Zamyka się explorer.exe/błąd instalatora - log

**Posty:** 5 · przez **ecz** 03 Lip 2009, 15:40

Witam. Od pewnego czasu często wyskakuje błąd - zamyka się explorer.exe / a przy instalacji gier - odmowa dostępu.
poniżej log HJ:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:35:34, on 2009-07-03 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\alg.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\foobar2000\foobar2000.exe C:\Program Files\Last.fm\LastFM.exe C:\Program Files\Azureus\Azureus.exe C:\Program Files\WapSter\WapSter AQQ\AQQ.exe C:\WINDOWS\system32\drwtsn32.exe C:\WINDOWS\system32\drwtsn32.exe C:\WINDOWS\system32\drwtsn32.exe C:\WINDOWS\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O3 - Toolbar: Easy Gif Animator Toolbar - {35065594-9169-4A34-B167-FC4865038E53} - C:\Program Files\Easy Gif Animator Extension\v3.3.0.1\EasyGifAnimator_Toolbar.dll (file missing) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Ashampoo AntiSpyWare 2 Guard] C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ALLUpdate] "C:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-21-1085031214-484061587-725345543-1005\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.07\AMVConverter\grab.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.07\MediaManager\grab.html O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1188744859203 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u2-windows-i586-jc.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ashampoo AntiSpyWare 2 Service (AASW2_Service) - Unknown owner - C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe -- End of file - 8499 bytes

**Posty:** 574 · przez **Tomasz** 03 Lip 2009, 17:02

Mam podobny problem co kolega ecz z zamykaniem się przeglądarki explorer.exe.

U mnie problem powstał tak:
Na kompie objawił mi się Rootkit.TDSS!sd6, którego nie mogłem usunąć. Użyłem programu Rising Internet Security 2009, który uporał mi się z tym syfem. Jednak powstał jeden mankament a mianowicie przeglądarka Internet Explorer 8 nie działa. Po kliknięciu w ikonę przeglądarki załącza się okno ale po chwili gaśnie i nawet strona nie zdąży się wyświetlić. Jeżeli tak by się stało, że nie da się uruchomić tej przeglądarki to nic nie szkodzi, bo działa mi opera i FireFox ale chciałbym odzyskać ulubione z internet Explorera. Czy jest taka możliwość ?. Bardzo bym prosił o przeglądnięcie logów [1] z hijackthis a [2] z RSIT czy gdzieś nie ma jakichś pozostałości po tym rokicie i trojanach lub czegoś innego.

Hijackthis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:19:44, on 2009-07-03 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe C:\Program Files\Windows Desktop Search\WindowsSearch.exe C:\Program Files\Corel\Graphics9\Register\Remind32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\UPHClean\uphclean.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\SearchProtocolHost.exe C:\WINDOWS\system32\SearchFilterHost.exe C:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [NVRTCLK] C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE HP Premium Starter Camera O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ALLUpdate] "C:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep" O4 - HKCU\..\Run: [Nowe Gadu-Gadu] "C:\Program Files\Nowe Gadu-Gadu\gg.exe" O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Expressivo] "C:\Program Files\ivo\Expressivo\expressivo.exe" -t -nosplash O4 - HKCU\..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Rejestrowanie produktów Corela.lnk = C:\Program Files\Corel\Graphics9\Register\Remind32.exe O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: FlashCapture - {753BBC4B-CC73-4fb8-A5B5-CA09C804C1DD} - C:\Program Files\Flash Capture\fciext.dll (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing) O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Rising RealTime Monitor (RsRavMon) - Beijing Rising Information Technology Co., Ltd. - C:\Program Files\Rising\Ris\RavMonD.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe -- End of file - 7186 bytes

RSIT

Kod: Zaznacz wszystko: Logfile of random's system information tool 1.06 (written by random/random) Run by Mariusz i Janusz at 2009-07-03 16:42:24 Microsoft Windows XP Professional Dodatek Service Pack 3 System drive C: has 6 GB (18%) free of 30 GB Total RAM: 2559 MB (78% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:44:05, on 2009-07-03 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\Spyware Doctor\pctsTray.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe C:\Program Files\Windows Desktop Search\WindowsSearch.exe C:\Program Files\Corel\Graphics9\Register\Remind32.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Spyware Doctor\pctsAuxs.exe C:\Program Files\Spyware Doctor\pctsSvc.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\UPHClean\uphclean.exe C:\WINDOWS\system32\SearchIndexer.exe C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Skype\Plugin Manager\skypePM.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Mariusz i Janusz\Pulpit\RSIT.exe C:\WINDOWS\system32\wbem\wmiprvse.exe C:\Program Files\Trend Micro\HijackThis\Mariusz i Janusz.exe C:\WINDOWS\system32\NOTEPAD.EXE R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file) O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [NVRTCLK] C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [BigDogPath] C:\WINDOWS\VM_STI.EXE HP Premium Starter Camera O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe" O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ALLUpdate] "C:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep" O4 - HKCU\..\Run: [Nowe Gadu-Gadu] "C:\Program Files\Nowe Gadu-Gadu\gg.exe" O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Expressivo] "C:\Program Files\ivo\Expressivo\expressivo.exe" -t -nosplash O4 - HKCU\..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: Rejestrowanie produktów Corela.lnk = C:\Program Files\Corel\Graphics9\Register\Remind32.exe O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe O8 - Extra context menu item: Download All by FlashGet - C:\Program Files\FlashGet\jc_all.htm O8 - Extra context menu item: Download using FlashGet - C:\Program Files\FlashGet\jc_link.htm O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: FlashCapture - {753BBC4B-CC73-4fb8-A5B5-CA09C804C1DD} - C:\Program Files\Flash Capture\fciext.dll (file missing) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing) O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\PROGRA~1\FlashGet\flashget.exe (file missing) O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe -- End of file - 7069 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {E0E899AB-F487-11D5-8D29-0050BA6940E3} [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "CTSysVol"=C:\Program Files\Creative\SB Live! 24-bit\Surround Mixer\CTSysVol.exe [2003-09-17 57344] "UpdReg"=C:\WINDOWS\UpdReg.EXE [2000-05-11 90112] "NVRTCLK"=C:\WINDOWS\system32\NVRTCLK\NVRTClk.exe [2003-12-30 24576] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2005-06-15 6803456] "nwiz"=nwiz.exe /install [] "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2005-06-15 86016] "HPDJ Taskbar Utility"=C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe [2001-10-29 196608] "WinampAgent"=C:\Program Files\Winamp\winampa.exe [2008-08-04 36352] "BluetoothAuthenticationAgent"=bthprops.cpl,,BluetoothAuthenticationAgent [] "UnlockerAssistant"=C:\Program Files\Unlocker\UnlockerAssistant.exe [2006-09-07 15872] "BigDogPath"=C:\WINDOWS\VM_STI.EXE [2005-02-28 53248] "ISTray"=C:\Program Files\Spyware Doctor\pctsTray.exe [2008-12-08 1173384] "NBKeyScan"=C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe [] "NeroFilterCheck"=C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe [2007-03-01 153136] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360] "ALLUpdate"=C:\Program Files\ALLPlayer\ALLUpdate.exe [2008-11-24 869888] "Nowe Gadu-Gadu"=C:\Program Files\Nowe Gadu-Gadu\gg.exe [2008-12-22 8966760] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe [2007-08-03 202024] "Skype"=C:\Program Files\Skype\Phone\Skype.exe [2009-02-02 23975720] "Expressivo"=C:\Program Files\ivo\Expressivo\expressivo.exe [2009-06-05 1368064] "cdoosoft"=C:\WINDOWS\system32\olhrwef.exe [] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart Windows Search.lnk - C:\Program Files\Windows Desktop Search\WindowsSearch.exe C:\Documents and Settings\Mariusz i Janusz\Menu Start\Programy\Autostart Rejestrowanie produktów Corela.lnk - C:\Program Files\Corel\Graphics9\Register\Remind32.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{56F9679E-7826-4C84-81F3-532071A8BCC5}"=C:\Program Files\Windows Desktop Search\MSNLNamespaceMgr.dll [2009-05-24 304128] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdauxservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdcoreservice] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 "NoSMConfigurePrograms"=1 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "HonorAutoRunSetting"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\BitComet\BitComet.exe"="C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet - a BitTorrent Client" "C:\Program Files\TmUnitedForever\TmForever.exe"="C:\Program Files\TmUnitedForever\TmForever.exe:*:Enabled:TmForever" "C:\Program Files\Metin2_PL\metin2.bin"="C:\Program Files\Metin2_PL\metin2.bin:*:Enabled:metin2" "C:\Documents and Settings\Mariusz i Janusz\Moje dokumenty\Folder janusza\Trackmania United, United Forever\TmUnitedForever\TmForever.exe"="C:\Documents and Settings\Mariusz i Janusz\Moje dokumenty\Folder janusza\Trackmania United, United Forever\TmUnitedForever\TmForever.exe:*:Enabled:TmForever" "C:\Documents and Settings\Mariusz i Janusz\Moje dokumenty\Folder janusza\folder janusza\Trackmania United, United Forever\TmUnitedForever\TmForever.exe"="C:\Documents and Settings\Mariusz i Janusz\Moje dokumenty\Folder janusza\folder janusza\Trackmania United, United Forever\TmUnitedForever\TmForever.exe:*:Enabled:TmForever" "D:\Program Files\Serious Sam - Pierwsze Starcie\Bin\SeriousSam.exe"="D:\Program Files\Serious Sam - Pierwsze Starcie\Bin\SeriousSam.exe:*:Enabled:SeriousSam" "D:\Program Files\Metin2_PL\metin2.bin"="D:\Program Files\Metin2_PL\metin2.bin:*:Enabled:metin2" "C:\Program Files\newlongju\metin2.bin"="C:\Program Files\newlongju\metin2.bin:*:Enabled:metin2" "C:\Documents and Settings\Mariusz i Janusz\Moje dokumenty\Folder janusza\folder janusza\Doom2\skulltag.exe"="C:\Documents and Settings\Mariusz i Janusz\Moje dokumenty\Folder janusza\folder janusza\Doom2\skulltag.exe:*:Enabled:Skulltag" "C:\Program Files\Opera\opera.exe"="C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser" "D:\FOGDownloaderEN-RunesOfMagic.exe"="D:\FOGDownloaderEN-RunesOfMagic.exe:*:Enabled:FOG Downloader" "C:\Documents and Settings\Mariusz i Janusz\Moje dokumenty\Folder janusza\folder janusza\soldat\Soldat\Soldat.exe"="C:\Documents and Settings\Mariusz i Janusz\Moje dokumenty\Folder janusza\folder janusza\soldat\Soldat\Soldat.exe:*:Enabled:Soldat" "C:\Program Files\Nowe Gadu-Gadu\gg.exe"="C:\Program Files\Nowe Gadu-Gadu\gg.exe:*:Enabled:Nowe Gadu-Gadu beta" "C:\Documents and Settings\Mariusz i Janusz\Moje dokumenty\Folder janusza\folder janusza\Doom2\IdeSE.exe"="C:\Documents and Settings\Mariusz i Janusz\Moje dokumenty\Folder janusza\folder janusza\Doom2\IdeSE.exe:*:Enabled:IdeSE" "C:\Documents and Settings\Mariusz i Janusz\Moje dokumenty\Folder janusza\folder janusza\SRB2 Needed Characters\srb2JTE.exe"="C:\Documents and Settings\Mariusz i Janusz\Moje dokumenty\Folder janusza\folder janusza\SRB2 Needed Characters\srb2JTE.exe:*:Enabled:srb2JTE" "C:\Documents and Settings\Mariusz i Janusz\Moje dokumenty\Folder janusza\folder janusza\SRB2 Needed Characters\srb2riders.exe"="C:\Documents and Settings\Mariusz i Janusz\Moje dokumenty\Folder janusza\folder janusza\SRB2 Needed Characters\srb2riders.exe:*:Enabled:srb2riders" "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D] shell\AutoRun\command - D:\rbj9jn1n.bat shell\open\command - D:\rbj9jn1n.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E] shell\AutoRun\command - E:\rbj9jn1n.bat shell\open\command - E:\rbj9jn1n.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] shell\AutoRun\command - F:\rbj9jn1n.bat shell\open\command - F:\rbj9jn1n.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\H] shell\AutoRun\command - H:\pcformat.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{102d6cca-ff1c-11dd-8d77-00304f0b6e60}] shell\AutoRun\command - J:\rbj9jn1n.bat shell\open\command - J:\rbj9jn1n.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{54b3207e-0c6d-11de-8da8-00304f0b6e60}] shell\AutoRun\command - J:\rbj9jn1n.bat shell\open\command - J:\rbj9jn1n.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8fe5e076-1cf3-11de-8dd3-00304f0b6e60}] shell\AutoRun\command - J:\0bcobed.exe shell\open\command - J:\0bcobed.exe ======List of files/folders created in the last 1 months====== 2009-07-03 16:33:06 ----D---- C:\rsit 2009-07-03 16:16:33 ----D---- C:\Program Files\Trend Micro 2009-07-03 14:13:00 ----D---- C:\WINDOWS\CSC 2009-07-03 14:04:20 ----RD---- C:\RavBin 2009-07-03 13:22:05 ----A---- C:\WINDOWS\system32\UACdimpkchneekomds.dll 2009-07-03 12:02:14 ----A---- C:\WINDOWS\system32\mfc71.dll 2009-07-03 11:55:59 ----D---- C:\Program Files\Rising 2009-07-03 11:52:37 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Rising 2009-07-03 08:55:48 ----D---- C:\WINDOWS\ERUNT 2009-07-03 08:55:48 ----D---- C:\WINDOWS\ERDNT 2009-07-03 08:14:36 ----HDC---- C:\WINDOWS\ie8 2009-07-02 09:46:57 ----D---- C:\Program Files\GonVisor 2009-06-27 11:02:05 ----A---- C:\WINDOWS\bgsdatatemp.INI 2009-06-27 11:01:52 ----A---- C:\WINDOWS\gamesystem.ini 2009-06-27 11:01:52 ----A---- C:\WINDOWS\bgssb3.ini 2009-06-26 12:38:55 ----A---- C:\WINDOWS\gfscore.ini 2009-06-26 12:38:36 ----D---- C:\WINDOWS\Sonic Avalanche 2009-06-22 13:58:45 ----A---- C:\WINDOWS\gamedata.INI 2009-06-22 00:23:49 ----D---- C:\Documents and Settings\Mariusz i Janusz\Dane aplikacji\Canneverbe_Limited 2009-06-22 00:16:42 ----D---- C:\Program Files\Nero 2009-06-22 00:16:42 ----D---- C:\Program Files\Common Files\Nero 2009-06-12 14:25:44 ----D---- C:\Documents and Settings\Mariusz i Janusz\Dane aplikacji\Expressivo 2009-06-12 11:06:55 ----D---- C:\Documents and Settings\Mariusz i Janusz\Dane aplikacji\IVONA Player 2009-06-12 11:06:29 ----D---- C:\Program Files\Ivona 2009-06-11 22:15:43 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$ 2009-06-11 22:15:39 ----HDC---- C:\WINDOWS\$NtUninstallKB969898$ 2009-06-11 22:15:36 ----HDC---- C:\WINDOWS\$NtUninstallKB963093$ 2009-06-11 22:13:40 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$ 2009-06-11 22:13:19 ----N---- C:\WINDOWS\system32\spmsg.dll 2009-06-11 22:13:18 ----HDC---- C:\WINDOWS\$NtUninstallKB968537$ 2009-06-10 17:56:03 ----RSH---- C:\6phx.com 2009-06-08 13:38:25 ----D---- C:\Program Files\ivo 2009-06-08 11:52:04 ----D---- C:\Program Files\Foxit Software 2009-06-08 09:46:20 ----D---- C:\Program Files\Common Files\Adobe 2009-06-08 09:37:38 ----D---- C:\Documents and Settings\Mariusz i Janusz\Dane aplikacji\ABBYY 2009-06-08 09:35:01 ----D---- C:\Program Files\ABBYY FineReader 8.0 Professional Edition 2009-06-06 23:26:48 ----D---- C:\Program Files\Common Files\DivX Shared 2009-06-04 19:45:25 ----D---- C:\Documents and Settings\Mariusz i Janusz\Dane aplikacji\Corel 2009-06-04 18:10:52 ----A---- C:\WINDOWS\OLHRWEF.EXE-285816C3.pf 2009-06-04 18:06:55 ----A---- C:\WINDOWS\userinit.exe 2009-06-04 17:57:17 ----A---- C:\WINDOWS\ntbtlog.txt 2009-06-04 16:00:33 ----RA---- C:\WINDOWS\system32\VBAR332.DLL 2009-06-04 16:00:33 ----RA---- C:\WINDOWS\system32\MSJET35.DLL 2009-06-04 16:00:11 ----N---- C:\WINDOWS\system32\Decslib.dll 2009-06-04 15:58:30 ----N---- C:\WINDOWS\system32\shw32.dll 2009-06-04 15:58:27 ----N---- C:\WINDOWS\system32\3dviewer.dll 2009-06-04 15:58:26 ----N---- C:\WINDOWS\system32\rave.dll 2009-06-04 15:58:26 ----N---- C:\WINDOWS\system32\qd3d.dll 2009-06-04 15:58:11 ----N---- C:\WINDOWS\system32\Awrtl30.dll 2009-06-04 15:58:11 ----N---- C:\WINDOWS\system32\awpe.dll 2009-06-04 15:58:01 ----N---- C:\WINDOWS\system32\Scint91.dll 2009-06-04 15:58:01 ----N---- C:\WINDOWS\system32\Sccres91.dll 2009-06-04 15:58:01 ----N---- C:\WINDOWS\system32\Sccomp91.dll 2009-06-04 15:57:55 ----D---- C:\WINDOWS\Profiles 2009-06-04 15:57:54 ----D---- C:\Program Files\Corel 2009-06-04 15:57:02 ----D---- C:\WINDOWS\Corel 2009-06-04 15:24:17 ----A---- C:\Documents and Settings\Mariusz i Janusz\Dane aplikacji\ispro3_0.tmp 2009-06-04 15:23:44 ----D---- C:\Program Files\iSpring Pro 3 2009-06-04 15:15:52 ----A---- C:\Documents and Settings\Mariusz i Janusz\Dane aplikacji\bhs.bat 2009-06-04 15:15:40 ----A---- C:\WINDOWS\system32\uacinit.dll 2009-06-04 15:15:35 ----A---- C:\WINDOWS\system32\UACsubchwuwpkhfdsa.dll 2009-06-04 15:15:34 ----A---- C:\WINDOWS\system32\UAComimqtdwysrffvb.dll 2009-06-04 15:15:31 ----A---- C:\Documents and Settings\Mariusz i Janusz\Dane aplikacji\~ygw.tmp 2009-06-04 15:15:30 ----A---- C:\WINDOWS\system32\UACxoyirjxbgqvaxvi.dll 2009-06-04 14:22:39 ----A---- C:\Documents and Settings\Mariusz i Janusz\Dane aplikacji\fspro3_1.tmp 2009-06-04 14:16:47 ----D---- C:\Documents and Settings\Mariusz i Janusz\Dane aplikacji\CPS Labs 2009-06-04 13:43:28 ----A---- C:\Documents and Settings\Mariusz i Janusz\Dane aplikacji\fspro3_0.tmp 2009-06-04 13:43:09 ----D---- C:\Program Files\Common Files\CPS Labs Ltd 2009-06-04 13:10:31 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\GIRDAC 2009-06-04 13:02:44 ----A---- C:\WINDOWS\system32\MP3Enc.dll 2009-06-04 12:58:02 ----D---- C:\Program Files\VeryDOC PowerPoint to Flash Converter v3.0 2009-06-04 12:50:11 ----D---- C:\Program Files\JustDo 2009-06-04 12:31:31 ----D---- C:\Documents and Settings\Mariusz i Janusz\Dane aplikacji\authorPOINT 2009-06-04 10:18:03 ----D---- C:\Program Files\ScanSoft ======List of files/folders modified in the last 1 months====== 2009-07-03 16:47:58 ----AD---- C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2009-07-03 16:25:13 ----D---- C:\Program Files\Mozilla Firefox 2009-07-03 16:23:27 ----D---- C:\Program Files 2009-07-03 16:23:26 ----D---- C:\WINDOWS\system32\drivers 2009-07-03 16:23:14 ----AD---- C:\WINDOWS 2009-07-03 16:15:20 ----D---- C:\Documents and Settings\Mariusz i Janusz\Dane aplikacji\Skype 2009-07-03 16:14:53 ----D---- C:\WINDOWS\Temp 2009-07-03 16:07:41 ----D---- C:\WINDOWS\system32 2009-07-03 15:27:49 ----SHD---- C:\found.000 2009-07-03 14:43:37 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-07-03 14:31:52 ----A---- C:\WINDOWS\NeroDigital.ini 2009-07-03 12:11:26 ----SHD---- C:\WINDOWS\Installer 2009-07-03 10:44:53 ----D---- C:\Program Files\Spyware Doctor 2009-07-03 09:01:01 ----D---- C:\WINDOWS\system32\CatRoot2 2009-07-03 08:19:19 ----HD---- C:\WINDOWS\inf 2009-07-03 08:19:19 ----D---- C:\WINDOWS\system32\pl-pl 2009-07-03 08:19:19 ----D---- C:\WINDOWS\Media 2009-07-03 08:19:19 ----D---- C:\WINDOWS\Help 2009-07-03 08:19:19 ----D---- C:\Program Files\Internet Explorer 2009-07-03 08:19:18 ----RSHDC---- C:\WINDOWS\system32\dllcache 2009-07-03 08:04:14 ----D---- C:\Documents and Settings\Mariusz i Janusz\Dane aplikacji\skypePM 2009-07-02 22:01:50 ----A---- C:\m.txt 2009-07-02 21:58:18 ----D---- C:\Documents and Settings\Mariusz i Janusz\Dane aplikacji\BESTplayer 2009-07-02 10:19:44 ----D---- C:\WINDOWS\Prefetch 2009-07-01 05:29:36 ----D---- C:\WINDOWS\network diagnostic 2009-06-27 19:20:24 ----A---- C:\WINDOWS\SB2.INI 2009-06-26 18:33:49 ----RSD---- C:\WINDOWS\Fonts 2009-06-26 12:38:36 ----A---- C:\WINDOWS\system32\cncs32.dll 2009-06-25 13:06:22 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2009-06-24 15:07:51 ----SHD---- C:\Config.Msi 2009-06-22 00:17:47 ----D---- C:\WINDOWS\WinSxS 2009-06-22 00:16:42 ----D---- C:\Program Files\Common Files 2009-06-22 00:16:42 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Nero 2009-06-20 18:44:49 ----D---- C:\Program Files\Dziobas Rar Player 2009-06-14 17:09:38 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2009-06-13 09:24:01 ----D---- C:\Documents and Settings\Mariusz i Janusz\Dane aplikacji\Real 2009-06-11 22:15:45 ----A---- C:\WINDOWS\imsins.BAK 2009-06-11 22:15:39 ----HD---- C:\WINDOWS\$hf_mig$ 2009-06-11 22:15:37 ----D---- C:\Program Files\Windows Desktop Search 2009-06-11 22:14:39 ----A---- C:\WINDOWS\system32\MRT.INI 2009-06-11 22:13:26 ----D---- C:\WINDOWS\ie7updates 2009-06-06 23:27:22 ----D---- C:\Program Files\DivX 2009-06-05 15:18:21 ----D---- C:\Program Files\Trojan Remover 2009-06-05 00:37:49 ----SHD---- C:\System Volume Information 2009-06-05 00:37:49 ----D---- C:\WINDOWS\system32\Restore 2009-06-05 00:06:59 ----SD---- C:\WINDOWS\Downloaded Program Files 2009-06-04 17:31:12 ----D---- C:\WINDOWS\Minidump 2009-06-04 15:11:52 ----SD---- C:\Documents and Settings\Mariusz i Janusz\Dane aplikacji\Microsoft 2009-06-04 14:43:35 ----A---- C:\WINDOWS\win.ini 2009-06-04 12:50:10 ----HD---- C:\Program Files\InstallShield Installation Information ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2008-07-21 24392] R1 ISODrive;ISO DVD/CD-ROM Device Driver; \??\C:\Program Files\UltraISO\drivers\ISODrive.sys [] R2 irda;Protokół IrDA; C:\WINDOWS\system32\DRIVERS\irda.sys [2008-04-14 88192] R2 PfModNT;PfModNT; \??\C:\WINDOWS\system32\drivers\PfModNT.sys [] R3 AnyDVD;AnyDVD; C:\WINDOWS\System32\Drivers\AnyDVD.sys [2008-12-01 103360] R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys [2004-07-13 130128] R3 GVCplDrv;GVCplDrv; C:\WINDOWS\system32\drivers\GVCplDrv.sys [2004-05-02 23040] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2005-06-15 3200256] R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\DRIVERS\ctoss2k.sys [2004-07-13 178640] R3 P17;Sound Blaster Live! 24-bit; C:\WINDOWS\system32\drivers\P17.sys [2004-11-10 844032] R3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2009-02-19 47360] R3 Rasirda;WAN Miniport (IrDA); C:\WINDOWS\system32\DRIVERS\rasirda.sys [2001-08-17 19584] R3 rtl8139;Sterownik NT karty Realtek RTL8139(A/B/C)-based PCI Fast Ethernet; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-04 20992] R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208] R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520] R3 usbohci;Sterownik Miniport otwartego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-14 17152] R3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856] R3 VCSVADHWSer;Avnex Virtual Audio Device (WDM); C:\WINDOWS\system32\DRIVERS\vcsvad.sys [2008-12-10 17792] S1 UACd.sys;UACd.sys; C:\WINDOWS\system32\drivers\UACnodoymrwsikdblr.sys [] S3 Arp1394;Protokół klienta 1394 ARP; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-14 60800] S3 AVPsys;AVPsys; \??\C:\WINDOWS\system32\drivers\cdaudio.sys [] S3 BthEnum;Usługa wyliczania Bluetooth; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2008-04-14 17024] S3 BTHMODEM;Sterownik Bluetooth Serial Communications; C:\WINDOWS\system32\DRIVERS\bthmodem.sys [2008-04-14 37888] S3 BthPan;Bluetooth Device (Personal Area Network); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2008-04-14 101120] S3 BTHPORT;Sterownik portu Bluetooth; C:\WINDOWS\System32\Drivers\BTHport.sys [2008-06-14 273024] S3 BTHUSB;Sterownik USB odbiornika radiowego Bluetooth; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2008-04-14 18944] S3 CCDECODE;Dekoder napisów; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024] S3 HidUsb;Sterownik Microsoft klasy HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368] S3 IKFileSec;File Security Driver; C:\WINDOWS\system32\drivers\ikfilesec.sys [] S3 IKSysFlt;System Filter Driver; C:\WINDOWS\system32\drivers\iksysflt.sys [] S3 IKSysSec;System Security Driver; C:\WINDOWS\system32\drivers\iksyssec.sys [] S3 KS-959;MA-620 USB Infrared Adapter; C:\WINDOWS\system32\DRIVERS\KS-959.sys [2005-10-22 19034] S3 MEMSWEEP2;MEMSWEEP2; \??\C:\WINDOWS\system32\109.tmp [] S3 MSIRCOMM;Microsoft IR Communications Driver; C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys [2008-04-14 22016] S3 MSTEE;Konwerter strumieni Tee/Sink-to-Sink Microsoft Streaming; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504] S3 NABTSFEC;Koder-dekoder NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248] S3 NdisIP;Połączenie TV/wideo firmy Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880] S3 NIC1394;Sterownik sieci 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-14 61824] S3 ovt519;VGA USB Camera; C:\WINDOWS\System32\Drivers\ov519vid.sys [2003-10-22 174530] S3 RFCOMM;Urządzenie Bluetooth (Protokół TDI RFCOMM); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2008-04-14 59136] S3 SCREAMINGBDRIVER;Screaming Bee Audio; C:\WINDOWS\system32\drivers\ScreamingBAudio.sys [2009-03-27 23064] S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232] S3 TfNetMon;TfNetMon; \??\C:\WINDOWS\system32\drivers\TfNetMon.sys [] S3 usbaudio;Sterownik audio USB (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-14 60032] S3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128] S3 usbscan;Sterownik skanera USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104] S3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368] S3 WSTCODEC;Kodery-dekodery teletekstu w standardzie światowym; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200] S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944] S3 ZSMC301b;HP Premium Starter Camera; C:\WINDOWS\System32\Drivers\usbVM31b.sys [2007-03-19 1271168] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336] R2 Creative Service for CDROM Access;Creative Service for CDROM Access; C:\WINDOWS\system32\CTsvcCDA.EXE [1999-12-13 44032] R2 Irmon;Monitor podczerwieni; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2005-06-15 127043] R2 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\pctsAuxs.exe [2009-01-07 348752] R2 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\pctsSvc.exe [2009-01-21 1095560] R2 UPHClean;User Profile Hive Cleanup; C:\Program Files\UPHClean\uphclean.exe [2005-04-27 241725] R2 WSearch;Windows Search; C:\WINDOWS\system32\SearchIndexer.exe [2008-05-26 439808] R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe [2007-08-03 382248] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144] S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864] S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256] S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2007-08-24 443776] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184] S3 WMPNetworkSvc;Usługa udostępniania w sieci programu Windows Media Player; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-12-01 918016] S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336] S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880] -----------------EOF-----------------

Tomasz

**Posty:** 237 · przez **Kuba1** 03 Lip 2009, 17:14

Ecz daj log z RSIT

W logu z Hijack'a nic nie widać.

Tomasz, tu panują pewne zasady, ale nie mnie Cie o tym pouczać..

**Posty:** 5 · przez **ecz** 03 Lip 2009, 17:21

Kuba1 napisał(a):Ecz daj log z RSIT

W logu z Hijack'a nic nie widać.

Kod: Zaznacz wszystko: Logfile of random's system information tool 1.06 (written by random/random) Run by Michał at 2009-07-03 17:19:11 WIN_XP Dodatek Service Pack 3 System drive C: has 14 GB (24%) free of 60 GB Total RAM: 1023 MB (25% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:19:22, on 2009-07-03 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Ahead\InCD\InCDsrv.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\CyberLink\Shared Files\RichVideo.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\System32\alg.exe C:\Program Files\foobar2000\foobar2000.exe C:\Program Files\Last.fm\LastFM.exe C:\Program Files\Azureus\Azureus.exe C:\Program Files\WapSter\WapSter AQQ\AQQ.exe C:\WINDOWS\system32\drwtsn32.exe C:\WINDOWS\system32\drwtsn32.exe C:\WINDOWS\system32\drwtsn32.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\ChomikBox\ChomikBox.exe C:\Program Files\RSIT.exe C:\Program Files\Trend Micro\HijackThis\Michał.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: IE7Pro - {00011268-E188-40DF-A514-835FCD78B1BF} - C:\Program Files\IEPro\iepro.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll O3 - Toolbar: Easy Gif Animator Toolbar - {35065594-9169-4A34-B167-FC4865038E53} - C:\Program Files\Easy Gif Animator Extension\v3.3.0.1\EasyGifAnimator_Toolbar.dll (file missing) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Ashampoo AntiSpyWare 2 Guard] C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ALLUpdate] "C:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?') O4 - HKUS\S-1-5-21-1085031214-484061587-725345543-1005\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: Add to AMV Converter... - C:\Program Files\MP3 Player Utilities 4.07\AMVConverter\grab.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: MediaManager tool grab multimedia file - C:\Program Files\MP3 Player Utilities 4.07\MediaManager\grab.html O9 - Extra button: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll O9 - Extra 'Tools' menuitem: IE7Pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\Program Files\IEPro\iepro.dll O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1188744859203 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u2-windows-i586-jc.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAVA/Secure/HPGetDownloadManager.ocx O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (a-squared Scanner) - http://ax.emsisoft.com/asquared.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ashampoo AntiSpyWare 2 Service (AASW2_Service) - Unknown owner - C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe -- End of file - 8564 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\Norton Security Scan.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00011268-E188-40DF-A514-835FCD78B1BF}] IE7Pro BHO - C:\Program Files\IEPro\iepro.dll [2008-01-02 699496] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}] Skype add-on (mastermind) - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2008-11-07 1088296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}] Megaupload Toolbar - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL [2007-07-31 1933256] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] SSVHelper Class - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll [2007-07-12 501136] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}] Google Toolbar Helper - c:\program files\google\googletoolbar1.dll [2007-09-01 2403392] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}] Google Toolbar Notifier BHO - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll [2007-09-03 325048] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar] {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - TextAloud - C:\PROGRA~1\TEXTAL~1\TAForIE.dll [2005-11-21 510976] {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - Megaupload Toolbar - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL [2007-07-31 1933256] {2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\program files\google\googletoolbar1.dll [2007-09-01 2403392] {32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2008-12-10 929224] {35065594-9169-4A34-B167-FC4865038E53} - Easy Gif Animator Toolbar - C:\Program Files\Easy Gif Animator Extension\v3.3.0.1\EasyGifAnimator_Toolbar.dll [] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-08-11 7630848] "Ashampoo AntiSpyWare 2 Guard"=C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe [2009-01-14 2347352] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360] "Gadu-Gadu"=C:\Program Files\Gadu-Gadu\gg.exe [2007-09-21 2119104] "ALLUpdate"=C:\Program Files\ALLPlayer\ALLUpdate.exe [2009-06-04 869888] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader] C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe [2007-03-09 63712] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVKTray] C:\Program Files\G DATA AntiVirus Trial\AVKTray\AVKTray.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2006-12-23 143360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray] [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreeCall] [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gainward] C:\Program Files\Vtune\TBPanel.exe [2006-09-13 2154496] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2006-02-19 49152] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] C:\Program Files\Ahead\InCD\InCD.exe [2006-03-14 1397760] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LGODDFU] C:\Program Files\lg_fwupdate\fwupdate.exe [2007-09-02 249856] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2006-01-12 155648] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon] C:\WINDOWS\system32\NvCpl.dll [2006-08-11 7630848] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter] C:\WINDOWS\system32\NvMcTray.dll [2006-08-11 86016] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] nwiz.exe /install [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] C:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe [2004-11-02 32768] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel] C:\WINDOWS\SkyTel.EXE [2006-05-16 2879488] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe [2007-07-12 132496] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] C:\Program Files\Common Files\Real\Update_OB\realsched.exe [2007-11-03 185632] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch] C:\Program Files\DAEMON Tools SearchBar\Search.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearchWHSE] C:\Program Files\DAEMON Tools SearchBar\whse.exe [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] C:\PROGRA~1\HP\DIGITA~1\bin\hpqtra08.exe [2006-02-19 288472] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Photosmart Premier - Szybkie uruchomienie.lnk] C:\PROGRA~1\HP\DIGITA~1\bin\hpqthb08.exe -s [] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Last.fm Helper.lnk] C:\PROGRA~1\Last.fm\LASTFM~1.EXE [2008-01-08 106496] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] C:\PROGRA~1\MICROS~2\Office10\OSA.EXE [2001-02-13 83360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveAutoRun"= "NoDriveTypeAutoRun"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "D:\EEEEEEEEEEEEEEEEEE\eMule\emule.exe"="D:\EEEEEEEEEEEEEEEEEE\eMule\emule.exe:*:Enabled:emule" "C:\Program Files\Gadu-Gadu\gg.exe"="C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program główny" "C:\Program Files\Last.fm\LastFM.exe"="C:\Program Files\Last.fm\LastFM.exe:*:Enabled:Last.fm" "C:\Program Files\Azureus\Azureus.exe"="C:\Program Files\Azureus\Azureus.exe:*:Enabled:Azureus" "C:\Program Files\MarBit\ALLPlayer\ALLPlayer.exe"="C:\Program Files\MarBit\ALLPlayer\ALLPlayer.exe:*:Enabled:ALLPlayer V3.0" "C:\Program Files\NAPI-PROJEKT\napisy.exe"="C:\Program Files\NAPI-PROJEKT\napisy.exe:*:Enabled:www.napiprojekt.pl" "C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe:*:Enabled:hpqtra08.exe" "C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe:*:Enabled:hpqste08.exe" "C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpofxm08.exe:*:Enabled:hpofxm08.exe" "C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe"="C:\Program Files\HP\Digital Imaging\bin\hposfx08.exe:*:Enabled:hposfx08.exe" "C:\Program Files\HP\Digital Imaging\bin\hposid01.exe"="C:\Program Files\HP\Digital Imaging\bin\hposid01.exe:*:Enabled:hposid01.exe" "C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe" "C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe" "C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqCopy.exe:*:Enabled:hpqcopy.exe" "C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe"="C:\Program Files\HP\Digital Imaging\bin\hpfccopy.exe:*:Enabled:hpfccopy.exe" "C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpzwiz01.exe:*:Enabled:hpzwiz01.exe" "C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqPhUnl.exe:*:Enabled:hpqphunl.exe" "C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe"="C:\Program Files\HP\Digital Imaging\Unload\HpqDIA.exe:*:Enabled:hpqdia.exe" "C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe"="C:\Program Files\HP\Digital Imaging\bin\hpoews01.exe:*:Enabled:hpoews01.exe" "C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe"="C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe:*:Enabled:hpqnrs08.exe" "C:\Program Files\Bonjour\mDNSResponder.exe"="C:\Program Files\Bonjour\mDNSResponder.exe:*:Enabled:Bonjour" "C:\Program Files\VLC Media Player\vlc-0.8.6c\vlc.exe"="C:\Program Files\VLC Media Player\vlc-0.8.6c\vlc.exe:*:Enabled:VLC media player" "C:\Program Files\WapSter\AQQ\AQQ.exe"="C:\Program Files\WapSter\AQQ\AQQ.exe:*:Enabled:P2P AQQ" "C:\PROGRA~1\WapSter\AQQ\AQQ.exe"="C:\PROGRA~1\WapSter\AQQ\AQQ.exe:*:Enabled:P2P AQQ" "D:\eserver-16.40.i686-win32.exe"="D:\eserver-16.40.i686-win32.exe:*:Enabled:eserver-16.40.i686-win32" "C:\Program Files\WapSter\WapSter AQQ\AQQ.exe"="C:\Program Files\WapSter\WapSter AQQ\AQQ.exe:*:Enabled:AQQ" "C:\Documents and Settings\All Users\Dane aplikacji\NexonEU\NGM\NGM.exe"="C:\Documents and Settings\All Users\Dane aplikacji\NexonEU\NGM\NGM.exe:*:Enabled:Nexon Game Manager" "C:\Nexon\Combat Arms EU\CombatArms.exe"="C:\Nexon\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe" "C:\Nexon\Combat Arms EU\Engine.exe"="C:\Nexon\Combat Arms EU\Engine.exe:*Enabled:Engine.exe" "C:\Nexon\Combat Arms EU\NMService.exe"="C:\Nexon\Combat Arms EU\NMService.exe:*:Enabled:Nexon Messenger Core" "C:\Program Files\ChomikBox\ChomikBox.exe"="C:\Program Files\ChomikBox\ChomikBox.exe:*:Enabled:ChomikBox.exe" "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. Take a deep breath " "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Nexon\Combat Arms EU\CombatArms.exe"="C:\Nexon\Combat Arms EU\CombatArms.exe:*Enabled:CombatArms.exe" "C:\Nexon\Combat Arms EU\Engine.exe"="C:\Nexon\Combat Arms EU\Engine.exe:*Enabled:Engine.exe" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F] shell\AutoRun\command - F:\install.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\G] shell\AutoRun\command - G:\install.exe ======List of files/folders created in the last 1 months====== 2009-07-03 17:19:11 ----D---- C:\rsit 2009-07-03 17:18:42 ----A---- C:\Program Files\RSIT.exe 2009-07-03 15:35:11 ----D---- C:\Program Files\Trend Micro 2009-07-03 15:32:59 ----A---- C:\Program Files\HJTInstall.exe 2009-07-03 14:00:01 ----D---- C:\Program Files\Common Files\InstallShield 2009-07-03 13:27:30 ----D---- C:\WINDOWS\Prefetch 2009-07-03 13:23:18 ----HDC---- C:\WINDOWS\$NtUninstallKB960714$ 2009-07-03 13:22:47 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$ 2009-07-03 13:22:03 ----HDC---- C:\WINDOWS\$NtUninstallKB958215$ 2009-07-03 13:21:27 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$ 2009-07-03 13:20:54 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$ 2009-07-03 13:20:16 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$ 2009-07-03 13:19:51 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$ 2009-07-03 13:19:22 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$ 2009-07-03 13:18:33 ----HDC---- C:\WINDOWS\$NtUninstallKB956390$ 2009-07-03 13:17:58 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$ 2009-07-03 13:17:28 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$ 2009-07-03 13:16:54 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$ 2009-07-03 13:16:05 ----HDC---- C:\WINDOWS\$NtUninstallKB953838$ 2009-07-03 13:15:24 ----HDC---- C:\WINDOWS\$NtUninstallKB953155$ 2009-07-03 13:14:42 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$ 2009-07-03 13:13:56 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$ 2009-07-03 13:13:12 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$ 2009-07-03 13:12:21 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$ 2009-07-03 13:11:07 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$ 2009-07-03 13:10:13 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$ 2009-07-03 13:09:08 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$ 2009-07-03 13:08:06 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$ 2009-07-03 13:07:11 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$ 2009-07-03 13:06:15 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$ 2009-07-03 13:06:07 ----D---- C:\WINDOWS\LastGood.Tmp 2009-07-03 13:02:44 ----N---- C:\WINDOWS\system32\msxml6r.dll 2009-07-03 13:02:44 ----N---- C:\WINDOWS\system32\msxml6.dll 2009-07-03 13:02:41 ----N---- C:\WINDOWS\system32\ativtmxx.dll 2009-07-03 13:02:41 ----N---- C:\WINDOWS\system32\ati3duag.dll 2009-07-03 13:02:41 ----N---- C:\WINDOWS\system32\ati3d1ag.dll 2009-07-03 13:02:41 ----N---- C:\WINDOWS\system32\ati2dvag.dll 2009-07-03 13:02:41 ----N---- C:\WINDOWS\system32\ati2dvaa.dll 2009-07-03 13:02:41 ----N---- C:\WINDOWS\system32\ati2cqag.dll 2009-07-03 13:02:41 ----N---- C:\WINDOWS\system32\aaclient.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\eapsvc.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\eapqec.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\eappprxy.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\eapphost.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\eappgnui.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\eappcfg.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\eapp3hst.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\eapolqec.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\dot3ui.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\dot3svc.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\dot3msm.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\dot3dlg.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\dot3cfg.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\dot3api.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\dimsroam.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\dimsntfy.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\dhcpqec.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\credssp.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\bitsprx4.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\azroles.dll 2009-07-03 13:02:40 ----N---- C:\WINDOWS\system32\ativvaxx.dll 2009-07-03 13:02:39 ----N---- C:\WINDOWS\system32\kbdiultn.dll 2009-07-03 13:02:39 ----N---- C:\WINDOWS\system32\kbdbhc.dll 2009-07-03 13:02:39 ----N---- C:\WINDOWS\system32\hsfcisp2.dll 2009-07-03 13:02:38 ----N---- C:\WINDOWS\system32\msshavmsg.dll 2009-07-03 13:02:38 ----N---- C:\WINDOWS\system32\mssha.dll 2009-07-03 13:02:38 ----N---- C:\WINDOWS\system32\mmcperf.exe 2009-07-03 13:02:38 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll 2009-07-03 13:02:38 ----N---- C:\WINDOWS\system32\mmcex.dll 2009-07-03 13:02:38 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll 2009-07-03 13:02:38 ----N---- C:\WINDOWS\system32\mdmxsdk.dll 2009-07-03 13:02:38 ----N---- C:\WINDOWS\system32\l2gpstore.dll 2009-07-03 13:02:38 ----N---- C:\WINDOWS\system32\kmsvc.dll 2009-07-03 13:02:38 ----N---- C:\WINDOWS\system32\kbdpash.dll 2009-07-03 13:02:38 ----N---- C:\WINDOWS\system32\kbdnepr.dll 2009-07-03 13:02:37 ----N---- C:\WINDOWS\system32\slserv.exe 2009-07-03 13:02:37 ----N---- C:\WINDOWS\system32\slrundll.exe 2009-07-03 13:02:37 ----N---- C:\WINDOWS\system32\slgen.dll 2009-07-03 13:02:37 ----N---- C:\WINDOWS\system32\slextspk.dll 2009-07-03 13:02:37 ----N---- C:\WINDOWS\system32\slcoinst.dll 2009-07-03 13:02:37 ----N---- C:\WINDOWS\system32\setupn.exe 2009-07-03 13:02:37 ----N---- C:\WINDOWS\system32\s3gnb.dll 2009-07-03 13:02:37 ----N---- C:\WINDOWS\system32\rhttpaa.dll 2009-07-03 13:02:37 ----N---- C:\WINDOWS\system32\rasqec.dll 2009-07-03 13:02:37 ----N---- C:\WINDOWS\system32\qutil.dll 2009-07-03 13:02:37 ----N---- C:\WINDOWS\system32\qcliprov.dll 2009-07-03 13:02:37 ----N---- C:\WINDOWS\system32\qagentrt.dll 2009-07-03 13:02:37 ----N---- C:\WINDOWS\system32\qagent.dll 2009-07-03 13:02:37 ----N---- C:\WINDOWS\system32\photometadatahandler.dll 2009-07-03 13:02:37 ----N---- C:\WINDOWS\system32\onex.dll 2009-07-03 13:02:37 ----N---- C:\WINDOWS\system32\napstat.exe 2009-07-03 13:02:37 ----N---- C:\WINDOWS\system32\napmontr.dll 2009-07-03 13:02:37 ----N---- C:\WINDOWS\system32\napipsec.dll 2009-07-03 13:02:37 ----N---- C:\WINDOWS\system32\mtxparhd.dll 2009-07-03 13:02:36 ----N---- C:\WINDOWS\system32\windowscodecsext.dll 2009-07-03 13:02:36 ----N---- C:\WINDOWS\system32\windowscodecs.dll 2009-07-03 13:02:36 ----N---- C:\WINDOWS\system32\tspkg.dll 2009-07-03 13:02:36 ----N---- C:\WINDOWS\system32\tsgqec.dll 2009-07-03 13:02:35 ----N---- C:\WINDOWS\system32\wmphoto.dll 2009-07-03 13:02:35 ----N---- C:\WINDOWS\system32\wlanapi.dll 2009-07-03 13:02:35 ----N---- C:\WINDOWS\slrundll.exe 2009-07-03 13:02:34 ----D---- C:\WINDOWS\l2schemas 2009-07-03 13:02:33 ----D---- C:\WINDOWS\system32\pl 2009-07-03 13:02:33 ----D---- C:\WINDOWS\system32\bits 2009-07-03 13:00:28 ----D---- C:\WINDOWS\ServicePackFiles 2009-07-03 12:59:10 ----D---- C:\WINDOWS\network diagnostic 2009-07-03 12:58:10 ----A---- C:\WINDOWS\002694_.tmp 2009-07-03 12:56:23 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$ 2009-07-03 12:56:19 ----D---- C:\WINDOWS\EHome 2009-07-03 12:44:29 ----A---- C:\Program Files\WINDOWSXP-KB936929-SP3-X86-PLK.EXE 2009-07-02 22:19:37 ----A---- C:\WINDOWS\system32\rlmfc.dll 2009-07-02 22:13:14 ----A---- C:\Program Files\WindowsInstaller-KB893803-v2-x86.exe 2009-07-01 17:54:12 ----A---- C:\WINDOWS\system32\iconv.dll 2009-07-01 17:52:22 ----A---- C:\Program Files\ALLPlayerNew.exe 2009-06-18 11:54:23 ----D---- C:\Filmy 2009-06-09 11:15:31 ----SHD---- C:\found.003 2009-06-07 18:24:42 ----D---- C:\Program Files\Kyodai Mahjongg 2006 2009-06-04 14:50:32 ----SHD---- C:\WINDOWS\ftpcache ======List of files/folders modified in the last 1 months====== 2009-07-03 17:18:55 ----RD---- C:\Program Files 2009-07-03 17:18:52 ----D---- C:\Documents and Settings\Michał\Dane aplikacji\Azureus 2009-07-03 16:41:28 ----A---- C:\WINDOWS\NeroDigital.ini 2009-07-03 16:04:43 ----D---- C:\WINDOWS\Temp 2009-07-03 16:02:22 ----D---- C:\WINDOWS\system32 2009-07-03 15:49:52 ----D---- C:\Program Files\Mozilla Firefox 2009-07-03 15:35:05 ----D---- C:\Program Files\hijackthis 2009-07-03 14:00:01 ----D---- C:\Program Files\Common Files 2009-07-03 13:59:33 ----D---- C:\G R Y 2009-07-03 13:29:17 ----D---- C:\WINDOWS\system32\drivers 2009-07-03 13:28:58 ----D---- C:\WINDOWS\Debug 2009-07-03 13:28:58 ----D---- C:\WINDOWS 2009-07-03 13:28:29 ----A---- C:\WINDOWS\OEWABLog.txt 2009-07-03 13:28:07 ----D---- C:\WINDOWS\system32\CatRoot2 2009-07-03 13:27:33 ----A---- C:\WINDOWS\setuplog.txt 2009-07-03 13:26:54 ----D---- C:\WINDOWS\system32\wbem 2009-07-03 13:26:54 ----D---- C:\WINDOWS\system32\Setup 2009-07-03 13:26:54 ----D---- C:\WINDOWS\AppPatch 2009-07-03 13:26:53 ----D---- C:\WINDOWS\Fonts 2009-07-03 13:26:16 ----D---- C:\WINDOWS\security 2009-07-03 13:26:01 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-07-03 13:25:17 ----D---- C:\Documents and Settings\Michał\Dane aplikacji\foobar2000 2009-07-03 13:23:43 ----RSHDC---- C:\WINDOWS\system32\dllcache 2009-07-03 13:23:43 ----D---- C:\WINDOWS\system32\CatRoot 2009-07-03 13:23:17 ----D---- C:\WINDOWS\inf 2009-07-03 13:07:38 ----D---- C:\Program Files\Messenger 2009-07-03 13:02:48 ----D---- C:\WINDOWS\WinSxS 2009-07-03 13:02:43 ----D---- C:\WINDOWS\ime 2009-07-03 13:02:43 ----D---- C:\WINDOWS\Help 2009-07-03 13:02:35 ----D---- C:\WINDOWS\system32\pl-pl 2009-07-03 13:02:34 ----SHD---- C:\WINDOWS\Installer 2009-07-03 13:02:34 ----D---- C:\WINDOWS\system32\usmt 2009-07-03 13:02:34 ----D---- C:\Program Files\Internet Explorer 2009-07-03 13:02:33 ----D---- C:\WINDOWS\PeerNet 2009-07-03 13:02:33 ----D---- C:\Program Files\Movie Maker 2009-07-03 13:00:24 ----D---- C:\WINDOWS\system32\Restore 2009-07-03 13:00:24 ----D---- C:\WINDOWS\system32\npp 2009-07-03 13:00:23 ----D---- C:\WINDOWS\msagent 2009-07-03 13:00:21 ----D---- C:\WINDOWS\srchasst 2009-07-03 13:00:21 ----D---- C:\Program Files\NetMeeting 2009-07-03 13:00:20 ----D---- C:\WINDOWS\system32\Com 2009-07-03 13:00:19 ----D---- C:\Program Files\Windows NT 2009-07-03 13:00:19 ----D---- C:\Program Files\Windows Media Player 2009-07-03 13:00:19 ----D---- C:\Program Files\Outlook Express 2009-07-03 13:00:17 ----D---- C:\Program Files\Common Files\System 2009-07-03 13:00:05 ----D---- C:\WINDOWS\system32\oobe 2009-07-03 13:00:04 ----D---- C:\WINDOWS\system 2009-07-01 17:54:14 ----D---- C:\Program Files\ALLPlayer 2009-07-01 17:54:11 ----D---- C:\Program Files\NAPI-PROJEKT 2009-07-01 17:47:22 ----D---- C:\Program Files\IZArc 2009-07-01 17:42:38 ----D---- C:\Program Files\foobar2000 2009-06-18 15:16:50 ----D---- C:\dok ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 AmdK8;AMD Processor Driver; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2005-03-09 36352] R1 InCDPass;InCDPass; C:\WINDOWS\System32\DRIVERS\InCDPass.sys [2005-07-08 29696] R1 incdrm;InCD Reader; C:\WINDOWS\system32\drivers\incdrm.sys [2006-03-14 28672] R1 StarOpen;StarOpen; C:\WINDOWS\system32\drivers\StarOpen.sys [2006-07-24 5632] R1 Tcpip6;Sterownik protokołu IPv6 Microsoft; C:\WINDOWS\system32\DRIVERS\tcpip6.sys [2008-06-20 225856] R1 WS2IFSL;Środowisko wspomagające dostawcę usług innych niż IFS - Windows Socket 2.0; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2006-03-02 12032] R2 acedrv11;acedrv11; \??\C:\WINDOWS\system32\drivers\acedrv11.sys [] R2 BT848;BtCap, WDM Video Capture; C:\WINDOWS\system32\drivers\BT848.sys [2001-11-06 265512] R2 BTTUNER;BtTuner, WDM TvTuner; C:\WINDOWS\system32\drivers\BTTUNER.sys [2001-03-07 18944] R2 BTXBAR;BtXBar, WDM Crossbar; C:\WINDOWS\system32\drivers\BTXBAR.sys [1999-07-21 13308] R2 nvcap;nVidia WDM Video Capture (universal); C:\WINDOWS\system32\DRIVERS\nvcap.sys [2005-04-14 141582] R2 NVXBAR;nVidia WDM A/V Crossbar; C:\WINDOWS\system32\DRIVERS\NVxbar.sys [2005-04-14 16496] R2 NwlnkIpx;Protokół transportowy zgodny z NWLink IPX/SPX/NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys [2008-04-14 88320] R2 NwlnkNb;System NetBIOS NWLink; C:\WINDOWS\system32\DRIVERS\nwlnknb.sys [2006-03-02 63232] R2 NwlnkSpx;Protokół NWLink SPX/SPXII; C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys [2006-03-02 55936] R2 TBPanel;TBPanel; C:\WINDOWS\system32\drivers\TBPanel.sys [2002-07-27 5306] R3 GEARAspiWDM;GEARAspiWDM; C:\WINDOWS\System32\Drivers\GEARAspiWDM.sys [2006-09-19 15664] R3 HDAudBus;Sterownik magistrali Microsoft UAA dla High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-05-16 4275712] R3 mcdbus;Driver for MagicISO SCSI Host Controller; C:\WINDOWS\system32\DRIVERS\mcdbus.sys [2005-04-04 52992] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-08-11 3958496] R3 NVENETFD;NVIDIA nForce Networking Controller Driver; C:\WINDOWS\system32\DRIVERS\NVENETFD.sys [2006-03-22 52736] R3 nvnetbus;NVIDIA Network Bus Enumerator; C:\WINDOWS\system32\DRIVERS\nvnetbus.sys [2006-03-22 18944] R3 StillCam;Sterownik szeregowego cyfrowego aparatu fotograficznego; C:\WINDOWS\system32\DRIVERS\serscan.sys [2001-10-26 6912] R3 tunmp;Sterownik karty Microsoft Tun Miniport; C:\WINDOWS\system32\DRIVERS\tunmp.sys [2008-04-14 12288] R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208] R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520] R3 usbohci;Sterownik Miniport otwartego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-14 17152] R4 InCDfs;InCD File System; C:\WINDOWS\system32\drivers\InCDfs.sys [2005-07-08 99584] S3 a2twbxuw;a2twbxuw; C:\WINDOWS\system32\drivers\a2twbxuw.sys [] S3 ASPI;Advanced SCSI Programming Interface Driver; \??\C:\WINDOWS\System32\DRIVERS\ASPI32.sys [] S3 Cardex;Cardex; \??\C:\WINDOWS\system32\drivers\TBPANEL.SYS [] S3 CCDECODE;Dekoder napisów; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024] S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys [] S3 GMSIPCI;GMSIPCI; \??\E:\INSTALL\GMSIPCI.SYS [] S3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2006-04-13 49664] S3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2006-04-13 16496] S3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2006-04-13 21568] S3 MSICPL;MSICPL; \??\C:\Documents and Settings\Michał\Pulpit\install4\MSICPL.sys [] S3 MSTEE;Konwerter strumieni Tee/Sink-to-Sink Microsoft Streaming; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504] S3 NABTSFEC;Koder-dekoder NABTS/FEC VBI; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248] S3 NdisIP;Połączenie TV/wideo firmy Microsoft; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880] S3 NTACCESS;NTACCESS; \??\E:\NTACCESS.sys [] S3 pcouffin;VSO Software pcouffin; C:\WINDOWS\System32\Drivers\pcouffin.sys [2007-10-29 47360] S3 SE27bus;Sony Ericsson Device 039 Driver driver (WDM); C:\WINDOWS\system32\DRIVERS\SE27bus.sys [2006-09-18 61600] S3 SE27mdfl;Sony Ericsson Device 039 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\SE27mdfl.sys [2006-09-18 9360] S3 SE27mdm;Sony Ericsson Device 039 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\SE27mdm.sys [2006-09-18 97184] S3 SE27mgmt;Sony Ericsson Device 039 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\SE27mgmt.sys [2006-09-18 88688] S3 se27nd5;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (NDIS); C:\WINDOWS\system32\DRIVERS\se27nd5.sys [2006-09-18 18704] S3 SE27obex;Sony Ericsson Device 039 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\SE27obex.sys [2006-09-18 86560] S3 se27unic;Sony Ericsson Device 039 USB Ethernet Emulation SEMC39 (WDM); C:\WINDOWS\system32\DRIVERS\se27unic.sys [2006-09-18 90800] S3 service.sys;service.sys; \??\C:\WINDOWS\system32\service.sys [] S3 SetupNTGLM7X;SetupNTGLM7X; \??\E:\NTGLM7X.sys [] S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136] S3 ss_bus;SAMSUNG Mobile USB Device 1.0 driver (WDM); C:\WINDOWS\system32\DRIVERS\ss_bus.sys [2007-05-02 83592] S3 ss_mdfl;SAMSUNG Mobile USB Modem 1.0 Filter; C:\WINDOWS\system32\DRIVERS\ss_mdfl.sys [2007-05-02 15112] S3 ss_mdm;SAMSUNG Mobile USB Modem 1.0 Drivers; C:\WINDOWS\system32\DRIVERS\ss_mdm.sys [2007-05-02 109704] S3 streamip;BDA IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232] S3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128] S3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856] S3 usbscan;Sterownik skanera USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-14 15104] S3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368] S3 WSTCODEC;Kodery-dekodery teletekstu w standardzie światowym; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200] S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 6to4;Usługa Pomocnik IPv6; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336] R2 AASW2_Service;Ashampoo AntiSpyWare 2 Service; C:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe [2009-01-14 749400] R2 InCDsrv;InCD Helper; C:\Program Files\Ahead\InCD\InCDsrv.exe [2005-07-08 871424] R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files\Common Files\LightScribe\LSSrvc.exe [2006-10-19 61440] R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe [2001-02-23 270336] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-08-11 155715] R2 NwSapAgent;Agent SAP; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336] R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\system32\HPZipm12.exe [2007-02-21 73728] R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Program Files\CyberLink\Shared Files\RichVideo.exe [2005-08-07 167936] S3 aspnet_state;Usługa stanu ASP.NET; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768] S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-09-01 138168] S3 IDriverT;InstallDriver Table Manager; C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632] S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-01-05 774144] S3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2006-12-23 262144] S3 WMPNetworkSvc;Usługa udostępniania w sieci programu Windows Media Player; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-12-01 918016] S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336] -----------------EOF-----------------

**Posty:** 237 · przez **Kuba1** 03 Lip 2009, 17:41

Odinstaluj Daemon Tools Toolbar, Daemon Tools Search Bar oraz jeśli nie jest do niczego Ci potrzebny Easy Gif Animator Toolbar(chodź nie sądze, że jest Ci potrzebny bo pliku juz nie ma tylko folder) przez DODAJ/USUŃ programy, następnie

Wywal foldery:

C:\Program Files\DAEMON Tools Toolbar
C:\Program Files\DAEMON Tools SearchBar
C:\Program Files\Easy Gif Animator Extension

Otwórz notatnik i wklej w nim:

Windows Registry Editor Version 5.00

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearch]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WhenUSearchWHSE]

Plik > Zapisz jako > Zmień rozszerzenie z TXT na Wszystkie pliki > Zapisz pod nazwą FIX.REG

NIestety, to nie to powodowało Twoje problemy, radze przy instalacji programów obejść sie bez ToolBarów..

Mówisz, że przy instalacji gier jest odmowa dostępu, daj screen, i powiedz w którym momencie to sie dzieje.Mówimy cały czas o koncie administratora?
Co do błędu explorera, nie kojarzysz może czy nie zaczeło to sie dziac po instalacji jakiegos programu?

**Posty:** 5 · przez **ecz** 06 Lip 2009, 09:21

Screen błędu przy instalacji gier:

Co do błędu explorera, nie kojarzysz może czy nie zaczeło to sie dziac po instalacji jakiegos programu?

Niestety, nie pamietam czy zaczęło sie tak dziać po jakiejś instalacji

Nie było to wcześniej "zbyt uciążliwe" a stało się coraz bardziej. Szczególnie, że nie powinno tak być...
Tak, to konto administratora.

**Posty:** 18165 · przez **wojtas** 06 Lip 2009, 19:57

wejdz do konsoli odzyskiwania i wpisz

expand X:\i386\explorer.ex_ C:\WINDOWS\

a jak nie działa

expand X:\i386\explorer.ex_ C:\WINDOWS\explorer.exe

X - literka Twojego napedu..

i reset kompa

**Posty:** 5 · przez **ecz** 07 Lip 2009, 13:12

Cały czas to samo... :lipa:

..ale może cos źle robię --> w konsoli --> komenda

expand X:\i386\explorer.ex_ C:\WINDOWS\

--> zapytał czy zamienić explorer.exe --> Tak -->

"Zdekompresowano 1 plik"

--> restart kompa --> a explorer jak sie zamykał tak się zamyka. z pulpitu (skrót) w ogóle się dyski nie otwierają (C;D), tylko przez ppm --> Otwórz

takie buty...

edit:
..aha, dodam, że po zamknięciu się explorera wyskakuje tez okienko z błędem: drwtsn32.exe

**Posty:** 18165 · przez **wojtas** 07 Lip 2009, 19:13

Daj loga z combofixa ale zainstaluj wraz z nim konsolę odzyskiwania ( instrukcja programu )

**Posty:** 5 · przez **ecz** 07 Lip 2009, 20:48

Kod: Zaznacz wszystko: ComboFix 09-07-07.03 - Michał 2009-07-07 20:34.1 - NTFSx86 Uruchomiony z: D:\ComboFix.exe * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\Michał\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\Ashampoo AntiSpyWare 2.lnk . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_SERVICE.SYS -------\Service_service.sys ((((((((((((((((((((((((( Pliki utworzone od 2009-06-07 do 2009-07-07 ))))))))))))))))))))))))))))))) . 2009-07-07 15:47 . 2009-07-07 15:47 -------- d-----w- c:\program files\gmer 2009-07-07 14:19 . 2009-07-07 14:19 -------- d-----w- c:\program files\RegFreeze 2009-07-07 13:04 . 2004-08-04 00:44 1033728 ----a-w- c:\windows\explorer.exe 2009-07-06 07:13 . 2009-07-06 07:13 216 ----a-w- C:\FIX.REG 2009-07-03 15:19 . 2009-07-03 15:19 -------- d-----w- C:\rsit 2009-07-03 15:18 . 2009-07-03 15:18 781909 ----a-w- c:\program files\RSIT.exe 2009-07-03 13:35 . 2009-07-03 13:35 -------- d-----w- c:\program files\Trend Micro_hijack 2009-07-03 13:32 . 2009-07-03 13:32 812344 ----a-w- c:\program files\HJTInstall.exe 2009-07-03 12:00 . 2009-07-03 12:00 -------- d-----w- c:\program files\Common Files\InstallShield 2009-07-03 10:59 . 2008-04-14 20:50 4255 ------w- c:\windows\system32\drivers\adv01nt5.dll 2009-07-03 10:56 . 2009-07-03 10:56 -------- d-----w- c:\windows\EHome 2009-07-03 10:44 . 2009-07-03 10:48 322713128 ----a-w- c:\program files\WINDOWSXP-KB936929-SP3-X86-PLK.EXE 2009-07-02 20:19 . 2004-05-13 15:21 270336 ----a-w- c:\windows\system32\rlmfc.dll 2009-07-02 20:13 . 2009-07-02 20:13 2585872 ----a-w- c:\program files\WindowsInstaller-KB893803-v2-x86.exe 2009-07-01 15:54 . 2007-07-05 02:33 892928 ----a-w- c:\windows\system32\iconv.dll 2009-07-01 15:52 . 2009-07-01 15:52 6260040 ----a-w- c:\program files\ALLPlayerNew.exe 2009-06-18 09:54 . 2009-07-07 14:14 -------- d-----w- C:\Filmy 2009-06-09 09:15 . 2009-06-09 09:15 -------- d-sh--w- C:\found.003 . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-07 14:18 . 2007-11-16 20:35 -------- d-----w- c:\program files\DivX 2009-07-01 15:54 . 2008-11-26 17:13 -------- d-----w- c:\program files\ALLPlayer 2009-07-01 15:54 . 2007-10-29 14:24 -------- d-----w- c:\program files\NAPI-PROJEKT 2009-07-01 15:47 . 2007-09-03 11:21 -------- d-----w- c:\program files\IZArc 2009-07-01 15:42 . 2007-09-02 12:53 -------- d-----w- c:\program files\foobar2000 2009-06-07 18:25 . 2009-06-07 16:24 -------- d-----w- c:\program files\Kyodai Mahjongg 2006 2009-06-01 12:15 . 2007-08-30 14:43 -------- d--h--w- c:\program files\InstallShield Installation Information 2009-05-29 11:08 . 2007-09-17 12:57 -------- d-----w- c:\program files\Azureus 2009-05-19 11:00 . 2009-05-19 11:00 1878888 ----a-w- c:\program files\install_flash_player.exe 2009-05-15 15:53 . 2009-05-15 15:53 -------- d-----w- c:\program files\ConvertHelper 2009-01-30 13:00 . 2009-01-30 13:00 15892408 ----a-w- c:\program files\gimp-2.6.4-i686-setup_[www.programosy.pl].exe 2009-01-20 15:36 . 2009-01-20 15:36 7321032 ----a-w- c:\program files\daemon4303-lite.exe 2008-03-12 14:06 . 2008-03-12 14:04 20921040 ----a-w- c:\program files\AdbeRdr705_enu_full.exe 2008-03-10 11:30 . 2008-03-10 11:29 6663359 ----a-w- c:\program files\wma-to-mp3.exe 2008-03-04 18:06 . 2008-03-04 18:06 734592 ----a-w- c:\program files\ComboFix.exe 2008-01-03 21:45 . 2008-01-03 21:45 1059238 ----a-w- c:\program files\setup_magicdisc.exe 2007-12-27 22:30 . 2007-12-27 22:29 2632648 ----a-w- c:\program files\daemon4111-lite-x86.exe 2007-11-20 16:34 . 2007-11-20 16:33 3767595 ----a-w- c:\program files\WinAVI_Video_Converter_7_7_videoaudio.pl_.exe 2007-11-16 13:55 . 2007-11-16 13:55 2841064 ----a-w- c:\program files\Shockwave_Installer_Slim.exe 2007-11-10 09:36 . 2007-11-10 09:45 1891840 ----a-w- c:\program files\clip32.exe 2007-10-29 14:23 . 2007-10-29 14:23 1369622 ----a-w- c:\program files\napiprojekt1.0.5.0_(www.programs.pl).exe 2007-10-09 17:41 . 2007-10-09 17:41 2672152 ----a-w- c:\program files\SetupCloneCD5301.exe 2007-10-09 17:10 . 2007-10-09 17:10 921957 ----a-w- c:\program files\winimage61pl.exe 2007-10-03 14:44 . 2007-10-03 14:44 2863832 ----a-w- c:\program files\DeepBurner1.exe 2007-09-21 08:47 . 2007-09-21 08:47 3763031 ----a-w- c:\program files\ffdshow_rev1376_20070728_xxl.exe 2007-09-03 12:23 . 2007-09-03 12:23 1630151 ----a-w- c:\program files\Setup_AltoMP3Gold.exe 2007-09-03 11:21 . 2007-09-03 11:21 3723454 ----a-w- c:\program files\IZArc_Setup.exe 2007-09-01 21:17 . 2007-09-01 21:17 4346704 ----a-w- c:\program files\gg77.exe 2007-09-01 20:44 . 2007-09-01 20:44 4090448 ----a-w- c:\program files\LastFM_Win_1.3.1.1.exe 2004-10-01 13:00 . 2007-09-02 15:17 40960 ----a-w- c:\program files\Uninstall_CDS.exe 2003-04-21 12:09 . 2007-10-06 15:13 245408 ----a-w- c:\program files\unicows.dll 2002-03-11 09:06 . 2007-10-06 15:13 1822520 ----a-w- c:\program files\instmsiw.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-09-21 2119104] "ALLUpdate"="c:\program files\ALLPlayer\ALLUpdate.exe" [2009-06-04 869888] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-11 7630848] "Ashampoo AntiSpyWare 2 Guard"="c:\program files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe" [2009-01-14 2347352] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] c:\documents and settings\Micha\Menu Start\Programy\Autostart\ RegFreeze.lnk - c:\program files\RegFreeze\regfreeze.exe [2009-7-7 3591168] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Photosmart Premier - Szybkie uruchomienie.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\HP Photosmart Premier - Szybkie uruchomienie.lnk backup=c:\windows\pss\HP Photosmart Premier - Szybkie uruchomienie.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Last.fm Helper.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Last.fm Helper.lnk backup=c:\windows\pss\Last.fm Helper.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=c:\windows\pss\Microsoft Office.lnkCommon Startup HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CloneCDTray HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreeCall [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusOverride"=dword:00000001 "FirewallOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "d:\\EEEEEEEEEEEEEEEEEE\\eMule\\emule.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Last.fm\\LastFM.exe"= "c:\\Program Files\\Azureus\\Azureus.exe"= "c:\\Program Files\\NAPI-PROJEKT\\napisy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"= "c:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\Program Files\\VLC Media Player\\vlc-0.8.6c\\vlc.exe"= "c:\\Program Files\\WapSter\\WapSter AQQ\\AQQ.exe"= "c:\\Documents and Settings\\All Users\\Dane aplikacji\\NexonEU\\NGM\\NGM.exe"= "c:\\Program Files\\ChomikBox\\ChomikBox.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= R3 ASPI;Advanced SCSI Programming Interface Driver;c:\windows\System32\DRIVERS\ASPI32.sys [2002-07-17 16512] R3 SetupNTGLM7X;SetupNTGLM7X;E:\NTGLM7X.sys [x] S0 tffsport;M-Systems DiskOnChip 2000;c:\windows\system32\DRIVERS\tffsport.sys [2008-04-13 149376] S2 AASW2_Service;Ashampoo AntiSpyWare 2 Service;c:\program files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe [2009-01-14 749400] S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [2008-07-30 277736] S2 BT848;BtCap, WDM Video Capture;c:\windows\system32\drivers\BT848.sys [2001-11-06 265512] S2 BTTUNER;BtTuner, WDM TvTuner;c:\windows\system32\drivers\BTTUNER.sys [2001-03-07 18944] S2 BTXBAR;BtXBar, WDM Crossbar;c:\windows\system32\drivers\BTXBAR.sys [1999-07-21 13308] S2 NwSapAgent;Agent SAP;c:\windows\system32\svchost.exe [2008-04-14 14336] --- Inne Usługi/Sterowniki w Pamięci --- *Deregistered* - mchInjDrv . Zawartość folderu 'Zaplanowane zadania' . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.daemon-search.com/startpage uSearchMigratedDefaultURL = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 uInternet Settings,ProxyOverride = *.local uSearchURL,(Default) = hxxp://www.google.com/search?q=%s IE: Add to AMV Converter... - c:\program files\MP3 Player Utilities 4.07\AMVConverter\grab.html IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000 IE: MediaManager tool grab multimedia file - c:\program files\MP3 Player Utilities 4.07\MediaManager\grab.html IE: {{CDB280E8-BE43-4128-8A5A-3FCD094E2D88} - {CDB280E8-BE43-4128-8A5A-3FCD094E2D88} - c:\program files\RegFreeze\rfsearchhandler.dll Trusted Zone: com.pl\mks FF - ProfilePath - c:\documents and settings\Michał\Dane aplikacji\Mozilla\Firefox\Profiles\jwq88q3b.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.interia.pl FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=megaup&p= FF - plugin: c:\documents and settings\All Users\Dane aplikacji\NexonEU\NGM\npNxGameeu.dll FF - plugin: c:\documents and settings\All Users\Dane aplikacji\Zylom\ZylomGamesPlayer\npzylomgamesplayer.dll FF - plugin: c:\program files\Mozilla Firefox\plugins\npzylomgamesplayer.dll ---- FIREFOX - SPOSÓB POSTĘPOWANIA ---- c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.enforce_same_site_origin", false); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.cache_size", 51200); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.ogg.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.wave.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("media.autoplay.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("browser.urlbar.autocomplete.enabled", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("capability.policy.mailnews.*.wholeText", "noAccess"); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.storage.default_quota", 5120); c:\program files\Mozilla Firefox\greprefs\all.js - pref("content.sink.event_probe_rate", 3); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.http.prompt-temp-redirect", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.dpi", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("layout.css.devPixelsPerPx", -1); c:\program files\Mozilla Firefox\greprefs\all.js - pref("gestures.enable_single_finger_input", true); c:\program files\Mozilla Firefox\greprefs\all.js - pref("dom.max_chrome_script_run_time", 0); c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.tcp.sendbuffer", 131072); c:\program files\Mozilla Firefox\greprefs\all.js - pref("geo.enabled", true); c:\program files\Mozilla Firefox\greprefs\security-prefs.js - pref("security.remember_cert_checkbox_default_setting", true); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox-branding.js - pref("browser.search.param.yahoo-fr-cjkt", "moz35"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.restrict.typed", "~"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.urlbar.default.behavior", 0); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.clearOnShutdown.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.history", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.formdata", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.passwords", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.downloads", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cookies", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.cache", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.sessions", true); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.offlineApps", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.cpd.siteSettings", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("privacy.sanitize.migrateFx3Prefs", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror"); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false); c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("geo.wifi.uri", "https://www.google.com/loc/json"); . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-07 20:42 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1004) c:\program files\Ashampoo\Ashampoo AntiSpyWare 2\Guard.dll - - - - - - - > 'lsass.exe'(1068) c:\program files\Ashampoo\Ashampoo AntiSpyWare 2\Guard.dll - - - - - - - > 'explorer.exe'(1940) c:\program files\Ashampoo\Ashampoo AntiSpyWare 2\Guard.dll c:\windows\system32\WPDShServiceObj.dll c:\windows\system32\PortableDeviceTypes.dll c:\windows\system32\PortableDeviceApi.dll - - - - - - - > 'csrss.exe'(980) c:\program files\Ashampoo\Ashampoo AntiSpyWare 2\Guard.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\savedump.exe c:\program files\Ahead\InCD\InCDsrv.exe c:\program files\Common Files\LightScribe\LSSrvc.exe c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe c:\windows\system32\msiexec.exe c:\windows\system32\nvsvc32.exe c:\windows\system32\HPZipm12.exe c:\program files\CyberLink\Shared Files\RichVideo.exe . ************************************************************************** . Czas ukończenia: 2009-07-07 20:46 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-07-07 18:46 ComboFix2.txt 2008-03-05 11:37 Przed: 12 820 934 656 bajtów wolnych Po: 13 250 494 464 bajtów wolnych Current=1 Default=1 Failed=0 LastKnownGood=4 Sets=1,2,3,4 253 --- E O F --- 2009-01-13 16:43

**Posty:** 18165 · przez **wojtas** 09 Lip 2009, 20:39

1.Uruchom OTL z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
4. Wykonaj skan Dr. Web CureIt
5. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym (skasuj co znajdzie)

Malwarebytes Anti-Malware

Jeśli masz Adobe Reader to zaaktualizuj go do najnowszej wersji