Komputer działa wolno + problem z logowaniem do mbanku

**Posty:** 201 · przez **karlol** 11 Maj 2011, 15:01

Witam,
Od jakiegoś czasu mój komputer działa bardzo wolno. Często, mimo otwartego filmiku na YouTube, zużycie procesora znacząco wzrasta. NOD32 nic nie wykazał więc zwracam się z prośbą o pomoc do was. Dodatkowo w dniu dzisiejszym pojawił się kolejny problem. Mianowicie przy próbie logowania do mBanku, wyskakuje komunikat, żeby podać pin itp. Czytałem kiedyś o tym i wiem że to jakiś syf, z resztą komunikaty mBanku są po Polsku a ten brzmi tak:

Kod: Zaznacz wszystko: We do not recognize the computer you are using. To continue with Online Banking, please provide the information requested below. Confirm Your Identity Instructions: Provide your Card Security Code and as much additional security information as you can. Your entries must match the information on the account record and will be used solely to confirm your identity.

Wrzucam zatem logi do sprawdzenia:
http://karolortyl.pl/OTL.Txt
http://karolortyl.pl/Extras.Txt

Liczę na waszą pomoc.
Pozdrawiam...

**Posty:** 18165 · przez **wojtas** 11 Maj 2011, 16:21

Brak loga z Gmera , dodaj w następnym poście , pamiętaj o emulacji
zastosuj się do tego
odinstaluj w dodaj usuń :

MyPlayCity Toolbar, Ask Toolbar, BitTorrentBar Toolbar, MediaBar,Conduit Engine

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL
SRV - File not found [Auto | Stopped] -- -- (UserAccess7) SecuROM User Access Service (V7)
SRV - File not found [Disabled | Stopped] -- -- (NMIndexingService)
DRV - File not found [Kernel | On_Demand | Running] -- -- (xpsec)
DRV - File not found [Kernel | On_Demand | Running] -- -- (xcpip)
O4 - HKLM..\Run: [] File not found
O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.)
O16 - DPF: {33564D57-0000-0010-8000-00AA00389B71} http://download.microsoft.com/download/F/6/E/F6E491A6-77E1-4E20-9F5F-94901338C922/wmv9VCM.CAB (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-
O16 - DPF: {CAFEEFAC-0014-0002-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-142-windows-i586.cab (Reg Error: Key error.)
O16 - DPF: {CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} http://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab (Reg Error: Key error.)
[2011-04-26 12:15:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karol\Ustawienia lokalne\Dane aplikacji\BitTorrentBar
[2011-04-26 12:14:17 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karol\Ustawienia lokalne\Dane aplikacji\ConduitEngine
@Alternate Data Stream - 97 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:2A81F9CE
@Alternate Data Stream - 353 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:05EE1EEF

:Files
C:\Documents and Settings\Karol\Dane aplikacji\PriceGong
C:\WINDOWS\tasks\*.job
C:\Documents and Settings\Kasiurek\Dane aplikacji\BearShareTb
C:\Documents and Settings\Kasiurek\Dane aplikacji\PriceGong

:Commands
[emptytemp]
[emptyflash]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia (zawartość notatnika, która otworzy się po restarcie). oczywiście Gmer też potrzebny

**Posty:** 201 · przez **karlol** 11 Maj 2011, 19:04

Wszystkie logi:
http://karolortyl.pl/logi/OTL.Txt
http://karolortyl.pl/logi/gmer.txt
http://karolortyl.pl/logi/Extras.Txt
http://karolortyl.pl/logi/05112011_163646.txt

Pozdrawiam

**Posty:** 18165 · przez **wojtas** 11 Maj 2011, 19:29

działają jeszcze pliki :

DRV - [2010-04-28 18:21:47 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)
DRV - [2010-04-28 18:21:47 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)

czy wszystkie emulujące programy odinstalowałeś ?być może wpływ na to ma program : ImgBurn lub PowerISO, spróbuj użyć Defogger'a w przyklejonym.

wykonaj skan: Kaspersky TDSSKiller, jeśli coś znajdzie dajesz Skip. po tym dajesz raport z TDSSKiller'a + log z MBRCheck

**Posty:** 201 · przez **karlol** 11 Maj 2011, 20:07

Kod: Zaznacz wszystko: MBRCheck, version 1.2.3 (c) 2010, AD Command-line: Windows Version: Windows XP Professional Windows Information: Dodatek Service Pack 2 (build 2600) Logical Drives Mask: 0x000001fd Kernel Drivers (total 149): 0x804D7000 \WINDOWS\system32\ntkrnlpa.exe 0x806CE000 \WINDOWS\system32\hal.dll 0xF7B5C000 \WINDOWS\system32\KDCOM.DLL 0xF7A6C000 \WINDOWS\system32\BOOTVID.dll 0xF752C000 ACPI.sys 0xF7B5E000 \WINDOWS\system32\DRIVERS\WMILIB.SYS 0xF751B000 pci.sys 0xF765C000 isapnp.sys 0xF7C24000 pciide.sys 0xF78DC000 \WINDOWS\system32\DRIVERS\PCIIDEX.SYS 0xF766C000 MountMgr.sys 0xF74FC000 ftdisk.sys 0xF7B60000 dmload.sys 0xF74D6000 dmio.sys 0xF78E4000 PartMgr.sys 0xF767C000 sfsync02.sys 0xF768C000 VolSnap.sys 0xF74BE000 atapi.sys 0xF769C000 disk.sys 0xF76AC000 \WINDOWS\system32\DRIVERS\CLASSPNP.SYS 0xF749F000 fltmgr.sys 0xF748D000 sr.sys 0xF76BC000 PxHelp20.sys 0xF7476000 KSecDD.sys 0xF7463000 WudfPf.sys 0xF73D6000 Ntfs.sys 0xF73A9000 NDIS.sys 0xF7A70000 vbtenum.sys 0xF7395000 sfvfs02.sys 0xF78EC000 sfhlp02.sys 0xF7383000 sfdrv01.sys 0xF7368000 Mup.sys 0xF78F4000 BTHidMgr.sys 0xF7A74000 BtHidBus.sys 0xF76FC000 \SystemRoot\system32\DRIVERS\AmdK8.sys 0xF79BC000 \SystemRoot\system32\DRIVERS\usbohci.sys 0xF6AF2000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0xF770C000 \SystemRoot\system32\DRIVERS\usbfilter.sys 0xF7B88000 \SystemRoot\system32\DRIVERS\USBD.SYS 0xF79C4000 \SystemRoot\system32\DRIVERS\usbehci.sys 0xF771C000 \SystemRoot\system32\DRIVERS\imapi.sys 0xF772C000 \SystemRoot\system32\DRIVERS\cdrom.sys 0xF773C000 \SystemRoot\system32\DRIVERS\redbook.sys 0xF6ACF000 \SystemRoot\system32\DRIVERS\ks.sys 0xF6978000 \SystemRoot\system32\drivers\P17.sys 0xF6954000 \SystemRoot\system32\drivers\portcls.sys 0xF774C000 \SystemRoot\system32\drivers\drmk.sys 0xF6924000 \SystemRoot\system32\DRIVERS\ctoss2k.sys 0xF68FE000 \SystemRoot\system32\DRIVERS\ctsfm2k.sys 0xF7B40000 \SystemRoot\system32\DRIVERS\nvnetbus.sys 0xF68B8000 \SystemRoot\system32\DRIVERS\NVNRM.SYS 0xF6884000 \SystemRoot\system32\DRIVERS\NVSNPU.SYS 0xF6405000 \SystemRoot\system32\DRIVERS\ati2mtag.sys 0xF63F1000 \SystemRoot\system32\DRIVERS\VIDEOPRT.SYS 0xF63CC000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0xF79CC000 \SystemRoot\system32\DRIVERS\fdc.sys 0xF63BB000 \SystemRoot\system32\DRIVERS\serial.sys 0xF7B44000 \SystemRoot\system32\DRIVERS\serenum.sys 0xF63A7000 \SystemRoot\system32\DRIVERS\parport.sys 0xF775C000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0xF79D4000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0xF776C000 \SystemRoot\System32\Drivers\VcommMgr.sys 0xF7D40000 \SystemRoot\system32\DRIVERS\audstub.sys 0xF7B8C000 \SystemRoot\System32\Drivers\RootMdm.sys 0xF79DC000 \SystemRoot\System32\Drivers\Modem.SYS 0xF777C000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0xF7B48000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0xF6390000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0xF778C000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0xF779C000 \SystemRoot\system32\DRIVERS\raspptp.sys 0xF79E4000 \SystemRoot\system32\DRIVERS\TDI.SYS 0xF637F000 \SystemRoot\system32\DRIVERS\psched.sys 0xF77AC000 \SystemRoot\system32\DRIVERS\msgpc.sys 0xF79EC000 \SystemRoot\system32\DRIVERS\ptilink.sys 0xF79F4000 \SystemRoot\system32\DRIVERS\raspti.sys 0xF7B50000 \SystemRoot\system32\DRIVERS\btnetdrv.sys 0xF79FC000 \SystemRoot\system32\DRIVERS\VComm.sys 0xF634E000 \SystemRoot\system32\DRIVERS\rdpdr.sys 0xF77BC000 \SystemRoot\system32\DRIVERS\termdd.sys 0xF7A04000 \SystemRoot\system32\DRIVERS\mouclass.sys 0xF7B8E000 \SystemRoot\system32\DRIVERS\swenum.sys 0xF62F2000 \SystemRoot\system32\DRIVERS\update.sys 0xF733C000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0xF77CC000 \SystemRoot\System32\Drivers\NDProxy.SYS 0xF77DC000 \SystemRoot\system32\DRIVERS\usbhub.sys 0xF77EC000 \SystemRoot\system32\DRIVERS\NVENETFD.sys 0xF7A0C000 \SystemRoot\system32\DRIVERS\flpydisk.sys 0xF7B92000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0xF7CD8000 \SystemRoot\System32\Drivers\Null.SYS 0xF7B94000 \SystemRoot\System32\Drivers\Beep.SYS 0xF7A1C000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0xF7A24000 \SystemRoot\System32\drivers\vga.sys 0xF7B96000 \SystemRoot\System32\Drivers\mnmdd.SYS 0xF7B98000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0xF7A2C000 \SystemRoot\System32\Drivers\Msfs.SYS 0xF7A34000 \SystemRoot\System32\Drivers\Npfs.SYS 0xF7B2C000 \SystemRoot\system32\DRIVERS\rasacd.sys 0xAE7CD000 \SystemRoot\system32\DRIVERS\ipsec.sys 0xAE775000 \SystemRoot\system32\DRIVERS\tcpip.sys 0xF7B34000 \SystemRoot\System32\drivers\ws2ifsl.sys 0xAE753000 \SystemRoot\System32\drivers\afd.sys 0xF782C000 \SystemRoot\system32\DRIVERS\netbios.sys 0xF7A3C000 \SystemRoot\System32\Drivers\StarOpen.SYS 0xF784C000 \SystemRoot\System32\Drivers\SCDEmu.SYS 0xAE6D7000 \SystemRoot\system32\DRIVERS\rdbss.sys 0xF7B9A000 \SystemRoot\system32\drivers\nod32drv.sys 0xAE640000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0xF785C000 \SystemRoot\System32\Drivers\Fips.SYS 0xAE57F000 \SystemRoot\system32\DRIVERS\ipnat.sys 0xF786C000 \SystemRoot\system32\DRIVERS\wanarp.sys 0xF7A44000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0xF7B24000 \SystemRoot\system32\DRIVERS\hidusb.sys 0xF787C000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0xAE74F000 \SystemRoot\system32\DRIVERS\kbdhid.sys 0xAE74B000 \SystemRoot\system32\DRIVERS\mouhid.sys 0xF789C000 \SystemRoot\System32\Drivers\Cdfs.SYS 0xAE567000 \SystemRoot\System32\Drivers\dump_atapi.sys 0xF7BA0000 \SystemRoot\System32\Drivers\dump_WMILIB.SYS 0xBF800000 \SystemRoot\System32\win32k.sys 0xF7A4C000 \SystemRoot\System32\watchdog.sys 0xAE72B000 \SystemRoot\System32\drivers\Dxapi.sys 0xBF000000 \SystemRoot\System32\drivers\dxg.sys 0xF7C4A000 \SystemRoot\System32\drivers\dxgthk.sys 0xBF012000 \SystemRoot\System32\ati2dvag.dll 0xBF061000 \SystemRoot\System32\ati2cqag.dll 0xBF0E9000 \SystemRoot\System32\atikvmag.dll 0xBF14F000 \SystemRoot\System32\atiok3x2.dll 0xBF18F000 \SystemRoot\System32\ati3duag.dll 0xBF4E6000 \SystemRoot\System32\ativvaxx.dll 0xBFFA0000 \SystemRoot\System32\ATMFD.DLL 0xAC086000 \SystemRoot\system32\DRIVERS\netbt.sys 0xAC21E000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0xABE6B000 \SystemRoot\system32\drivers\xpsec.sys 0xABE13000 \SystemRoot\system32\drivers\xcpip.sys 0xABC6E000 \SystemRoot\system32\drivers\wdmaud.sys 0xABF16000 \SystemRoot\system32\drivers\sysaudio.sys 0xAB8F4000 \SystemRoot\system32\DRIVERS\mrxdav.sys 0xF7B7C000 \SystemRoot\System32\Drivers\ParVdm.SYS 0xAB879000 \SystemRoot\system32\drivers\amon.sys 0xAB836000 \SystemRoot\system32\DRIVERS\atksgt.sys 0xF79B4000 \SystemRoot\system32\DRIVERS\lirsgt.sys 0xAB6CE000 \SystemRoot\system32\DRIVERS\secdrv.sys 0xAB653000 \SystemRoot\system32\DRIVERS\srv.sys 0xF7C00000 \??\C:\WINDOWS\system32\Drivers\Vcs.sys 0xF79A4000 \SystemRoot\System32\Drivers\TDTCP.SYS 0xAB4A1000 \SystemRoot\System32\Drivers\RDPWD.SYS 0xAB0B5000 \SystemRoot\system32\drivers\kmixer.sys 0xAAEC1000 \SystemRoot\system32\drivers\klmd.sys 0x7C900000 \WINDOWS\system32\ntdll.dll Processes (total 34): 0 System Idle Process 4 System 764 C:\WINDOWS\system32\smss.exe 820 csrss.exe 860 C:\WINDOWS\system32\winlogon.exe 904 C:\WINDOWS\system32\services.exe 916 C:\WINDOWS\system32\lsass.exe 1072 C:\WINDOWS\system32\ati2evxx.exe 1084 C:\WINDOWS\system32\svchost.exe 1168 svchost.exe 1316 C:\WINDOWS\system32\svchost.exe 1356 C:\WINDOWS\system32\svchost.exe 1428 C:\WINDOWS\system32\ati2evxx.exe 1488 svchost.exe 1600 svchost.exe 1812 C:\WINDOWS\system32\spoolsv.exe 1496 C:\WINDOWS\explorer.exe 1664 C:\Program Files\ESET\nod32kui.exe 1684 C:\WINDOWS\system32\rundll32.exe 1704 C:\Program Files\Common Files\Java\Java Update\jusched.exe 1720 C:\PROGRA~1\A4Tech\Keyboard\Ikeymain.exe 1744 C:\WINDOWS\system32\ctfmon.exe 236 F:\BlueSoleil\BlueSoleilCS.exe 332 C:\Program Files\Bonjour\mDNSResponder.exe 1584 C:\Program Files\Google\Update\GoogleUpdate.exe 1396 C:\Program Files\Java\jre6\bin\jqs.exe 2152 C:\Program Files\ESET\nod32krn.exe 2168 C:\WINDOWS\system32\PnkBstrA.exe 2232 C:\WINDOWS\system32\svchost.exe 2904 F:\BlueSoleil\BsHelpCS.exe 3740 alg.exe 3008 F:\Mozilla Thunderbird\thunderbird.exe 2868 F:\Mozilla Firefox\firefox.exe 3612 C:\Documents and Settings\Karol\Pulpit\MBRCheck.exe \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000000`00007e00 (NTFS) \\.\D: --> \\.\PhysicalDrive0 at offset 0x00000009`f4e39c00 (NTFS) \\.\E: --> \\.\PhysicalDrive0 at offset 0x0000000e`d7108800 (NTFS) \\.\F: --> \\.\PhysicalDrive0 at offset 0x00000016`2a53ea00 (NTFS) \\.\H: --> \\.\PhysicalDrive0 at offset 0x0000001f`eeadc200 (NTFS) \\.\I: --> \\.\PhysicalDrive0 at offset 0x00000029`b3079a00 (NTFS) PhysicalDrive0 Model Number: ST3200820AS, Rev: 3.AAD Size Device Name MBR Status -------------------------------------------- 186 GB \\.\PhysicalDrive0 Windows XP MBR code detected SHA1: DA38B874B7713D1B51CBC449F4EF809B0DEC644A Done!

Kod: Zaznacz wszystko: 2011/05/11 20:05:20.0937 2036 TDSS rootkit removing tool 2.5.0.0 May 1 2011 14:20:16 2011/05/11 20:05:21.0453 2036 ================================================================================ 2011/05/11 20:05:21.0453 2036 SystemInfo: 2011/05/11 20:05:21.0453 2036 2011/05/11 20:05:21.0453 2036 OS Version: 5.1.2600 ServicePack: 2.0 2011/05/11 20:05:21.0453 2036 Product type: Workstation 2011/05/11 20:05:21.0453 2036 ComputerName: PPP-77949343E3D 2011/05/11 20:05:21.0453 2036 UserName: Karol 2011/05/11 20:05:21.0453 2036 Windows directory: C:\WINDOWS 2011/05/11 20:05:21.0453 2036 System windows directory: C:\WINDOWS 2011/05/11 20:05:21.0453 2036 Processor architecture: Intel x86 2011/05/11 20:05:21.0453 2036 Number of processors: 1 2011/05/11 20:05:21.0453 2036 Page size: 0x1000 2011/05/11 20:05:21.0453 2036 Boot type: Normal boot 2011/05/11 20:05:21.0453 2036 ================================================================================ 2011/05/11 20:05:22.0187 2036 Initialize success 2011/05/11 20:05:23.0593 3276 ================================================================================ 2011/05/11 20:05:23.0593 3276 Scan started 2011/05/11 20:05:23.0593 3276 Mode: Manual; 2011/05/11 20:05:23.0593 3276 ================================================================================ 2011/05/11 20:05:24.0859 3276 ACPI (a966410ecf83b81f3b0b8e07a71957d4) C:\WINDOWS\system32\DRIVERS\ACPI.sys 2011/05/11 20:05:24.0906 3276 ACPIEC (66a42b7db194e24b973bbcce840a0f3f) C:\WINDOWS\system32\drivers\ACPIEC.sys 2011/05/11 20:05:25.0015 3276 aec (841f385c6cfaf66b58fbd898722bb4f0) C:\WINDOWS\system32\drivers\aec.sys 2011/05/11 20:05:25.0046 3276 AFD (5ac495f4cb807b2b98ad2ad591e6d92e) C:\WINDOWS\System32\drivers\afd.sys 2011/05/11 20:05:25.0265 3276 AmdK8 (59301936898ae62245a6f09c0aba9475) C:\WINDOWS\system32\DRIVERS\AmdK8.sys 2011/05/11 20:05:25.0359 3276 AMON (98ecca556d67deba604a4b4b1fdb02b8) C:\WINDOWS\system32\drivers\amon.sys 2011/05/11 20:05:25.0671 3276 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys 2011/05/11 20:05:25.0703 3276 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys 2011/05/11 20:05:25.0921 3276 ati2mtag (b70ecb6bd20e13f0ce3c0bc95f5c3a9a) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys 2011/05/11 20:05:26.0015 3276 AtiHdmiService (eaece4a0d90d6e1fbe068cce9efd73a0) C:\WINDOWS\system32\drivers\AtiHdmi.sys 2011/05/11 20:05:26.0109 3276 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys 2011/05/11 20:05:26.0171 3276 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys 2011/05/11 20:05:26.0218 3276 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys 2011/05/11 20:05:26.0312 3276 BlueletAudio (f5148b2be0f5771efb73b355ba026d04) C:\WINDOWS\system32\DRIVERS\blueletaudio.sys 2011/05/11 20:05:26.0375 3276 BlueletSCOAudio (bd91afc523fd59f881e1763c38fb772f) C:\WINDOWS\system32\DRIVERS\BlueletSCOAudio.sys 2011/05/11 20:05:26.0515 3276 BT (c5cce2b26f73f8cf7f3c82159e79aa08) C:\WINDOWS\system32\DRIVERS\btnetdrv.sys 2011/05/11 20:05:26.0578 3276 BTCAMDRV (62506a32d1f1878655dc3de3dfd1cff2) C:\WINDOWS\system32\DRIVERS\BTCamDrv.sys 2011/05/11 20:05:26.0640 3276 Btcsrusb (fb2abc6d08d9f8d5ed8e02cbd18b39bb) C:\WINDOWS\system32\Drivers\btcusb.sys 2011/05/11 20:05:26.0671 3276 BtHidBus (69511655f2563b3719e0290065369f08) C:\WINDOWS\system32\Drivers\BtHidBus.sys 2011/05/11 20:05:26.0718 3276 BTHidEnum (ce643d0918123d76a5caab008fca9663) C:\WINDOWS\system32\DRIVERS\vbtenum.sys 2011/05/11 20:05:26.0734 3276 BTHidMgr (dfca4fe4c8aec786b4d0f432eb730f48) C:\WINDOWS\system32\Drivers\BTHidMgr.sys 2011/05/11 20:05:26.0781 3276 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys 2011/05/11 20:05:26.0843 3276 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys 2011/05/11 20:05:26.0906 3276 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys 2011/05/11 20:05:26.0953 3276 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys 2011/05/11 20:05:26.0984 3276 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys 2011/05/11 20:05:27.0156 3276 ctsfm2k (8db84de3aab34a8b4c2f644eff41cd76) C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys 2011/05/11 20:05:27.0250 3276 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys 2011/05/11 20:05:27.0312 3276 dmboot (3b809ffad55dcebdb156d5ca1bd3da65) C:\WINDOWS\system32\drivers\dmboot.sys 2011/05/11 20:05:27.0359 3276 dmio (27725b6501201c3080ba73048bce389a) C:\WINDOWS\system32\drivers\dmio.sys 2011/05/11 20:05:27.0406 3276 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys 2011/05/11 20:05:27.0437 3276 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys 2011/05/11 20:05:27.0500 3276 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys 2011/05/11 20:05:27.0546 3276 dtscsi (12aca694b50ea53563c1e7c99e7bb27d) C:\WINDOWS\System32\Drivers\dtscsi.sys 2011/05/11 20:05:27.0625 3276 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys 2011/05/11 20:05:27.0687 3276 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\DRIVERS\fdc.sys 2011/05/11 20:05:27.0718 3276 Fips (c5fb298257c0a6514ea17835e774ea0a) C:\WINDOWS\system32\drivers\Fips.sys 2011/05/11 20:05:27.0765 3276 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\DRIVERS\flpydisk.sys 2011/05/11 20:05:27.0812 3276 FltMgr (157754f0df355a9e0a6f54721914f9c6) C:\WINDOWS\system32\drivers\fltmgr.sys 2011/05/11 20:05:27.0875 3276 FsUsbExDisk (790a4ca68f44be35967b3df61f3e4675) C:\WINDOWS\system32\FsUsbExDisk.SYS 2011/05/11 20:05:27.0906 3276 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys 2011/05/11 20:05:27.0937 3276 Ftdisk (ed6d921d8ab423138fb35beee6d6a6cb) C:\WINDOWS\system32\DRIVERS\ftdisk.sys 2011/05/11 20:05:28.0000 3276 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys 2011/05/11 20:05:28.0062 3276 GVCplDrv (f22bf7f345df95c09942951246aaa28d) C:\WINDOWS\system32\drivers\GVCplDrv.sys 2011/05/11 20:05:28.0109 3276 hamachi (7929a161f9951d173ca9900fe7067391) C:\WINDOWS\system32\DRIVERS\hamachi.sys 2011/05/11 20:05:28.0156 3276 HDAudBus (3fcc124b6e08ee0e9351f717dd136939) C:\WINDOWS\system32\DRIVERS\HDAudBus.sys 2011/05/11 20:05:28.0218 3276 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys 2011/05/11 20:05:28.0296 3276 HTTP (c19b522a9ae0bbc3293397f3055e80a1) C:\WINDOWS\system32\Drivers\HTTP.sys 2011/05/11 20:05:28.0406 3276 i8042prt (2656fdfe0a7916c3a16f374454c55dd9) C:\WINDOWS\system32\DRIVERS\i8042prt.sys 2011/05/11 20:05:28.0453 3276 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys 2011/05/11 20:05:28.0562 3276 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\drivers\ip6fw.sys 2011/05/11 20:05:28.0593 3276 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys 2011/05/11 20:05:28.0625 3276 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys 2011/05/11 20:05:28.0656 3276 IpNat (b5a8e215ac29d24d60b4d1250ef05ace) C:\WINDOWS\system32\DRIVERS\ipnat.sys 2011/05/11 20:05:28.0703 3276 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys 2011/05/11 20:05:28.0734 3276 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys 2011/05/11 20:05:28.0796 3276 isapnp (01a9e68528f4f34e5702123d27c67bd4) C:\WINDOWS\system32\DRIVERS\isapnp.sys 2011/05/11 20:05:28.0828 3276 IvtBtBUs (71e1fc547cc488d5cd7bf0860c96f5af) C:\WINDOWS\system32\Drivers\IvtBtBus.sys 2011/05/11 20:05:28.0875 3276 Kbdclass (cc13db862f929ae33f64c3bedc01cd31) C:\WINDOWS\system32\DRIVERS\kbdclass.sys 2011/05/11 20:05:28.0937 3276 kbdhid (831be9197bdace6bdcac1bfdbe1c380f) C:\WINDOWS\system32\DRIVERS\kbdhid.sys 2011/05/11 20:05:29.0000 3276 kmixer (d93cad07c5683db066b0b2d2d3790ead) C:\WINDOWS\system32\drivers\kmixer.sys 2011/05/11 20:05:29.0046 3276 KSecDD (eb7ffe87fd367ea8fca0506f74a87fbb) C:\WINDOWS\system32\drivers\KSecDD.sys 2011/05/11 20:05:29.0125 3276 L6PODX3LV (0e2e3cabb4723b78441e58e5899d82d9) C:\WINDOWS\system32\Drivers\L6PODX3LV.sys 2011/05/11 20:05:29.0265 3276 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys 2011/05/11 20:05:29.0312 3276 Modem (15f33d12d604d0198ce5561f102cd9c5) C:\WINDOWS\system32\drivers\Modem.sys 2011/05/11 20:05:29.0359 3276 Mouclass (69c12b99ae8b6b99ec314e9b99833728) C:\WINDOWS\system32\DRIVERS\mouclass.sys 2011/05/11 20:05:29.0390 3276 mouhid (ecec1e6cd558ab80f944f31326e9d3b5) C:\WINDOWS\system32\DRIVERS\mouhid.sys 2011/05/11 20:05:29.0421 3276 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys 2011/05/11 20:05:29.0468 3276 MRxDAV (46edcc8f2db2f322c24f48785cb46366) C:\WINDOWS\system32\DRIVERS\mrxdav.sys 2011/05/11 20:05:29.0515 3276 MRxSmb (1fd607fc67f7f7c633c3da65bfc53d18) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 2011/05/11 20:05:29.0562 3276 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys 2011/05/11 20:05:29.0609 3276 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys 2011/05/11 20:05:29.0656 3276 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys 2011/05/11 20:05:29.0671 3276 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys 2011/05/11 20:05:29.0703 3276 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys 2011/05/11 20:05:29.0750 3276 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys 2011/05/11 20:05:29.0781 3276 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys 2011/05/11 20:05:29.0828 3276 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys 2011/05/11 20:05:29.0859 3276 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys 2011/05/11 20:05:29.0906 3276 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys 2011/05/11 20:05:29.0937 3276 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys 2011/05/11 20:05:29.0984 3276 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys 2011/05/11 20:05:30.0015 3276 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys 2011/05/11 20:05:30.0046 3276 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys 2011/05/11 20:05:30.0109 3276 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys 2011/05/11 20:05:30.0140 3276 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys 2011/05/11 20:05:30.0218 3276 nmwcd (4a8a2aa0706b659175169decf198e9d7) C:\WINDOWS\system32\drivers\ccdcmb.sys 2011/05/11 20:05:30.0265 3276 nmwcdc (fd3e61831095ac62e6840d986b5a2016) C:\WINDOWS\system32\drivers\ccdcmbo.sys 2011/05/11 20:05:30.0312 3276 nmwcdnsu (02e96113511171ba7559386d10d3daea) C:\WINDOWS\system32\drivers\nmwcdnsu.sys 2011/05/11 20:05:30.0375 3276 nmwcdnsuc (fb09150cfc7a499a53c308d04841a3bd) C:\WINDOWS\system32\drivers\nmwcdnsuc.sys 2011/05/11 20:05:30.0421 3276 nod32drv (18c1c4b7098130e672cb9d28cf67f81e) C:\WINDOWS\system32\drivers\nod32drv.sys 2011/05/11 20:05:30.0468 3276 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys 2011/05/11 20:05:30.0515 3276 Ntfs (b78be402c3f63dd55521f73876951cdd) C:\WINDOWS\system32\drivers\Ntfs.sys 2011/05/11 20:05:30.0562 3276 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys 2011/05/11 20:05:30.0625 3276 NVENETFD (2f4ca0052a50d122b9f0a2efa52dfa67) C:\WINDOWS\system32\DRIVERS\NVENETFD.sys 2011/05/11 20:05:30.0656 3276 nvnetbus (197779dde275445ab253667832120ea7) C:\WINDOWS\system32\DRIVERS\nvnetbus.sys 2011/05/11 20:05:30.0687 3276 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys 2011/05/11 20:05:30.0765 3276 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys 2011/05/11 20:05:30.0812 3276 ossrv (103a9b117a7d9903111955cdafe65ac6) C:\WINDOWS\system32\DRIVERS\ctoss2k.sys 2011/05/11 20:05:30.0890 3276 P17 (df886ffed69aead0cf608b89b18c3f6f) C:\WINDOWS\system32\drivers\P17.sys 2011/05/11 20:05:31.0000 3276 Parport (2ff48d8fdc815a8492fb2bd81e6999c2) C:\WINDOWS\system32\DRIVERS\parport.sys 2011/05/11 20:05:31.0187 3276 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys 2011/05/11 20:05:31.0421 3276 ParVdm (453ec2c2a20a1382f564541918520eeb) C:\WINDOWS\system32\drivers\ParVdm.sys 2011/05/11 20:05:31.0515 3276 PCANDIS5 (58c5ea3de400fe1d08cfeca6d5c14ebd) C:\WINDOWS\system32\PCANDIS5.SYS 2011/05/11 20:05:31.0562 3276 pccsmcfd (fd2041e9ba03db7764b2248f02475079) C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys 2011/05/11 20:05:31.0593 3276 PCI (5fd05c92ec56f696eaa50b68cef1b84a) C:\WINDOWS\system32\DRIVERS\pci.sys 2011/05/11 20:05:31.0656 3276 PCIIde (548cf2d6369eae441a4c6baa75bc4f0a) C:\WINDOWS\system32\DRIVERS\pciide.sys 2011/05/11 20:05:31.0687 3276 Pcmcia (2849812217ecec059cb45f80eb6e52d4) C:\WINDOWS\system32\drivers\Pcmcia.sys 2011/05/11 20:05:31.0906 3276 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys 2011/05/11 20:05:31.0937 3276 Processor (0914733fb2fc58f69cda0e929bf2df22) C:\WINDOWS\system32\DRIVERS\processr.sys 2011/05/11 20:05:31.0984 3276 PSched (48671f327553dcf1d27f6197f622a668) C:\WINDOWS\system32\DRIVERS\psched.sys 2011/05/11 20:05:32.0031 3276 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys 2011/05/11 20:05:32.0078 3276 PxHelp20 (d86b4a68565e444d76457f14172c875a) C:\WINDOWS\system32\Drivers\PxHelp20.sys 2011/05/11 20:05:32.0234 3276 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys 2011/05/11 20:05:32.0281 3276 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 2011/05/11 20:05:32.0359 3276 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys 2011/05/11 20:05:32.0406 3276 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys 2011/05/11 20:05:32.0437 3276 Rdbss (29d66245adba878fff574cd66abd2884) C:\WINDOWS\system32\DRIVERS\rdbss.sys 2011/05/11 20:05:32.0484 3276 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys 2011/05/11 20:05:32.0531 3276 rdpdr (a2cae2c60bc37e0751ef9dda7ceaf4ad) C:\WINDOWS\system32\DRIVERS\rdpdr.sys 2011/05/11 20:05:32.0578 3276 RDPWD (d4f5643d7714ef499ae9527fdcd50894) C:\WINDOWS\system32\drivers\RDPWD.sys 2011/05/11 20:05:32.0640 3276 redbook (bddcece9acdad26841c987d10376f6f7) C:\WINDOWS\system32\DRIVERS\redbook.sys 2011/05/11 20:05:32.0703 3276 ROOTMODEM (d8b0b4ade32574b2d9c5cc34dc0dbbe7) C:\WINDOWS\system32\Drivers\RootMdm.sys 2011/05/11 20:05:32.0796 3276 SCDEmu (c23dbd9bfba8b1170706e0896b3cf7da) C:\WINDOWS\system32\drivers\SCDEmu.sys 2011/05/11 20:05:32.0843 3276 Secdrv (07f7f501ad50de2ba2d5842d9b6d6155) C:\WINDOWS\system32\DRIVERS\secdrv.sys 2011/05/11 20:05:32.0890 3276 serenum (a2d868aeeff612e70e213c451a70cafb) C:\WINDOWS\system32\DRIVERS\serenum.sys 2011/05/11 20:05:32.0937 3276 Serial (859bc6f8c3d58cfda9181e9926c7ddb9) C:\WINDOWS\system32\DRIVERS\serial.sys 2011/05/11 20:05:33.0000 3276 sfdrv01 (4c0d673281178cb496011a2e28571fc8) C:\WINDOWS\system32\drivers\sfdrv01.sys 2011/05/11 20:05:33.0046 3276 sfhlp02 (15be2b5e4dc5b8623cf167720682abc9) C:\WINDOWS\system32\drivers\sfhlp02.sys 2011/05/11 20:05:33.0093 3276 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys 2011/05/11 20:05:33.0156 3276 sfsync02 (efebbc1d13fdb77a6af4eddfc7232edf) C:\WINDOWS\system32\drivers\sfsync02.sys 2011/05/11 20:05:33.0187 3276 sfvfs02 (4edf98028a05263b515b17b3e7b52509) C:\WINDOWS\system32\drivers\sfvfs02.sys 2011/05/11 20:05:33.0281 3276 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys 2011/05/11 20:05:33.0312 3276 SONYPVU1 (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS 2011/05/11 20:05:33.0390 3276 splitter (8e186b8f23295d1e42c573b82b80d548) C:\WINDOWS\system32\drivers\splitter.sys 2011/05/11 20:05:33.0468 3276 sr (6145ca23bccda679a772ec0af42d6eb5) C:\WINDOWS\system32\DRIVERS\sr.sys 2011/05/11 20:05:33.0500 3276 Srv (20b7e396720353e4117d64d9dcb926ca) C:\WINDOWS\system32\DRIVERS\srv.sys 2011/05/11 20:05:33.0562 3276 ss_bbus (eaa66218cd39f5bb1b4853a78c67c787) C:\WINDOWS\system32\DRIVERS\ss_bbus.sys 2011/05/11 20:05:33.0593 3276 ss_bmdfl (91765f99914ed8693d8bc76524f21581) C:\WINDOWS\system32\DRIVERS\ss_bmdfl.sys 2011/05/11 20:05:33.0640 3276 ss_bmdm (840e7b738b03c10ee91d9b7d3d6eff15) C:\WINDOWS\system32\DRIVERS\ss_bmdm.sys 2011/05/11 20:05:33.0687 3276 StarOpen (306521935042fc0a6988d528643619b3) C:\WINDOWS\system32\drivers\StarOpen.sys 2011/05/11 20:05:33.0734 3276 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys 2011/05/11 20:05:33.0765 3276 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys 2011/05/11 20:05:33.0828 3276 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys 2011/05/11 20:05:33.0984 3276 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys 2011/05/11 20:05:34.0062 3276 Tcpip (9f4b36614a0fc234525ba224957de55c) C:\WINDOWS\system32\DRIVERS\tcpip.sys 2011/05/11 20:05:34.0109 3276 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys 2011/05/11 20:05:34.0156 3276 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys 2011/05/11 20:05:34.0187 3276 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys 2011/05/11 20:05:34.0281 3276 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys 2011/05/11 20:05:34.0343 3276 Update (aff2e5045961bbc0a602bb6f95eb1345) C:\WINDOWS\system32\DRIVERS\update.sys 2011/05/11 20:05:34.0406 3276 upperdev (587e643a4e2ffd9a00f114b057ceb773) C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys 2011/05/11 20:05:34.0468 3276 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys 2011/05/11 20:05:34.0515 3276 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys 2011/05/11 20:05:34.0562 3276 usbfilter (80cfe695c3a32e846d3e79694ac528d1) C:\WINDOWS\system32\DRIVERS\usbfilter.sys 2011/05/11 20:05:34.0593 3276 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys 2011/05/11 20:05:34.0625 3276 usbohci (bdfe799a8531bad8a5a985821fe78760) C:\WINDOWS\system32\DRIVERS\usbohci.sys 2011/05/11 20:05:34.0671 3276 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys 2011/05/11 20:05:34.0718 3276 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys 2011/05/11 20:05:34.0765 3276 usbser (49106ee29074e6a3d3ac9e24c6d791d8) C:\WINDOWS\system32\DRIVERS\usbser.sys 2011/05/11 20:05:34.0812 3276 UsbserFilt (fca6a196d47cb972a0e4adc0db9cd17c) C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys 2011/05/11 20:05:34.0875 3276 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS 2011/05/11 20:05:34.0921 3276 VComm (51750b0539986186c6931fc40d171521) C:\WINDOWS\system32\DRIVERS\VComm.sys 2011/05/11 20:05:34.0953 3276 VcommMgr (6d9c891c0a761afed1f3609c2e56f2b9) C:\WINDOWS\system32\Drivers\VcommMgr.sys 2011/05/11 20:05:35.0015 3276 Vcs (ce9b7df9af5b01884beeab3f703c3bf6) C:\WINDOWS\system32\Drivers\Vcs.sys 2011/05/11 20:05:35.0046 3276 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys 2011/05/11 20:05:35.0109 3276 VolSnap (ecd173739b8ec10a814cc18653df5a36) C:\WINDOWS\system32\drivers\VolSnap.sys 2011/05/11 20:05:35.0187 3276 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys 2011/05/11 20:05:35.0234 3276 wceusbsh (46a247f6617526afe38b6f12f5512120) C:\WINDOWS\system32\DRIVERS\wceusbsh.sys 2011/05/11 20:05:35.0296 3276 Wdf01000 (bbcfeab7e871cddac2d397ee7fa91fdc) C:\WINDOWS\system32\Drivers\wdf01000.sys 2011/05/11 20:05:35.0375 3276 wdmaud (2797f33ebf50466020c430ee4f037933) C:\WINDOWS\system32\drivers\wdmaud.sys 2011/05/11 20:05:35.0484 3276 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\Drivers\wpdusb.sys 2011/05/11 20:05:35.0531 3276 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys 2011/05/11 20:05:35.0578 3276 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS 2011/05/11 20:05:35.0640 3276 WudfPf (6ff66513d372d479ef1810223c8d20ce) C:\WINDOWS\system32\DRIVERS\WudfPf.sys 2011/05/11 20:05:35.0671 3276 WudfRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\WINDOWS\system32\DRIVERS\wudfrd.sys 2011/05/11 20:05:35.0875 3276 \HardDisk0 - detected Backdoor.Win32.Sinowal.knf (0) 2011/05/11 20:05:35.0890 3276 ================================================================================ 2011/05/11 20:05:35.0890 3276 Scan finished 2011/05/11 20:05:35.0890 3276 ================================================================================ 2011/05/11 20:05:35.0906 3140 Detected object count: 1 2011/05/11 20:05:40.0500 3140 \HardDisk0 (Backdoor.Win32.Sinowal.knf) - will be cured after reboot 2011/05/11 20:05:40.0500 3140 \HardDisk0 - ok 2011/05/11 20:05:40.0500 3140 Backdoor.Win32.Sinowal.knf(\HardDisk0) - User select action: Cure 2011/05/11 20:05:53.0515 3572 Deinitialize success

**Posty:** 18165 · przez **wojtas** 11 Maj 2011, 20:43

po MBR powinieneś zresetować kompa, jeśli to zrobiłeś to teraz zaprezentuj nowe logi z OTL + Gmer

Autor postu otrzymał pochwałę

**Posty:** 201 · przez **karlol** 12 Maj 2011, 22:28

Kod: Zaznacz wszystko: OTL logfile created on: 2011-05-12 16:14:46 - Run 3 OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Karol\Pulpit Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1 023,00 Mb Total Physical Memory | 273,00 Mb Available Physical Memory | 27,00% Memory free 2,00 Gb Paging File | 2,00 Gb Available in Paging File | 76,00% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 39,83 Gb Total Space | 9,41 Gb Free Space | 23,63% Space Free | Partition Type: NTFS Drive D: | 19,53 Gb Total Space | 8,94 Gb Free Space | 45,76% Space Free | Partition Type: NTFS Drive E: | 29,30 Gb Total Space | 0,95 Gb Free Space | 3,23% Space Free | Partition Type: NTFS Drive F: | 39,07 Gb Total Space | 7,37 Gb Free Space | 18,85% Space Free | Partition Type: NTFS Drive H: | 39,07 Gb Total Space | 10,30 Gb Free Space | 26,36% Space Free | Partition Type: NTFS Drive I: | 19,51 Gb Total Space | 1,52 Gb Free Space | 7,78% Space Free | Partition Type: NTFS Computer Name: PPP-77949343E3D | User Name: Karol | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2011-05-11 14:11:10 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Karol\Pulpit\OTL.exe PRC - [2011-04-29 22:57:08 | 012,594,352 | ---- | M] (Mozilla Messaging) -- F:\Mozilla Thunderbird\thunderbird.exe PRC - [2011-04-29 19:14:43 | 000,924,632 | ---- | M] (Mozilla Corporation) -- F:\Mozilla Firefox\firefox.exe PRC - [2010-10-27 21:21:54 | 001,155,072 | ---- | M] (Last.fm) -- F:\Last.fm\LastFM.exe PRC - [2009-03-17 22:11:08 | 001,155,180 | ---- | M] () -- F:\BlueSoleil\BlueSoleilCS.exe PRC - [2009-01-17 16:48:08 | 005,853,672 | ---- | M] (o2.pl Sp. z o.o.) -- F:\Tlen.pl\tlen.exe PRC - [2008-09-25 18:29:14 | 000,949,376 | ---- | M] (Eset ) -- C:\Program Files\ESET\nod32kui.exe PRC - [2008-09-25 18:29:14 | 000,552,064 | ---- | M] (Eset ) -- C:\Program Files\ESET\nod32krn.exe PRC - [2007-08-17 16:58:08 | 000,057,447 | ---- | M] () -- F:\BlueSoleil\BsHelpCS.exe PRC - [2006-04-09 19:31:44 | 000,061,440 | ---- | M] (A4Tech Co.,Ltd.) -- C:\Program Files\A4Tech\Keyboard\Ikeymain.exe PRC - [2004-08-04 00:44:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2011-05-11 14:11:10 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Karol\Pulpit\OTL.exe MOD - [2008-06-19 14:20:08 | 000,017,408 | ---- | M] () -- F:\Tlen.pl\hook.dll MOD - [2006-05-03 22:53:54 | 000,174,592 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\framedyn.dll MOD - [2004-08-04 01:42:34 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Auto | Stopped] -- -- (UserAccess7) SecuROM User Access Service (V7) SRV - [2010-05-29 13:15:08 | 000,654,848 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service) SRV - [2009-06-02 10:10:08 | 000,637,952 | ---- | M] (Nokia.) [On_Demand | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer) SRV - [2009-03-17 22:11:08 | 001,155,180 | ---- | M] () [Auto | Running] -- F:\BlueSoleil\BlueSoleilCS.exe -- (BlueSoleilCS) SRV - [2008-09-25 18:29:14 | 000,552,064 | ---- | M] (Eset ) [Auto | Running] -- C:\Program Files\Eset\nod32krn.exe -- (NOD32krn) SRV - [2007-08-17 16:58:08 | 000,057,447 | ---- | M] () [On_Demand | Running] -- F:\BlueSoleil\BsHelpCS.exe -- (BsHelpCS) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2010-09-08 00:45:02 | 000,579,456 | ---- | M] (Line 6) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\L6PODX3LV.sys -- (L6PODX3LV) DRV - [2009-10-13 14:57:34 | 000,025,280 | ---- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hamachi.sys -- (hamachi) DRV - [2009-03-31 18:30:36 | 000,223,128 | ---- | M] (DT Soft Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\Drivers\dtscsi.sys -- (dtscsi) DRV - [2009-03-31 09:39:36 | 000,036,608 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\FsUsbExDisk.Sys -- (FsUsbExDisk) DRV - [2009-03-20 10:01:26 | 000,121,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ss_bmdm.sys -- (ss_bmdm) DRV - [2009-03-20 10:01:26 | 000,090,112 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ss_bbus.sys -- (ss_bbus) SAMSUNG USB Mobile Device (WDM) DRV - [2009-03-20 10:01:26 | 000,014,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ss_bmdfl.sys -- (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter) DRV - [2009-03-19 14:48:18 | 000,136,704 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdnsu.sys -- (nmwcdnsu) DRV - [2009-03-19 14:48:12 | 000,008,320 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\nmwcdnsuc.sys -- (nmwcdnsuc) DRV - [2009-03-17 22:11:08 | 000,034,312 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\blueletaudio.sys -- (BlueletAudio) DRV - [2009-02-09 08:37:56 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys -- (UsbserFilt) DRV - [2009-02-09 08:37:48 | 000,007,808 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\usbser_lowerflt.sys -- (upperdev) DRV - [2009-02-09 08:37:46 | 000,022,016 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmbo.sys -- (nmwcdc) DRV - [2009-02-09 08:37:46 | 000,017,664 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ccdcmb.sys -- (nmwcd) DRV - [2008-11-02 10:44:10 | 000,056,572 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\scdemu.sys -- (SCDEmu) DRV - [2008-09-25 18:29:14 | 000,512,096 | ---- | M] (Eset ) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\amon.sys -- (AMON) DRV - [2008-09-25 18:29:14 | 000,015,424 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\nod32drv.sys -- (nod32drv) DRV - [2008-08-26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\pccsmcfd.sys -- (pccsmcfd) DRV - [2008-07-31 21:45:42 | 000,020,616 | ---- | M] (IVT Corporation.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\BtHidBus.sys -- (BtHidBus) DRV - [2008-07-02 15:58:48 | 000,026,248 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\IvtBtBus.sys -- (IvtBtBUs) DRV - [2008-06-03 08:20:54 | 003,100,160 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2008-03-19 18:28:52 | 000,022,072 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\usbfilter.sys -- (usbfilter) DRV - [2007-11-14 21:48:20 | 000,084,992 | R--- | M] (ATI Research Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV - [2007-06-24 22:56:54 | 000,038,920 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\btcusb.sys -- (Btcsrusb) DRV - [2007-06-24 22:56:40 | 000,027,656 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BlueletSCOAudio.sys -- (BlueletSCOAudio) DRV - [2007-06-15 11:47:26 | 001,127,936 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\P17.sys -- (P17) DRV - [2007-03-05 21:59:04 | 000,018,320 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\btnetdrv.sys -- (BT) DRV - [2007-03-05 21:56:18 | 000,035,600 | ---- | M] (IVT Corporation.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\BTHidMgr.sys -- (BTHidMgr) DRV - [2007-03-05 21:55:12 | 000,020,880 | ---- | M] (IVT Corporation.) [Kernel | Boot | Running] -- C:\WINDOWS\system32\DRIVERS\vbtenum.sys -- (BTHidEnum) DRV - [2007-03-05 21:53:18 | 000,044,304 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VcommMgr.sys -- (VcommMgr) DRV - [2007-03-05 21:52:18 | 000,034,448 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\VComm.sys -- (VComm) DRV - [2006-11-01 18:45:14 | 000,219,264 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\BTCamDrv.sys -- (BTCAMDRV) DRV - [2006-07-24 16:05:00 | 000,005,632 | ---- | M] () [File_System | System | Running] -- C:\WINDOWS\System32\drivers\StarOpen.sys -- (StarOpen) DRV - [2005-08-24 15:55:48 | 000,066,560 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfvfs02.sys -- (sfvfs02) StarForce Protection VFS Driver (version 2.x) DRV - [2005-08-10 16:06:28 | 000,019,968 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfsync02.sys -- (sfsync02) StarForce Protection Synchronization Driver (version 2.x) DRV - [2005-08-10 14:44:04 | 000,050,688 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x) DRV - [2005-07-26 11:48:30 | 000,012,928 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvnetbus.sys -- (nvnetbus) DRV - [2005-07-26 11:48:28 | 000,033,664 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\NVENETFD.sys -- (NVENETFD) DRV - [2005-06-17 11:27:14 | 000,016,292 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\PCANDIS5.SYS -- (PCANDIS5) DRV - [2005-05-16 15:20:39 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x) DRV - [2005-03-09 08:53:00 | 000,036,352 | R--- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8) DRV - [2005-01-10 19:15:30 | 000,106,496 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctoss2k.sys -- (ossrv) DRV - [2005-01-10 19:15:24 | 000,138,752 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ctsfm2k.sys -- (ctsfm2k) DRV - [2004-11-14 13:01:02 | 000,006,852 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\Vcs.sys -- (Vcs) DRV - [2004-05-02 10:47:08 | 000,023,040 | R--- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\GVCplDrv.sys -- (GVCplDrv) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1935655697-1532298954-839522115-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.msn.com/ IE - HKU\S-1-5-21-1935655697-1532298954-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1935655697-1532298954-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "" FF - prefs.js..extensions.enabledItems: istockzoom@kanjar.art.pl:0.3.2 FF - prefs.js..extensions.enabledItems: {c45c406e-ab73-11d8-be73-000a95be3b12}:1.1.9 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {02450954-cdd9-410f-b1da-db804e18c671}:0.96.3 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - HKLM\software\mozilla\Firefox\Extensions\\bkmrksync@nokia.com: F:\Nokia\Nokia PC Suite 7\bkmrksync\ [2009-08-21 16:36:17 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: F:\Mozilla Firefox\components [2011-05-11 19:01:35 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: F:\Mozilla Firefox\plugins [2011-05-11 19:01:35 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Components: F:\Mozilla Thunderbird\components [2011-04-29 22:57:12 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Thunderbird 3.1.10\extensions\\Plugins: F:\Mozilla Thunderbird\plugins [2009-12-10 00:40:06 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Extensions [2009-12-10 00:40:06 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2011-03-23 16:59:19 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\bjhxujju.default\extensions [2011-01-29 18:49:36 | 000,000,000 | ---D | M] (Screengrab) -- C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\bjhxujju.default\extensions\{02450954-cdd9-410f-b1da-db804e18c671} [2011-01-07 21:25:36 | 000,000,000 | ---D | M] (Web Developer) -- C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\bjhxujju.default\extensions\{c45c406e-ab73-11d8-be73-000a95be3b12} [2011-02-24 14:33:15 | 000,000,000 | ---D | M] (stock zoom) -- C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\bjhxujju.default\extensions\istockzoom@kanjar.art.pl [2011-05-07 20:09:15 | 000,001,221 | ---- | M] () -- C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\bjhxujju.default\searchplugins\ultimate-guitar---band-names.xml [2010-02-21 13:53:22 | 000,001,204 | ---- | M] () -- C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Profiles\bjhxujju.default\searchplugins\ultimate-guitar---song-names.xml File not found (No name found) -- [2010-04-06 12:42:25 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2010-06-02 15:53:51 | 000,000,000 | ---D | M] (Java Console) -- F:\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010-08-05 22:13:46 | 000,000,000 | ---D | M] (Java Console) -- F:\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} [2010-10-29 17:08:03 | 000,000,000 | ---D | M] (Java Console) -- F:\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011-01-02 21:50:45 | 000,000,000 | ---D | M] (Java Console) -- F:\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011-03-06 01:46:03 | 000,000,000 | ---D | M] (Java Console) -- F:\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} O1 HOSTS File: ([2009-10-01 15:14:46 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O3 - HKU\S-1-5-21-1935655697-1532298954-839522115-1004\..\Toolbar\ShellBrowser: (no name) - {4724C5D8-DFA7-417A-A2F5-1EABFEE9B4AC} - No CLSID value found. O3 - HKU\S-1-5-21-1935655697-1532298954-839522115-1004\..\Toolbar\ShellBrowser: (no name) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - No CLSID value found. O3 - HKU\S-1-5-21-1935655697-1532298954-839522115-1004\..\Toolbar\WebBrowser: (no name) - {00000000-5736-4205-0008-F7ED0776FB27} - No CLSID value found. O3 - HKU\S-1-5-21-1935655697-1532298954-839522115-1004\..\Toolbar\WebBrowser: (no name) - {4596013B-6C31-408B-A266-DEAE5C086DC2} - No CLSID value found. O3 - HKU\S-1-5-21-1935655697-1532298954-839522115-1004\..\Toolbar\WebBrowser: (no name) - {71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7} - No CLSID value found. O3 - HKU\S-1-5-21-1935655697-1532298954-839522115-1004\..\Toolbar\WebBrowser: (no name) - {88C7F2AA-F93F-432C-8F0E-B7D85967A527} - No CLSID value found. O4 - HKLM..\Run: [iKeyWorks] C:\Program Files\A4Tech\Keyboard\Ikeymain.exe (A4Tech Co.,Ltd.) O4 - HKLM..\Run: [nod32kui] C:\Program Files\Eset\nod32kui.exe (Eset ) O4 - HKLM..\Run: [P17Helper] C:\WINDOWS\System32\P17.dll () O4 - HKLM..\Run: [UpdateReminder] C:\Program Files\ESET\UpdateReminder.exe (ESET, spol. s r.o.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1935655697-1532298954-839522115-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKU\S-1-5-21-1935655697-1532298954-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKU\S-1-5-21-1935655697-1532298954-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKU\S-1-5-21-1935655697-1532298954-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O8 - Extra context menu item: 使用快车3下载 - C:\Documents and Settings\Karol\Dane aplikacji\FlashGetBHO\GetUrl.htm () O8 - Extra context menu item: 使用快车3下载全部链接 - C:\Documents and Settings\Karol\Dane aplikacji\FlashGetBHO\GetAllUrl.htm () O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Computer, Inc.) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\WINDOWS\System32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\WINDOWS\System32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\WINDOWS\System32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\imon.dll (Eset ) O10 - Protocol_Catalog9\Catalog_Entries\000000000011 - C:\WINDOWS\System32\imon.dll (Eset ) O15 - HKU\S-1-5-21-1935655697-1532298954-839522115-1004\..Trusted Domains: line6.net ([]* in Zaufane witryny) O16 - DPF: {1A781DED-C22D-4153-3213-A3211E29DF13} http://67.15.101.3/g_bin/pl/cards_2_0_0_73.cab (GameDesire Card Games) O16 - DPF: {BFA1F11D-3121-AFE1-4112-894323212DAC} http://67.15.101.3/g_bin/pl/words_2_0_0_47.cab (GameDesire Word Games) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {FDDBE2B8-6602-4AD8-946D-94C5A32FA6C1} http://67.15.101.3/g_bin/pl/billard8_2_0_0_30.cab (GameDesire Pool 8) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 0.0.0.0 O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\Karol\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\Karol\Dane aplikacji\Mozilla\Firefox\Tapeta pulpitu.bmp O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2011-05-11 20:04:02 | 001,407,280 | ---- | C] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Karol\Pulpit\tdsskiller.exe [2011-05-11 18:57:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karol\Pulpit\logi [2011-05-11 17:57:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karol\Menu Start\Programy\Sprzet A4Tech [2011-05-11 17:57:26 | 000,000,000 | ---D | C] -- C:\Program Files\A4Tech [2011-05-11 17:52:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karol\Pulpit\Nowy folder [2011-05-11 16:55:37 | 000,607,288 | ---- | C] (Duplex Secure Ltd.) -- C:\Documents and Settings\Karol\Pulpit\SPTDinst-v178-x86.exe [2011-05-11 16:36:46 | 000,000,000 | ---D | C] -- C:\_OTL [2011-05-11 14:10:46 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Karol\Pulpit\OTL.exe [2011-05-11 13:42:13 | 000,021,504 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hidserv.dll [2011-05-11 13:42:07 | 000,014,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\kbdhid.sys [2011-05-08 13:12:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karol\Pulpit\zdjecia głośnik [2011-05-08 12:52:24 | 000,159,232 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusd.dll [2011-05-08 12:52:24 | 000,005,632 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\ptpusb.dll [2011-05-07 20:45:20 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\MozBackup 1.4.6 PL [2011-05-07 18:32:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karol\Pulpit\komputer [2011-05-07 17:08:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Symulator Jazdy 2 [2011-04-16 20:26:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\RDRM [2011-04-16 20:26:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karol\Dane aplikacji\ipla [2011-04-16 20:26:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\ipla [2011-04-16 20:26:24 | 000,000,000 | ---D | C] -- C:\Program Files\ipla [2011-04-14 13:51:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Karol\Menu Start\Programy\Testy maturalne 2011 [2002-04-11 10:41:06 | 000,065,536 | ---- | C] ( ) -- C:\WINDOWS\System32\A3d.dll [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2011-05-12 15:18:19 | 000,004,334 | ---- | M] () -- C:\WINDOWS\System32\LOCALSERVICE.INI [2011-05-12 15:18:19 | 000,000,202 | ---- | M] () -- C:\WINDOWS\System32\PSLOG [2011-05-12 15:18:07 | 000,000,938 | ---- | M] () -- C:\WINDOWS\System32\bscs.ini [2011-05-12 15:17:52 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011-05-11 20:33:52 | 000,138,160 | ---- | M] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2011-05-11 20:33:15 | 000,271,200 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrB.xtr [2011-05-11 20:31:17 | 000,271,200 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrB.ex0 [2011-05-11 20:04:47 | 001,407,280 | ---- | M] (Kaspersky Lab ZAO) -- C:\Documents and Settings\Karol\Pulpit\tdsskiller.exe [2011-05-11 20:02:49 | 000,080,384 | ---- | M] () -- C:\Documents and Settings\Karol\Pulpit\MBRCheck.exe [2011-05-11 19:55:06 | 000,000,028 | ---- | M] () -- C:\Documents and Settings\Karol\defogger_reenable [2011-05-11 19:53:54 | 000,050,477 | ---- | M] () -- C:\Documents and Settings\Karol\Pulpit\Defogger.exe [2011-05-11 17:01:11 | 000,302,080 | ---- | M] () -- C:\Documents and Settings\Karol\Pulpit\vntfyt4u.exe [2011-05-11 16:55:37 | 000,607,288 | ---- | M] (Duplex Secure Ltd.) -- C:\Documents and Settings\Karol\Pulpit\SPTDinst-v178-x86.exe [2011-05-11 15:04:40 | 000,000,584 | ---- | M] () -- C:\WINDOWS\System32\settingsbkup.sfm [2011-05-11 15:04:40 | 000,000,584 | ---- | M] () -- C:\WINDOWS\System32\settings.sfm [2011-05-11 14:11:10 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Karol\Pulpit\OTL.exe [2011-05-11 13:35:40 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011-05-09 21:20:01 | 010,211,487 | ---- | M] () -- C:\Documents and Settings\Karol\Pulpit\mozbackup stuff.rar [2011-05-07 20:54:54 | 000,124,766 | ---- | M] () -- C:\Documents and Settings\Karol\Pulpit\bookmarks.html [2011-05-07 20:54:29 | 010,476,122 | ---- | M] () -- C:\Documents and Settings\Karol\Pulpit\Firefox 4.0.1 pl - 2011-05-07.pcv [2011-05-07 20:51:05 | 000,033,042 | ---- | M] () -- C:\Documents and Settings\Karol\Pulpit\Thunderbird 3.1.10 (pl) - 2011-05-07.pcv [2011-05-07 17:08:25 | 000,444,952 | ---- | M] (Creative Labs) -- C:\WINDOWS\System32\wrap_oal.dll [2011-05-07 17:08:25 | 000,109,080 | ---- | M] (Portions (C) Creative Labs Inc. and NVIDIA Corp.) -- C:\WINDOWS\System32\OpenAL32.dll [2011-05-02 01:26:08 | 000,000,856 | ---- | M] () -- C:\WINDOWS\System32\REMOTEDEVICE.INI [2011-05-02 00:17:04 | 000,000,107 | ---- | M] () -- C:\WINDOWS\System32\LOCALDEVICE.INI [2011-05-01 23:45:49 | 000,009,535 | ---- | M] () -- C:\WINDOWS\System32\SHORTCUT.INI [2011-04-30 20:04:34 | 000,027,136 | ---- | M] () -- C:\Documents and Settings\Karol\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [color=#E56717]========== Files Created - No Company Name ==========[/color] [2011-05-11 20:02:48 | 000,080,384 | ---- | C] () -- C:\Documents and Settings\Karol\Pulpit\MBRCheck.exe [2011-05-11 19:54:56 | 000,000,028 | ---- | C] () -- C:\Documents and Settings\Karol\defogger_reenable [2011-05-11 19:53:53 | 000,050,477 | ---- | C] () -- C:\Documents and Settings\Karol\Pulpit\Defogger.exe [2011-05-11 17:01:06 | 000,302,080 | ---- | C] () -- C:\Documents and Settings\Karol\Pulpit\vntfyt4u.exe [2011-05-09 21:19:49 | 010,211,487 | ---- | C] () -- C:\Documents and Settings\Karol\Pulpit\mozbackup stuff.rar [2011-05-07 20:54:54 | 000,124,766 | ---- | C] () -- C:\Documents and Settings\Karol\Pulpit\bookmarks.html [2011-05-07 20:54:23 | 010,476,122 | ---- | C] () -- C:\Documents and Settings\Karol\Pulpit\Firefox 4.0.1 pl - 2011-05-07.pcv [2011-05-07 20:46:38 | 000,033,042 | ---- | C] () -- C:\Documents and Settings\Karol\Pulpit\Thunderbird 3.1.10 (pl) - 2011-05-07.pcv [2011-04-08 13:28:58 | 000,041,872 | ---- | C] () -- C:\WINDOWS\System32\xfcodec.dll [2011-02-07 15:43:27 | 000,005,663 | ---- | C] () -- C:\WINDOWS\System32\Ludap17.ini [2011-02-07 15:43:27 | 000,000,075 | ---- | C] () -- C:\WINDOWS\System32\ctzapxx.ini [2011-02-01 23:55:46 | 000,000,101 | ---- | C] () -- C:\WINDOWS\PSXLPR.INI [2011-02-01 23:55:44 | 000,000,152 | ---- | C] () -- C:\WINDOWS\CONFIG.INI [2011-02-01 23:55:40 | 000,212,992 | ---- | C] () -- C:\WINDOWS\System32\Bot.dll [2011-01-21 21:35:29 | 000,000,204 | ---- | C] () -- C:\WINDOWS\System32\secustat.dat [2011-01-21 21:33:42 | 000,000,025 | ---- | C] () -- C:\WINDOWS\libem.INI [2010-12-03 17:03:44 | 000,000,050 | ---- | C] () -- C:\WINDOWS\Winamp.ini [2010-12-03 17:03:41 | 000,000,041 | ---- | C] () -- C:\WINDOWS\winampa.ini [2010-03-22 18:00:27 | 000,000,355 | ---- | C] () -- C:\WINDOWS\GearBox.ini [2009-12-22 23:08:10 | 000,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009-12-22 23:08:02 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2009-12-22 23:08:02 | 000,795,648 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2009-12-22 23:08:02 | 000,130,048 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009-12-22 23:07:53 | 000,067,584 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009-12-05 23:26:39 | 000,000,067 | ---- | C] () -- C:\WINDOWS\DVDIdle.INI [2009-10-12 16:05:31 | 000,000,048 | ---- | C] () -- C:\WINDOWS\System32\msvcsv60.dll [2009-10-10 16:57:54 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDevice.Dll [2009-10-10 16:57:54 | 000,036,608 | ---- | C] () -- C:\WINDOWS\System32\FsUsbExDisk.Sys [2009-10-01 15:00:40 | 000,229,888 | ---- | C] () -- C:\WINDOWS\PEV.exe [2009-10-01 15:00:40 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2009-10-01 15:00:39 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2009-10-01 15:00:39 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2009-06-14 17:22:44 | 000,000,026 | ---- | C] () -- C:\WINDOWS\neosetup.INI [2009-05-31 22:54:35 | 000,138,160 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2009-05-31 22:53:41 | 000,682,280 | ---- | C] () -- C:\WINDOWS\System32\pbsvc.exe [2009-05-30 22:19:47 | 000,000,084 | ---- | C] () -- C:\WINDOWS\netdet.ini [2009-05-29 14:22:05 | 000,079,612 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat [2009-04-03 17:11:18 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll [2009-04-03 17:11:18 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll [2009-04-03 17:11:18 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll [2009-03-17 22:16:41 | 000,009,535 | ---- | C] () -- C:\WINDOWS\System32\SHORTCUT.INI [2009-03-17 22:16:34 | 000,000,856 | ---- | C] () -- C:\WINDOWS\System32\REMOTEDEVICE.INI [2009-03-17 22:12:56 | 000,004,334 | ---- | C] () -- C:\WINDOWS\System32\LOCALSERVICE.INI [2009-03-17 22:12:54 | 000,000,107 | ---- | C] () -- C:\WINDOWS\System32\LOCALDEVICE.INI [2009-03-17 22:10:44 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\BSPRINT.INI [2008-12-29 14:35:27 | 000,016,384 | ---- | C] () -- C:\WINDOWS\System32\FileOps.exe [2008-12-15 16:02:56 | 000,000,000 | ---- | C] () -- C:\WINDOWS\ativpsrm.bin [2008-12-15 15:53:50 | 000,593,920 | ---- | C] () -- C:\WINDOWS\System32\ati2sgag.exe [2008-12-15 15:53:40 | 000,887,724 | R--- | C] () -- C:\WINDOWS\System32\ativva6x.dat [2008-12-15 15:53:39 | 003,107,788 | R--- | C] () -- C:\WINDOWS\System32\ativva5x.dat [2008-12-15 15:53:38 | 003,107,788 | R--- | C] () -- C:\WINDOWS\System32\ativvaxx.dat [2008-12-15 15:53:38 | 000,172,033 | R--- | C] () -- C:\WINDOWS\System32\atiicdxx.dat [2008-10-18 17:24:40 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\LauncherAccess.dt [2008-10-18 17:23:33 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\drivers\StarOpen.sys [2008-09-25 18:29:46 | 000,015,424 | ---- | C] () -- C:\WINDOWS\System32\drivers\nod32drv.sys [2008-08-09 22:06:32 | 000,000,048 | ---- | C] () -- C:\WINDOWS\msocreg32.dat [2008-07-16 12:19:07 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\Karol\Dane aplikacji\$_hpcst$.hpc [2008-06-09 17:29:19 | 000,000,074 | ---- | C] () -- C:\WINDOWS\musicmaker.INI [2008-06-09 17:15:37 | 000,038,912 | ---- | C] () -- C:\WINDOWS\System32\mgxasio.dll [2008-06-09 17:14:51 | 000,002,446 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini [2008-05-18 22:19:03 | 000,037,632 | ---- | C] () -- C:\WINDOWS\DPUNIN20.EXE [2008-05-01 12:05:05 | 000,006,852 | ---- | C] () -- C:\WINDOWS\System32\drivers\Vcs.sys [2008-04-30 23:35:00 | 000,000,162 | ---- | C] () -- C:\WINDOWS\StudyWords.INI [2008-04-30 23:34:18 | 000,000,115 | ---- | C] () -- C:\WINDOWS\disney.ini [2008-04-21 18:52:54 | 000,000,032 | ---- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat [2008-03-23 23:06:24 | 000,000,083 | ---- | C] () -- C:\WINDOWS\wwp.INI [2008-03-14 18:41:28 | 000,000,043 | ---- | C] () -- C:\WINDOWS\SCNDRVU.INI [2008-03-09 18:02:16 | 000,022,328 | ---- | C] () -- C:\Documents and Settings\Karol\Dane aplikacji\PnkBstrK.sys [2008-03-05 17:46:34 | 000,004,096 | ---- | C] () -- C:\WINDOWS\d3dx.dat [2007-12-28 14:03:07 | 000,005,632 | ---- | C] () -- C:\WINDOWS\System32\CNMVS27.DLL [2007-12-28 14:02:41 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\CNMCP27.EXE [2007-11-21 13:45:28 | 000,000,160 | ---- | C] () -- C:\WINDOWS\mafosav.INI [2007-11-17 17:15:49 | 000,034,308 | ---- | C] () -- C:\WINDOWS\System32\Chip.dll [2007-11-17 17:15:34 | 000,053,760 | ---- | C] () -- C:\WINDOWS\System32\Squeeze.dll [2007-11-10 17:33:57 | 000,000,525 | ---- | C] () -- C:\WINDOWS\QIII.INI [2007-10-09 19:15:57 | 004,229,496 | ---- | C] () -- C:\WINDOWS\System32\SpoonUninstall.exe [2007-10-05 13:26:08 | 000,000,031 | ---- | C] () -- C:\WINDOWS\IDC.INI [2007-09-14 11:34:20 | 000,000,938 | ---- | C] () -- C:\WINDOWS\System32\bscs.ini [2007-09-03 14:54:20 | 000,000,172 | ---- | C] () -- C:\WINDOWS\RtlRack.ini [2007-08-28 19:28:26 | 000,013,312 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll [2007-08-23 20:33:50 | 000,000,025 | ---- | C] () -- C:\WINDOWS\System32\aces.ini [2007-08-21 23:51:16 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ATIODE.exe [2007-08-21 21:36:12 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\ATIODCLI.exe [2007-08-20 13:00:08 | 000,237,568 | ---- | C] () -- C:\WINDOWS\System32\lame_enc.dll [2007-08-17 16:59:36 | 000,278,647 | ---- | C] () -- C:\WINDOWS\System32\outlookAddin.dll [2007-08-17 16:59:14 | 000,528,485 | ---- | C] () -- C:\WINDOWS\System32\BSShell.dll [2007-08-17 16:57:54 | 000,077,923 | ---- | C] () -- C:\WINDOWS\System32\Bs2Res.dll [2007-07-30 10:32:16 | 016,326,769 | ---- | C] () -- C:\WINDOWS\System32\BsLangInDepRes.dll [2007-07-29 17:16:37 | 000,271,200 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrB.exe [2007-07-29 17:16:11 | 000,075,136 | ---- | C] () -- C:\WINDOWS\System32\PnkBstrA.exe [2007-06-24 22:56:34 | 000,034,312 | ---- | C] () -- C:\WINDOWS\System32\drivers\blueletaudio.sys [2007-05-30 10:49:35 | 000,000,801 | ---- | C] () -- C:\WINDOWS\Gfact.ini [2007-05-28 22:01:09 | 000,000,303 | ---- | C] () -- C:\WINDOWS\KNP.INI [2007-05-27 14:21:14 | 000,008,452 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2007-05-06 18:19:28 | 000,000,051 | ---- | C] () -- C:\WINDOWS\System32\imon1.dat [2007-04-12 18:46:26 | 000,000,023 | ---- | C] () -- C:\WINDOWS\BlendSettings.ini [2007-03-27 17:36:31 | 000,000,258 | ---- | C] () -- C:\WINDOWS\naglos.INI [2007-03-23 23:12:18 | 000,000,251 | ---- | C] () -- C:\WINDOWS\cdplayer.ini [2007-03-19 11:59:18 | 000,065,536 | ---- | C] () -- C:\WINDOWS\System32\BsVistaCommon.dll [2007-03-18 00:56:34 | 000,001,743 | ---- | C] () -- C:\Documents and Settings\All Users\Dane aplikacji\QTSBandwidthCache [2007-03-17 13:03:30 | 000,001,080 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini [2007-03-10 15:55:40 | 000,000,102 | ---- | C] () -- C:\WINDOWS\stasavegame.INI [2007-02-27 16:24:05 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2007-02-24 20:34:32 | 000,000,346 | ---- | C] () -- C:\WINDOWS\WINCMD.INI [2007-02-24 14:14:22 | 000,002,655 | ---- | C] () -- C:\WINDOWS\bestplayer.ini [2007-02-23 11:51:47 | 000,000,677 | ---- | C] () -- C:\WINDOWS\ChaseHQ2EvoConfig.ini [2007-02-21 21:39:53 | 000,000,556 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2007-02-19 15:33:34 | 000,004,038 | ---- | C] () -- C:\WINDOWS\mozver.dat [2007-02-17 23:21:41 | 000,000,004 | ---- | C] () -- C:\WINDOWS\System32\proc20744962.bin [2007-02-15 17:08:49 | 000,000,009 | ---- | C] () -- C:\WINDOWS\Jeppesen.ini [2007-02-14 13:07:34 | 000,027,136 | ---- | C] () -- C:\Documents and Settings\Karol\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2007-02-10 00:00:02 | 000,000,750 | ---- | C] () -- C:\WINDOWS\eReg.dat [2007-02-09 12:17:12 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat [2007-02-09 12:07:04 | 000,114,688 | ---- | C] () -- C:\WINDOWS\System32\WLANUTL.dll [2007-02-09 10:22:27 | 000,004,293 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2007-02-09 10:20:44 | 002,463,616 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2007-02-09 10:09:15 | 000,000,258 | ---- | C] () -- C:\WINDOWS\System32\raidmgmt.ini [2007-02-09 09:51:30 | 000,023,040 | R--- | C] () -- C:\WINDOWS\System32\drivers\GVCplDrv.sys [2007-02-09 09:35:18 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2007-02-09 09:28:39 | 000,021,856 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2005-05-03 20:38:42 | 000,064,512 | ---- | C] () -- C:\WINDOWS\System32\P17.dll [2004-08-04 00:56:48 | 000,001,788 | ---- | C] () -- C:\WINDOWS\System32\Dcache.bin [2004-08-04 00:44:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2004-08-02 14:20:40 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2003-10-02 19:48:18 | 000,053,248 | ---- | C] () -- C:\WINDOWS\System32\P17CPI.dll [2003-07-07 18:08:54 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\frapsvid.dll [2002-09-18 01:45:00 | 000,119,808 | ---- | C] () -- C:\WINDOWS\lsb_un20.exe [2001-10-26 18:15:16 | 000,451,352 | ---- | C] () -- C:\WINDOWS\System32\perfh015.dat [2001-10-26 18:15:16 | 000,313,828 | ---- | C] () -- C:\WINDOWS\System32\perfi015.dat [2001-10-26 18:15:16 | 000,075,486 | ---- | C] () -- C:\WINDOWS\System32\perfc015.dat [2001-10-26 18:15:16 | 000,034,990 | ---- | C] () -- C:\WINDOWS\System32\perfd015.dat [2001-09-17 13:20:02 | 000,009,216 | ---- | C] () -- C:\WINDOWS\System32\cpuinf32.dll [2001-08-23 15:00:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2001-08-23 15:00:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat [2001-08-17 23:30:24 | 000,395,200 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2001-08-17 23:30:24 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2001-08-17 23:30:24 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2001-08-17 23:30:22 | 000,059,440 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2001-08-17 23:15:38 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2001-07-22 00:36:48 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2001-07-22 00:36:04 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2001-07-22 00:24:16 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2000-02-02 16:43:37 | 000,005,647 | ---- | C] () -- C:\WINDOWS\System32\HDK3CRYP.DLL [1998-03-17 19:15:00 | 000,000,116 | ---- | C] () -- C:\WINDOWS\smp32.dll [color=#E56717]========== LOP Check ==========[/color] [2007-02-09 12:10:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Opera [2009-10-02 21:54:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\1B30D [2009-10-15 17:13:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\2DBoy [2009-08-27 21:02:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\AlawarWrapper [2009-03-03 16:59:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Autodesk [2007-06-10 15:23:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Azureus [2009-03-03 17:00:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Bluetooth [2010-04-28 18:07:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite [2009-06-22 13:53:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Electronic Arts [2008-05-13 16:45:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ESET [2009-08-21 16:34:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Installations [2011-04-16 20:26:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ipla [2009-03-07 15:54:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Last.fm [2010-12-24 18:25:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Line 6 [2010-06-22 22:46:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\NCH Swift Sound [2008-06-06 17:25:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\PC Drivers HeadQuarters [2009-08-21 16:39:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite [2011-04-16 20:26:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\RDRM [2007-08-31 18:54:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\River Past G5 [2008-05-06 13:58:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP [2009-02-27 17:48:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Test Drive Unlimited [2008-11-02 22:11:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\tlen.pl [2010-05-23 15:55:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\TmForever [2009-02-21 19:36:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Winter Sports 2009 [2007-10-06 13:49:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\Azureus [2009-12-05 23:13:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\bearsharetb [2011-05-06 20:32:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\BESTplayer [2011-01-21 21:35:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\BITS [2008-01-15 13:44:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\BitTorrent [2011-01-17 14:06:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\BlackBean [2009-07-17 13:06:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\CDRoller [2007-12-28 18:05:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\Cool Record Edit Pro [2008-04-19 13:51:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\DAEMON Tools [2010-04-28 18:09:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\DAEMON Tools Lite [2007-09-30 20:56:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\Datalayer [2008-02-18 13:28:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\Desktop Sidebar [2008-01-17 18:17:13 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\DNA [2009-05-30 21:30:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\Eltima Software [2008-05-13 16:11:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\ESET [2011-05-11 19:05:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\FileZilla [2011-01-21 21:33:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\FlashGet [2011-01-21 21:33:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\FlashGetBHO [2007-08-26 16:47:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\flightgear.org [2007-11-04 15:48:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\fretsonfire [2007-04-17 21:07:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\Gadu-Gadu [2009-02-08 21:44:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\GanymedeNet [2010-09-04 15:18:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\GetRightToGo [2009-08-13 12:55:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\GlarySoft [2008-05-18 15:18:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\gtk-2.0 [2008-03-14 14:39:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\Image Zone Express [2010-08-05 14:52:49 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\ImgBurn [2011-04-16 20:27:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\ipla [2011-02-27 23:37:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\IrfanView [2009-10-15 17:28:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\Leadertech [2010-11-28 13:48:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\Line 6 [2011-02-17 16:07:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\Miranda [2007-03-14 14:51:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\Mobipocket [2009-05-30 22:37:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\Moyea [2010-06-22 22:45:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\NCH Swift Sound [2009-08-21 16:40:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\Nokia [2009-03-06 23:29:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\Nowe Gadu-Gadu [2011-01-28 13:15:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\OnLive App [2007-02-11 12:55:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\Opera [2010-07-26 19:07:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\PC Suite [2008-01-17 11:17:17 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\POLENG4 [2008-03-14 14:39:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\Printer Info Cache [2010-05-07 19:57:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\REAPER [2007-08-31 18:44:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\River Past G5 [2008-10-18 17:46:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\Samsung [2010-10-11 21:51:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\TeamViewer [2007-08-19 13:49:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\The Bat! [2010-04-28 16:53:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\Thinstall [2009-12-10 00:40:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\Thunderbird [2011-05-11 23:22:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\Tlen.pl [2011-05-01 14:37:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\uTorrent [2011-01-21 20:32:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Karol\Dane aplikacji\VitySoft [2007-06-10 21:51:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasiurek\Dane aplikacji\Azureus [2011-05-02 20:11:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasiurek\Dane aplikacji\BitTorrent [2007-12-27 22:27:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasiurek\Dane aplikacji\Cool Record Edit Pro [2011-05-02 20:11:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasiurek\Dane aplikacji\DNA [2007-04-17 22:13:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasiurek\Dane aplikacji\Gadu-Gadu [2009-08-03 19:35:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasiurek\Dane aplikacji\GanymedeNet [2008-08-03 13:31:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasiurek\Dane aplikacji\Nokia [2008-08-03 13:31:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasiurek\Dane aplikacji\Nokia Multimedia Player [2008-07-07 11:50:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasiurek\Dane aplikacji\Nowe Gadu-Gadu [2007-02-11 21:27:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasiurek\Dane aplikacji\Opera [2007-08-29 16:20:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasiurek\Dane aplikacji\PC Suite [2009-10-10 16:57:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasiurek\Dane aplikacji\Samsung [2009-03-13 17:53:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasiurek\Dane aplikacji\Thunderbird [2008-07-29 10:00:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasiurek\Dane aplikacji\Tlen.pl [2007-11-21 15:40:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kasiurek\Dane aplikacji\uTorrent [2008-05-06 12:03:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\marian\Dane aplikacji\Azureus [2007-04-22 13:17:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\marian\Dane aplikacji\Gadu-Gadu [2008-11-11 13:09:20 | 000,000,000 | ---D | M] -- C:\Documents and Settings\marian\Dane aplikacji\Nowe Gadu-Gadu [2007-02-13 20:35:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\marian\Dane aplikacji\Opera [2010-04-07 16:48:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\marian\Dane aplikacji\Thunderbird [color=#E56717]========== Purity Check ==========[/color] < End of report >

Kod: Zaznacz wszystko: GMER 1.0.15.15627 - http://www.gmer.net Rootkit scan 2011-05-12 22:19:11 Windows 5.1.2600 Dodatek Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-e ST3200820AS rev.3.AAD Running: vntfyt4u.exe; Driver: C:\DOCUME~1\Karol\USTAWI~1\Temp\kwxirkod.sys ---- Kernel code sections - GMER 1.0.15 ---- .text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xF64B6000, 0x198FE0, 0xE8000020] pnidata C:\WINDOWS\system32\DRIVERS\secdrv.sys unknown last section [0xABC1EF00, 0x24000, 0x48000000] ---- User code sections - GMER 1.0.15 ---- .text F:\Mozilla Thunderbird\thunderbird.exe[2264] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 004012F1 F:\Mozilla Thunderbird\thunderbird.exe (Thunderbird/Mozilla Messaging) ---- Devices - GMER 1.0.15 ---- AttachedDevice \FileSystem\Ntfs \Ntfs amon.sys (Amon monitor/Eset ) ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 d:\DAEMON Tools\ Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xD0 0x27 0x8A 0x53 ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xF4 0x70 0x1B 0xA9 ... Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x64 0x25 0xFD 0xA9 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xF9 0x77 0xE2 0x55 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 d:\DAEMON Tools\ Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xD0 0x27 0x8A 0x53 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xF4 0x70 0x1B 0xA9 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x00 0xA7 0xA2 0x9A ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xF9 0x77 0xE2 0x55 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 d:\DAEMON Tools\ Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xD0 0x27 0x8A 0x53 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xF4 0x70 0x1B 0xA9 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x00 0xA7 0xA2 0x9A ... Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1 Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xF9 0x77 0xE2 0x55 ... Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 d:\DAEMON Tools\ Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xD0 0x27 0x8A 0x53 ... Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xF4 0x70 0x1B 0xA9 ... Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x64 0x62 0x02 0x00 ... Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1 Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xF9 0x77 0xE2 0x55 ... Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 d:\DAEMON Tools\ Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0xD0 0x27 0x8A 0x53 ... Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xF4 0x70 0x1B 0xA9 ... Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet005\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x64 0x62 0x02 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x42 0xA4 0x9A 0xC1 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 2 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x8C 0x49 0x3A 0x2B ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x44 0x53 0x08 0xDF ... Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1 Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xF9 0x77 0xE2 0x55 ... Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet007\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x79 0xA2 0x85 0x51 ... Reg HKLM\SYSTEM\ControlSet008\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet008\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 1 Reg HKLM\SYSTEM\ControlSet008\Services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x42 0xA4 0x9A 0xC1 ... Reg HKLM\SYSTEM\ControlSet008\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet008\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 2 Reg HKLM\SYSTEM\ControlSet008\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x8C 0x49 0x3A 0x2B ... Reg HKLM\SYSTEM\ControlSet008\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet008\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet008\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x44 0x53 0x08 0xDF ... Reg HKLM\SOFTWARE\Classes\CLSID\{6D169E1B-0877-6BA9-7D7F-0B98D7FE1E72}\InProcServer32 Reg HKLM\SOFTWARE\Classes\CLSID\{6D169E1B-0877-6BA9-7D7F-0B98D7FE1E72}\InProcServer32@fapiejakldfe 0x70 0x61 0x6F 0x62 ... Reg HKLM\SOFTWARE\Classes\CLSID\{6D169E1B-0877-6BA9-7D7F-0B98D7FE1E72}\InProcServer32@napikhhkgfjkgengfcmpgmpakdgk 0x64 0x62 0x61 0x6A ... Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{6059E4D1-14F3-6536-7171-8B5ADF997992} Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{6059E4D1-14F3-6536-7171-8B5ADF997992}@paefaalligpkmjjopbijnpcmdoedekli 0x6A 0x61 0x61 0x61 ... Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{6059E4D1-14F3-6536-7171-8B5ADF997992}@oaofckngcpihaciihognhjikoljhme 0x6A 0x61 0x70 0x70 ... Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{6D169E1B-0877-6BA9-7D7F-0B98D7FE1E72} Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{6D169E1B-0877-6BA9-7D7F-0B98D7FE1E72}@ianiogakkgpjdnpjdo 0x6A 0x61 0x62 0x63 ... Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{6D169E1B-0877-6BA9-7D7F-0B98D7FE1E72}@hadigfnmincmpbge 0x69 0x61 0x68 0x62 ... Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F7B98A29-C5EF-EAE6-9C25-52AF0A17B710} Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F7B98A29-C5EF-EAE6-9C25-52AF0A17B710}@iadgncohpoocoiboig 0x69 0x61 0x6A 0x6C ... Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{F7B98A29-C5EF-EAE6-9C25-52AF0A17B710}@hafhhabdhlkbhdnf 0x6A 0x61 0x63 0x6C ... ---- Disk sectors - GMER 1.0.15 ---- Disk \Device\Harddisk0\DR0 malicious Win32:MBRoot code @ sector 390716868 Disk \Device\Harddisk0\DR0 PE file @ sector 390716890 ---- Files - GMER 1.0.15 ---- File C:\Documents and Settings\Karol\Ustawienia lokalne\temp\IH2D2F.tmp 0 bytes ---- EOF - GMER 1.0.15 ----

Kod: Zaznacz wszystko: OTL Extras logfile created on: 2011-05-12 16:14:46 - Run 3 OTL by OldTimer - Version 3.2.22.3 Folder = C:\Documents and Settings\Karol\Pulpit Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1 023,00 Mb Total Physical Memory | 273,00 Mb Available Physical Memory | 27,00% Memory free 2,00 Gb Paging File | 2,00 Gb Available in Paging File | 76,00% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 39,83 Gb Total Space | 9,41 Gb Free Space | 23,63% Space Free | Partition Type: NTFS Drive D: | 19,53 Gb Total Space | 8,94 Gb Free Space | 45,76% Space Free | Partition Type: NTFS Drive E: | 29,30 Gb Total Space | 0,95 Gb Free Space | 3,23% Space Free | Partition Type: NTFS Drive F: | 39,07 Gb Total Space | 7,37 Gb Free Space | 18,85% Space Free | Partition Type: NTFS Drive H: | 39,07 Gb Total Space | 10,30 Gb Free Space | 26,36% Space Free | Partition Type: NTFS Drive I: | 19,51 Gb Total Space | 1,52 Gb Free Space | 7,78% Space Free | Partition Type: NTFS Computer Name: PPP-77949343E3D | User Name: Karol | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* .url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l [HKEY_USERS\S-1-5-21-1935655697-1532298954-839522115-1004\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- F:\Mozilla Firefox\firefox.exe (Mozilla Corporation) [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* exefile [open] -- "%1" %* https [open] -- "F:\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation) InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [Odkurz tutaj] -- f:\Odkurzacz\odkurzacz.exe %1 (Franmo Software) Directory [Winamp.Bookmark] -- "F:\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft) Directory [Winamp.Enqueue] -- "F:\Winamp\winamp.exe" /ADD "%1" (Nullsoft) Directory [Winamp.Play] -- "F:\Winamp\winamp.exe" "%1" (Nullsoft) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 1 "UpdatesDisableNotify" = 1 "AntiVirusOverride" = 0 "FirewallOverride" = 0 "FirewallDisableNotify" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [color=#E56717]========== System Restore Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore] "DisableSR" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr] "Start" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService] "Start" = 2 [color=#E56717]========== Firewall Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile] [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List] "3389:TCP" = 3389:TCP:*:Enabled:Remote Desktop "65533:TCP" = 65533:TCP:*:Enabled:Services "52344:TCP" = 52344:TCP:*:Enabled:Services "7652:TCP" = 7652:TCP:*:Enabled:Services "7653:TCP" = 7653:TCP:*:Enabled:Services "3988:TCP" = 3988:TCP:*:Enabled:Services "7691:TCP" = 7691:TCP:*:Enabled:Services "6144:TCP" = 6144:TCP:*:Enabled:Services "7004:TCP" = 7004:TCP:*:Enabled:Services "8394:TCP" = 8394:TCP:*:Enabled:Services "4785:TCP" = 4785:TCP:*:Enabled:Services "8070:TCP" = 8070:TCP:*:Enabled:Services [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 "DisableNotifications" = 0 "DoNotAllowExceptions" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004 "445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005 "137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001 "138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002 "1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008 "3389:TCP" = 3389:TCP:*:Enabled:Remote Desktop "65533:TCP" = 65533:TCP:*:Enabled:Services "52344:TCP" = 52344:TCP:*:Enabled:Services "7652:TCP" = 7652:TCP:*:Enabled:Services "7653:TCP" = 7653:TCP:*:Enabled:Services "3988:TCP" = 3988:TCP:*:Enabled:Services "7691:TCP" = 7691:TCP:*:Enabled:Services "6144:TCP" = 6144:TCP:*:Enabled:Services "7004:TCP" = 7004:TCP:*:Enabled:Services "8394:TCP" = 8394:TCP:*:Enabled:Services "4785:TCP" = 4785:TCP:*:Enabled:Services "8070:TCP" = 8070:TCP:*:Enabled:Services [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\WINDOWS\system32\dpnsvr.exe" = C:\WINDOWS\system32\dpnsvr.exe:*:Enabled:Microsoft DirectPlay8 Server -- (Microsoft Corporation) "C:\WINDOWS\system32\java.exe" = C:\WINDOWS\system32\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.) "C:\Program Files\Java\jre1.6.0_07\bin\javaw.exe" = C:\Program Files\Java\jre1.6.0_07\bin\javaw.exe:*:Enabled:Java(TM) Platform SE binary "C:\Program Files\Java\jre1.6.0_07\bin\java.exe" = C:\Program Files\Java\jre1.6.0_07\bin\java.exe:*:Enabled:Java(TM) Platform SE binary "F:\Tlen.pl\tlen.exe" = F:\Tlen.pl\tlen.exe:*:Enabled:Komunikator Tlen.pl -- (o2.pl Sp. z o.o.) "C:\WINDOWS\system32\dpvsetup.exe" = C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test -- (Microsoft Corporation) "C:\Program Files\Java\jre1.6.0_07\launch4j-tmp\JDownloader.exe" = C:\Program Files\Java\jre1.6.0_07\launch4j-tmp\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.) "C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe" = C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary "F:\BlueSoleil\BlueSoleil.exe" = F:\BlueSoleil\BlueSoleil.exe:*:Enabled:BlueSoleil -- () "F:\Xfire\Xfire.exe" = F:\Xfire\Xfire.exe:*:Enabled:Xfire -- (Xfire Inc.) "F:\BlueSoleil\BlueSoleilCS.exe" = F:\BlueSoleil\BlueSoleilCS.exe:*:Enabled:BlueSoleilCS -- () "H:\Call of Duty 2\CoD2MP_s.exe" = H:\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s "F:\eMule\emule.exe" = F:\eMule\emule.exe:*:Enabled:eMule "F:\uTorrent\uTorrent.exe" = F:\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.) "H:\Call of Duty 4 - Modern Warfare\iw3mp.exe" = H:\Call of Duty 4 - Modern Warfare\iw3mp.exe:*:Enabled:Call of Duty(R) 4 - Modern Warfare(TM) -- () "C:\Program Files\DNA\btdna.exe" = C:\Program Files\DNA\btdna.exe:*:Enabled:DNA -- (BitTorrent, Inc.) "I:\Samsung\npsasvr.exe" = I:\Samsung\npsasvr.exe:*:Enabled:KTF MUSIC AoD Server "I:\Samsung\npsvsvr.exe" = I:\Samsung\npsvsvr.exe:*:Enabled:KTF MUSIC VoD Server "F:\Steam\Steam.exe" = F:\Steam\Steam.exe:*:Enabled:Steam "L:\AXISAddPrinter.exe" = L:\AXISAddPrinter.exe:*:Enabled:AXISAddPrinter "f:\FlashGet Network\FlashGet 3\FlashGet3.exe" = f:\FlashGet Network\FlashGet 3\FlashGet3.exe:*:Enabled:Flashget3 "I:\BitTorrent\BitTorrent.exe" = I:\BitTorrent\BitTorrent.exe:*:Enabled:BitTorrent -- (BitTorrent, Inc.) [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{04AF207D-9A77-465A-8B76-991F6AB66245}" = Adobe Help Viewer CS3 "{08B32819-6EEF-4057-AEDA-5AB681A36A23}" = Adobe Bridge Start Meeting "{0C973594-7DDF-4BD0-84ED-3517F7622037}" = PC Connectivity Solution "{1064CABD-7390-4336-94E4-8A53DFBCB636}_is1" = GT Legends 1.0.0.0 "{11202615-E557-4ECF-9B86-F59C81E52909}" = FIFA 10 "{155F4A0E-76ED-45A2-91FB-FF2A2133C31A}" = Risen "{15CEC2E1-16AF-11D9-88E4-0004769F25D1}" = Colin McRae Rally 2005 "{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}" = Adobe WinSoft Linguistics Plugin "{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}" = Adobe AIR "{1C36647E-F5BD-43E9-BA64-5F274B7F7050}_is1" = Prawo Jazdy 2006 1.0 "{1C36647E-F5BD-43E9-BA64-5F274B7F7051}_is1" = Symulator Jazdy 2 v.1.0 "{1E726A53-78E9-47DE-B3D9-4165CBC9ABBF}" = Bluesoleil 5.0.5.178 "{1E99F5D7-4262-4C7C-9135-F066E7485811}" = System Requirements Lab "{212748BB-0DA5-46DE-82A1-403736DC9F27}" = MSVC80_x86 "{21E77392-C30A-4AA2-8CA7-5728316939D6}" = AmpliTube X-GEAR "{236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2 "{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}" = Skype™ 4.0 "{26A24AE4-039D-4CA4-87B4-2F83216019FF}" = Java(TM) 6 Update 24 "{29E5EA97-5F74-4A57-B8B2-D4F169117183}" = Adobe Stock Photos CS3 "{2BD5C305-1B27-4D41-B690-7A61172D2FEB}" = Macromedia Flash 8 "{3248F0A8-6813-11D6-A77B-00B0D0150110}" = J2SE Runtime Environment 5.0 Update 11 "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{36CDA33B-909B-4719-97D1-C4B99309BDC7}" = ATI Parental Control & Encoder "{38697498-F4AA-4A8A-81F6-C09446AD020D}" = Print Server Utilities "{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player "{3D347E6D-5A03-4342-B5BA-6A771885F379}" = Backburner "{3D39E775-DDDA-4327-B747-0BDC5F191331}" = Nokia PC Suite "{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}" = NVIDIA PhysX "{43E8D9E7-AFC9-4BA3-8106-B95E02B87AB7}" = EZdrummer "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4DFF1415-4C29-44A8-BFD4-2BCE249C4991}" = SpPhones "{4F3E17F8-F1C8-4A4B-9EB8-1EE2D190CDA9}" = Adobe Setup "{51846830-E7B2-4218-8968-B77F0FF475B8}" = Adobe Color EU Extra Settings "{52D02A2B-03D2-4E34-A358-DC5D951FD296}" = Nokia Connectivity Cable Driver "{54793AA1-5001-42F4-ABB6-C364617C6078}" = Adobe Linguistics CS3 "{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}" = Macromedia Extension Manager "{560F47F7-EB23-44B1-AAFC-667F1CD8FE5C}" = Sp5 "{5C90D8CF-F12A-41C6-9007-3B651A1F0D78}" = HP Deskjet 1050 J410 series Pomoc "{5DA6F06A-B389-407B-BF8C-1548767914D8}" = ATI Problem Report Wizard "{5DD152A8-BFB3-439E-90CD-5C00C2116E23}" = AmpliTube 3 "{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update "{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin "{6A3E5F76-7DD4-4F59-9CD6-B0159622B353}" = Double Vibration steering wheel "{6ABE0BEE-D572-4FE8-B434-9E72A289431B}" = Adobe Fonts All "{6B3CA80E-6AC0-4725-BABF-9B0FEF880CB3}" = Power Tab Editor 1.7 "{6C3959C6-943E-44B3-BAAD-570B04B134E5}" = SpCommon "{6EECB283-E65F-40EF-86D3-D51BF02A8D43}" = Microsoft Office Converter Pack "{6FCBE08B-EB47-448E-8566-CE38E8B8D065}" = System Requirements Lab CYRI "{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}" = Adobe Asset Services CS3 "{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0 "{7148F0A8-6813-11D6-A77B-00B0D0142030}" = Java 2 Runtime Environment, SE v1.4.2_03 "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{786C5747-1033-0000-B58E-000000000001}" = Adobe Stock Photos 1.0 "{7E20EFE6-E604-48C6-8B39-BA4742F2CDB4}" = Zune Desktop Theme "{7E84FAC8-C518-40F9-9807-7455301D6D25}" = SamsungConnectivityCableDriver "{802771A9-A856-4A41-ACF7-1450E523C923}" = Adobe XMP Panels CS3 "{8094F7AE-CA21-4AF2-A256-BC918CE0E796}" = EZXClaustrophobic "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{89DE67AD-08B8-4699-A55D-CA5C0AF82BF3}" = ATI AVIVO Codecs "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch "{8BCD7AE7-F713-4D50-BAB9-7839B9386870}" = ImageShack Uploader 2.2.0 "{8BF2C401-02CE-424D-BC26-6C4F9FB446B6}" = Macromedia Flash 8 Video Encoder "{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}" = Adobe Device Central CS3 "{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}" = Adobe Type Support "{8EDBA74D-0686-4C99-BFDD-F894678E5B39}" = Adobe Common File Installer "{90120000-0010-0415-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (Polish) 12 "{90120000-0015-0415-0000-0000000FF1CE}" = Microsoft Office Access MUI (Polish) 2007 "{90120000-0016-0415-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Polish) 2007 "{90120000-0018-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Polish) 2007 "{90120000-0019-0415-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Polish) 2007 "{90120000-001A-0415-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Polish) 2007 "{90120000-001B-0415-0000-0000000FF1CE}" = Microsoft Office Word MUI (Polish) 2007 "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2007 "{90120000-0020-0415-0000-0000000FF1CE}" = Pakiet zgodności dla systemu Office 2007 "{90120000-002C-0415-0000-0000000FF1CE}" = Microsoft Office Proofing (Polish) 2007 "{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007 "{90120000-0044-0415-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Polish) 2007 "{90120000-006E-0415-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Polish) 2007 "{90120000-00A1-0415-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Polish) 2007 "{90120000-00BA-0415-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Polish) 2007 "{90176341-0A8B-4CCC-A78D-F862228A6B95}" = Adobe Anchor Service CS3 "{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch "{95655ED4-7CA5-46DF-907F-7144877A32E5}" = Adobe Color NA Recommended Settings "{9C9824D9-9000-4373-A6A5-D0E5D4831394}" = Adobe Bridge CS3 "{9E1BAB75-EB78-440D-94C0-A3857BE2E733}" = System Requirements Lab "{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}" = Adobe CMaps "{A777CB31-A5EC-4E32-A462-2E24F45D4D4F}_is1" = Moyea FLV to Video Converter Pro version 1.29.2.11 "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}" = PDF Settings "{AC76BA86-7AD7-1045-7B44-A90000000001}" = Adobe Reader 9 - Polish "{AF7E85DC-317C-47F5-810E-B82EE093A612}" = Samsung New PC Studio USB Driver Installer "{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}" = Adobe Camera Raw 4.0 "{B74D4E10-1033-0000-0000-000000000001}" = Adobe Bridge 1.0 "{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}" = Adobe Default Language CS3 "{BEA3FF0E-D040-4D9A-B939-9AEB28C2EC64}" = HP Deskjet 1050 J410 series Badanie ulepszeń produktu "{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = The Sims™ 3 "{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}" = Adobe ExtendScript Toolkit 2 "{C3AE9DA1-2E44-4F11-803E-20977F0FE6B9}" = Safari "{C7340571-7773-4A8C-9EBC-4E4243B38C76}" = Microsoft XML Parser "{C95AACD4-9507-4F5C-9D53-22B1ACCFECD1}" = AmpliTube2 "{D0DFF92A-492E-4C40-B862-A74A173C25C5}" = Adobe Version Cue CS3 Client "{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}" = Adobe PDF Library Files "{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}" = Adobe Color Common Settings "{DBC3FDEC-D5F4-439C-9A18-EF454A74E3DE}_is1" = NOD32 FiX v2.1 "{DD4371B0-D2F6-11D7-BDC5-123456789098}" = Translatica 4 "{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}" = Adobe Color JA Extra Settings "{DE77FE3F-A33D-499A-87AD-5FC406617B40}" = HP Update "{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime "{E415C943-37E5-473F-8BAE-043C56734124}" = Sp5TTInt "{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM) "{E69AE897-9E0B-485C-8552-7841F48D42D8}" = Adobe Update Manager CS3 "{E9787678-1033-0000-8E67-000000000001}" = Adobe Help Center 1.0 "{F08E8D2E-F132-4742-9C87-D5FF223A016A}" = Adobe Illustrator CS3 "{FD4B33E1-24AE-4535-AA7B-162B30FB57CD}" = Sp5Intl "{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 "504244733D18C8F63FF584AEB290E3904E791693" = Pakiet sterowników systemu Windows - Nokia pccsmcfd (08/22/2008 7.0.0.0) "6194C28A8F62DD817EA1B918E6E46E806A21B452" = Pakiet sterowników systemu Windows - MobileTop (sshpmdm) Modem (02/23/2007 2.5.0.0) "65B6FE5418CE28F4D72543FB2D964C3CEC83F161" = Pakiet sterowników systemu Windows - MobileTop (sshpusb) USB (02/23/2007 2.5.0.0) "7-Zip" = 7-Zip 4.42 "A4Tech iKeyWorks" = A4Tech iKeyWorks 7.72 "Absolute Uninstaller_is1" = Absolute Uninstaller 2.3 "Addictive Drums" = Addictive Drums "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Adobe Photoshop CS2 - {236BB7C4-4419-42FD-0409-1E257A25E34D}" = Adobe Photoshop CS2 "Adobe Shockwave Player" = Adobe Shockwave Player 11.5 "Adobe SVG Viewer" = Adobe SVG Viewer 3.0 "Adobe_a04a925a57548091300ada368235fc6" = Adobe Illustrator CS3 "All ATI Software" = Narzędzie Software Uninstall Utility firmy ATI "ALLPlayer_is1" = ALLPlayer V3.X "AP Tuner 3.08" = AP Tuner 3.08 "ASIO4ALL" = ASIO4ALL "ATI Display Driver" = ATI Display Driver "Audacity_is1" = Audacity 1.2.6 "Billiard Art_is1" = Billiard Art "BitTorrent" = BitTorrent "CANONBJ_Deinstall_CNMCP27.DLL" = BJC-85 "Carom3D" = Carom3D "CDRoller_is1" = CDRoller version 7.00 "Collab" = Collab "com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player "Deluxe Ski Jump 3_is1" = Deluxe Ski Jump 3 v1.4.0 "Deluxe Ski Jump 4_is1" = Deluxe Ski Jump 4 Beta-1 "Device Control" = Device Control "Drumsite" = Drumsite 1.3 "E8A6D621B6D3FC5D43C68C549D959DE76EEF5D84" = Pakiet sterowników systemu Windows - Nokia Modem (06/01/2009 4.1) "EAXSet" = Creative EAX Settings "ENTERPRISE" = Microsoft Office Enterprise 2007 "EVEREST Home Edition_is1" = EVEREST Home Edition v2.20 "F779F5541ABD99C95C03B0FD5E3C058B22DA0FF7" = Pakiet sterowników systemu Windows - Nokia Modem (06/01/2009 7.01.0.3) "FL Studio 8" = FL Studio 8 "Gadu-Gadu" = Gadu-Gadu 7.7 "GameDesire-Pool & Snooker" = GameDesire-Pool & Snooker "Guitar Pro 5_is1" = Guitar Pro 5.0 "GuitarSpeedTrainer_is1" = GST 2.3.8.4 "Hamachi" = Hamachi 1.0.3.0 "HijackThis" = HijackThis 2.0.2 "IL Download Manager" = IL Download Manager "ImgBurn" = ImgBurn "InstallShield_{050C1C8E-4A4D-4C2F-B9AE-67E60EE91B7F}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.3 Patch "InstallShield_{3BD633E0-4BF8-4499-9149-88F0767D449C}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch "InstallShield_{5D7767FA-7FE8-4627-9F09-AEF7A25F1E07}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.1 Patch "InstallShield_{6A3E5F76-7DD4-4F59-9CD6-B0159622B353}" = Double Vibration steering wheel "InstallShield_{8503C901-85D7-4262-88D2-8D8B2A7B08B8}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Multiplayer Patch "InstallShield_{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch "InstallShield_{931C37FC-594D-43A9-B10F-A2F2B1F03498}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch "InstallShield_{AF7E85DC-317C-47F5-810E-B82EE093A612}" = Samsung New PC Studio USB Driver Installer "InstallShield_{AFAE2B15-89A0-4215-A030-F7B5B478886B}" = Call of Duty(R) - World at War(TM) 1.1 Patch "InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM) "InstallShield_{E5141379-B2D9-4BBC-BB2A-5805541571DD}" = Call of Duty(R) 4 - Modern Warfare(TM) 1.2 Patch "IrfanView" = IrfanView (remove only) "KLiteCodecPack_is1" = K-Lite Codec Pack 4.6.2 (Full) "LastFM_is1" = Last.fm 1.5.4.27091 "Line 6 Uninstaller" = Line 6 Uninstaller "Menedżer ucznia_is1" = Menedżer ucznia 1.0 "Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0 "MozBackup_is1" = MozBackup 1.4.6 PL "Mozilla Firefox 4.0.1 (x86 pl)" = Mozilla Firefox 4.0.1 (x86 pl) "Mozilla Thunderbird (3.1.10)" = Mozilla Thunderbird (3.1.10) "MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP "NAPIPROJEKT_is1" = NAPIPROJEKT 1.0.6.2 "Native Instruments GuitarRig 2.01 RTAS VSTi DXi" = Native Instruments GuitarRig 2.01 RTAS VSTi DXi "Nero - Burning Rom!UninstallKey" = Nero 6 Demo "NOD32" = System Antywirusowy NOD32 "Nokia PC Suite" = Nokia PC Suite "Odkurzacz 11.3_is1" = Odkurzacz 11.3 "OpenAL" = OpenAL "PoiZone" = PoiZone "PowerISO" = PowerISO "PunkBusterSvc" = PunkBuster Services "RealAlt_is1" = Real Alternative 2.0.1 Lite "REAPER" = REAPER "ReaPlugs" = ReaPlugs "SAMSUNG Mobile Composite Device" = SAMSUNG Mobile Composite Device Software "SAMSUNG Mobile Modem" = SAMSUNG Mobile Modem Driver Set "Samsung Mobile Modem Device" = Samsung Mobile Modem Device Software "Samsung Mobile phone USB driver" = Samsung Mobile phone USB driver Software "SAMSUNG Mobile USB Modem" = SAMSUNG Mobile USB Modem Software "SAMSUNG Mobile USB Modem 1.0" = SAMSUNG Mobile USB Modem 1.0 Software "SAMSUNG USB Mobile Device" = SAMSUNG USB Mobile Device Software "Skoki Narciarskie 2006" = Skoki Narciarskie 2006 "SoftickPPP" = Softick PPP 3.00 (remove only) "SPEAKER" = Creative Speaker Settings "Switch" = Switch Sound File Converter "SystemRequirementsLab" = System Requirements Lab "Testy maturalne 2011" = Testy maturalne 2011 1.0 "The KMPlayer" = The KMPlayer (remove only) "Tlen.pl" = Tlen.pl "TmNationsForever_is1" = TmNationsForever "Total Video Converter 3.21_is1" = Total Video Converter 3.21 090220 "Toxic Biohazard" = Toxic Biohazard "Trials 2 SE" = Trials 2 Second Edition "VOX WebComposer 1.604" = VOX WebComposer 1.604 "VueScan" = VueScan "Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7 "Winamp" = Winamp "Winamp Toolbar for Firefox" = Winamp Toolbar for Firefox "Windows Media Format Runtime" = Windows Media Format 11 runtime "Windows Media Player" = Windows Media Player 11 "WinRAR archiver" = Archiwizator WinRAR "WMFDist11" = Windows Media Format 11 runtime "wmp11" = Windows Media Player 11 "WMV9_VCM" = Microsoft Windows Media Video 9 VCM "Wudf01007" = Microsoft User-Mode Driver Framework Feature Pack 1.7 "Xfire" = Xfire (remove only) [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-21-1935655697-1532298954-839522115-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "BankBrowser" = BankBrowser "Google Chrome" = Google Chrome "uTorrent" = µTorrent [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Application Events ] Error - 2011-02-22 11:22:17 | Computer Name = PPP-77949343E3D | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd plugin-container.exe, wersja 1.9.2.3989, moduł powodujący błąd ntdll.dll, wersja 5.1.2600.2180, adres błędu 0x00001010. Error - 2011-02-22 14:15:25 | Computer Name = PPP-77949343E3D | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd chrome.exe, wersja 0.0.0.0, moduł powodujący błąd ntdll.dll, wersja 5.1.2600.2180, adres błędu 0x00018fea. Error - 2011-03-16 13:59:33 | Computer Name = PPP-77949343E3D | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd chrome.exe, wersja 0.0.0.0, moduł powodujący błąd chrome.dll, wersja 1.0.154.59, adres błędu 0x004e55bf. Error - 2011-03-22 07:09:52 | Computer Name = PPP-77949343E3D | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd silverlight.configuration.exe, wersja 4.0.50917.0, moduł powodujący błąd silverlight.configuration.exe, wersja 4.0.50917.0, adres błędu 0x0003ccb0. Error - 2011-03-23 09:01:31 | Computer Name = PPP-77949343E3D | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd chrome.exe, wersja 0.0.0.0, moduł powodujący błąd chrome.dll, wersja 1.0.154.59, adres błędu 0x004e55b7. Error - 2011-03-25 10:53:27 | Computer Name = PPP-77949343E3D | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca firefox.exe, wersja 2.0.0.4094, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2011-04-10 11:35:45 | Computer Name = PPP-77949343E3D | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd chrome.exe, wersja 0.0.0.0, moduł powodujący błąd chrome.dll, wersja 1.0.154.59, adres błędu 0x004e55bf. Error - 2011-04-12 10:22:34 | Computer Name = PPP-77949343E3D | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca wmplayer.exe, wersja 11.0.5721.5145, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2011-04-20 10:26:23 | Computer Name = PPP-77949343E3D | Source = crypt32 | ID = 131083 Description = Nie można wyodrębnić głównej listy innych firm z pliku cab automatycznej aktualizacji z: <http://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>, wystąpił błąd: Wymagany certyfikat jest poza okresem ważności, co wynika z weryfikacji bieżącego zegara systemowego lub sygnatury czasowej. Error - 2011-05-09 12:45:39 | Computer Name = PPP-77949343E3D | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd iw3mp.exe, wersja 0.0.0.0, moduł powodujący błąd pbcl.dll, wersja 0.0.0.0, adres błędu 0x000d2f49. [ OSession Events ] Error - 2008-11-10 15:37:13 | Computer Name = PPP-77949343E3D | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.6021.5000. This session lasted 25 seconds with 0 seconds of active time. This session ended with a crash. Error - 2008-11-10 15:37:25 | Computer Name = PPP-77949343E3D | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.6021.5000. This session lasted 3 seconds with 0 seconds of active time. This session ended with a crash. Error - 2008-11-10 15:38:38 | Computer Name = PPP-77949343E3D | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.6021.5000. This session lasted 60 seconds with 60 seconds of active time. This session ended with a crash. Error - 2008-11-10 15:38:43 | Computer Name = PPP-77949343E3D | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.6021.5000. This session lasted 1 seconds with 0 seconds of active time. This session ended with a crash. Error - 2009-02-28 06:31:22 | Computer Name = PPP-77949343E3D | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.6021.5000. This session lasted 5 seconds with 0 seconds of active time. This session ended with a crash. [ System Events ] Error - 2011-05-12 03:50:15 | Computer Name = PPP-77949343E3D | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi adfs z powodu następującego błędu: %%2 Error - 2011-05-12 03:50:15 | Computer Name = PPP-77949343E3D | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi atksgt z powodu następującego błędu: %%2 Error - 2011-05-12 03:50:15 | Computer Name = PPP-77949343E3D | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi lirsgt z powodu następującego błędu: %%2 Error - 2011-05-12 03:50:15 | Computer Name = PPP-77949343E3D | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi SecuROM User Access Service (V7) z powodu następującego błędu: %%2 Error - 2011-05-12 09:18:17 | Computer Name = PPP-77949343E3D | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi adfs z powodu następującego błędu: %%2 Error - 2011-05-12 09:18:17 | Computer Name = PPP-77949343E3D | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi atksgt z powodu następującego błędu: %%2 Error - 2011-05-12 09:18:17 | Computer Name = PPP-77949343E3D | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi lirsgt z powodu następującego błędu: %%2 Error - 2011-05-12 09:18:17 | Computer Name = PPP-77949343E3D | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi SecuROM User Access Service (V7) z powodu następującego błędu: %%2 Error - 2011-05-12 09:18:42 | Computer Name = PPP-77949343E3D | Source = DCOM | ID = 10010 Description = Serwer {4EB61BAC-A3B6-4760-9581-655041EF4D69} nie zarejestrował się w modelu DCOM w wymaganym czasie. Error - 2011-05-12 09:49:16 | Computer Name = PPP-77949343E3D | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd „%1058” podczas próby uruchomienia usługi upnphost z argumentami „” w celu uruchomienia serwera: {204810B9-73B2-11D4-BF42-00B0D0118B56} < End of report >

**Posty:** 18165 · przez **wojtas** 12 Maj 2011, 22:39

odpal Kaspersky jeszcze raz i jeśli coś znajdzie dajesz Cure, resetujesz kompa i dajesz raport

w OTL wklej:

:OTL

:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"3389:TCP"=-
"65533:TCP"=-
"52344:TCP"=-
"7652:TCP"=-
"7653:TCP"=-
"3988:TCP"=-
"7691:TCP"=-
"6144:TCP"=-
"7004:TCP"=-
"8394:TCP"=-
"4785:TCP"=-
"8070:TCP"=-

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"3389:TCP"=-
"65533:TCP"=-
"52344:TCP"=-
"7652:TCP"=-
"7653:TCP"=-
"3988:TCP"=-
"7691:TCP"=-
"6144:TCP"=-
"7004:TCP"=-
"8394:TCP"=-
"4785:TCP"=-
"8070:TCP"=-

:Commands
[emptytemp]
[emptyflash]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia (zawartość notatnika, która otworzy się po restarcie). + Kasper + Gmer

**Posty:** 201 · przez **karlol** 13 Maj 2011, 13:52

Problem z mBankiem minął. Tu linki do logów o które prosiłeś:

http://karolortyl.pl/log/1.txt
http://karolortyl.pl/log/2.txt
http://karolortyl.pl/log/3.Txt
http://karolortyl.pl/log/4.Txt
http://karolortyl.pl/log/5.txt

Pozdrawiam

**Posty:** 18165 · przez **wojtas** 13 Maj 2011, 16:19

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL
O3 - HKU\S-1-5-21-1935655697-1532298954-839522115-1004\..\Toolbar\ShellBrowser: (no name) - {4724C5D8-DFA7-417A-A2F5-1EABFEE9B4AC} - No CLSID value found.
O3 - HKU\S-1-5-21-1935655697-1532298954-839522115-1004\..\Toolbar\ShellBrowser: (no name) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - No CLSID value found.
O3 - HKU\S-1-5-21-1935655697-1532298954-839522115-1004\..\Toolbar\WebBrowser: (no name) - {00000000-5736-4205-0008-F7ED0776FB27} - No CLSID value found.
O3 - HKU\S-1-5-21-1935655697-1532298954-839522115-1004\..\Toolbar\WebBrowser: (no name) - {4596013B-6C31-408B-A266-DEAE5C086DC2} - No CLSID value found.
O3 - HKU\S-1-5-21-1935655697-1532298954-839522115-1004\..\Toolbar\WebBrowser: (no name) - {71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7} - No CLSID value found.
O3 - HKU\S-1-5-21-1935655697-1532298954-839522115-1004\..\Toolbar\WebBrowser: (no name) - {88C7F2AA-F93F-432C-8F0E-B7D85967A527} - No CLSID value found.

daj wykonaj skrypt:

Wykonaj czynności końcowe :
*Uruchom OTL z opcji sprzątanie.
* wykonaj optymalizację Windowsa ( instrukcja dla Windowsa XP, lecz w innych systemach jest podobnie )
* zrób pełny skan Malwarebytes Anti-Malware (zaktualizuj, usuń co znajdzie )
* Skasuj stan przywracania systemu

Zaktualizuj zabezpieczenia:
>>> Adobe Reader (bez Free McAfee® Security Scan Plus)
>>> Internet Explorer 8
>>> Service Pack 3
>>> Java™ 6

zmień wszystkie hasła dostępu do witryn , rootkit mbr lubi je wykradać

napisz jak sytuacja

**Posty:** 201 · przez **karlol** 13 Maj 2011, 18:41

Wszystko wydaję się być ok. Dzięki za pomoc i pozdrawiam.

Kto jest na forum