prosze o sprawdzenie loga (wirus error cleaner..)

[kamiilto]

Witam. od paru dni mam dosc powazny problem. na pulpicie pokazały mi sie trzy magiczne ikonki Error Cleaner, Privacy Protector, Spyware&Malware Protection. Cały czas pokazuje sie systemowe ostrzeżenie o intruzie i informacja o stronie skad moge sciagnac antywisrusa. Blokowany byl menadzer zadan ale z nim sobie poradziłem. W menadzerze nic nie ma mi obcego. Niewiem co zrobic. Jeszcze jedno pyatnie, na dysku c jest systemowo ukrytu plik o nazwie pagefile.sys. Zajmuje ponad 780mb i niewiem co to. Mam Windows XP Pro. Podaje loga.z gory dziekuje

Logfile of HijackThis v1.99.1
Scan saved at 18:48:33, on 2007-12-15
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\WapSter\AQQ\AQQ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
C:\WINDOWS\SYSTEM32\taskmgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Kamil Tobiasz\Pulpit\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\pl-pl\msntb.dll
O3 - Toolbar: The bonsws - {7BF35567-E7C5-4646-8F65-41898BEF0637} - (no file)
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\pl-pl\msntb.dll
O3 - Toolbar: The retnsrp - {CC304A4D-FC79-4CD3-9A67-46E3AF59319D} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\WapSter\AQQ\AQQ.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uniblue SpyEraser] "C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" -m
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [Uniblue SpeedUpMyPC] C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: leorop - {DA4F0026-F34A-4449-938A-F8288506FE90} - C:\WINDOWS\leorop.dll

[Dzi@dek]

Popraw posta-log obejmij w tagi code lub quote.

[kamiilto]

Nie bardzo wiem co znaczy objąć w tagi..możesz mi wyjaśnić:)

[wojtas]

poprostu zaznacz myszka caly log i nacisnij quote lub code

wszystko o tagach jest tu:
http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

[Dzi@dek]

http://forum.programosy.pl/hijackthis-amp-silent-runners-gtobsuga-i-umieszczanie-vt9452.html

zaznaczasz w edycji log i klikasz na CODE z menu u góry.

[kamiilto]

Naprawde nie rozumiem chociaz czytalem ten poradnik dokladnie. Jak daje pierwsze polecenie scan otwiera mi tylko log zapisany w notatniku i koniec..nigdzie nie ma jakies code albo quote. naprawde jestem laikiem:)

[wojtas]

wklejasz log na forum i wtedy zaznaczasz myszka i dajesz code lub quote

tak jak tu:

[kamiilto]

Logfile of HijackThis v1.99.1
Scan saved at 19:44:11, on 2007-12-15
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\PROGRA~1\WapSter\AQQ\AQQ.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\WINDOWS\SYSTEM32\taskmgr.exe
C:\WINDOWS\explorer.exe
C:\Documents and Settings\Kamil Tobiasz\Pulpit\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - Default URLSearchHook is missing
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\pl-pl\msntb.dll
O3 - Toolbar: The bonsws - {7BF35567-E7C5-4646-8F65-41898BEF0637} - (no file)
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O3 - Toolbar: MSN - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.5000.1021\pl-pl\msntb.dll
O3 - Toolbar: The retnsrp - {CC304A4D-FC79-4CD3-9A67-46E3AF59319D} - (no file)
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\WapSter\AQQ\AQQ.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Uniblue SpyEraser] "C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" -m
O4 - HKCU\..\Run: [Uniblue RegistryBooster 2] C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe /S
O4 - HKCU\..\Run: [Uniblue SpeedUpMyPC] C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe -s
O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: leorop - {DA4F0026-F34A-4449-938A-F8288506FE90} - C:\WINDOWS\leorop.dll

[wojtas]

czy to caly log?


Wykonaj to co jest podane w tym temacie

zastosuj:

smitfraudfix z opcji 2
(sciagnij, wlacz nacisnij 2 i enter i czekaj )

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

[kamiilto]

Tak log jest cały. Sproboje to co napisales.dzieki

[ Dodano: Dzisiaj o 20:06 ]
Właczylem ten smitfraudfix i opcje 2. wyswietlil 3 pliki ktore nie moze usunac. BIT13.tmp ; Perflib_Perfdata_274.dat ; ~DF2E51. wszystko jest w ustawieniach lokalnych w temp. Program pyta sie mnie teraz czy wyczyścić rejestr?

[Dzi@dek]

Pobierz ATFCleaner i wyczyść wszystko ( zrób to w trybie awaryjnym - F8 przy starcie systemu )

Uruchom Hijackthis - scan - zaznacz podane wpisy V i daj na Fixchecked

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O3 - Toolbar: The bonsws - {7BF35567-E7C5-4646-8F65-41898BEF0637} - (no file)
O3 - Toolbar: The retnsrp - {CC304A4D-FC79-4CD3-9A67-46E3AF59319D} - (no file)

[kamiilto]

wyczyscil.przepraszam za glupote moja:D

[ Dodano: Dzisiaj o 20:43 ]
dziekuje za pomoc. wszystko ok tylko mam jeszcze dwa pytania. czy potrzebne jest nadal trzymanie na dysku tego programu SDFix?drugie to chodzi o ten plik..pagefile.sys. czemu on jest taki duzy i czy mozna go jakos ograniczyc?dziekuje

[Dzi@dek]

Katalog z sdfix możesz usunąć.

pagefile.sys - plik wymiany ( ilość Twojego RAM-u x 1,5 )
mój komputer -> właściwości -> zaawansowane -> wydajność -> ustawienia -> zaawansowane -> pamięć wirtualna

Daj log z combofix
http://www.programosy.pl/program,combofix.html

[kamiilto]

ComboFix 07-12-15.5 - Kamil Tobiasz 2007-12-15 20:58:18.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.167 [GMT 1:00]
Running from: C:\Documents and Settings\Kamil Tobiasz\Pulpit\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\system32\_000008_.tmp.dll
C:\WINDOWS\system32\rlls.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\nm


((((((((((((((((((((((((( Files Created from 2007-11-15 to 2007-12-15 )))))))))))))))))))))))))))))))
.

2007-12-15 20:21 . 2007-12-15 20:21 <DIR> d-------- C:\WINDOWS\ERUNT
2007-12-15 19:37 . 2007-12-15 19:37 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-15 17:33 . 2007-12-15 17:33 <DIR> d--hs---- C:\FOUND.002
2007-12-15 15:37 . 2007-12-15 15:37 <DIR> d-------- C:\Program Files\Uniblue
2007-12-15 15:37 . 2007-12-15 15:37 <DIR> d-------- C:\Documents and Settings\Kamil Tobiasz\Dane aplikacji\Uniblue
2007-12-15 15:37 . 2007-12-15 15:37 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Uniblue
2007-12-15 14:27 . 2007-12-15 14:27 <DIR> d-------- C:\Program Files\Kaspersky Lab
2007-12-15 01:44 . 2007-12-15 01:44 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Winamp
2007-12-15 01:23 . 2007-12-15 01:23 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\FastStone
2007-12-15 01:22 . 2007-12-15 01:22 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2007-12-15 01:22 . 2007-12-15 01:22 1,409 --a------ C:\WINDOWS\QTFont.for
2007-12-15 01:21 . 2007-12-15 01:21 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\Corel
2007-12-15 00:53 . 2007-12-15 00:53 <DIR> d-------- C:\Documents and Settings\Administrator\Dane aplikacji\ATI
2007-12-15 00:52 . 2005-12-07 04:22 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne
2007-12-15 00:52 . 2007-12-15 00:53 <DIR> dr------- C:\Documents and Settings\Administrator\Ulubione
2007-12-15 00:52 . 2005-12-07 04:22 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony
2007-12-15 00:52 . 2005-12-07 04:22 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit
2007-12-15 00:52 . 2007-12-15 00:53 <DIR> dr------- C:\Documents and Settings\Administrator\Moje dokumenty
2007-12-15 00:52 . 2005-12-07 04:22 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start
2007-12-15 00:52 . 2005-12-07 04:22 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji
2007-12-14 23:13 . 2007-12-14 23:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2007-12-14 22:51 . 2007-12-14 22:51 <DIR> d-------- C:\Program Files\SmartVideoCodec
2007-12-14 11:42 . 2007-12-14 11:42 <DIR> d-------- C:\Program Files\Red Storm Entertainment
2007-12-14 00:32 . 2007-12-14 00:32 <DIR> d-------- C:\Program Files\YouSendIt
2007-12-14 00:32 . 2007-12-14 00:32 <DIR> d-------- C:\Documents and Settings\Kamil Tobiasz\Dane aplikacji\YouSendIt
2007-12-13 19:38 . 2006-01-30 11:32 5,632 --a------ C:\WINDOWS\system32\pxc25pm.dll
2007-12-13 19:37 . 2004-12-07 09:11 258,352 --a------ C:\WINDOWS\system32\unicows.dll
2007-12-13 19:36 . 2007-12-13 19:36 <DIR> d-------- C:\Program Files\ABBYY PDF Transformer 2.0
2007-12-13 11:36 . 2007-12-13 11:36 <DIR> d-------- C:\Program Files\Samsung ML-2010 Series
2007-12-13 11:36 . 2005-03-14 06:01 766 --------- C:\WINDOWS\Uninstall.ico
2007-12-13 11:35 . 2005-03-03 05:32 151,552 --a------ C:\WINDOWS\system32\SSCoInst.exe
2007-12-13 11:35 . 2005-03-03 11:09 57,344 --a------ C:\WINDOWS\system32\SSCoInst.dll
2007-12-13 11:35 . 2005-04-08 03:29 20,622 --a------ C:\WINDOWS\system32\SUGS2LMK.DLL
2007-12-13 11:35 . 2005-03-03 12:23 604 --a------ C:\WINDOWS\system32\SUGS2LMK.SMT
2007-12-13 11:34 . 2007-12-13 11:34 <DIR> d-------- C:\WINDOWS\Samsung
2007-12-13 11:34 . 2005-03-14 06:01 208,896 --------- C:\WINDOWS\system32\SSRemove.exe
2007-12-13 11:34 . 2005-03-14 06:01 41,984 --------- C:\WINDOWS\system32\drivers\DGIVECP.SYS
2007-12-13 11:34 . 2005-07-08 21:54 11,502 --------- C:\WINDOWS\system32\SP119.ICO
2007-12-13 11:31 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-12-13 11:31 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\dllcache\usbprint.sys
2007-12-12 22:58 . 2007-12-12 22:58 <DIR> d-------- C:\Program Files\WapSter
2007-12-12 22:58 . 2007-12-12 22:58 <DIR> d-------- C:\Documents and Settings\Kamil Tobiasz\WapSter
2007-12-12 19:34 . 2007-12-12 19:34 <DIR> d-------- C:\Program Files\CyTaT
2007-12-11 22:28 . 2007-12-11 22:28 <DIR> d-------- C:\Program Files\Apple Software Update
2007-12-11 22:27 . 2007-12-11 22:27 <DIR> d-------- C:\Program Files\InterVideo Information Service
2007-12-11 22:27 . 2007-12-11 22:27 <DIR> d-------- C:\Program Files\Common Files\Ulead
2007-12-11 22:27 . 2006-05-11 18:41 654 --------- C:\WINDOWS\remove.iss
2007-12-11 21:16 . 2004-08-03 22:43 97,280 --a------ C:\WINDOWS\system32\dpcdll.dll.wga
2007-12-11 21:16 . 2001-08-23 11:00 29,338 --a------ C:\WINDOWS\system32\EULA.TXT.wga
2007-12-11 21:16 . 2004-08-03 22:42 24,064 --a------ C:\WINDOWS\system32\pidgen.dll.wga
2007-12-11 21:16 . 2007-12-11 21:16 13,588 --a------ C:\WINDOWS\system32\wpa.bak
2007-12-11 20:58 . 2007-12-11 20:58 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
2007-12-11 17:36 . 2007-12-11 17:36 <DIR> d--h----- C:\WINDOWS\system32\GroupPolicy
2007-12-11 16:26 . 2007-12-11 16:26 <DIR> d-------- C:\Documents and Settings\Kamil Tobiasz\Dane aplikacji\vlc
2007-12-11 16:25 . 2007-12-11 16:25 <DIR> d-------- C:\Program Files\VideoLAN
2007-12-11 15:47 . 2007-12-11 15:47 <DIR> d-------- C:\Program Files\Thoosje Sidebar V2.3
2007-12-11 14:28 . 2007-12-11 14:28 <DIR> d--hs---- C:\FOUND.001
2007-12-11 12:46 . 2007-12-11 12:46 <DIR> d-------- C:\WINDOWS\SWAT 4
2007-12-11 12:46 . 2007-12-11 12:46 <DIR> d-------- C:\Program Files\SWAT 4
2007-11-28 12:59 . 2007-11-28 12:59 <DIR> d-------- C:\Program Files\Activision Value
2007-11-28 12:34 . 2007-11-28 12:34 <DIR> d-------- C:\Program Files\No-IP
2007-11-28 11:45 . 2007-11-28 12:00 38 --a------ C:\WINDOWS\avisplitter.INI
2007-11-27 19:19 . 2007-11-27 19:19 <DIR> d-------- C:\Program Files\Common Files\Skype
2007-11-27 19:19 . 2007-11-27 19:19 <DIR> d-------- C:\Documents and Settings\Kamil Tobiasz\Dane aplikacji\skypePM
2007-11-27 19:19 . 2007-11-27 19:19 32 --a------ C:\Documents and Settings\All Users\Dane aplikacji\ezsid.dat
2007-11-27 18:38 . 2007-11-27 18:38 <DIR> d-------- C:\Program Files\MSN Apps
2007-11-25 22:46 . 2007-11-25 22:47 <DIR> d-------- C:\Documents and Settings\Kamil Tobiasz\Contacts
2007-11-25 22:36 . 2007-11-25 23:12 595 --ah----- C:\WINDOWS\system32\ws783973.ocx
2007-11-25 22:36 . 2007-11-25 23:12 595 --ah----- C:\os582744.bin
2007-11-25 22:04 . 2007-11-25 22:04 <DIR> d-------- C:\Program Files\MSN Messenger
2007-11-25 21:14 . 2007-11-25 21:14 <DIR> d-------- C:\WINDOWS\Vbox
2007-11-25 21:14 . 2007-11-25 21:14 <DIR> d-------- C:\Program Files\TI Education
2007-11-25 20:31 . 2007-11-25 20:31 <DIR> d-------- C:\Program Files\Executive Software
2007-11-25 17:26 . 2007-11-25 17:26 <DIR> d-------- C:\Program Files\Alwil Software
2007-11-25 10:32 . 2007-11-25 10:32 72 ---hs---- C:\desktop.ini
2007-11-24 12:12 . 2007-11-24 12:13 <DIR> d-------- C:\Program Files\The KMPlayer
2007-11-24 00:43 . 2007-11-24 00:43 <DIR> d-------- C:\Downloads
2007-11-24 00:14 . 2007-11-24 00:14 <DIR> d-------- C:\Program Files\Free Download Manager
2007-11-20 17:31 . 2007-10-29 18:02 706,512 -ra------ C:\WINDOWS\system32\drivers\cfosspeed.sys
2007-11-20 16:46 . 2007-11-20 16:47 <DIR> d-------- C:\Program Files\cFosSpeed
2007-11-20 16:46 . 2007-10-29 18:02 281,552 --a------ C:\WINDOWS\system32\cfosspeed.dll
2007-11-20 12:55 . 2007-11-20 12:55 <DIR> d-------- C:\Documents and Settings\Kamil Tobiasz\Dane aplikacji\F-Secure
2007-11-17 00:32 . 2007-11-17 13:06 3,120 --a------ C:\WINDOWS\MF_C425.lfa
2007-11-17 00:32 . 2007-11-17 13:06 3,120 --a------ C:\WINDOWS\MF_C421.lfa
2007-11-17 00:32 . 2007-11-17 13:06 3,120 --a------ C:\WINDOWS\MF_C420.lfa
2007-11-17 00:18 . 2007-11-17 00:18 <DIR> d-------- C:\Documents and Settings\Kamil Tobiasz\Dane aplikacji\Thunderbird
2007-11-16 15:52 . 2007-11-16 15:52 <DIR> d-------- C:\Documents and Settings\Kamil Tobiasz\Dane aplikacji\Media Player Classic
2007-11-16 01:11 . 2007-11-16 01:11 <DIR> d-------- C:\Documents and Settings\Kamil Tobiasz\Dane aplikacji\The Bat!
2007-11-15 01:39 . 2007-11-15 01:39 <DIR> d-------- C:\Program Files\Diskeeper Corporation
2007-11-15 00:41 . 2005-07-15 16:48 40,960 --a------ C:\WINDOWS\system32\ChCfg.exe
2007-11-15 00:39 . 2007-11-15 00:39 <DIR> d-------- C:\Program Files\Realtek AC97
2007-11-15 00:39 . 2005-10-04 14:11 18,776,064 --a------ C:\WINDOWS\system32\alsndmgr.cpl
2007-11-15 00:39 . 2005-10-04 16:27 10,459,648 --a------ C:\WINDOWS\system32\RTLCPL.exe
2007-11-15 00:39 . 2005-10-04 17:39 3,797,632 --a------ C:\WINDOWS\system32\drivers\alcxwdm.sys
2007-11-15 00:39 . 2005-08-12 18:40 307,200 --a------ C:\WINDOWS\alcupd.exe
2007-11-15 00:39 . 2005-09-09 16:39 212,992 --a------ C:\WINDOWS\alcrmv.exe
2007-11-15 00:39 . 2005-09-16 14:14 157,184 --a------ C:\WINDOWS\system32\RtlCPAPI.dll
2007-11-15 00:39 . 2002-02-05 13:54 141,016 --a------ C:\WINDOWS\system32\alsndmgr.wav
2007-11-15 00:39 . 2005-10-04 14:12 90,112 --a------ C:\WINDOWS\soundman.exe
2007-11-15 00:39 . 2001-07-06 00:19 164 --a------ C:\WINDOWS\avrack.ini

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-13 18:40 77,824 ----a-w C:\WINDOWS\system32\IEDFix.exe
2007-12-13 17:33 27,904 ----a-w C:\Documents and Settings\Kamil Tobiasz\Dane aplikacji\GDIPFONTCACHEV1.DAT
2007-12-11 14:26 219,648 ----a-w C:\WINDOWS\system32\uxtheme.dll
2007-12-11 14:26 219,648 ----a-w C:\WINDOWS\system32\dllcache\uxtheme.dll
2007-11-14 22:31 --------- d-----w C:\Program Files\Winamp Toolbar
2007-11-14 22:31 --------- d-----w C:\Program Files\Winamp Remote
2007-11-14 22:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2007-11-14 22:31 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2007-11-14 22:28 --------- d-----w C:\Documents and Settings\Kamil Tobiasz\Dane aplikacji\Winamp
2007-11-14 22:26 --------- d-----w C:\Documents and Settings\Kamil Tobiasz\Dane aplikacji\DivX
2007-11-14 22:25 --------- d-----w C:\Program Files\AC3Filter
2007-11-14 22:23 --------- d-----w C:\Program Files\DivX
2007-11-14 21:49 --------- d-----w C:\Program Files\Realtek Sound Manager
2007-11-14 21:49 --------- d-----w C:\Program Files\AvRack
2007-11-14 21:15 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\PC Drivers HeadQuarters
2007-11-14 20:49 --------- d-----w C:\Program Files\Gadu-Gadu
2007-11-14 20:33 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\MailFrontier
2007-11-14 07:28 450,560 ----a-w C:\WINDOWS\system32\dllcache\jscript.dll
2007-11-13 19:30 8,464 ----a-w C:\WINDOWS\system32\sporder.dll
2007-11-13 13:14 --------- d-----w C:\Program Files\Common Files\Stardock
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-12 23:50 --------- d-----w C:\Documents and Settings\Kamil Tobiasz\Dane aplikacji\GanymedeNet
2007-11-11 15:10 --------- d-----w C:\Documents and Settings\Kamil Tobiasz\Dane aplikacji\Samsung
2007-11-09 22:37 --------- d-----w C:\Program Files\Ganymede
2007-11-06 21:00 --------- d-----w C:\Program Files\Incomplete
2007-10-31 08:40 --------- d-----w C:\Documents and Settings\Kamil Tobiasz\Dane aplikacji\Publish Providers
2007-10-31 08:30 --------- d-----w C:\Documents and Settings\Kamil Tobiasz\Dane aplikacji\Sony
2007-10-31 08:28 --------- d-----w C:\Program Files\Vstplugins
2007-10-30 10:56 --------- d-----w C:\Program Files\F-Secure Internet Security
2007-10-30 10:35 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\fssg
2007-10-30 10:19 3,079,680 ----a-w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-29 22:44 1,291,264 ----a-w C:\WINDOWS\system32\dllcache\quartz.dll
2007-10-28 14:36 --------- d-----w C:\Program Files\iMesh Applications
2007-10-28 14:22 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
2007-10-28 14:22 --------- d-----w C:\Program Files\Real
2007-10-28 14:22 --------- d-----w C:\Program Files\Common Files\xing shared
2007-10-28 14:22 --------- d-----w C:\Program Files\Common Files\Real
2007-10-28 13:58 --------- d-----w C:\Program Files\LimeWire
2007-10-28 13:58 --------- d-----w C:\Documents and Settings\Kamil Tobiasz\Dane aplikacji\LimeWire
2007-10-28 07:48 --------- d-----w C:\Documents and Settings\Kamil Tobiasz\Dane aplikacji\Corel
2007-10-28 07:45 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Corel
2007-10-28 07:44 --------- d-----w C:\Program Files\Corel
2007-10-28 07:44 --------- d-----w C:\Program Files\Common Files\Corel
2007-10-25 16:57 8,483,328 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-25 08:28 222,720 ----a-w C:\WINDOWS\system32\dllcache\wmasf.dll
2007-10-20 18:33 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2007-10-20 18:33 139,264 ----a-w C:\WINDOWS\system32\UAService7.exe
2007-10-20 13:20 --------- d-----w C:\Program Files\D-Tools
2007-10-20 00:56 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-10-20 00:56 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-10-20 00:56 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-10-20 00:56 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2007-10-20 00:56 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2007-10-20 00:56 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2007-10-20 00:56 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-10-20 00:54 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-10-20 00:54 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-10-20 00:54 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-10-20 00:54 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-10-20 00:54 739,840 ----a-w C:\WINDOWS\system32\DivX.dll
2007-10-20 00:54 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-10-18 09:06 156,992 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-10-18 09:03 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-10-18 09:03 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-10-18 09:03 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-10-18 09:03 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-10-18 09:03 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-10-18 09:03 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-10-18 09:02 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
2007-10-16 00:03 --------- d-----w C:\Program Files\uTorrent
2007-10-11 06:14 96,768 ----a-w C:\WINDOWS\system32\dllcache\inseng.dll
2007-10-11 06:14 662,016 ----a-w C:\WINDOWS\system32\dllcache\wininet.dll
2007-10-11 06:14 616,448 ----a-w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-10-11 06:14 55,808 ----a-w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-10-11 06:14 532,480 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll
2007-10-11 06:14 474,112 ----a-w C:\WINDOWS\system32\dllcache\shlwapi.dll
2007-10-11 06:14 449,024 ----a-w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-10-11 06:14 39,424 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
2007-10-11 06:14 357,888 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
2007-10-11 06:14 251,392 ----a-w C:\WINDOWS\system32\dllcache\iepeers.dll
2007-10-11 06:14 205,312 ----a-w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-10-11 06:14 16,384 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-10-11 06:14 151,552 ----a-w C:\WINDOWS\system32\dllcache\cdfview.dll
2007-10-11 06:14 146,432 ----a-w C:\WINDOWS\system32\dllcache\msrating.dll
2007-10-11 06:14 1,494,528 ----a-w C:\WINDOWS\system32\dllcache\shdocvw.dll
2007-10-11 06:14 1,055,744 ----a-w C:\WINDOWS\system32\dllcache\danim.dll
2007-10-11 06:14 1,023,488 ----a-w C:\WINDOWS\system32\dllcache\browseui.dll
2007-10-10 11:16 18,432 ----a-w C:\WINDOWS\system32\dllcache\iedw.exe
2007-10-03 22:36 25,600 ----a-w C:\WINDOWS\system32\WS2Fix.exe
2004-03-11 12:27 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2007-10-04 21:06 1135968 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2007-10-04 21:06 1135968]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"AQQ"="C:\PROGRA~1\WapSter\AQQ\AQQ.exe" [2007-02-28 13:18]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:44]
"Uniblue SpyEraser"="C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe" [2007-12-10 12:22]
"Uniblue RegistryBooster 2"="C:\Program Files\Uniblue\RegistryBooster 2\RegistryBooster.exe" [2007-12-05 15:51]
"Uniblue SpeedUpMyPC"="C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe" [2007-12-10 12:22]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMan"="SOUNDMAN.EXE" [2005-10-04 14:12 C:\WINDOWS\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-03 22:44]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^ATI CATALYST – pasek zadań.lnk]
backup=C:\WINDOWS\pss\ATI CATALYST – pasek zadań.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^InterVideo WinCinema Manager.lnk]
backup=C:\WINDOWS\pss\InterVideo WinCinema Manager.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^NETGEAR WG111v2 Smart Wizard.lnk]
backup=C:\WINDOWS\pss\NETGEAR WG111v2 Smart Wizard.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^VIA RAID TOOL.lnk]
backup=C:\WINDOWS\pss\VIA RAID TOOL.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Kamil Tobiasz^Menu Start^Programy^Autostart^Stardock ObjectDock.lnk]
backup=C:\WINDOWS\pss\Stardock ObjectDock.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Kamil Tobiasz^Menu Start^Programy^Autostart^Thoosje Sidebar.lnk]
backup=C:\WINDOWS\pss\Thoosje Sidebar.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Kamil Tobiasz^Menu Start^Programy^Autostart^Thoosje Vista Sidebar.lnk]
backup=C:\WINDOWS\pss\Thoosje Vista Sidebar.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Kamil Tobiasz^Menu Start^Programy^Autostart^WordWeb.lnk]
backup=C:\WINDOWS\pss\WordWeb.lnkStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2007-10-10 19:51 39792 --a------ C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Anti-Blaxx Manager]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\APVXDWIN]
C:\Program Files\Panda Software\Panda Antivirus Platinum\APVXDWIN.EXE /s

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATICCC]
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe runtime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\cFosSpeed]
2007-10-29 18:02 850896 -ra------ C:\Program Files\cFosSpeed\cFosSpeed.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
2004-08-03 22:44 15360 --a------ C:\WINDOWS\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
C:\Program Files\D-Tools\daemon.exe -lang 1033

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DemonStarter]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DiskeeperSystray]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DownloadAccelerator]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Download Manager]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Upload Manager]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Free Uploader Oe Integration]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
C:\Program Files\Gadu-Gadu\gg.exe /tray

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail]
C:\PROGRA~1\INCRED~1\bin\IncMail.exe /c

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM]
C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe -scheduler

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe -start

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KAVPersonal50]
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus Personal\kav.exe /minimize

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Magentic]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
C:\Program Files\Messenger\msmsgs.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnappau]
C:\Program Files\MSN Apps\Updater\01.02.3000.1001\pl-pl\msnappau.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NI.UGA6P_0001_N122M2210]
C:\Documents and Settings\Kamil Tobiasz\Ustawienia lokalne\Temporary Internet Files\Content.IE5\8XLSH894\install_en
[1].exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Orb]
C:\Program Files\Winamp Remote\bin\OrbTray.exe /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PowerDVD]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Program Files\QuickTime\qttask.exe -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Samsung Common SM]
C:\WINDOWS\Samsung\ComSMMgr\ssmmgr.exe /autorun

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SCANINICIO]
C:\Program Files\Panda Software\Panda Antivirus Platinum\Inicio.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]
SOUNDMAN.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SsAAD.exe]
2007-02-05 10:11 476728 --a------ C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2007-07-12 04:00 132496 --a------ C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
C:\Program Files\Common Files\Real\Update_OB\realsched.exe -osboot

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent]
2007-10-10 06:28 36352 --a------ C:\Program Files\Winamp\winampa.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"kavsvc"=3 (0x3)
"iPodService"=3 (0x3)
"SSScsiSV"=3 (0x3)
"SPTISRV"=3 (0x3)
"PACSPTISVR"=3 (0x3)
"MSCSPTISRV"=3 (0x3)
"IDriverT"=3 (0x3)
"ATI Smart"=2 (0x2)
"TapiSrv"=3 (0x3)
"CLTNetCnService"=2 (0x2)
"SonicStage Back-End Service"=3 (0x3)
"helpsvc"=2 (0x2)
"LmHosts"=2 (0x2)
"sdCoreService"=3 (0x3)
"sdAuxService"=3 (0x3)
"SysmonLog"=3 (0x3)
"Eventlog"=2 (0x2)
"Diskeeper"=2 (0x2)
"BlueSoleil Hid Service"=2 (0x2)
"WMPNetworkSvc"=3 (0x3)
"UserAccess7"=2 (0x2)
"ServiceLayer"=3 (0x3)
"usnjsvc"=3 (0x3)
"ProtexisLicensing"=2 (0x2)
"ose"=3 (0x3)
"IviRegMgr"=2 (0x2)
"cFosSpeedS"=2 (0x2)
"Ati HotKey Poller"=2 (0x2)

R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys
R2 ithsgt;ithsgt;C:\WINDOWS\system32\DRIVERS\ithsgt.sys
R2 lilsgt;lilsgt;C:\WINDOWS\system32\DRIVERS\lilsgt.sys
S3 BTNetFilter;Bluetooth Network Filter;\??\C:\WINDOWS\system32\drivers\BTNetFilter.sys
S3 naecd;naecd;\??\C:\DOCUME~1\KAMILT~1\USTAWI~1\Temp\naecd.sys
S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\wg111v2.sys
S3 sony_ssm.sys;sony_ssm.sys;\??\C:\DOCUME~1\KAMILT~1\USTAWI~1\Temp\sony_ssm.sys
S3 sscdbus;SAMSUNG USB Composite Device driver (WDM);C:\WINDOWS\system32\DRIVERS\sscdbus.sys
S3 sscdmdfl;SAMSUNG CDMA Modem Filter;C:\WINDOWS\system32\DRIVERS\sscdmdfl.sys
S3 sscdmdm;SAMSUNG CDMA Modem Drivers;C:\WINDOWS\system32\DRIVERS\sscdmdm.sys

.
Contents of the 'Scheduled Tasks' folder
"2007-12-11 21:28:56 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2007-12-15 15:07:32 C:\WINDOWS\Tasks\Uniblue SpyEraser.job"
- C:\Program Files\Uniblue\SpyEraser\SpyEraser.exe
"2007-12-15 15:58:08 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
"2007-12-15 15:58:08 C:\WINDOWS\Tasks\Uniblue SpeedUpMyPC Nag.job"
- C:\Program Files\Uniblue\SpeedUpMyPC 3\SpeedUpMyPC.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-15 21:03:17
Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-15 21:04:41 - machine was rebooted
.
2007-12-11 20:48:06 --- E O F ---

[Dzi@dek]

FAT32x86

Nie zalecane aby na XP był system FAT32.

Możesz przekonwertować na NTFS komendą:

Start -> uruchom-> cmd [enter]
wpisujesz:
convert litera_dysku: /fs:ntfs

Aby na przykład konwertować dysk C do systemu NTFS, wpisz następujące polecenie:
convert c: /fs:ntfs [enter]

[kamiilto]

Wiem ja mialem stary dysk i zapomnialem go na NTFS zrobic. ale czy to nie grozi jakas utrata danych taka nagła zamiana?

[Dzi@dek]

ale czy to nie grozi jakas utrata danych taka nagła zamiana?

bez obaw - nic Ci nie zginie.