Wolny internet

**Posty:** 37 · przez **1111** 10 Wrz 2009, 00:41

witam. mam problem z Internetem, z którym nie moge dać sobie rady. otóż pierwsza sprawa wygląda tak, że w ogóle nie chodzi mi firefox. wciskam ikonkę z całych sił a on nawet nie raczy się uruchomić. naszczęście Internet Explorer jakoś działa, z tym że strasznie wolno.... baaaaardzo wolno. wcześniej wszystko było oki.
skanowałem system avastem i kasperskym online, ale oba skany nie znalazły nic. no avast niby jakąś bombę dekompresyjną wykrył, ale czytałem o tym i to chyba nie to.
próbowałem zainstalować ponownie firefoxa ale nie pomogło. Żeby sobie nie robić problemu ściągnąłem opere 10.0 ale ona też zamula i to gorzej niż IE.
co więcej oprócz tego, że firefox nie działa, a opera i IE strasznie zamula to wszystko oki. Transfer w porządku. Plis pomóż ktoś bo ja ciemny jestem. Dziex

**Posty:** 4459 · przez **jarski185** 10 Wrz 2009, 00:45

zacznij od zapoznania sie zasadami dzialu bezpieczenstwo i wstawienia logow

**Posty:** 37 · przez **1111** 10 Wrz 2009, 00:47

no tak na logach się nie znam... mam niby ten HjackThis ale nie kminie logów:( to są logi z HijackThis (dla mnie czarna magia):

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 00:49:54, on 2009-09-10
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\SAGEM WiFi manager\WLANUTL.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - {4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac} - (no file)
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = ?
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - Unknown owner - C:\Program Files\PC Tools Firewall Plus\FWService.exe (file missing)
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 4769 bytes

Dodano 09.09.2009 23:54:03:
a oto logi z Silent Runners:

"Silent Runners.vbs", revision 59, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"

Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS]
"Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"igfxtray" = "C:\WINDOWS\System32\igfxtray.exe" ["Intel Corporation"]
"igfxhkcmd" = "C:\WINDOWS\System32\hkcmd.exe" ["Intel Corporation"]
"igfxpers" = "C:\WINDOWS\System32\igfxpers.exe" ["Intel Corporation"]
"Smapp" = "C:\Program Files\Analog Devices\SoundMAX\SMTray.exe" ["Analog Devices, Inc."]
"DrvLsnr" = "C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe" ["adi"]
"SunJavaUpdateSched" = ""C:\Program Files\Java\jre6\bin\jusched.exe"" ["Sun Microsystems, Inc."]
"avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" ["ALWIL Software"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{DBC80044-A445-435b-BC74-9C25C1C588A9}\(Default) = (no title provided)
-> {HKLM...CLSID} = "Java(tm) Plug-In 2 SSV Helper"
\InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\jp2ssv.dll" ["Sun Microsystems, Inc."]
{E7E6F031-17CE-4C07-BC86-EABFE594F69C}\(Default) = "JQSIEStartDetectorImpl"
-> {HKLM...CLSID} = "JQSIEStartDetectorImpl Class"
\InProcServer32\(Default) = "C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll" ["Sun Microsystems, Inc."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"]
"{11016101-E366-4D22-BC06-4ADA335C892B}" = "IE History and Feeds Shell Data Source for Windows Search"
-> {HKLM...CLSID} = "IE History and Feeds Shell Data Source for Windows Search"
\InProcServer32\(Default) = "C:\WINDOWS\system32\ieframe.dll" [MS]
"{472083B0-C522-11CF-8763-00608CC02F24}" = "avast"
-> {HKLM...CLSID} = "avast"
\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
"WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}"
-> {HKLM...CLSID} = "WPDShServiceObj Class"
\InProcServer32\(Default) = "C:\WINDOWS\system32\WPDShServiceObj.dll" [MS]

HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> igfxcui\DLLName = "igfxdev.dll" ["Intel Corporation"]

HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
-> {HKLM...CLSID} = "avast"
\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
ISOpenMenuHandler\(Default) = "{B92FD3C8-F5A5-4F3E-B299-D24A69E7EC41}"
-> {HKLM...CLSID} = "ISOpenMenuHandler"
\InProcServer32\(Default) = "C:\Program Files\ISOpen\ISOpenMenu.dll" [null data]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"]

HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"]

HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\
avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}"
-> {HKLM...CLSID} = "avast"
\InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"]
ISOpenMenuHandler\(Default) = "{B92FD3C8-F5A5-4F3E-B299-D24A69E7EC41}"
-> {HKLM...CLSID} = "ISOpenMenuHandler"
\InProcServer32\(Default) = "C:\Program Files\ISOpen\ISOpenMenu.dll" [null data]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"]

Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\

"HonorAutoRunSetting" = (REG_DWORD) dword:0x00000001
{unrecognized setting}

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}

"undockwithoutlogon" = (REG_DWORD) dword:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}

Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"

Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]

Windows Portable Device AutoPlay Handlers
-----------------------------------------

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\

MSWPDShellNamespaceHandler\
"Provider" = "@%SystemRoot%\System32\WPDShextRes.dll,-501"
"CLSID" = "{A55803CC-4D53-404c-8557-FD63DBA95D24}"
"InitCmdLine" = " "
-> {HKLM...CLSID} = "WPDShextAutoplay"
\LocalServer32\(Default) = "C:\WINDOWS\system32\WPDShextAutoplay.exe" [MS]

Startup items in "User" & "All Users" startup folders:
------------------------------------------------------

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
"Program sieciowy dla SAGEM Wi-Fi 11g USB adapter" -> shortcut to: "C:\Program Files\SAGEM WiFi manager\WLANUTL.exe" [" "]

Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 26
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05

Toolbars, Explorer Bars, Extensions:
------------------------------------

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{E2E2DD38-D088-4134-82B7-F2BA38496583}\
"MenuText" = "@xpsp3res.dll,-20001"
"Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS]

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]

Miscellaneous IE Hijack Points
------------------------------

C:\WINDOWS\INF\IERESET.INF (used to "Reset Web Settings")

Added lines (compared with English-language version):
[Strings]: START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"
[Strings]: MS_START_PAGE_URL="http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome"

Missing lines (compared with English-language version):
[Strings]: 2 lines

HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\
<<H>> "InPrivate" = "res://ieframe.dll/inprivate.htm" [MS]

Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Apple Mobile Device, Apple Mobile Device, ""C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe"" ["Apple Inc."]
avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" ["ALWIL Software"]
avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" ["ALWIL Software"]
avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"]
avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"]
Java Quick Starter, JavaQuickStarterService, ""C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf"" ["Sun Microsystems, Inc."]
SoundMAX Agent Service, SoundMAX Agent Service (default), "C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe" ["Analog Devices, Inc."]
Usługa Pomocnik IPv6, 6to4, "C:\WINDOWS\system32\svchost.exe -k netsvcs" {"C:\WINDOWS\System32\6to4svc.dll" [MS]}

---------- (launch time: 2009-09-10 00:51:30)
<<!>>: Suspicious data at a malware launch point.
<<H>>: Suspicious data at a browser hijack point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 47 seconds, including 8 seconds for message boxes)

**Posty:** 584 · przez **Andziorka** 10 Wrz 2009, 01:12

Loga z OTL poproszę jeszcze: jak-generujemy-loga-z-rsita-i-otl-vt95026.html

Jaki dostawca internetu? Jaka prędkość?
Wykonaj speedtest: http://www.speedtest.net/ wklej wynik
Napisz jeszcze czy łączysz się za pomocą routera czy modemu? Jeśli tak jaki to sprzęt?

* Wpisz Open Dns-y, czyli: wchodzisz w połączenia sieciowe, naciskasz prawym przyciskiem myszy na Twoje połączenie, właściwości, najeżdżasz na: Protokół internetowy (TCP/IP)i klik na właściwości, na dole masz: Użyj następujących serwerów DNS, zaznacz i wpisz takie DMS-y: 208.67.222.222 i 208.67.220.220

* Wejdź w Start, uruchom, wpisz cmd, w okienku wpisz: ( po każdym wpisie enter)
netsh winsock reset
netsh int ip reset resetlog.txt

* Wejdź w: start->uruchom->wpisz cmd
w nowym oknie wpisz: ipconfig /flushdns

zrestartuj komputer i zobacz czy chodzi lepiej

**Posty:** 37 · przez **1111** 10 Wrz 2009, 01:49

juz juz zaraz podaje. dostawca to Telekomunikacja Polska. hmm mam Liveboxa 1 mega. nie wiem czemu mi odwaliło na ta opcje z TV. ale to juz inna bajka.
Oto log z OTL:

OTL logfile created on: 2009-09-10 01:45:14 - Run 1
OTL by OldTimer - Version 3.0.10.7 Folder = C:\Documents and Settings\User\Pulpit\pobieranie
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

1015,48 Mb Total Physical Memory | 595,26 Mb Available Physical Memory | 58,62% Memory free
1,64 Gb Paging File | 1,21 Gb Available in Paging File | 73,97% Paging File free
Paging file location(s): C:\pagefile.sys 756 1512 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 76,69 Gb Total Space | 61,84 Gb Free Space | 80,63% Space Free | Partition Type: NTFS
D: Drive not present or media not loaded
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: USER-D9O683JDC5
Current User Name: User
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: On
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2009-08-17 17:58:55 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
PRC - [2009-08-17 18:07:17 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe
PRC - [2009-07-09 12:22:18 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
PRC - [2009-08-01 00:55:10 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe
PRC - [2002-09-20 16:50:10 | 00,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
PRC - [2009-08-17 18:07:01 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
PRC - [2009-08-17 18:04:21 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
PRC - [2005-09-20 10:32:24 | 00,077,824 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\hkcmd.exe
PRC - [2005-09-20 10:36:20 | 00,114,688 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\igfxpers.exe
PRC - [2003-01-31 16:49:34 | 00,098,304 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
PRC - [2002-05-28 08:37:16 | 00,069,632 | ---- | M] (adi) -- C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe
PRC - [2009-08-01 00:55:10 | 00,148,888 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe
PRC - [2009-08-17 18:07:23 | 00,081,000 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashDisp.exe
PRC - [2008-03-20 12:04:46 | 02,127,296 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\gg.exe
PRC - [2007-01-16 13:42:20 | 00,950,272 | ---- | M] ( ) -- C:\Program Files\SAGEM WiFi manager\WLANUTL.exe
PRC - [2008-04-14 22:51:18 | 01,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2009-03-08 14:09:26 | 00,638,816 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe
PRC - [2009-03-08 14:09:26 | 00,638,816 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe
PRC - [2009-03-08 14:09:26 | 00,638,816 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe
PRC - [2009-09-10 01:43:29 | 00,514,048 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\User\Pulpit\pobieranie\OTL.exe

========== Win32 Services (SafeList) ==========

SRV - [2008-04-14 22:49:54 | 00,100,352 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\6to4svc.dll -- (6to4 [Auto | Running])
SRV - [2008-03-13 15:36:04 | 00,730,968 | ---- | M] () -- C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe -- (AASW2_Service [Disabled | Stopped])
SRV - [2009-07-09 12:22:18 | 00,144,712 | ---- | M] (Apple Inc.) -- C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe -- (Apple Mobile Device [Auto | Running])
SRV - [2009-08-17 17:58:55 | 00,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv [Auto | Running])
SRV - [2009-08-17 18:07:17 | 00,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus [Auto | Running])
SRV - [2009-08-17 18:07:01 | 00,254,040 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner [On_Demand | Running])
SRV - [2009-08-17 18:04:21 | 00,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner [On_Demand | Running])
SRV - [2008-04-14 22:50:46 | 00,038,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running])
SRV - [2009-08-01 00:55:10 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running])
SRV - File not found -- -- (PCToolsFirewallPlus [Auto | Stopped])
SRV - [2002-09-20 16:50:10 | 00,045,056 | ---- | M] (Analog Devices, Inc.) -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default) [Auto | Running])
SRV - [2006-12-01 11:46:28 | 00,918,016 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Media Player\WMPNetwk.exe -- (WMPNetworkSvc [On_Demand | Stopped])

========== Driver Services (SafeList) ==========

DRV - [2009-08-17 18:03:21 | 00,026,944 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4 [System | Running])
DRV - [2003-03-13 17:34:48 | 00,100,224 | ---- | M] (Andrea Electronics Corporation) -- C:\WINDOWS\System32\drivers\aeaudio.sys -- (aeaudio [On_Demand | Running])
DRV - [2009-08-17 18:05:37 | 00,020,560 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\DRIVERS\aswFsBlk.sys -- (aswFsBlk [Auto | Running])
DRV - [2009-08-17 18:06:43 | 00,094,160 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2 [Auto | Running])
DRV - [2009-08-17 18:04:29 | 00,023,152 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr [On_Demand | Running])
DRV - [2009-08-17 18:05:52 | 00,114,768 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP [System | Running])
DRV - [2009-08-17 18:04:40 | 00,051,376 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi [System | Running])
DRV - [2007-11-29 17:35:44 | 00,163,328 | ---- | M] (Broadcom Corporation) -- C:\WINDOWS\System32\DRIVERS\b57xp32.sys -- (b57w2k [On_Demand | Running])
DRV - [2005-09-20 11:00:54 | 01,302,332 | ---- | M] (Intel Corporation) -- C:\WINDOWS\System32\DRIVERS\ialmnt5.sys -- (ialm [On_Demand | Running])
DRV - [2008-12-18 12:16:56 | 00,073,840 | ---- | M] (PC Tools) -- C:\WINDOWS\System32\drivers\PCTAppEvent.sys -- (PCTAppEvent [Auto | Running])
DRV - [2009-04-03 11:18:26 | 00,130,936 | ---- | M] (PC Tools) -- C:\WINDOWS\system32\drivers\PCTCore.sys -- (PCTCore [Boot | Running])
DRV - [2008-12-11 08:38:22 | 00,159,600 | ---- | M] (PC Tools) -- C:\WINDOWS\System32\drivers\pctgntdi.sys -- (pctgntdi [System | Running])
DRV - [2009-01-21 09:38:32 | 00,095,640 | ---- | M] (PC Tools) -- C:\WINDOWS\System32\drivers\pctplfw.sys -- (pctplfw [On_Demand | Stopped])
DRV - [2003-04-16 14:00:00 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running])
DRV - [2009-04-28 22:20:06 | 00,044,944 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running])
DRV - [2008-04-13 22:09:18 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped])
DRV - [2008-09-22 11:29:18 | 00,097,408 | ---- | M] (PC Tools) -- C:\WINDOWS\System32\DRIVERS\pctfw.sys -- (SFilter [On_Demand | Running])
DRV - [2007-01-10 10:14:34 | 00,450,560 | ---- | M] (ZyDAS Technology Corporation) -- C:\WINDOWS\System32\DRIVERS\WlanBZXP.sys -- (SG762_XP [On_Demand | Running])
DRV - [2003-03-19 07:54:36 | 00,542,976 | ---- | M] (Analog Devices, Inc.) -- C:\WINDOWS\System32\drivers\smwdm.sys -- (smwdm [On_Demand | Running])
DRV - [2008-06-20 13:08:27 | 00,225,856 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\DRIVERS\tcpip6.sys -- (Tcpip6 [System | Running])
DRV - [2009-07-09 12:16:16 | 00,039,424 | ---- | M] (Apple, Inc.) -- C:\WINDOWS\System32\Drivers\usbaapl.sys -- (USBAAPL [On_Demand | Stopped])
DRV - [2007-01-16 13:52:20 | 00,017,664 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) -- C:\WINDOWS\System32\Drivers\ZDPSp50.sys -- (ZDPSp50 [On_Demand | Running])

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm

IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\.DEFAULT\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-20\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-725345543-838170752-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\S-1-5-21-725345543-838170752-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\windows\system32\blank.htm
IE - HKU\S-1-5-21-725345543-838170752-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1
IE - HKU\S-1-5-21-725345543-838170752-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
IE - HKU\S-1-5-21-725345543-838170752-839522115-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome
IE - URLSearchHook: {4724c5d8-dfa7-417a-a2f5-1eabfee9b4ac} - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-725345543-838170752-839522115-1003\S-1-5-21-725345543-838170752-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "MyStart Search"
FF - prefs.js..browser.search.defaulturl: "http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query="
FF - prefs.js..browser.search.order.1: "Ask"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "http://www.google.pl/firefox"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.1
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}:6.0.14
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - prefs.js..extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.11.2
FF - prefs.js..extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.5.2
FF - prefs.js..keyword.URL: "http://mystart.incredimail.com/?loc=ff_address_bar&search="

FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009-08-01 00:55:11 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2009-09-09 02:57:34 | 00,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.5.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009-09-09 02:57:32 | 00,000,000 | ---D | M]

[2009-08-07 17:42:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\mozilla\Extensions
[2009-08-07 17:42:20 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\mozilla\Extensions\{ec8030f7-c20a-464f-9b0e-13a3a9e97384}
[2009-09-09 02:57:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\mozilla\Firefox\Profiles\ux9wygny.default\extensions
[2009-08-14 19:29:00 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\mozilla\Firefox\Profiles\ux9wygny.default\extensions\{0b38152b-1b20-484d-a11f-5e04a9b0661f}
[2009-09-09 02:57:38 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\mozilla\Firefox\Profiles\ux9wygny.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}(2)
[2009-08-29 20:49:51 | 00,002,137 | ---- | M] () -- C:\Documents and Settings\User\Dane aplikacji\Mozilla\FireFox\Profiles\ux9wygny.default\searchplugins\MyStart Search.xml
[2009-09-09 02:57:33 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions
[2009-09-09 02:57:33 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2009-09-09 00:12:12 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}(2)
[2009-08-01 00:55:20 | 00,000,000 | ---D | M] -- C:\Program Files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA}
[2009-07-31 01:45:28 | 00,023,544 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browserdirprovider.dll
[2009-07-31 01:45:28 | 00,137,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\brwsrcmp.dll
[2009-07-17 10:40:12 | 00,704,512 | ---- | M] (BitComet) -- C:\Program Files\mozilla firefox\plugins\npBitCometAgent.dll
[2009-07-16 18:23:24 | 00,873,976 | ---- | M] (Ganymede Technologies) -- C:\Program Files\mozilla firefox\plugins\NPCARDS.dll
[2009-08-01 00:55:11 | 00,410,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeploytk.dll
[2009-07-31 01:45:28 | 00,065,016 | ---- | M] (mozilla.org) -- C:\Program Files\mozilla firefox\plugins\npnul32.dll
[2008-09-10 21:56:44 | 00,144,960 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\mozilla firefox\plugins\nppl3260.dll
[2009-08-21 19:46:16 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin.dll
[2009-08-21 19:46:16 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll
[2009-08-21 19:46:16 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll
[2009-08-21 19:46:16 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll
[2009-08-21 19:46:16 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll
[2009-08-21 19:46:16 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll
[2009-08-21 19:46:16 | 00,143,360 | ---- | M] (Apple Inc.) -- C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll
[2008-09-10 21:37:54 | 00,094,208 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\mozilla firefox\plugins\nprpjplug.dll

O1 HOSTS File: (742 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [avast!] C:\Program Files\Alwil Software\Avast4\ashDisp.exe (ALWIL Software)
O4 - HKLM..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe (adi)
O4 - HKLM..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe (Intel Corporation)
O4 - HKLM..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe (Intel Corporation)
O4 - HKLM..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe (Intel Corporation)
O4 - HKLM..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe (Analog Devices, Inc.)
O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.)
O4 - HKU\S-1-5-21-725345543-838170752-839522115-1003..\Run: [Gadu-Gadu] C:\Program Files\Gadu-Gadu\gg.exe (Gadu-Gadu S.A.)
O4 - HKU\S-1-5-21-725345543-838170752-839522115-1003..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Program sieciowy dla SAGEM Wi-Fi 11g USB adapter.lnk = C:\Program Files\SAGEM WiFi manager\WLANUTL.exe ( )
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext =
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-725345543-838170752-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O9 - Extra 'Tools' menuitem : @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe (Microsoft Corporation)
O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation)
O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone.
O15 - HKU\S-1-5-21-725345543-838170752-839522115-1003\..Trusted Domains: ([]msn in My Computer)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-0016-0000-0014-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_14-windows-i586.cab (Java Plug-in 1.6.0_14)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\igfxcui: DllName - igfxdev.dll - C:\WINDOWS\System32\igfxdev.dll (Intel Corporation)
O31 - SafeBoot: AlternateShell - cmd.exe
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009-07-31 12:58:26 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{5165990d-87e8-11de-ba96-000bcdb72def}\Shell - "" = AutoRun
O33 - MountPoints2\{5165990d-87e8-11de-ba96-000bcdb72def}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
O33 - MountPoints2\{5165990e-87e8-11de-ba96-000bcdb72def}\Shell\AutoRun\command - "" = F:\Protector.exe -- File not found
O33 - MountPoints2\{5165990e-87e8-11de-ba96-000bcdb72def}\Shell\brow\command - "" = F:\Protector.exe -- File not found
O33 - MountPoints2\{5165990e-87e8-11de-ba96-000bcdb72def}\Shell\protect\command - "" = F:\Protector.exe -- File not found
O33 - MountPoints2\{c276d85b-8e56-11de-ba9d-0060b35f753a}\Shell - "" = AutoRun
O33 - MountPoints2\{c276d85b-8e56-11de-ba9d-0060b35f753a}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found
O33 - MountPoints2\{c276d85c-8e56-11de-ba9d-0060b35f753a}\Shell\AutoRun\command - "" = F:\Protector.exe -- File not found
O33 - MountPoints2\{c276d85c-8e56-11de-ba9d-0060b35f753a}\Shell\brow\command - "" = F:\Protector.exe -- File not found
O33 - MountPoints2\{c276d85c-8e56-11de-ba9d-0060b35f753a}\Shell\protect\command - "" = F:\Protector.exe -- File not found
O34 - HKLM BootExecute: (autocheck) - File not found
O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation)
O34 - HKLM BootExecute: (*) - File not found

========== Files/Folders - Created Within 30 Days ==========

[1 C:\WINDOWS\System32\*.tmp files]
[6 C:\WINDOWS\*.tmp files]
[2009-09-10 01:44:45 | 00,000,000 | ---D | C] -- C:\_OTL
[2009-09-10 00:15:29 | 00,001,048 | ---- | C] () -- C:\WINDOWS\System32\tmp.reg
[2009-09-10 00:11:55 | 00,289,144 | ---- | C] (S!Ri) -- C:\WINDOWS\System32\VCCLSID.exe
[2009-09-10 00:11:55 | 00,288,417 | ---- | C] (S!Ri) -- C:\WINDOWS\System32\SrchSTS.exe
[2009-09-10 00:11:55 | 00,135,168 | ---- | C] (SteelWerX) -- C:\WINDOWS\System32\swreg.exe
[2009-09-10 00:11:55 | 00,087,552 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\VACFix.exe
[2009-09-10 00:11:55 | 00,082,944 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\IEDFix.exe
[2009-09-10 00:11:55 | 00,082,944 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\IEDFix.C.exe
[2009-09-10 00:11:55 | 00,082,432 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\404Fix.exe
[2009-09-10 00:11:55 | 00,080,384 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\o4Patch.exe
[2009-09-10 00:11:55 | 00,079,360 | ---- | C] (SteelWerX) -- C:\WINDOWS\System32\swxcacls.exe
[2009-09-10 00:11:55 | 00,078,336 | ---- | C] (S!Ri.URZ) -- C:\WINDOWS\System32\Agent.OMZ.Fix.exe
[2009-09-10 00:11:55 | 00,075,776 | ---- | C] () -- C:\WINDOWS\System32\WS2Fix.exe
[2009-09-10 00:11:55 | 00,053,248 | ---- | C] (http://www.beyondlogic.org) -- C:\WINDOWS\System32\Process.exe
[2009-09-10 00:11:55 | 00,051,200 | ---- | C] () -- C:\WINDOWS\System32\dumphive.exe
[2009-09-10 00:11:55 | 00,040,960 | ---- | C] () -- C:\WINDOWS\System32\swsc.exe
[2009-09-10 00:01:18 | 00,001,734 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\HijackThis.lnk
[2009-09-10 00:01:18 | 00,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2009-09-09 23:32:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\Opera
[2009-09-09 23:32:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Dane aplikacji\Opera
[2009-09-09 23:32:01 | 00,000,592 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Opera.lnk
[2009-09-09 23:31:58 | 00,000,000 | ---D | C] -- C:\Program Files\Opera
[2009-09-09 04:43:28 | 00,000,488 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\wirus.doc
[2009-09-09 04:01:32 | 00,023,152 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2009-09-09 04:01:32 | 00,001,709 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\avast! Antivirus.lnk
[2009-09-09 04:01:31 | 00,051,376 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2009-09-09 04:01:31 | 00,026,944 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2009-09-09 04:01:29 | 00,114,768 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2009-09-09 04:01:29 | 00,097,480 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\AvastSS.scr
[2009-09-09 04:01:29 | 00,094,160 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2009-09-09 04:01:29 | 00,093,392 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2009-09-09 04:01:29 | 00,020,560 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2009-09-09 04:01:12 | 01,279,456 | ---- | C] (ALWIL Software) -- C:\WINDOWS\System32\aswBoot.exe
[2009-09-09 04:01:12 | 01,060,864 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MFC71.dll
[2009-09-09 04:01:12 | 00,380,928 | ---- | C] () -- C:\WINDOWS\System32\actskin4.ocx
[2009-09-09 02:58:14 | 00,000,000 | ---D | C] -- C:\Program Files\TryMedia
[2009-09-09 02:58:14 | 00,000,000 | ---D | C] -- C:\Program Files\Kaspersky Lab
[2009-09-09 02:58:13 | 00,000,000 | ---D | C] -- C:\Program Files\Activision
[2009-09-09 00:20:06 | 00,153,088 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\triedit.dll
[2009-09-08 15:27:11 | 00,000,000 | ---D | C] -- C:\Program Files\Alwil Software
[2009-09-08 05:09:14 | 00,000,000 | ---D | C] -- C:\Program Files\TryMedia(2)
[2009-09-08 02:04:02 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\ESET
[2009-09-07 23:29:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Pulpit\kicia
[2009-09-05 22:15:51 | 00,000,000 | ---D | C] -- C:\Program Files\Codemasters
[2009-09-04 17:20:17 | 00,000,745 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\sgh!!!!!!!!!!!!!1.doc
[2009-09-04 00:17:01 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\karta
[2009-09-03 21:26:01 | 00,000,000 | ---D | C] -- C:\Program Files\GameSpy Arcade
[2009-09-02 23:22:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\WildTangent
[2009-09-01 02:36:43 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Pulpit\Skoki2001
[2009-09-01 01:19:47 | 00,047,104 | ---- | C] () -- C:\WINDOWS\System32\KMVIDC32.DLL
[2009-09-01 01:19:30 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Pulpit\gry do zgrania
[2009-09-01 01:18:52 | 00,000,000 | ---D | C] -- C:\Program Files\Worms
[2009-09-01 01:08:28 | 00,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2009-08-31 13:40:55 | 00,000,000 | ---D | C] -- C:\WINDOWS\wb
[2009-08-31 00:35:44 | 00,000,540 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\Nowy Dokument WordPad.doc
[2009-08-29 22:19:56 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Pulpit\Kurnik - GRY Online - darmowe szachy, brydż itp_pliki
[2009-08-29 22:19:55 | 00,010,330 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\Kurnik - GRY Online - darmowe szachy, brydż itp.htm
[2009-08-29 20:59:21 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\IM
[2009-08-29 20:59:07 | 00,000,056 | ---- | C] () -- C:\WINDOWS\Wininit.ini
[2009-08-29 20:56:35 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\IM
[2009-08-29 20:56:31 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\IncrediMail
[2009-08-27 01:25:23 | 00,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2009-08-27 01:25:22 | 00,000,000 | ---D | C] -- C:\Program Files\K-Lite Codec Pack
[2009-08-27 01:23:52 | 04,864,007 | ---- | C] ( ) -- C:\Documents and Settings\User\Pulpit\klcodec505b.exe
[2009-08-26 19:46:27 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\Ashampoo
[2009-08-26 19:05:36 | 00,000,000 | ---D | C] -- C:\Program Files\Ashampoo
[2009-08-26 11:47:33 | 00,016,760 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsg.dll
[2009-08-26 11:47:13 | 00,000,000 | ---D | C] -- C:\Program Files\Windows Media Connect 2
[2009-08-26 11:46:02 | 00,000,000 | -H-- | C] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2009-08-26 11:45:59 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\LogFiles
[2009-08-26 11:45:59 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\drivers\UMDF
[2009-08-26 00:23:17 | 00,000,000 | ---D | C] -- C:\WINDOWS\pss
[2009-08-25 19:57:12 | 00,002,189 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\CV.rtf
[2009-08-25 19:39:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Dane aplikacji\OpenOffice.org2
[2009-08-25 12:40:37 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Dane aplikacji\BESTplayer
[2009-08-25 12:24:38 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Dane aplikacji\Media Player Classic
[2009-08-25 12:24:08 | 00,000,931 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Media Player Classic.lnk
[2009-08-25 12:24:06 | 00,278,528 | ---- | C] (Real Networks, Inc) -- C:\WINDOWS\System32\pncrt.dll
[2009-08-25 12:24:05 | 00,499,712 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcp71.dll
[2009-08-25 12:24:05 | 00,348,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcr71.dll
[2009-08-25 12:24:05 | 00,000,000 | ---D | C] -- C:\Program Files\Real Alternative
[2009-08-25 12:24:05 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\Real
[2009-08-25 12:24:05 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Dane aplikacji\Real
[2009-08-25 12:24:05 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Real
[2009-08-25 11:58:14 | 00,000,000 | -H-D | C] -- C:\WINDOWS\PIF
[2009-08-24 13:31:45 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Pulpit\movies
[2009-08-22 23:37:16 | 00,286,720 | ---- | C] (Indigo Rose Corporation) -- C:\WINDOWS\iun503.exe
[2009-08-22 23:36:50 | 00,000,000 | ---D | C] -- C:\Program Files\CUE CLUB
[2009-08-22 20:19:41 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Trymedia
[2009-08-21 19:47:14 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Dane aplikacji\Apple Computer
[2009-08-21 19:46:43 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009-08-21 19:46:07 | 00,001,604 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\QuickTime Player.lnk
[2009-08-21 19:45:50 | 00,000,000 | ---D | C] -- C:\Program Files\QuickTime
[2009-08-21 19:45:48 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
[2009-08-21 19:45:33 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\Apple
[2009-08-21 19:45:01 | 00,000,000 | ---D | C] -- C:\Program Files\Common Files\Apple
[2009-08-21 19:45:00 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Apple
[2009-08-21 19:44:16 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\Apple Computer
[2009-08-19 21:25:46 | 00,000,654 | ---- | C] () -- C:\Documents and Settings\User\Pulpit\ISOpen.lnk
[2009-08-19 21:25:45 | 01,081,616 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mscomctl.ocx
[2009-08-19 21:25:45 | 00,662,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSCOMCT2.OCX
[2009-08-19 21:25:45 | 00,224,016 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\TABCTL32.OCX
[2009-08-19 21:25:45 | 00,152,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\COMDLG32.OCX
[2009-08-19 21:25:45 | 00,141,312 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\MSCMCFR.DLL
[2009-08-19 21:25:45 | 00,119,568 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\VB6FR.DLL
[2009-08-19 21:25:45 | 00,115,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msinet.OCX
[2009-08-19 21:25:45 | 00,101,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\VB6STKIT.DLL
[2009-08-19 21:25:45 | 00,059,904 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\Mscc2fr.dll
[2009-08-19 21:25:45 | 00,044,544 | ---- | C] () -- C:\WINDOWS\System32\GIF89.DLL
[2009-08-19 21:25:45 | 00,040,960 | ---- | C] (vbAccelerator) -- C:\WINDOWS\System32\SSubTmr6.dll
[2009-08-19 21:25:45 | 00,032,768 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\CMDLGFR.DLL
[2009-08-19 21:25:45 | 00,028,672 | ---- | C] (Microsoft Corporation ) -- C:\WINDOWS\System32\CMCT3FR.DLL
[2009-08-19 21:25:45 | 00,024,626 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\scrrnfr.dll
[2009-08-19 21:25:45 | 00,021,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\TABCTFR.DLL
[2009-08-19 21:25:45 | 00,018,728 | ---- | C] () -- C:\WINDOWS\System32\ISHF_Ex.tlb
[2009-08-19 21:25:45 | 00,017,804 | ---- | C] () -- C:\WINDOWS\System32\shlctxmnu2.tlb
[2009-08-19 21:25:45 | 00,015,360 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\inetfr.DLL
[2009-08-19 21:25:45 | 00,001,308 | ---- | C] () -- C:\WINDOWS\System32\RUNNABLE.TLB
[2009-08-19 21:25:44 | 00,307,200 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcr70.dll
[2009-08-19 21:25:44 | 00,000,000 | ---D | C] -- C:\Program Files\ISOpen
[2009-08-19 13:41:51 | 00,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusb.dll
[2009-08-19 13:41:50 | 00,159,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusd.dll
[2009-08-19 13:41:49 | 00,015,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usbscan.sys
[2009-08-19 13:41:49 | 00,015,104 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbscan.sys
[2009-08-19 00:37:59 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Pulpit\pobieranie
[2009-08-14 19:06:47 | 00,000,000 | ---D | C] -- C:\WINDOWS\RegisteredPackages
[2009-08-14 19:01:32 | 00,000,000 | ---D | C] -- C:\Program Files\Winamp
[2009-08-14 18:55:02 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Pulpit\marek
[2009-08-14 12:05:42 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Pulpit\Zbyszek
[2009-08-14 11:57:09 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Dane aplikacji\U3
[2009-08-14 11:09:20 | 00,000,000 | ---D | C] -- C:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\WMTools Downloaded Files
[2009-08-14 11:09:07 | 00,000,000 | R--D | C] -- C:\Documents and Settings\User\Moje dokumenty\Moje wideo
[2009-08-14 11:09:07 | 00,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Dokumenty\Moje wideo
[2009-08-12 05:27:39 | 00,128,512 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\dhtmled.ocx
[2009-08-12 05:27:32 | 01,315,328 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msoe.dll
[2009-07-31 21:00:42 | 00,114,688 | ---- | C] () -- C:\WINDOWS\System32\WLANUTL.dll
[2009-07-31 13:22:36 | 00,000,044 | ---- | C] () -- C:\WINDOWS\System32\msssc.dll
[2003-04-16 14:00:00 | 00,000,542 | ---- | C] () -- C:\WINDOWS\win.ini
[2003-04-16 14:00:00 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini

========== Files - Modified Within 30 Days ==========

[1 C:\WINDOWS\System32\*.tmp files]
[6 C:\WINDOWS\*.tmp files]
[2009-09-10 01:11:42 | 00,000,488 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\wirus.doc
[2009-09-10 00:15:29 | 00,001,048 | ---- | M] () -- C:\WINDOWS\System32\tmp.reg
[2009-09-10 00:01:18 | 00,001,734 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\HijackThis.lnk
[2009-09-09 23:56:25 | 00,002,422 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2009-09-09 23:37:16 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2009-09-09 23:37:11 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2009-09-09 23:32:01 | 00,000,592 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Opera.lnk
[2009-09-09 04:43:47 | 00,000,754 | ---- | M] () -- C:\WINDOWS\WORDPAD.INI
[2009-09-09 04:24:05 | 00,000,542 | ---- | M] () -- C:\WINDOWS\win.ini
[2009-09-09 04:24:05 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2009-09-09 04:24:05 | 00,000,211 | RHS- | M] () -- C:\boot.ini
[2009-09-09 04:01:32 | 00,001,709 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\avast! Antivirus.lnk
[2009-09-09 04:01:29 | 00,002,645 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2009-09-09 03:35:44 | 00,017,408 | ---- | M] () -- C:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009-09-09 03:03:47 | 00,001,355 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2009-09-09 02:57:16 | 05,327,144 | -H-- | M] () -- C:\Documents and Settings\User\Ustawienia lokalne\Dane aplikacji\IconCache.db
[2009-09-08 22:28:15 | 00,000,745 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\sgh!!!!!!!!!!!!!1.doc
[2009-09-04 19:05:43 | 00,000,540 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\Nowy Dokument WordPad.doc
[2009-09-01 01:19:47 | 00,047,104 | ---- | M] () -- C:\WINDOWS\System32\KMVIDC32.DLL
[2009-08-29 22:19:56 | 00,010,330 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\Kurnik - GRY Online - darmowe szachy, brydż itp.htm
[2009-08-29 20:59:07 | 00,000,056 | ---- | M] () -- C:\WINDOWS\Wininit.ini
[2009-08-28 23:38:20 | 24,689,600 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\MRT.exe
[2009-08-27 16:58:21 | 00,000,931 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Media Player Classic.lnk
[2009-08-27 01:23:52 | 04,864,007 | ---- | M] ( ) -- C:\Documents and Settings\User\Pulpit\klcodec505b.exe
[2009-08-26 11:47:25 | 00,023,392 | ---- | M] () -- C:\WINDOWS\System32\nscompat.tlb
[2009-08-26 11:47:25 | 00,016,832 | ---- | M] () -- C:\WINDOWS\System32\amcompat.tlb
[2009-08-26 11:46:02 | 00,000,000 | -H-- | M] () -- C:\WINDOWS\System32\drivers\UMDF\MsftWdf_user_01_00_00.Wdf
[2009-08-25 19:57:14 | 00,002,189 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\CV.rtf
[2009-08-22 23:36:44 | 00,286,720 | ---- | M] (Indigo Rose Corporation) -- C:\WINDOWS\iun503.exe
[2009-08-21 19:46:07 | 00,001,604 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\QuickTime Player.lnk
[2009-08-21 02:18:06 | 00,763,990 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2009-08-21 02:18:06 | 00,355,486 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat
[2009-08-21 02:18:06 | 00,311,604 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2009-08-21 02:18:06 | 00,049,492 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat
[2009-08-21 02:18:06 | 00,039,992 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2009-08-19 21:25:46 | 00,000,654 | ---- | M] () -- C:\Documents and Settings\User\Pulpit\ISOpen.lnk
[2009-08-19 21:25:38 | 00,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx
[2009-08-17 18:10:20 | 01,279,456 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\aswBoot.exe
[2009-08-17 18:06:54 | 00,093,392 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2009-08-17 18:06:43 | 00,094,160 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2009-08-17 18:05:52 | 00,114,768 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2009-08-17 18:05:37 | 00,020,560 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2009-08-17 18:04:40 | 00,051,376 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2009-08-17 18:04:29 | 00,023,152 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2009-08-17 18:03:21 | 00,026,944 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2009-08-17 18:02:50 | 00,097,480 | ---- | M] (ALWIL Software) -- C:\WINDOWS\System32\AvastSS.scr

========== LOP Check ==========

[2009-09-08 02:04:02 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\All Users\Dane aplikacji
[2009-08-21 19:47:04 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906}
[2009-09-08 02:04:02 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ESET
[2009-08-29 20:59:21 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\IM
[2009-08-29 20:56:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\IncrediMail
[2009-09-09 02:58:39 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\karta
[2009-08-01 00:30:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\MSN6
[2009-09-09 04:03:32 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP
[2009-08-22 20:19:41 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Trymedia
[2009-09-09 02:59:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\WildTangent
[2009-07-31 12:29:17 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\Default User\Dane aplikacji
[2009-07-31 13:14:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\LocalService\Dane aplikacji
[2009-07-31 13:14:09 | 00,000,000 | ---D | M] -- C:\Documents and Settings\NetworkService\Dane aplikacji
[2009-09-09 23:32:14 | 00,000,000 | RH-D | M] -- C:\Documents and Settings\User\Dane aplikacji
[2009-08-25 12:41:58 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\BESTplayer
[2009-07-31 23:58:53 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Gadu-Gadu
[2009-08-01 00:30:57 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\MSN6
[2009-08-26 00:15:51 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\OpenOffice.org2
[2009-09-09 23:32:14 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\Opera
[2009-09-09 02:58:31 | 00,000,000 | ---D | M] -- C:\Documents and Settings\User\Dane aplikacji\U3
[2003-04-16 14:00:00 | 00,000,065 | RH-- | M] () -- C:\WINDOWS\Tasks\desktop.ini
[2009-09-09 23:37:16 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\Tasks\SA.DAT

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 121 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:C31F31E6
@Alternate Data Stream - 116 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:DFC5A2B2
< End of report >

Dodano 10.09.2009 01:10:07:
wykonałem Twoje polecenia. niestety żadnej poprawy. acha te dnsy co miałem je pozmieniać po resecie kompa znowu zniknęly. mogą to być jakieś problemy z siecią? wcześniej się nie spotkalem z czymś takim

**Posty:** 584 · przez **Andziorka** 10 Wrz 2009, 02:16

W okienko OTL wklej poniższe i klik na Run Fix:

:Processes
explorer.exe

:OTL
O18 - Protocol\Handler\ipp - No CLSID value found
O18 - Protocol\Handler\msdaipp - No CLSID value found
O33 - MountPoints2\{5165990d-87e8-11de-ba96-000bcdb72def}\Shell - "" = AutoRun
O33 - MountPoints2\{c276d85b-8e56-11de-ba9d-0060b35f753a}\Shell - "" = AutoRun

:Files
C:\WINDOWS\System32\tmp.reg
C:\WINDOWS\System32\VCCLSID.exe
C:\WINDOWS\System32\SrchSTS.exe
C:\WINDOWS\System32\VACFix.exe
C:\WINDOWS\System32\IEDFix.exe
C:\WINDOWS\System32\IEDFix.C.exe
C:\WINDOWS\System32\404Fix.exe
C:\WINDOWS\System32\o4Patch.exe
C:\WINDOWS\System32\Agent.OMZ.Fix.exe
C:\WINDOWS\System32\dumphive.exe
C:\WINDOWS\System32\WS2Fix.exe

:Commands
[emptytemp]
[start explorer]
[Reboot]

Dajesz loga powstałego po kasowani + nowy log

Następnie musisz usunąć klucz: MountPoints2.
Wejdź w: Start>>>Uruchom>>> wpisz: regedit
poszukaj klucza: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\ Explorer\MountPoints2
Usuwasz MountPoints2

Przeskanuj komputer tym: http://www.programosy.pl/program,malwarebytes-anti-malware.html suń wszystko co znajdzie i daj loga po kasowaniu (loga z Malware)

**Posty:** 37 · przez **1111** 10 Wrz 2009, 02:36

po tym wklejeniu w otl wyskoczyło:

Kod: Zaznacz wszystko: All processes killed ========== PROCESSES ========== No active process named explorer.exe was found! ========== OTL ========== Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ipp\ deleted successfully. File Protocol\Handler\ipp - No CLSID value found not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\ deleted successfully. File Protocol\Handler\msdaipp - No CLSID value found not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5165990d-87e8-11de-ba96-000bcdb72def}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5165990d-87e8-11de-ba96-000bcdb72def}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c276d85b-8e56-11de-ba9d-0060b35f753a}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c276d85b-8e56-11de-ba9d-0060b35f753a}\ not found. ========== FILES ========== C:\WINDOWS\System32\tmp.reg moved successfully. C:\WINDOWS\System32\VCCLSID.exe moved successfully. C:\WINDOWS\System32\SrchSTS.exe moved successfully. C:\WINDOWS\System32\VACFix.exe moved successfully. C:\WINDOWS\System32\IEDFix.exe moved successfully. C:\WINDOWS\System32\IEDFix.C.exe moved successfully. C:\WINDOWS\System32\404Fix.exe moved successfully. C:\WINDOWS\System32\o4Patch.exe moved successfully. C:\WINDOWS\System32\Agent.OMZ.Fix.exe moved successfully. C:\WINDOWS\System32\dumphive.exe moved successfully. C:\WINDOWS\System32\WS2Fix.exe moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 3623319 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 584241 bytes User: User ->Temp folder emptied: 758332711 bytes ->Temporary Internet Files folder emptied: 35311962 bytes ->Java cache emptied: 15172215 bytes ->FireFox cache emptied: 91391449 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 1299945 bytes %systemroot%\System32 .tmp files removed: 2596 bytes File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_524.dat scheduled to be deleted on reboot. Windows Temp folder emptied: 769209 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 864,53 mb OTL by OldTimer - Version 3.0.10.7 log created on 09102009_022551 Files\Folders moved on Reboot... File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot. C:\WINDOWS\temp\Perflib_Perfdata_524.dat moved successfully. Registry entries deleted on Reboot... teraz log z otl to: All processes killed ========== PROCESSES ========== No active process named explorer.exe was found! ========== OTL ========== Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ipp\ deleted successfully. File Protocol\Handler\ipp - No CLSID value found not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\ deleted successfully. File Protocol\Handler\msdaipp - No CLSID value found not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5165990d-87e8-11de-ba96-000bcdb72def}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5165990d-87e8-11de-ba96-000bcdb72def}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c276d85b-8e56-11de-ba9d-0060b35f753a}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c276d85b-8e56-11de-ba9d-0060b35f753a}\ not found. ========== FILES ========== C:\WINDOWS\System32\tmp.reg moved successfully. C:\WINDOWS\System32\VCCLSID.exe moved successfully. C:\WINDOWS\System32\SrchSTS.exe moved successfully. C:\WINDOWS\System32\VACFix.exe moved successfully. C:\WINDOWS\System32\IEDFix.exe moved successfully. C:\WINDOWS\System32\IEDFix.C.exe moved successfully. C:\WINDOWS\System32\404Fix.exe moved successfully. C:\WINDOWS\System32\o4Patch.exe moved successfully. C:\WINDOWS\System32\Agent.OMZ.Fix.exe moved successfully. C:\WINDOWS\System32\dumphive.exe moved successfully. C:\WINDOWS\System32\WS2Fix.exe moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 3623319 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 584241 bytes User: User ->Temp folder emptied: 758332711 bytes ->Temporary Internet Files folder emptied: 35311962 bytes ->Java cache emptied: 15172215 bytes ->FireFox cache emptied: 91391449 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 1299945 bytes %systemroot%\System32 .tmp files removed: 2596 bytes File delete failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_524.dat scheduled to be deleted on reboot. Windows Temp folder emptied: 769209 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 864,53 mb OTL by OldTimer - Version 3.0.10.7 log created on 09102009_022551 Files\Folders moved on Reboot... File move failed. C:\WINDOWS\temp\_avast4_\Webshlock.txt scheduled to be moved on reboot. C:\WINDOWS\temp\Perflib_Perfdata_524.dat moved successfully. Registry entries deleted on Reboot... [i][size=85]Dodano 10.09.2009 02:04:15:[/size][/i] puściłem scan tym programem. znalazł 1 infekcję: HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.TryMedia) . Log z malwarebytes: Malwarebytes' Anti-Malware 1.40 Wersja bazy definicji: 2769 Windows 5.1.2600 Dodatek Service Pack 3 2009-09-10 03:01:27 mbam-log-2009-09-10 (03-01-27).txt Typ skanowania: Pełne skanowanie (C:\|) Przeskanowane obiekty: 109994 Upłynęło: 16 minute(s), 51 second(s) Zainfekowane procesy w pamięci: 0 Zainfekowane moduły pamięci: 0 Zainfekowane klucze rejestru: 1 Zainfekowane wartości rejestru: 0 Zainfekowane pliki rejestru: 0 Zainfekowane foldery: 0 Zainfekowane pliki: 0 Zainfekowane procesy w pamięci: (Nie wykryto groźnych plików) Zainfekowane moduły pamięci: (Nie wykryto groźnych plików) Zainfekowane klucze rejestru: HKEY_CURRENT_USER\SOFTWARE\Trymedia Systems (Adware.TryMedia) -> Quarantined and deleted successfully. Zainfekowane wartości rejestru: (Nie wykryto groźnych plików) Zainfekowane pliki rejestru: (Nie wykryto groźnych plików) Zainfekowane foldery: (Nie wykryto groźnych plików) Zainfekowane pliki: (Nie wykryto groźnych plików)

Dodano 10.09.2009 16:31:18:
moge coś jeszcze zrobic?

Kto jest na forum