\System32\LXF3FXPU.DLL [2011-01-17 21:06:24 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\LXF3PMRC.DLL [2011-01-17 21:00:17 | 000,000,060 | -H-- | C] () -- C:\WINDOWS\System32\lxderwrd.ini [2011-01-17 21:00:05 | 000,348,160 | ---- | C] () -- C:\WINDOWS\System32\lxdeinst.dll [2011-01-17 21:00:02 | 000,208,896 | ---- | C] () -- C:\WINDOWS\System32\lxdegrd.dll [2008-10-09 08:22:26 | 000,004,293 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2008-10-09 08:21:03 | 001,420,280 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2008-10-09 07:04:19 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2008-10-09 07:00:23 | 000,000,095 | ---- | C] () -- C:\WINDOWS\winamp.ini [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56spn.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56itl.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56ger.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56fra.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56eng.dll [2008-10-09 06:54:16 | 000,065,536 | ---- | C] () -- C:\WINDOWS\sm56brz.dll [2008-10-09 06:54:16 | 000,049,152 | ---- | C] () -- C:\WINDOWS\sm56jpn.dll [2008-10-09 06:54:16 | 000,045,056 | ---- | C] () -- C:\WINDOWS\sm56cht.dll [2008-10-09 06:54:16 | 000,045,056 | ---- | C] () -- C:\WINDOWS\sm56chs.dll [2008-10-09 06:53:36 | 000,156,672 | ---- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll [2008-10-09 06:53:36 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ChCfg.exe [2008-10-09 06:31:53 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2008-10-09 06:27:10 | 000,021,856 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2008-07-05 12:14:48 | 000,456,192 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll [2008-07-05 12:14:44 | 003,591,168 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll [2008-07-05 12:13:16 | 000,708,096 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll [2008-06-22 18:34:00 | 000,177,664 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll [2008-06-13 12:39:38 | 000,023,552 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll [2008-06-12 19:36:38 | 000,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2006-11-02 17:10:16 | 000,080,912 | ---- | C] () -- C:\WINDOWS\System32\sherlock2.exe [2005-05-25 22:02:00 | 001,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2005-05-25 22:02:00 | 001,626,112 | ---- | C] () -- C:\WINDOWS\System32\nwiz.exe [2005-05-25 22:02:00 | 001,478,656 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2005-05-25 22:02:00 | 001,339,392 | ---- | C] () -- C:\WINDOWS\System32\nvdspsch.exe [2005-05-25 22:02:00 | 001,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2005-05-25 22:02:00 | 000,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2005-05-25 22:02:00 | 000,442,368 | ---- | C] () -- C:\WINDOWS\System32\nvappbar.exe [2004-10-03 18:50:54 | 000,129,024 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll [2004-08-04 13:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2004-08-04 13:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2004-08-04 13:00:00 | 000,555,962 | ---- | C] () -- C:\WINDOWS\System32\perfh015.dat [2004-08-04 13:00:00 | 000,493,638 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2004-08-04 13:00:00 | 000,313,828 | ---- | C] () -- C:\WINDOWS\System32\perfi015.dat [2004-08-04 13:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2004-08-04 13:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2004-08-04 13:00:00 | 000,104,856 | ---- | C] () -- C:\WINDOWS\System32\perfc015.dat [2004-08-04 13:00:00 | 000,084,056 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2004-08-04 13:00:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2004-08-04 13:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2004-08-04 13:00:00 | 000,034,990 | ---- | C] () -- C:\WINDOWS\System32\perfd015.dat [2004-08-04 13:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2004-08-04 13:00:00 | 000,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2004-08-04 13:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2004-08-04 13:00:00 | 000,004,461 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2004-08-04 13:00:00 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin [2004-08-04 13:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [color=#E56717]========== Alternate Data Streams ==========[/color] @Alternate Data Stream - 231 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:6BE50C2B < End of report >

Dalem tylko z OTL, czy na nim wygląda ze komputer jest mniej wiecej czysty? Jeżeli tak to dziekuje to forum pomogło mi już nie jeden raz, w końcu dlatego jestem tu 4 lata ;D

**Posty:** 18165 · przez **wojtas** 02 Cze 2011, 15:11

mniej więcej tak ale jeszcze nowy Gmer się przyda

wtedy przejdziemy do końcowego etapu

Kto jest na forum