Proces svchost.exe obciążą pc

**Posty:** 436 · przez **raiylo** 17 Mar 2014, 18:35

Od pewnego czasu zauważyłem, że proces svchost.exe strasznie obciąża mój komputer. Wcześniej zdecydowanie nie było takiej sytuacji.
Skaner online eseta nic nie znalazł podobnie jak malwarebytes anti-malware. Zerknijcie na logi w miarę możliwości.

gmer

Kod: Zaznacz wszystko: GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2014-03-17 17:27:14 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 SAMSUNG_HD502HJ rev.1AJ10001 465,76GB Running: p47ttk8b.exe; Driver: C:\Users\TOMASZ~1\AppData\Local\Temp\pgxdyuow.sys ---- User code sections - GMER 2.1 ---- .text C:\Windows\SysWOW64\PnkBstrA.exe[2032] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000075481a22 2 bytes [48, 75] .text C:\Windows\SysWOW64\PnkBstrA.exe[2032] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000075481ad0 2 bytes [48, 75] .text C:\Windows\SysWOW64\PnkBstrA.exe[2032] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000075481b08 2 bytes [48, 75] .text C:\Windows\SysWOW64\PnkBstrA.exe[2032] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000075481bba 2 bytes [48, 75] .text C:\Windows\SysWOW64\PnkBstrA.exe[2032] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000075481bda 2 bytes [48, 75] .text C:\Windows\SysWOW64\PnkBstrA.exe[2032] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076331465 2 bytes [33, 76] .text C:\Windows\SysWOW64\PnkBstrA.exe[2032] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000763314bb 2 bytes [33, 76] .text ... * 2 .text C:\Program Files (x86)\AkashaNET\KDLink32.exe[2044] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076331465 2 bytes [33, 76] .text C:\Program Files (x86)\AkashaNET\KDLink32.exe[2044] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000763314bb 2 bytes [33, 76] .text ... * 2 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{7E5392CC-6914-4FE1-BE62-9EADD075A031}\Connection@Name 6TO4 Adapter Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\6To4\{7E5392CC-6914-4FE1-BE62-9EADD075A031}@InterfaceName Reusable Microsoft 6To4 Adapter Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\6To4\{7E5392CC-6914-4FE1-BE62-9EADD075A031}@ReusableType 1 Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{BC2865D4-62D4-403B-B71F-B393FDA28F3B}@InterfaceName Reusable ISATAP Interface {BC2865D4-62D4-403B-B71F-B393FDA28F3B} Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{BC2865D4-62D4-403B-B71F-B393FDA28F3B}@ReusableType 1 Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch@Epoch 3466 Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch2@Epoch 959 ---- EOF - GMER 2.1 ----

otl#1

Kod: Zaznacz wszystko: OTL logfile created on: 2014-03-17 17:29:31 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Tomasz Ostrowski\Downloads 64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.11.9600.16521) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 3,98 Gb Total Physical Memory | 1,88 Gb Available Physical Memory | 47,26% Memory free 7,96 Gb Paging File | 5,56 Gb Available in Paging File | 69,78% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 465,66 Gb Total Space | 408,71 Gb Free Space | 87,77% Space Free | Partition Type: NTFS Drive D: | 232,89 Gb Total Space | 227,93 Gb Free Space | 97,87% Space Free | Partition Type: NTFS Computer Name: TOMASZOSTROWSKI | User Name: Tomasz Ostrowski | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2014-03-17 17:14:13 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Tomasz Ostrowski\Downloads\OTL_[www.programosy.pl].exe PRC - [2014-03-15 01:50:42 | 000,859,976 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Chrome\Application\chrome.exe PRC - [2013-12-21 07:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2013-11-28 13:29:01 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe PRC - [2010-09-30 22:26:54 | 000,393,216 | ---- | M] (AMD) -- C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe PRC - [2009-02-15 23:04:10 | 000,964,608 | ---- | M] (QuestPRO Software) -- C:\Program Files (x86)\AkashaNET\KDLink32.exe PRC - [2000-01-01 01:00:00 | 000,365,376 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe PRC - [2000-01-01 01:00:00 | 000,277,824 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2014-03-15 01:50:40 | 013,637,448 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\PepperFlash\pepflashplayer.dll MOD - [2014-03-15 01:50:40 | 000,394,568 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ppGoogleNaClPluginChrome.dll MOD - [2014-03-15 01:50:38 | 004,061,000 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\pdf.dll MOD - [2014-03-15 01:50:35 | 000,716,616 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\libglesv2.dll MOD - [2014-03-15 01:50:34 | 000,100,168 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\libegl.dll MOD - [2014-03-15 01:50:32 | 001,647,432 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\ffmpegsumo.dll MOD - [2014-03-15 01:50:30 | 000,051,016 | ---- | M] () -- C:\Program Files (x86)\Google\Chrome\Application\33.0.1750.154\chrome_elf.dll MOD - [2014-02-11 20:29:20 | 000,093,696 | ---- | M] () -- C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll MOD - [2014-01-22 04:07:52 | 008,878,248 | ---- | M] () -- C:\PROGRA~2\MICROS~3\Office15\1033\GrooveIntlResource.dll MOD - [2010-09-30 22:26:28 | 000,090,112 | ---- | M] () -- C:\Program Files (x86)\ATI Technologies\HydraVision\HydraPlk.dll [color=#E56717]========== Services (SafeList) ==========[/color] SRV:[b]64bit:[/b] - [2014-03-01 05:33:34 | 000,111,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService) SRV:[b]64bit:[/b] - [2013-10-16 14:08:06 | 000,186,056 | ---- | M] (Sandboxie Holdings, LLC) [Auto | Stopped] -- C:\Program Files\Sandboxie\SbieSvc.exe -- (SbieSvc) SRV:[b]64bit:[/b] - [2013-10-08 13:52:58 | 000,239,616 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV:[b]64bit:[/b] - [2013-05-27 06:50:47 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV:[b]64bit:[/b] - [2012-06-19 19:10:34 | 000,634,632 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\iCLS Client\HeciServer.exe -- (Intel(R) SRV:[b]64bit:[/b] - [2009-07-14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt) SRV - [2014-01-27 20:02:50 | 000,571,816 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2013-12-21 07:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2013-11-28 13:29:01 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA) SRV - [2013-09-11 21:21:54 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009-06-10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2000-01-01 01:00:00 | 000,365,376 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) SRV - [2000-01-01 01:00:00 | 000,277,824 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV:[b]64bit:[/b] - [2014-01-05 18:45:30 | 000,193,024 | ---- | M] (Sandboxie Holdings, LLC) [Kernel | On_Demand | Stopped] -- C:\Program Files\Sandboxie\SbieDrv.sys -- (SbieDrv) DRV:[b]64bit:[/b] - [2013-10-08 14:58:42 | 012,534,784 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:[b]64bit:[/b] - [2013-10-08 13:27:46 | 000,619,008 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:[b]64bit:[/b] - [2013-10-02 03:22:20 | 000,056,832 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:[b]64bit:[/b] - [2013-07-05 09:40:38 | 000,096,256 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService) DRV:[b]64bit:[/b] - [2013-05-30 17:16:40 | 000,064,280 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGSHidFilt.Sys -- (LGSHidFilt) DRV:[b]64bit:[/b] - [2012-08-23 15:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport) DRV:[b]64bit:[/b] - [2012-03-01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:[b]64bit:[/b] - [2011-03-11 07:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:[b]64bit:[/b] - [2011-03-11 07:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:[b]64bit:[/b] - [2010-12-29 17:55:46 | 000,370,152 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmtxhci.sys -- (asmtxhci) DRV:[b]64bit:[/b] - [2010-12-29 17:55:44 | 000,122,856 | ---- | M] (ASMedia Technology Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\asmthub3.sys -- (asmthub3) DRV:[b]64bit:[/b] - [2010-11-20 14:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:[b]64bit:[/b] - [2010-08-24 10:55:43 | 000,076,912 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\L1C62x64.sys -- (L1C) DRV:[b]64bit:[/b] - [2009-11-24 02:38:00 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid) DRV:[b]64bit:[/b] - [2009-11-24 02:37:50 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum) DRV:[b]64bit:[/b] - [2009-07-14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:[b]64bit:[/b] - [2009-07-14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:[b]64bit:[/b] - [2009-07-14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:[b]64bit:[/b] - [2009-06-10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:[b]64bit:[/b] - [2009-06-10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:[b]64bit:[/b] - [2009-06-10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:[b]64bit:[/b] - [2009-06-10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:[b]64bit:[/b] - [2000-01-01 01:00:00 | 000,062,784 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) DRV:[b]64bit:[/b] - [2000-01-01 01:00:00 | 000,052,736 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rtnic64.sys -- (RTL8023x64) DRV - [2009-07-14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE:[b]64bit:[/b] - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:[b]64bit:[/b] - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-590654591-1791893692-2598469870-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://www.google.pl/ IE - HKU\S-1-5-21-590654591-1791893692-2598469870-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKU\S-1-5-21-590654591-1791893692-2598469870-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE11SR IE - HKU\S-1-5-21-590654591-1791893692-2598469870-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.51.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.51.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@microsoft.com/Lync,version=15.0: C:\Program Files (x86)\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office15\NPSPWRAP.DLL (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.22.5\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) [2013-11-15 03:32:00 | 000,034,072 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\mozilla firefox\plugins\npMeetingJoinPluginOC.dll [color=#E56717]========== Chrome ==========[/color] CHR - default_search_provider: Google (Enabled) CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:originalQueryForSuggestion}{google:assistedQueryStats}{google:searchFieldtrialParameter}{google:bookmarkBarPinned}{google:searchClient}{google:sourceId}{google:instantExtendedEnabledParameter}{google:omniboxStartMarginParameter}ie={inputEncoding} CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client={google:suggestClient}&gs_ri={google:suggestRid}&xssi=t&q={searchTerms}&{google:cursorPosition}{google:currentPageUrl}{google:pageClassification}sugkey={google:suggestAPIKeyParameter}, CHR - homepage: http://www.google.pl/ CHR - plugin: Error reading preferences file CHR - Extension: Media Hint = C:\Users\Tomasz Ostrowski\AppData\Local\Google\Chrome\User Data\Default\Extensions\anepbdekljkmmimmhbniglnnanmmkoja\0.2.1_0\ CHR - Extension: Dokumenty Google = C:\Users\Tomasz Ostrowski\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.5_0\ CHR - Extension: Dysk Google = C:\Users\Tomasz Ostrowski\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\6.3_0\ CHR - Extension: Steam Market Helper = C:\Users\Tomasz Ostrowski\AppData\Local\Google\Chrome\User Data\Default\Extensions\apllombccaabkkfimgdniojcbhmmglbk\2.61_0\ CHR - Extension: YouTube = C:\Users\Tomasz Ostrowski\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.6_0\ CHR - Extension: Battlefield Heroes = C:\Users\Tomasz Ostrowski\AppData\Local\Google\Chrome\User Data\Default\Extensions\cehdakiococlfmjcbebbkjkfjhbieknh\5.0.203.0_0\ CHR - Extension: Szukaj w Google = C:\Users\Tomasz Ostrowski\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.20_0\ CHR - Extension: AdBlock = C:\Users\Tomasz Ostrowski\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.6.18_0\ CHR - Extension: Google Wallet = C:\Users\Tomasz Ostrowski\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.6.1_0\ CHR - Extension: Gmail = C:\Users\Tomasz Ostrowski\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\ O1 HOSTS File: ([2014-02-24 15:49:29 | 000,450,709 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts O1 - Hosts: 127.0.0.1 www.007guard.com O1 - Hosts: 127.0.0.1 007guard.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 www.008k.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 www.00hq.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 www.032439.com O1 - Hosts: 127.0.0.1 032439.com O1 - Hosts: 127.0.0.1 www.0scan.com O1 - Hosts: 127.0.0.1 0scan.com O1 - Hosts: 127.0.0.1 1000gratisproben.com O1 - Hosts: 127.0.0.1 www.1000gratisproben.com O1 - Hosts: 127.0.0.1 1001namen.com O1 - Hosts: 127.0.0.1 www.1001namen.com O1 - Hosts: 127.0.0.1 100888290cs.com O1 - Hosts: 127.0.0.1 www.100888290cs.com O1 - Hosts: 127.0.0.1 www.100sexlinks.com O1 - Hosts: 127.0.0.1 100sexlinks.com O1 - Hosts: 127.0.0.1 10sek.com O1 - Hosts: 127.0.0.1 www.10sek.com O1 - Hosts: 127.0.0.1 www.1-2005-search.com O1 - Hosts: 127.0.0.1 1-2005-search.com O1 - Hosts: 127.0.0.1 123fporn.info O1 - Hosts: 15469 more lines... O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office15\URLREDIR.DLL (Microsoft Corporation) O2 - BHO: (Microsoft SkyDrive Pro Browser Helper) - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~2\MICROS~3\Office15\GROOVEEX.DLL (Microsoft Corporation) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O4:[b]64bit:[/b] - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.) O4:[b]64bit:[/b] - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\amd64\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-590654591-1791893692-2598469870-1000..\Run: [HydraVisionDesktopManager] C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM.exe (AMD) O4 - HKU\.DEFAULT..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 File not found O4 - HKU\S-1-5-18..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 File not found O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O8:[b]64bit:[/b] - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~4\Office15\EXCEL.EXE/3000 File not found O8:[b]64bit:[/b] - Extra context menu item: Wyślij &do programu OneNote - res://C:\PROGRA~2\MICROS~4\Office15\ONBttnIE.dll/105 File not found O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~2\MICROS~4\Office15\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Wyślij &do programu OneNote - res://C:\PROGRA~2\MICROS~4\Office15\ONBttnIE.dll/105 File not found O13[b]64bit:[/b] - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{302571F5-3AE7-4EE1-804C-5BAA7B89BC07}: NameServer = 178.212.120.5 208.67.222.222 O18 - Protocol\Handler\ms-help - No CLSID value found O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O34 - HKLM BootExecute: (autocheck autochk *) O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %* O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %* O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2014-03-17 15:26:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ESET [2014-03-12 16:57:49 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Silverlight [2014-03-12 16:57:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft Silverlight [2014-03-12 16:56:09 | 000,051,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll [2014-03-12 16:56:09 | 000,032,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2014-03-12 16:56:09 | 000,004,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll [2014-03-12 16:56:08 | 001,964,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2014-03-12 16:56:08 | 000,553,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll [2014-03-12 16:56:08 | 000,440,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2014-03-12 16:56:08 | 000,061,952 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2014-03-12 16:56:08 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll [2014-03-12 16:56:08 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll [2014-03-12 16:56:07 | 002,041,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2014-03-12 16:56:07 | 000,627,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2014-03-12 16:56:07 | 000,218,624 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe [2014-03-12 16:56:07 | 000,066,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll [2014-03-12 16:56:06 | 000,703,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll [2014-03-12 16:56:06 | 000,164,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll [2014-03-12 16:56:06 | 000,112,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2014-03-12 16:56:06 | 000,111,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe [2014-03-12 16:56:05 | 005,768,704 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2014-03-12 16:56:05 | 000,817,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll [2014-03-12 16:56:05 | 000,708,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll [2014-03-12 16:56:05 | 000,574,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2014-03-12 16:56:05 | 000,139,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2014-03-12 16:56:04 | 000,940,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe [2014-03-12 16:56:04 | 000,195,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll [2014-03-12 16:55:53 | 000,484,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wer.dll [2014-03-12 16:55:53 | 000,381,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wer.dll [2014-03-12 16:55:52 | 000,624,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\qedit.dll [2014-03-12 16:55:52 | 000,509,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\qedit.dll [2014-03-12 16:55:15 | 001,424,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\WindowsCodecs.dll [2014-03-12 13:11:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\XAMPP [2014-03-12 13:09:42 | 000,000,000 | ---D | C] -- C:\xampp [2014-02-27 12:19:18 | 000,000,000 | ---D | C] -- C:\Users\Tomasz Ostrowski\Documents\Custom Office Templates [2014-02-27 12:18:39 | 000,000,000 | --SD | C] -- C:\Users\Tomasz Ostrowski\Documents\My Data Sources [2014-02-26 11:49:28 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET [2014-02-26 11:33:01 | 006,574,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstscax.dll [2014-02-26 11:33:01 | 005,694,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstscax.dll [2014-02-24 15:58:14 | 000,000,000 | ---D | C] -- C:\Program Files\Defraggler [2014-02-24 15:52:37 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TsUsbGDCoInstaller.dll [2014-02-24 15:52:29 | 000,056,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys [2014-02-24 15:52:29 | 000,013,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TsUsbRedirectionGroupPolicyControl.exe [2014-02-24 15:52:29 | 000,012,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TsUsbRedirectionGroupPolicyExtension.dll [2014-02-24 15:52:27 | 001,147,392 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mstsc.exe [2014-02-24 15:52:27 | 001,068,544 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mstsc.exe [2014-02-24 15:52:27 | 000,420,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wksprt.exe [2014-02-24 15:52:27 | 000,083,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TSWbPrxy.exe [2014-02-24 15:52:27 | 000,062,976 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\tsgqec.dll [2014-02-24 15:52:27 | 000,056,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\MsRdpWebAccess.dll [2014-02-24 15:52:27 | 000,053,248 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\tsgqec.dll [2014-02-24 15:52:27 | 000,050,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\MsRdpWebAccess.dll [2014-02-24 15:52:27 | 000,018,944 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\wksprtPS.dll [2014-02-24 15:52:27 | 000,017,920 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\wksprtPS.dll [2014-02-24 15:52:26 | 001,057,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\rdvidcrl.dll [2014-02-24 15:52:26 | 000,855,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\rdvidcrl.dll [2014-02-24 15:51:57 | 001,030,144 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\TSWorkspace.dll [2014-02-24 15:51:57 | 000,792,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\TSWorkspace.dll [2014-02-18 11:52:17 | 000,000,000 | ---D | C] -- C:\Users\Tomasz Ostrowski\AppData\Local\Logitech [2014-02-18 11:51:38 | 000,018,960 | ---- | C] (Logitech, Inc.) -- C:\Windows\SysNative\drivers\LNonPnP.sys [2014-02-18 11:51:20 | 000,000,000 | ---D | C] -- C:\Program Files\Logitech Gaming Software [2014-02-18 11:50:31 | 000,000,000 | ---D | C] -- C:\Users\Tomasz Ostrowski\AppData\Roaming\Logitech [2014-02-18 11:50:31 | 000,000,000 | ---D | C] -- C:\Users\Tomasz Ostrowski\AppData\Roaming\Logishrd [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2014-03-17 17:13:28 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2014-03-17 17:13:28 | 000,010,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2014-03-17 17:08:08 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2014-03-17 17:07:37 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2014-03-17 17:07:34 | 3206,762,496 | -HS- | M] () -- C:\hiberfil.sys [2014-03-17 16:58:56 | 000,001,068 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2014-03-17 14:46:55 | 000,282,296 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2014-03-17 14:46:55 | 000,282,296 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe [2014-03-17 14:38:05 | 000,282,296 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0 [2014-03-15 17:01:56 | 000,002,189 | ---- | M] () -- C:\Users\Public\Desktop\Google Chrome.lnk [2014-03-12 17:03:48 | 000,441,864 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2014-03-11 15:21:53 | 001,669,190 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2014-03-11 15:21:53 | 000,740,098 | ---- | M] () -- C:\Windows\SysNative\perfh015.dat [2014-03-11 15:21:53 | 000,653,930 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2014-03-11 15:21:53 | 000,155,672 | ---- | M] () -- C:\Windows\SysNative\perfc015.dat [2014-03-11 15:21:53 | 000,121,802 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2014-03-01 06:16:26 | 000,004,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollectorres.dll [2014-03-01 05:52:55 | 000,066,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iesetup.dll [2014-03-01 05:51:59 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwproxystub.dll [2014-03-01 05:40:43 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\iernonce.dll [2014-03-01 05:37:12 | 000,574,976 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2014-03-01 05:33:52 | 000,139,264 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2014-03-01 05:33:34 | 000,111,616 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieetwcollector.exe [2014-03-01 05:32:59 | 000,708,608 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9diag.dll [2014-03-01 05:23:49 | 000,940,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\MsSpellCheckingFacility.exe [2014-03-01 05:17:43 | 000,218,624 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ie4uinit.exe [2014-03-01 05:02:07 | 000,195,584 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msrating.dll [2014-03-01 04:54:33 | 005,768,704 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2014-03-01 04:52:43 | 000,061,952 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iesetup.dll [2014-03-01 04:51:53 | 000,051,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieetwproxystub.dll [2014-03-01 04:43:28 | 000,032,768 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\iernonce.dll [2014-03-01 04:42:12 | 000,627,200 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\msfeeds.dll [2014-03-01 04:40:17 | 000,440,832 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2014-03-01 04:38:26 | 000,112,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2014-03-01 04:37:35 | 000,553,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript9diag.dll [2014-03-01 04:35:11 | 002,041,856 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2014-03-01 04:16:09 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\msrating.dll [2014-03-01 04:00:08 | 001,964,032 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2014-03-01 03:25:42 | 000,703,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysWow64\ieapfltr.dll [2014-03-01 03:25:22 | 000,817,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\SysNative\ieapfltr.dll [2014-02-26 19:38:56 | 000,002,008 | ---- | M] () -- C:\Windows\unins000.dat [2014-02-26 19:38:53 | 000,715,038 | ---- | M] () -- C:\Windows\unins000.exe [2014-02-24 16:00:17 | 000,000,085 | ---- | M] () -- C:\Windows\wininit.ini [2014-02-24 15:49:29 | 000,450,709 | R--- | M] () -- C:\Windows\SysNative\drivers\etc\hosts [2014-02-18 11:51:38 | 000,018,960 | ---- | M] (Logitech, Inc.) -- C:\Windows\SysNative\drivers\LNonPnP.sys [color=#E56717]========== Files Created - No Company Name ==========[/color] [2014-02-26 19:38:56 | 000,715,038 | ---- | C] () -- C:\Windows\unins000.exe [2014-02-26 19:38:56 | 000,216,064 | ---- | C] ( ) -- C:\Windows\SysWow64\lagarith.dll [2014-02-26 19:38:56 | 000,148,992 | ---- | C] ( ) -- C:\Windows\SysNative\lagarith.dll [2014-02-26 19:38:55 | 000,002,008 | ---- | C] () -- C:\Windows\unins000.dat [2014-02-24 16:00:15 | 000,000,085 | ---- | C] () -- C:\Windows\wininit.ini [2014-01-12 11:29:29 | 000,000,218 | ---- | C] () -- C:\Users\Tomasz Ostrowski\AppData\Local\recently-used.xbel [2013-12-23 16:11:34 | 000,006,424 | ---- | C] () -- C:\Windows\Sandboxie.ini [2013-11-30 12:13:32 | 000,000,404 | ---- | C] () -- C:\Windows\BRWMARK.INI [2013-11-30 12:13:32 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI [2013-11-28 13:20:03 | 000,282,296 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2013-11-28 13:20:01 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2013-11-28 12:42:18 | 001,640,860 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2013-11-27 20:11:15 | 000,000,414 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2013-11-27 20:06:30 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2013-10-08 14:39:08 | 000,995,342 | ---- | C] () -- C:\Windows\SysWow64\amdocl_as32.exe [2013-10-08 14:39:08 | 000,798,734 | ---- | C] () -- C:\Windows\SysWow64\amdocl_ld32.exe [2013-10-08 13:56:12 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat [2013-10-08 13:56:12 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat [2013-10-08 09:45:08 | 000,038,912 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll [2013-05-28 21:22:48 | 000,641,024 | ---- | C] () -- C:\Windows\SysWow64\ficvdec_x86.dll [2012-06-19 18:52:42 | 000,001,536 | ---- | C] () -- C:\Windows\SysWow64\IusEventLog.dll [color=#E56717]========== ZeroAccess Check ==========[/color] [2009-07-14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2013-07-26 03:24:57 | 014,172,672 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2013-07-26 02:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009-07-14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010-11-20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009-07-14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] [color=#E56717]========== LOP Check ==========[/color] [2014-02-10 22:08:16 | 000,000,000 | ---D | M] -- C:\Users\Tomasz Ostrowski\AppData\Roaming\Battle.net [2014-03-02 21:19:08 | 000,000,000 | ---D | M] -- C:\Users\Tomasz Ostrowski\AppData\Roaming\FileZilla [2014-03-17 17:05:05 | 000,000,000 | ---D | M] -- C:\Users\Tomasz Ostrowski\AppData\Roaming\foobar2000 [2013-11-28 15:24:00 | 000,000,000 | ---D | M] -- C:\Users\Tomasz Ostrowski\AppData\Roaming\LolClient [2014-02-01 19:35:44 | 000,000,000 | ---D | M] -- C:\Users\Tomasz Ostrowski\AppData\Roaming\Notepad++ [2014-01-25 13:29:33 | 000,000,000 | ---D | M] -- C:\Users\Tomasz Ostrowski\AppData\Roaming\Publish Providers [2013-11-28 14:01:08 | 000,000,000 | ---D | M] -- C:\Users\Tomasz Ostrowski\AppData\Roaming\Riot Games [2014-01-25 14:25:17 | 000,000,000 | ---D | M] -- C:\Users\Tomasz Ostrowski\AppData\Roaming\Sony [2014-03-17 00:05:31 | 000,000,000 | ---D | M] -- C:\Users\Tomasz Ostrowski\AppData\Roaming\TS3Client [2014-02-16 00:24:30 | 000,000,000 | ---D | M] -- C:\Users\Tomasz Ostrowski\AppData\Roaming\uTorrent [color=#E56717]========== Purity Check ==========[/color] < End of report >

otl#2 extras

Kod: Zaznacz wszystko: OTL Extras logfile created on: 2014-03-17 17:29:31 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Tomasz Ostrowski\Downloads 64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.11.9600.16521) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 3,98 Gb Total Physical Memory | 1,88 Gb Available Physical Memory | 47,26% Memory free 7,96 Gb Paging File | 5,56 Gb Available in Paging File | 69,78% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 465,66 Gb Total Space | 408,71 Gb Free Space | 87,77% Space Free | Partition Type: NTFS Drive D: | 232,89 Gb Total Space | 227,93 Gb Free Space | 97,87% Space Free | Partition Type: NTFS Computer Name: TOMASZOSTROWSKI | User Name: Tomasz Ostrowski | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) [HKEY_USERS\S-1-5-21-590654591-1791893692-2598469870-1000\SOFTWARE\Classes\<extension>] .html [@ = ChromeHTML] -- Reg Error: Key error. File not found [color=#E56717]========== Shell Spawning ==========[/color] [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation) CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error. [color=#E56717]========== Security Center Settings ==========[/color] [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 [b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] [color=#E56717]========== Firewall Settings ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "DisableNotifications" = 0 "EnableFirewall" = 1 [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] [color=#E56717]========== Vista Active Open Ports Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0FE96AD2-242D-402D-9F65-95EBFFB9174E}" = lport=56352 | protocol=6 | dir=in | name=pando media booster | "{2569AC57-CAEA-4BB3-9E9B-87BE7A5CB1DB}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office15\outlook.exe | "{981D9961-578B-4EC0-9639-55DF26E85AE9}" = lport=56352 | protocol=17 | dir=in | name=pando media booster | "{99CB4352-1328-4B70-9B63-75DF7FDD6B6E}" = lport=56352 | protocol=17 | dir=in | name=pando media booster | "{9F9FF647-7DED-42CE-85B5-4101BC79ACFB}" = lport=56352 | protocol=6 | dir=in | name=pando media booster | [color=#E56717]========== Vista Active Application Exception List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0D6298C6-42E5-4A0F-A5FE-09FD3E5A625E}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office15\ucmapi.exe | "{0F90B734-CA2B-416F-9603-8CC9C80F26CC}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | "{177C0361-072A-4EB0-A950-6F3BE21B0129}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.2689\agent.exe | "{2725B0AE-5533-4854-9D74-380206B822CF}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | "{28D37B1E-82F4-431F-83EE-F72762FA37E0}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | "{2DECC206-0D59-48A1-9FB8-DBB386235716}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | "{3152C80C-8458-47BF-AB89-018C31D35834}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe | "{3491742C-4140-4A44-B6B0-B152FFE0323A}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | "{34AD2613-57A0-4019-B8CC-21F7C52782DC}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | "{352AD65E-E9CC-4245-9F72-F2AD13078360}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\torchlight ii\modlauncher.exe | "{35DB0212-65D9-4060-81B2-18A6B94374E3}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | "{3AAEA8F4-B553-4F83-BB91-7931D5EE48B7}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.beta.2680\agent.exe | "{3CF3DCE9-97CD-44A5-9F1B-3D070C0F89FF}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.2717\agent.exe | "{407D0FC2-9399-4F1C-A86E-1470D9C27FDD}" = protocol=17 | dir=in | app=c:\program files (x86)\hearthstone\hearthstone.exe | "{441CCBF5-8587-49C0-AD1A-8EA16A1C3957}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office15\lync.exe | "{4D72955C-B304-4F9E-8FB1-AE02364DE144}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.beta.2737\agent.exe | "{5170A85C-0632-4AAA-BEFC-2D4A887EF5AC}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | "{564A7DB2-AF23-4A5B-8712-2ADF42F5A384}" = protocol=6 | dir=in | app=c:\program files (x86)\battle.net\battle.net.exe | "{5D70FF36-464C-4F9B-BBE1-34112B5813C9}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | "{5FA9EE8E-44E8-4E23-93A6-6E340AB0DEEA}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.2689\agent.exe | "{69EFFDC3-A4B8-4693-BA80-57A3816DB3C0}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | "{8E91032B-5149-456E-8785-5AC5DA0A8DFE}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office15\ucmapi.exe | "{91AEEF07-C6F8-4A2C-835A-2FB460ACE906}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | "{A3E495B6-3FC9-446B-978E-4CB86A5587B4}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | "{A681A611-89A6-4A5E-8ABC-6627A0207D8C}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | "{A99CE3E1-1B93-48FE-9F71-1FBF45656A58}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office15\lync.exe | "{AC55F0BB-FD08-4551-97B7-E71384A680B7}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | "{AF59AD9F-BB29-46B9-9420-1BED551E7682}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.beta.2680\agent.exe | "{B0811257-F6B4-4222-B400-BB9EB97B3D2D}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | "{B4200B9F-8DB6-4FCB-9A31-42C34EBB3DF1}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | "{B634DC85-730C-47DB-A88B-19A088F3076C}" = protocol=6 | dir=in | app=c:\users\tomasz ostrowski\appdata\roaming\utorrent\utorrent.exe | "{B89F923A-9A0D-4949-8F79-6273438D9243}" = protocol=17 | dir=in | app=c:\program files (x86)\battle.net\battle.net.exe | "{C123697D-B645-4A32-9212-9C05F2532DF9}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\torchlight ii\modlauncher.exe | "{C6385660-84A0-4EAA-9541-5C7AE8EB8CAB}" = protocol=17 | dir=in | app=c:\users\tomasz ostrowski\appdata\roaming\utorrent\utorrent.exe | "{C9DC2789-8AB5-4D58-A5E5-967C0F196500}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | "{CC0B7235-1637-4977-B066-828CC04F0F46}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.beta.2737\agent.exe | "{DAB4992A-58D7-4B41-AAA1-C06EEF885DF2}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe | "{DE7587DB-FD7D-4FAE-B4BA-926D993293E2}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | "{DEE328C1-516A-46A6-B441-2518AFAE6E82}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.2717\agent.exe | "{E4E8CA77-68AA-472E-81EB-FFB520B9FC62}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | "{FCB04BAC-B507-437E-9DC6-438E4A446D0E}" = protocol=6 | dir=in | app=c:\program files (x86)\hearthstone\hearthstone.exe | "TCP Query User{28445982-7295-41C3-8EB3-F0C26058744B}C:\xampp\filezillaftp\filezillaserver.exe" = protocol=6 | dir=in | app=c:\xampp\filezillaftp\filezillaserver.exe | "TCP Query User{7083325A-16DD-4F7E-A008-A3C0A638ABF2}C:\program files (x86)\java\jre7\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\java.exe | "TCP Query User{B5F286E1-8794-48EE-A2BB-B748BCCC7122}C:\xampp\mysql\bin\mysqld.exe" = protocol=6 | dir=in | app=c:\xampp\mysql\bin\mysqld.exe | "TCP Query User{F52C3DBD-6EA1-4A2C-8CDD-6327098D53AD}C:\xampp\apache\bin\httpd.exe" = protocol=6 | dir=in | app=c:\xampp\apache\bin\httpd.exe | "TCP Query User{FDF89875-6343-4D8B-900E-855FEAACE2A6}C:\program files (x86)\ea games\battlefield heroes\bfheroes.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ea games\battlefield heroes\bfheroes.exe | "UDP Query User{736FC401-38D3-468E-BCC9-B2EBA160CFB1}C:\program files (x86)\java\jre7\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\java.exe | "UDP Query User{7E93B728-71D0-4AA7-BCD0-D314D8814C8D}C:\xampp\mysql\bin\mysqld.exe" = protocol=17 | dir=in | app=c:\xampp\mysql\bin\mysqld.exe | "UDP Query User{A4CF671A-96CF-47BF-9277-AA743D2148B0}C:\xampp\filezillaftp\filezillaserver.exe" = protocol=17 | dir=in | app=c:\xampp\filezillaftp\filezillaserver.exe | "UDP Query User{B88C36D9-7F23-48EB-9C04-9F343B419EBA}C:\program files (x86)\ea games\battlefield heroes\bfheroes.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ea games\battlefield heroes\bfheroes.exe | "UDP Query User{CA912A74-FE85-4959-92A2-709D2986ACDD}C:\xampp\apache\bin\httpd.exe" = protocol=17 | dir=in | app=c:\xampp\apache\bin\httpd.exe | [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219 "{391ED0B2-B886-A6D0-B1A6-C25A7FE5B452}" = ATI AVIVO64 Codecs "{45F1F774-38B4-3CC3-BAAF-051E6D19E48E}" = Microsoft .NET Framework 4.5.1 (PLK) "{4F8A27CA-6788-7965-3259-5C3B9C37FCD8}" = ATI Problem Report Wizard "{5AE0838D-19B1-5D12-5FE8-E6503B2C8716}" = AMD Catalyst Install Manager "{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 "{690285C2-2481-44FB-8402-162EA970A6DD}" = Logitech Gaming Software "{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64) "{7DEBE4EB-6B40-3766-BB35-5CBBC385DA37}" = Microsoft .NET Framework 4.5.1 "{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 "{83ED5086-5D6B-698F-5CD4-2F631DA8FD69}" = AMD Drag and Drop Transcoding "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{90150000-0011-0000-1000-0000000FF1CE}" = Microsoft Office Professional Plus 2013 "{90150000-0015-0409-1000-0000000FF1CE}" = Microsoft Access MUI (English) 2013 "{90150000-0016-0409-1000-0000000FF1CE}" = Microsoft Excel MUI (English) 2013 "{90150000-0018-0409-1000-0000000FF1CE}" = Microsoft PowerPoint MUI (English) 2013 "{90150000-0019-0409-1000-0000000FF1CE}" = Microsoft Publisher MUI (English) 2013 "{90150000-001A-0409-1000-0000000FF1CE}" = Microsoft Outlook MUI (English) 2013 "{90150000-001B-0409-1000-0000000FF1CE}" = Microsoft Word MUI (English) 2013 "{90150000-001F-0409-1000-0000000FF1CE}" = Microsoft Office Proofing Tools 2013 - English "{90150000-001F-040C-1000-0000000FF1CE}" = Outils de vérification linguistique 2013 de Microsoft Office - Français "{90150000-001F-0C0A-1000-0000000FF1CE}" = Microsoft Office Proofing Tools 2013 - Español "{90150000-002C-0409-1000-0000000FF1CE}" = Microsoft Office Proofing (English) 2013 "{90150000-0044-0409-1000-0000000FF1CE}" = Microsoft InfoPath MUI (English) 2013 "{90150000-006E-0409-1000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2013 "{90150000-0090-0409-1000-0000000FF1CE}" = Microsoft DCF MUI (English) 2013 "{90150000-00A1-0409-1000-0000000FF1CE}" = Microsoft OneNote MUI (English) 2013 "{90150000-00BA-0409-1000-0000000FF1CE}" = Microsoft Groove MUI (English) 2013 "{90150000-00C1-0000-1000-0000000FF1CE}" = Microsoft Office 32-bit Components 2013 "{90150000-00C1-0409-1000-0000000FF1CE}" = Microsoft Office Shared 32-bit MUI (English) 2013 "{90150000-00E1-0409-1000-0000000FF1CE}" = Microsoft Office OSM MUI (English) 2013 "{90150000-00E2-0409-1000-0000000FF1CE}" = Microsoft Office OSM UX MUI (English) 2013 "{90150000-0115-0409-1000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2013 "{90150000-0117-0409-1000-0000000FF1CE}" = Microsoft Access Setup Metadata MUI (English) 2013 "{90150000-012B-0409-1000-0000000FF1CE}" = Microsoft Lync MUI (English) 2013 "{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5.1 "{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1045" = Microsoft .NET Framework 4.5.1 (Polski) "{977D1ABF-4089-4CA7-BA33-CC75808B7ACE}" = Intel® Trusted Connect Service Client "{A2CB1ACB-94A2-32BA-A15E-7D80319F7589}" = Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.50727 "{AC53FC8B-EE18-3F9C-9B59-60937D0B182C}" = Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.50727 "{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64) "{ADCB5F9E-EF88-6D61-EE2F-99F51DF1B6EF}" = AMD Media Foundation Decoders "{BD422D00-5232-11E3-A6F3-F04DA23A5C58}" = Vegas Pro 12.0 (64-bit) "{C2B8CBDE-5232-11E3-B494-F04DA23A5C58}" = MSVCRT Redists "{E57289A3-B314-F00A-F0D0-7CB63E588CFF}" = AMD Accelerated Video Transcoding "{FEB22B7A-7B05-4A49-3BA3-D24815D37FAE}" = ccc-utility64 "CCleaner" = CCleaner "Defraggler" = Defraggler "Logitech Gaming Software" = Logitech Gaming Software 8.51 "Office15.PROPLUS" = Microsoft Office Professional Plus 2013 "Sandboxie" = Sandboxie 4.06 (64-bit) "TeamSpeak 3 Client" = TeamSpeak 3 Client "WinRAR archiver" = WinRAR 5.00 (64-bit) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{07BFA98D-6DB0-6D9C-95D5-7EF347AF587B}" = HydraVision "{0F5AEBB0-43F3-4571-ACE7-A7942E8AA179}" = Microsoft Application Compatibility Toolkit 5.6 "{15134cb0-b767-4960-a911-f2d16ae54797}" = Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.50727 "{170236F2-1F88-A116-DA64-3FEED17B9387}" = CCC Help Italian "{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1 "{2178EDD8-A3A6-50E3-407B-6629EA8E6ECE}" = AMD Catalyst Control Center "{22154f09-719a-4619-bb71-5b3356999fbf}" = Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.50727 "{2624B969-7135-4EB1-B0F6-2D8C397B45F7}_is1" = MPC-HC 1.7.1 "{26A24AE4-039D-4CA4-87B4-2F83217045FF}" = Java 7 Update 51 "{2F73A7B2-E50E-39A6-9ABC-EF89E4C62E36}" = Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.50727 "{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver "{32957F2B-A371-151F-9DA1-7BCA54BA2C71}" = CCC Help Danish "{398004A7-6198-B8AB-443A-D250FFA57446}" = CCC Help Greek "{3A29665B-2304-A9F7-601D-86340BD29D57}" = CCC Help Korean "{4310E447-8AF3-020C-06D0-CB317D1BC92B}" = CCC Help Spanish "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4DF0CAAC-F479-1673-EE92-03FFB9A05C1A}" = CCC Help English "{50D47CE8-9C16-42D1-A8D8-B143B22E232A}" = Belkin Desktop PCI Card Driver "{5DE67937-45D5-45E4-923C-0B7F7EC929A7}" = League of Legends "{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components "{6670AE0A-83FD-C514-C4EC-51618BEDCF04}" = Catalyst Control Center InstallProxy "{6DD76706-759A-1D77-9D1B-39FFFEC203BE}" = CCC Help Hungarian "{6DF3C5B5-AEA5-198E-289C-CAADC4A17C04}" = CCC Help Dutch "{6F9B3984-08EB-19EE-5E93-E79FD0854596}" = CCC Help Czech "{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable "{82DA3D5E-0041-D8F7-6ACD-53A06C863FD4}" = CCC Help Swedish "{88B2ABCF-9C00-47C1-8FC4-369B98845DD7}" = Catalyst Control Center - Branding "{8DC910CD-8EE3-4ffc-A4EB-9B02701059C4}" = Battlefield Heroes "{8E63AD00-6BEB-9E98-739E-C8EE42CF0419}" = CCC Help Norwegian "{9584BE1B-2FBE-4F45-13EA-6567F3E2D9A2}" = CCC Help Chinese Traditional "{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster "{993609E5-B0A7-0270-BA78-385016D5A4FA}" = CCC Help Chinese Standard "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{9C50B767-48BA-A567-0CFE-31620AE8FC97}" = CCC Help German "{9E94C6F8-2B4E-D900-E73C-E7BCC7653188}" = CCC Help Japanese "{A5457401-D56A-43F2-9524-78E54A7FC07A}" = SlimDrivers "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AC76BA86-7AD7-1045-7B44-AB0000000001}" = Adobe Reader XI (11.0.06) - Polish "{BEFD4139-C684-DBF8-33F2-7963161E2F10}" = CCC Help Russian "{CFBC3C9F-C781-4A0A-4AC9-BEBDE9850C16}" = CCC Help Turkish "{D17BE572-CBFB-2AA4-759B-E21F04093001}" = CCC Help Thai "{D3C44AE6-7A77-6CB3-0708-C970C53E8136}" = Catalyst Control Center Localization All "{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}" = Microsoft XNA Framework Redistributable 4.0 Refresh "{E4FB0B39-C991-4EE7-95DD-1A1A7857D33D}" = Asmedia ASM104x USB 3.0 Host Controller Driver "{E9E87CFE-894C-8FFB-31C2-61C6B640F2B2}" = CCC Help Finnish "{E9F63F5F-00EF-516C-C7F6-ABD3DC174B5E}" = CCC Help Polish "{EA3960CB-883C-5B18-FA85-7C36C320E4BC}" = Catalyst Control Center Graphics Previews Common "{ED62231A-B71D-C39A-7CE0-B2C8388A67C2}" = CCC Help French "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F59AC46C-10C3-4023-882C-4212A92283B3}_is1" = Lagarith Lossless Codec (1.3.27) "{FBC9A8BD-C74D-86B3-7818-D584C9174F48}" = CCC Help Portuguese "{FDB30193-FDA0-3DAA-ACCA-A75EEFE53607}" = Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.50727 "{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 "AkashaNET" = AkashaNET 1.27 "Battle.net" = Battle.net "Dxtory2.0_is1" = Dxtory version 2.0.122 "ESET Online Scanner" = ESET Online Scanner v3 "FileZilla Client" = FileZilla Client 3.7.4.1 "foobar2000" = foobar2000 v1.2.9 "Google Chrome" = Google Chrome "Hearthstone" = Hearthstone "League of Legends 3.0.1" = League of Legends "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware wersja 1.75.0.1300 "Notepad++" = Notepad++ "PunkBusterSvc" = PunkBuster Services "Steam" = Steam "Steam App 200710" = Torchlight II "Steam App 730" = Counter-Strike: Global Offensive "uGet_VGI_is1" = uGet version 2.0.8 "xampp" = XAMPP [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-21-590654591-1791893692-2598469870-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "uTorrent" = µTorrent [color=#E56717]========== Last 20 Event Log Errors ==========[/color] [ Application Events ] Error - 2014-03-14 07:11:51 | Computer Name = TomaszOstrowski | Source = Windows Search Service | ID = 7042 Description = Error - 2014-03-14 07:11:51 | Computer Name = TomaszOstrowski | Source = Windows Search Service | ID = 9002 Description = Error - 2014-03-14 07:11:51 | Computer Name = TomaszOstrowski | Source = Windows Search Service | ID = 3029 Description = Error - 2014-03-14 07:11:51 | Computer Name = TomaszOstrowski | Source = Windows Search Service | ID = 3029 Description = Error - 2014-03-14 07:11:51 | Computer Name = TomaszOstrowski | Source = Windows Search Service | ID = 3028 Description = Error - 2014-03-14 07:11:51 | Computer Name = TomaszOstrowski | Source = Windows Search Service | ID = 3058 Description = Error - 2014-03-14 07:11:51 | Computer Name = TomaszOstrowski | Source = Windows Search Service | ID = 7010 Description = Error - 2014-03-17 10:26:32 | Computer Name = TomaszOstrowski | Source = SideBySide | ID = 16842832 Description = Nie można wygenerować kontekstu aktywacji dla „C:\Users\Tomasz Ostrowski\Downloads\esetsmartinstaller_plk.exe”. Błąd w pliku manifestu lub w pliku zasad „” w wierszu . Wersja składnika wymagana przez aplikację powoduje konflikt z inną wersją składnika, która jest już aktywna. Składniki powodujące konflikt: Składnik 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Składnik 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Error - 2014-03-17 11:48:32 | Computer Name = TomaszOstrowski | Source = SideBySide | ID = 16842832 Description = Nie można wygenerować kontekstu aktywacji dla „C:\Users\Tomasz Ostrowski\Downloads\esetsmartinstaller_plk.exe”. Błąd w pliku manifestu lub w pliku zasad „” w wierszu . Wersja składnika wymagana przez aplikację powoduje konflikt z inną wersją składnika, która jest już aktywna. Składniki powodujące konflikt: Składnik 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest. Składnik 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest. Error - 2014-03-17 12:04:18 | Computer Name = TomaszOstrowski | Source = VSS | ID = 8194 Description = [ Media Center Events ] Error - 2014-02-09 06:37:12 | Computer Name = TomaszOstrowski | Source = MCUpdate | ID = 0 Description = 11:37:05 - Błąd podczas nawiązywania połączenia z Internetem. 11:37:05 - Nie można skontaktować się z serwerem.. Error - 2014-02-13 05:53:16 | Computer Name = TomaszOstrowski | Source = MCUpdate | ID = 0 Description = 10:53:16 - Błąd podczas nawiązywania połączenia z Internetem. 10:53:16 - Nie można skontaktować się z serwerem.. Error - 2014-02-13 05:53:49 | Computer Name = TomaszOstrowski | Source = MCUpdate | ID = 0 Description = 10:53:22 - Błąd podczas nawiązywania połączenia z Internetem. 10:53:22 - Nie można skontaktować się z serwerem.. Error - 2014-03-02 07:27:01 | Computer Name = TomaszOstrowski | Source = MCUpdate | ID = 0 Description = 12:27:01 - Błąd podczas nawiązywania połączenia z Internetem. 12:27:01 - Nie można skontaktować się z serwerem.. Error - 2014-03-08 07:37:26 | Computer Name = TomaszOstrowski | Source = MCUpdate | ID = 0 Description = 12:37:26 - Błąd podczas nawiązywania połączenia z Internetem. 12:37:26 - Nie można skontaktować się z serwerem.. Error - 2014-03-08 07:37:37 | Computer Name = TomaszOstrowski | Source = MCUpdate | ID = 0 Description = 12:37:31 - Błąd podczas nawiązywania połączenia z Internetem. 12:37:31 - Nie można skontaktować się z serwerem.. Error - 2014-03-12 06:53:01 | Computer Name = TomaszOstrowski | Source = MCUpdate | ID = 0 Description = 11:53:01 - Błąd podczas nawiązywania połączenia z Internetem. 11:53:01 - Nie można skontaktować się z serwerem.. Error - 2014-03-12 06:53:12 | Computer Name = TomaszOstrowski | Source = MCUpdate | ID = 0 Description = 11:53:06 - Błąd podczas nawiązywania połączenia z Internetem. 11:53:06 - Nie można skontaktować się z serwerem.. Error - 2014-03-14 07:13:08 | Computer Name = TomaszOstrowski | Source = MCUpdate | ID = 0 Description = 12:13:08 - Błąd podczas nawiązywania połączenia z Internetem. 12:13:08 - Nie można skontaktować się z serwerem.. Error - 2014-03-14 07:13:24 | Computer Name = TomaszOstrowski | Source = MCUpdate | ID = 0 Description = 12:13:13 - Błąd podczas nawiązywania połączenia z Internetem. 12:13:13 - Nie można skontaktować się z serwerem.. [ System Events ] Error - 2014-03-16 13:43:18 | Computer Name = TomaszOstrowski | Source = SbieSvc | ID = 16851986 Description = SBIE9234 Service startup error level 9153 status=C0000428 error=-1073740760 Error - 2014-03-16 15:05:48 | Computer Name = TomaszOstrowski | Source = SbieSvc | ID = 16851986 Description = SBIE9234 Service startup error level 9153 status=C0000428 error=-1073740760 Error - 2014-03-16 15:06:33 | Computer Name = TomaszOstrowski | Source = Server | ID = 2505 Description = Serwer nie mógł utworzyć powiązania do transportu \Device\NetBT_Tcpip_{302571F5-3AE7-4EE1-804C-5BAA7B89BC07}, ponieważ inny komputer w sieci ma tę samą nazwę. Nie można uruchomić serwera. Error - 2014-03-16 15:11:08 | Computer Name = TomaszOstrowski | Source = SbieSvc | ID = 16851986 Description = SBIE9234 Service startup error level 9153 status=C0000428 error=-1073740760 Error - 2014-03-17 06:56:36 | Computer Name = TomaszOstrowski | Source = SbieSvc | ID = 16851986 Description = SBIE9234 Service startup error level 9153 status=C0000428 error=-1073740760 Error - 2014-03-17 06:58:36 | Computer Name = TomaszOstrowski | Source = Server | ID = 2505 Description = Serwer nie mógł utworzyć powiązania do transportu \Device\NetBT_Tcpip_{302571F5-3AE7-4EE1-804C-5BAA7B89BC07}, ponieważ inny komputer w sieci ma tę samą nazwę. Nie można uruchomić serwera. Error - 2014-03-17 07:04:17 | Computer Name = TomaszOstrowski | Source = Disk | ID = 262155 Description = Sterownik wykrył błąd kontrolera na \Device\Harddisk2\DR2. Error - 2014-03-17 07:22:26 | Computer Name = TomaszOstrowski | Source = Disk | ID = 262155 Description = Sterownik wykrył błąd kontrolera na \Device\Harddisk2\DR4. Error - 2014-03-17 12:06:05 | Computer Name = TomaszOstrowski | Source = SbieSvc | ID = 16851986 Description = SBIE9234 Service startup error level 9153 status=C0000428 error=-1073740760 Error - 2014-03-17 12:07:54 | Computer Name = TomaszOstrowski | Source = SbieSvc | ID = 16851986 Description = SBIE9234 Service startup error level 9153 status=C0000428 error=-1073740760 < End of report >

**Posty:** 4765 · przez **ordynat** 17 Mar 2014, 22:22

W logach nie ma niczego podejrzanego.

Kosmetyka:
Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej to:

:OTL
O4 - HKU\.DEFAULT..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 File not found
O4 - HKU\S-1-5-18..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"http://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 File not found

:Commands
[emptytemp]

Kliknij w Wykonaj Skrypt.

**Posty:** 436 · przez **raiylo** 17 Mar 2014, 22:37

Kod: Zaznacz wszystko: All processes killed ========== OTL ========== Registry value HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SPReview deleted successfully. Registry value HKEY_USERS\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\RunOnce\\SPReview not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: Public User: Tomasz Ostrowski ->Temp folder emptied: 34973 bytes ->Temporary Internet Files folder emptied: 2190519 bytes ->Java cache emptied: 2097069 bytes ->Google Chrome cache emptied: 348872164 bytes ->Flash cache emptied: 494 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32 (64bit) .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 300 bytes %systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 43257594 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 378,00 mb OTL by OldTimer - Version 3.2.69.0 log created on 03172014_212405 Files\Folders moved on Reboot... C:\Users\Tomasz Ostrowski\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully. C:\Users\Tomasz Ostrowski\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully. PendingFileRenameOperations files... Registry entries deleted on Reboot...

pamietam kiedys przy sprawdzaniu logow mialem wyczyscic wszystkie bzdety jak temp i inne takim lekkim programikiem z niebieska ikona kosza

pamietacie jak sie nazywal bo byl prosty ale efektywny i sie przydawal zeby od czasu do czasu wyczyscic bajzel

/edit
patrze tak sobie i nigdy tak nie bylo ze po starcie systemu cos mi zjada 1,5gb ramu z dupala, co to za cholerstwo moze byc ze zaraz po starcie systemu procesy wygladaja tak:
//

**Posty:** 4765 · przez **ordynat** 17 Mar 2014, 22:47

Sprawdź, czy w Trybie Awaryjnym 9(F8 przed startem Systemu) jest tak samo?

Jeśli w Trybie Awaryjnym nie będzie problemu, to usuniesz 80% swoich programów, zostawisz tylko najniezbędniejsze.
.

**Posty:** 436 · przez **raiylo** 17 Mar 2014, 23:10

svchost w trybie awarujne z logicznego powodu jest wporzo
ale pamiec ram ciagle zuzycie ponad 1gb ;/

**Posty:** 4765 · przez **ordynat** 17 Mar 2014, 23:17

Aha, czyli komputer jest zepsuty.
Na to Ci nic nie doradzę.

.