Wirus atakujący połaczenie z internetem?

**Posty:** 143 · przez **Cipher** 26 Sie 2011, 17:12

Odrazu link do tematu załozonego wczesniej:
firefoxowi-odbija-vt128033.html
pozniej antywirus wykrył mi coś i przesunął to do kwarantanny, nastepnie całkowicie przestało działac mi połaczenie z internetem (probowałem we wszystkich przegladarkach, u dostawcy netu wszystko ok, w ogóle widziałem na komputerze ze wszystko jest połaczone etc a nie działało), po ponownym uruchomieniu komputera po samo plus przy starcie pulpity dwie informacje ze cos stało sie w katalogu temp.

wszystko wrocilo (tj. znow z netem wszystko ok) do normy gdy uzylem przywracania systemu o jeden dzien. no ale jestem na 99% pewny ze problem wroci. prosze o pomoc i rady.

**Posty:** 2183 · przez **NieWiem** 26 Sie 2011, 17:16

A słyszałeś kiedyś takie hasło jak LOGI?
obowiazkowe-zasady-wstawiania-logow-wazne-vt117887.html

Autor postu otrzymał pochwałę

**Posty:** 143 · przez **Cipher** 26 Sie 2011, 18:52

usunałem deamona i sptd ale przy próbie uruchomienia Gmera pojawia się blue screen (nie jestem w stanei pzreczytac o co konkretnei chodzi) i nastepuje reset.

**Posty:** 18165 · przez **wojtas** 26 Sie 2011, 19:00

spróbuj w trybie awaryjnym, jeśli nie daj logi z OTL...

Autor postu otrzymał pochwałę

**Posty:** 143 · przez **Cipher** 26 Sie 2011, 19:00

Tutaj z OTL:

Kod: Zaznacz wszystko: OTL logfile created on: 2011-08-26 18:54:17 - Run 1 OTL by OldTimer - Version 3.2.26.5 Folder = C:\Documents and Settings\adm\Moje dokumenty\Pobieranie Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 2,00 Gb Total Physical Memory | 1,55 Gb Available Physical Memory | 77,35% Memory free 3,85 Gb Paging File | 3,55 Gb Available in Paging File | 92,25% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS.0 | %ProgramFiles% = C:\Program Files Drive C: | 149,04 Gb Total Space | 13,39 Gb Free Space | 8,99% Space Free | Partition Type: NTFS Computer Name: SDF-4CFC9C4B323 | User Name: adm | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2011-08-26 18:53:21 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\adm\Moje dokumenty\Pobieranie\OTL.exe PRC - [2011-08-26 17:12:02 | 000,183,296 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\dwm.exe PRC - [2011-08-26 17:11:40 | 000,188,416 | ---- | M] () -- C:\Documents and Settings\adm\Ustawienia lokalne\Temp\csrss.exe PRC - [2011-08-26 17:11:19 | 000,179,200 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\Microsoft\conhost.exe PRC - [2011-08-12 11:02:21 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2011-05-01 10:35:23 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe PRC - [2011-02-08 21:51:52 | 001,114,040 | ---- | M] (MusicLab, LLC) -- C:\Program Files\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe PRC - [2011-01-31 14:31:24 | 000,273,544 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe PRC - [2010-08-02 16:09:55 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe PRC - [2010-07-29 12:20:16 | 000,238,952 | ---- | M] (Teruten) -- C:\WINDOWS.0\system32\FsUsbExService.Exe PRC - [2010-07-29 12:17:08 | 000,095,576 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe PRC - [2008-06-16 02:02:00 | 000,135,168 | ---- | M] (Vimicro Corporation) -- C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe PRC - [2008-04-14 21:21:40 | 000,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS.0\system32\savedump.exe PRC - [2008-04-14 21:21:18 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS.0\explorer.exe PRC - [2007-04-23 19:19:50 | 002,165,536 | ---- | M] (Palit Microsystems, Inc.) -- C:\Program Files\VDOTool\TBPANEL.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2011-08-26 17:12:02 | 000,183,296 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\dwm.exe MOD - [2011-08-26 17:11:40 | 000,188,416 | ---- | M] () -- C:\Documents and Settings\adm\Ustawienia lokalne\Temp\csrss.exe MOD - [2011-08-26 17:11:19 | 000,179,200 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\Microsoft\conhost.exe MOD - [2011-08-12 11:02:21 | 001,846,232 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll MOD - [2010-06-17 15:27:22 | 000,355,688 | ---- | M] () -- C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll MOD - [2008-04-14 21:20:38 | 000,014,336 | ---- | M] () -- C:\WINDOWS.0\system32\msdmo.dll MOD - [1998-10-31 04:55:56 | 000,005,120 | ---- | M] () -- C:\Program Files\VDOTool\TBMANAGE.DLL [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Disabled | Stopped] -- -- (HidServ) SRV - [2011-06-30 12:17:30 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Stopped] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011-05-01 10:35:23 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010-07-29 12:20:16 | 000,238,952 | ---- | M] (Teruten) [Auto | Running] -- C:\WINDOWS.0\system32\FsUsbExService.Exe -- (FsUsbExService) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2011-06-30 12:17:31 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS.0\system32\drivers\avipbb.sys -- (avipbb) DRV - [2011-06-30 12:17:31 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS.0\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2010-12-18 15:33:56 | 000,021,696 | ---- | M] (Almico Software) [Kernel | Boot | Running] -- C:\WINDOWS.0\system32\speedfan.sys -- (speedfan) DRV - [2010-06-17 15:27:22 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS.0\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010-06-17 15:27:12 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2010-06-14 05:02:54 | 000,036,608 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS.0\system32\FsUsbExDisk.Sys -- (FsUsbExDisk) DRV - [2009-09-21 13:25:36 | 000,121,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS.0\system32\drivers\ss_bmdm.sys -- (ss_bmdm) DRV - [2009-09-21 13:25:36 | 000,090,112 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS.0\system32\drivers\ss_bbus.sys -- (ss_bbus) SAMSUNG USB Mobile Device (WDM) DRV - [2009-09-21 13:25:36 | 000,014,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS.0\system32\drivers\ss_bmdfl.sys -- (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter) DRV - [2008-06-16 01:58:00 | 000,476,160 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS.0\system32\drivers\vvftUVC.sys -- (vvftUVC) DRV - [2008-06-16 01:58:00 | 000,250,240 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS.0\system32\drivers\VMUVC.sys -- (VMUVC) DRV - [2007-07-24 12:15:20 | 000,328,824 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\WINDOWS.0\system32\drivers\ACEDRV10.sys -- (acedrv10) DRV - [2007-07-11 12:50:26 | 000,201,848 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\WINDOWS.0\system32\drivers\acehlp10.sys -- (acehlp10) DRV - [2007-03-16 10:11:38 | 000,012,256 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS.0\System32\drivers\TBPanel.sys -- (TBPanel) DRV - [2007-03-16 10:11:38 | 000,012,256 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS.0\system32\drivers\TBPanel.sys -- (Cardex) DRV - [2006-08-14 14:51:28 | 000,105,344 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS.0\system32\DRIVERS\nvata.sys -- (nvata) DRV - [2006-07-11 21:38:30 | 000,020,480 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS.0\system32\drivers\nvnetbus.sys -- (nvnetbus) DRV - [2006-07-11 21:38:28 | 000,057,856 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS.0\system32\drivers\NVENETFD.sys -- (NVENETFD) DRV - [2006-03-18 10:18:00 | 000,392,960 | R--- | M] (Sensaura) [Kernel | On_Demand | Running] -- C:\WINDOWS.0\system32\drivers\senfilt.sys -- (SenFiltService) DRV - [1996-04-04 00:03:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS.0\system32\giveio.sys -- (giveio) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1 IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1454471165-790525478-1417001333-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1 IE - HKU\S-1-5-21-1454471165-790525478-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKU\S-1-5-21-1454471165-790525478-1417001333-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:56545 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultengine: "Web Search" FF - prefs.js..browser.search.defaultenginename: "Web Search" FF - prefs.js..browser.search.order.1: "Web Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://startsear.ch/?aff=1" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.2 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {1FD91A9C-410C-4090-BBCC-55D3450EF433}:1.0 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.9 FF - prefs.js..keyword.URL: "http://search.bearshare.com/web?src=ffb&systemid=2&q=" FF - prefs.js..network.proxy.http: "127.0.0.1" FF - prefs.js..network.proxy.http_port: 56545 FF - prefs.js..network.proxy.type: 1 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS.0\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60129.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS.0\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.633: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.633: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.633: C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.633: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-01-31 14:31:34 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011-08-24 23:19:12 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011-08-26 17:39:52 | 000,000,000 | ---D | M] [2011-01-30 23:15:27 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Extensions [2011-08-26 18:51:40 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\extensions [2011-06-17 14:49:21 | 000,000,000 | ---D | M] (MediaBar) -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0} [2011-07-15 14:47:32 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2011-04-03 17:04:28 | 000,000,000 | ---D | M] (vShare) -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\extensions\vshare@toolbar [2010-09-14 17:18:25 | 000,002,506 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\searchplugins\BearShareWebSearch.xml [2010-09-02 12:39:28 | 000,002,486 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\searchplugins\iMeshWebSearch.xml [2011-07-11 22:34:02 | 000,000,633 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\searchplugins\startsear.xml [2011-04-25 12:53:15 | 000,001,583 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\searchplugins\web-search.xml [2011-08-24 15:17:44 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2010-12-05 17:44:23 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} File not found (No name found) -- [2011-02-05 17:12:34 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2011-02-18 11:15:33 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS.0\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION [2011-08-12 11:02:21 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2010-08-20 13:35:08 | 000,636,408 | ---- | M] (Ganymede Technologies) -- C:\Program Files\mozilla firefox\plugins\NPBILLARD8.dll [2010-12-05 17:44:15 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2011-06-09 16:11:48 | 000,081,920 | ---- | M] (vShare.tv ) -- C:\Program Files\mozilla firefox\plugins\npvsharetvplg.dll [2011-08-12 08:21:25 | 000,002,767 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml [2010-09-14 17:18:25 | 000,002,506 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\BearShareWebSearch.xml [2011-08-12 08:21:25 | 000,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml [2010-09-02 12:39:28 | 000,002,486 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\iMeshWebSearch.xml [2011-08-12 08:21:25 | 000,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml [2011-08-12 08:21:25 | 000,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml [2011-08-12 08:21:25 | 000,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml [2011-08-12 08:21:25 | 000,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2001-10-26 16:15:16 | 000,000,742 | ---- | M]) - C:\WINDOWS.0\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (MediaBar) - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - C:\Program Files\iMesh Applications\MediaBar\ToolBar\imeshdtxmltbpi.dll () O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (UrlHelper Class) - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\MediaBar\Datamngr\IEBHO.dll (MusicLab, LLC) O2 - BHO: (IE5BarLauncherBHO Class) - {78F3A323-798E-4AEA-9A57-88F4B05FD5DD} - C:\Program Files\vShare.tv plugin\BarLcher.dll (VShare Inc.) O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.) O2 - BHO: (FlashGetBHO) - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Documents and Settings\adm\Dane aplikacji\FlashGetBHO\FlashGetBHO3.dll (Trend Media Group) O2 - BHO: (MediaBar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - C:\Program Files\BearShare Applications\MediaBar\ToolBar\bsdtxmltbpi.dll () O3 - HKLM\..\Toolbar: (MediaBar) - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - C:\Program Files\iMesh Applications\MediaBar\ToolBar\imeshdtxmltbpi.dll () O3 - HKLM\..\Toolbar: (VShareToolBar) - {7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - C:\Program Files\vShare.tv plugin\BarLcher.dll (VShare Inc.) O3 - HKLM\..\Toolbar: (MediaBar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - C:\Program Files\BearShare Applications\MediaBar\ToolBar\bsdtxmltbpi.dll () O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKU\S-1-5-21-1454471165-790525478-1417001333-1003\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found. O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [conhost] C:\Documents and Settings\adm\Dane aplikacji\Microsoft\conhost.exe () O4 - HKLM..\Run: [DATAMNGR] C:\Program Files\BearShare Applications\MediaBar\Datamngr\datamngrUI.exe (MusicLab, LLC) O4 - HKLM..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe (Palit Microsystems, Inc.) O4 - HKLM..\Run: [KernelFaultCheck] File not found O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS.0\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS.0\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS.0\System32\nwiz.exe () O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [VMonitorVMUVC] C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe (Vimicro Corporation) O4 - HKU\S-1-5-21-1454471165-790525478-1417001333-1003..\Run: [Abami] C:\WINDOWS.0\qademsn.dll (Agere Systems) O4 - HKU\S-1-5-21-1454471165-790525478-1417001333-1003..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKU\.DEFAULT..\RunOnce: [nltide_2] File not found O4 - HKU\S-1-5-18..\RunOnce: [nltide_2] File not found O4 - HKU\S-1-5-19..\RunOnce: [nltide_2] File not found O4 - HKU\S-1-5-20..\RunOnce: [nltide_2] File not found F3 - HKU\S-1-5-21-1454471165-790525478-1417001333-1003 WinNT: Load - (C:\DOCUME~1\adm\USTAWI~1\Temp\csrss.exe) - C:\Documents and Settings\adm\Ustawienia lokalne\Temp\csrss.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1454471165-790525478-1417001333-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Download all by FlashGet3 - C:\Documents and Settings\adm\Dane aplikacji\FlashGetBHO\GetAllUrl.htm () O8 - Extra context menu item: Download by FlashGet3 - C:\Documents and Settings\adm\Dane aplikacji\FlashGetBHO\GetUrl.htm () O8 - Extra context menu item: Funkcja Google Sidewiki - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll (Google Inc.) O8 - Extra context menu item: 使用快车3下载 - C:\Documents and Settings\adm\Dane aplikacji\FlashGetBHO\GetUrl.htm () O8 - Extra context menu item: 使用快车3下载全部链接 - C:\Documents and Settings\adm\Dane aplikacji\FlashGetBHO\GetAllUrl.htm () O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.204.159.1 194.204.152.34 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20 - AppInit_DLLs: (C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll) - C:\Program Files\BearShare Applications\MediaBar\Datamngr\datamngr.dll (MusicLab, LLC) O20 - AppInit_DLLs: (C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll) - C:\Program Files\BearShare Applications\MediaBar\Datamngr\IEBHO.dll (MusicLab, LLC) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS.0\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS.0\system32\userinit.exe) - C:\WINDOWS.0\system32\userinit.exe (Microsoft Corporation) O20 - HKU\S-1-5-21-1454471165-790525478-1417001333-1003 Winlogon: Shell - (explorer.exe) - C:\WINDOWS.0\explorer.exe (Microsoft Corporation) O20 - HKU\S-1-5-21-1454471165-790525478-1417001333-1003 Winlogon: Shell - (C:\Documents and Settings\adm\Dane aplikacji\dwm.exe) - C:\Documents and Settings\adm\Dane aplikacji\dwm.exe () O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\WINDOWS.0\Web\Wallpaper\Idylla.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS.0\Web\Wallpaper\Idylla.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010-12-05 13:43:07 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O35 - HKU\S-1-5-21-1454471165-790525478-1417001333-1003..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKU\S-1-5-21-1454471165-790525478-1417001333-1003\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2011-08-26 17:39:51 | 000,000,000 | ---D | C] -- C:\Program Files\vShare.tv plugin [2011-08-26 17:05:51 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\adm\Dane aplikacji\SecuROM [2011-08-25 14:31:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\adm\Ustawienia lokalne\Dane aplikacji\Wheelman [2011-08-25 14:31:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\adm\Ustawienia lokalne\Dane aplikacji\PC [2011-08-25 14:04:35 | 000,000,000 | ---D | C] -- C:\Program Files\Midway Games [2011-08-20 13:07:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS.0\Menu Start\Programy\7-Zip [2011-08-20 13:07:32 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip [2011-08-16 11:08:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\adm\Pulpit\lapt [2011-08-04 18:54:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\RDRM [2011-08-04 18:48:27 | 000,000,000 | ---D | C] -- C:\Program Files\PlayReady [2011-07-31 14:14:13 | 000,000,000 | ---D | C] -- C:\foty [2010-12-26 13:27:05 | 016,528,896 | ---- | C] (Spellbound Entertainment AG) -- C:\Program Files\Arcania.exe [2010-12-26 13:26:57 | 000,279,880 | ---- | C] (Sony DADC Austria AG) -- C:\Program Files\paul.dll [4 C:\WINDOWS.0\*.tmp files -> C:\WINDOWS.0\*.tmp -> ] [1 C:\WINDOWS.0\System32\*.tmp files -> C:\WINDOWS.0\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2011-08-26 18:55:20 | 000,000,558 | ---- | M] () -- C:\WINDOWS.0\DFC.INI [2011-08-26 18:50:40 | 000,000,258 | ---- | M] () -- C:\WINDOWS.0\tasks\WGASetup.job [2011-08-26 18:50:30 | 000,001,026 | ---- | M] () -- C:\WINDOWS.0\tasks\GoogleUpdateTaskMachineCore.job [2011-08-26 18:50:29 | 000,000,274 | ---- | M] () -- C:\WINDOWS.0\tasks\RealUpgradeLogonTaskS-1-5-21-1454471165-790525478-1417001333-1003.job [2011-08-26 18:50:27 | 000,002,048 | --S- | M] () -- C:\WINDOWS.0\bootstat.dat [2011-08-26 18:30:01 | 000,001,030 | ---- | M] () -- C:\WINDOWS.0\tasks\GoogleUpdateTaskMachineUA.job [2011-08-26 17:12:02 | 000,183,296 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\dwm.exe [2011-08-26 13:01:00 | 000,000,282 | ---- | M] () -- C:\WINDOWS.0\tasks\RealUpgradeScheduledTaskS-1-5-21-1454471165-790525478-1417001333-1003.job [2011-08-26 09:23:00 | 000,002,206 | ---- | M] () -- C:\WINDOWS.0\System32\wpa.dbl [2011-08-25 22:01:30 | 000,208,332 | ---- | M] () -- C:\Documents and Settings\adm\Pulpit\36c80ac8d910900bfed9.jpg [2011-08-25 21:55:42 | 000,929,538 | ---- | M] () -- C:\Documents and Settings\adm\Pulpit\c374a5cf8f47e3dc2a09.jpg [2011-08-25 21:55:25 | 000,821,220 | ---- | M] () -- C:\Documents and Settings\adm\Pulpit\5cb6724fe97b1f37bbdf.jpg [2011-08-25 21:50:43 | 000,027,769 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\72AA.956 [2011-08-25 21:47:05 | 000,481,714 | ---- | M] () -- C:\Documents and Settings\adm\Pulpit\tapetahx9.jpg [2011-08-25 16:43:54 | 000,000,644 | ---- | M] () -- C:\WINDOWS.0\System32\secustat.dat [2011-08-25 16:29:02 | 000,002,942 | ---- | M] () -- C:\WINDOWS.0\System32\secushr.dat [2011-08-24 17:36:32 | 000,030,208 | ---- | M] () -- C:\Documents and Settings\adm\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011-08-20 16:00:59 | 403,778,820 | ---- | M] () -- C:\Documents and Settings\adm\Moje dokumenty\aqw.uha [2011-08-19 14:43:56 | 000,024,241 | ---- | M] () -- C:\Documents and Settings\adm\Pulpit\92164222.jpg [2011-08-15 13:32:00 | 000,000,803 | ---- | M] () -- C:\Documents and Settings\adm\Pulpit\Internet Explorer.lnk [4 C:\WINDOWS.0\*.tmp files -> C:\WINDOWS.0\*.tmp -> ] [1 C:\WINDOWS.0\System32\*.tmp files -> C:\WINDOWS.0\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2011-08-25 22:01:29 | 000,208,332 | ---- | C] () -- C:\Documents and Settings\adm\Pulpit\36c80ac8d910900bfed9.jpg [2011-08-25 21:55:41 | 000,929,538 | ---- | C] () -- C:\Documents and Settings\adm\Pulpit\c374a5cf8f47e3dc2a09.jpg [2011-08-25 21:55:24 | 000,821,220 | ---- | C] () -- C:\Documents and Settings\adm\Pulpit\5cb6724fe97b1f37bbdf.jpg [2011-08-25 21:47:04 | 000,481,714 | ---- | C] () -- C:\Documents and Settings\adm\Pulpit\tapetahx9.jpg [2011-08-25 16:06:57 | 000,002,942 | ---- | C] () -- C:\WINDOWS.0\System32\secushr.dat [2011-08-24 23:19:13 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS.0\Menu Start\Programy\Mozilla Firefox.lnk [2011-08-23 17:38:55 | 000,183,296 | ---- | C] () -- C:\Documents and Settings\adm\Dane aplikacji\dwm.exe [2011-08-23 17:38:35 | 000,027,769 | ---- | C] () -- C:\Documents and Settings\adm\Dane aplikacji\72AA.956 [2011-08-20 15:44:35 | 403,778,820 | ---- | C] () -- C:\Documents and Settings\adm\Moje dokumenty\aqw.uha [2011-08-19 14:43:56 | 000,024,241 | ---- | C] () -- C:\Documents and Settings\adm\Pulpit\92164222.jpg [2011-08-15 13:32:00 | 000,000,803 | ---- | C] () -- C:\Documents and Settings\adm\Pulpit\Internet Explorer.lnk [2011-04-19 21:53:37 | 000,014,642 | -HS- | C] () -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\64uy677iby72x2r4gj86f3kdb27y451070j3kvldf2 [2011-04-19 21:53:37 | 000,014,642 | -HS- | C] () -- C:\Documents and Settings\adm\Ustawienia lokalne\Dane aplikacji\64uy677iby72x2r4gj86f3kdb27y451070j3kvldf2 [2011-04-10 14:31:45 | 000,000,644 | ---- | C] () -- C:\WINDOWS.0\System32\secustat.dat [2011-04-10 14:26:11 | 000,000,025 | ---- | C] () -- C:\WINDOWS.0\libem.INI [2011-03-22 19:20:45 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\adm\Dane aplikacji\$_hpcst$.hpc [2011-03-22 19:20:41 | 000,110,592 | ---- | C] () -- C:\WINDOWS.0\System32\FsUsbExDevice.Dll [2011-03-22 19:20:41 | 000,036,608 | ---- | C] () -- C:\WINDOWS.0\System32\FsUsbExDisk.Sys [2011-02-20 10:24:48 | 000,069,632 | ---- | C] () -- C:\WINDOWS.0\System32\xmltok.dll [2011-02-20 10:24:48 | 000,036,864 | ---- | C] () -- C:\WINDOWS.0\System32\xmlparse.dll [2011-02-11 12:09:49 | 000,123,392 | ---- | C] () -- C:\WINDOWS.0\System32\UnCasino5.exe [2011-02-07 16:38:54 | 000,000,056 | -H-- | C] () -- C:\WINDOWS.0\System32\ezsidmv.dat [2011-01-31 15:54:46 | 000,146,136 | ---- | C] () -- C:\WINDOWS.0\hpoins27.dat [2011-01-31 15:54:46 | 000,000,932 | ---- | C] () -- C:\WINDOWS.0\hpomdl27.dat [2011-01-31 15:07:23 | 000,030,208 | ---- | C] () -- C:\Documents and Settings\adm\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011-01-31 15:07:12 | 000,165,376 | ---- | C] () -- C:\WINDOWS.0\System32\unrar.dll [2011-01-31 15:07:12 | 000,000,038 | ---- | C] () -- C:\WINDOWS.0\avisplitter.ini [2011-01-31 15:07:09 | 000,810,496 | ---- | C] () -- C:\WINDOWS.0\System32\xvidcore.dll [2011-01-31 15:07:09 | 000,183,808 | ---- | C] () -- C:\WINDOWS.0\System32\xvidvfw.dll [2011-01-31 15:07:09 | 000,080,896 | ---- | C] () -- C:\WINDOWS.0\System32\ff_vfw.dll [2011-01-30 23:30:03 | 000,004,381 | ---- | C] () -- C:\WINDOWS.0\ODBCINST.INI [2011-01-30 23:27:12 | 000,269,392 | ---- | C] () -- C:\WINDOWS.0\System32\FNTCACHE.DAT [2011-01-30 23:17:41 | 000,000,004 | ---- | C] () -- C:\WINDOWS.0\System32\proc-503976190.bin [2011-01-30 23:15:22 | 000,000,000 | ---- | C] () -- C:\WINDOWS.0\nsreg.dat [2011-01-30 22:56:29 | 000,000,558 | ---- | C] () -- C:\WINDOWS.0\DFC.INI [2011-01-30 22:54:36 | 001,626,112 | ---- | C] () -- C:\WINDOWS.0\System32\nwiz.exe [2011-01-30 22:54:36 | 001,339,392 | ---- | C] () -- C:\WINDOWS.0\System32\nvdspsch.exe [2011-01-30 22:54:36 | 000,442,368 | ---- | C] () -- C:\WINDOWS.0\System32\nvappbar.exe [2011-01-30 22:54:36 | 000,425,984 | ---- | C] () -- C:\WINDOWS.0\System32\keystone.exe [2011-01-30 22:54:34 | 001,703,936 | ---- | C] () -- C:\WINDOWS.0\System32\nvwdmcpl.dll [2011-01-30 22:54:34 | 001,474,560 | ---- | C] () -- C:\WINDOWS.0\System32\nview.dll [2011-01-30 22:54:34 | 001,019,904 | ---- | C] () -- C:\WINDOWS.0\System32\nvwimg.dll [2011-01-30 22:54:34 | 000,466,944 | ---- | C] () -- C:\WINDOWS.0\System32\nvshell.dll [2011-01-30 22:54:34 | 000,286,720 | ---- | C] () -- C:\WINDOWS.0\System32\nvnt4cpl.dll [2011-01-30 22:54:33 | 000,929,744 | ---- | C] () -- C:\WINDOWS.0\System32\nvucode.bin [2011-01-30 22:42:07 | 000,002,048 | --S- | C] () -- C:\WINDOWS.0\bootstat.dat [2011-01-30 22:35:14 | 000,021,856 | ---- | C] () -- C:\WINDOWS.0\System32\emptyregdb.dat [2010-12-28 00:28:24 | 002,698,827 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-S-1-5-21-1659004503-1580818891-682003330-1003-0.dat [2010-12-27 01:19:26 | 000,837,498 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-System.dat [2010-12-26 13:27:05 | 000,300,460 | ---- | C] () -- C:\Program Files\dfe [2010-12-26 13:26:57 | 001,085,440 | ---- | C] () -- C:\Program Files\rldata.dll [2010-12-26 13:26:57 | 000,190,976 | ---- | C] () -- C:\Program Files\rld.dll [2010-12-26 13:26:57 | 000,153,046 | ---- | C] () -- C:\Program Files\lang.ini [2010-12-26 13:26:57 | 000,043,874 | ---- | C] () -- C:\Program Files\GameServices.ini [2010-12-26 13:26:49 | 093,153,894 | ---- | C] () -- C:\Program Files\Crack.zip [2009-08-21 16:58:40 | 000,122,880 | ---- | C] () -- C:\WINDOWS.0\System32\AitVirtualComInstall.exe [2009-07-20 20:10:48 | 000,307,200 | ---- | C] () -- C:\WINDOWS.0\System32\InstallVCOM.exe [2008-05-04 17:39:34 | 000,002,560 | ---- | C] () -- C:\WINDOWS.0\System32\ViaClassCoInstaller.dll [2008-04-14 21:46:20 | 000,001,804 | ---- | C] () -- C:\WINDOWS.0\System32\Dcache.bin [2007-10-25 17:26:10 | 000,005,632 | ---- | C] () -- C:\WINDOWS.0\System32\drivers\StarOpen.sys [2006-12-31 06:27:08 | 000,004,569 | ---- | C] () -- C:\WINDOWS.0\System32\secupd.dat [2001-10-26 16:45:16 | 000,533,814 | ---- | C] () -- C:\WINDOWS.0\System32\perfh015.dat [2001-10-26 16:45:16 | 000,313,828 | ---- | C] () -- C:\WINDOWS.0\System32\perfi015.dat [2001-10-26 16:45:16 | 000,093,818 | ---- | C] () -- C:\WINDOWS.0\System32\perfc015.dat [2001-10-26 16:45:16 | 000,034,990 | ---- | C] () -- C:\WINDOWS.0\System32\perfd015.dat [2001-08-23 13:30:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS.0\System32\oembios.bin [2001-08-23 13:30:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS.0\System32\oembios.dat [2001-08-17 22:00:24 | 000,474,168 | ---- | C] () -- C:\WINDOWS.0\System32\perfh009.dat [2001-08-17 22:00:24 | 000,272,128 | ---- | C] () -- C:\WINDOWS.0\System32\perfi009.dat [2001-08-17 22:00:24 | 000,028,626 | ---- | C] () -- C:\WINDOWS.0\System32\perfd009.dat [2001-08-17 22:00:22 | 000,075,856 | ---- | C] () -- C:\WINDOWS.0\System32\perfc009.dat [2001-08-17 21:45:38 | 000,046,258 | ---- | C] () -- C:\WINDOWS.0\System32\mib.bin [2001-07-21 23:06:48 | 000,218,003 | ---- | C] () -- C:\WINDOWS.0\System32\dssec.dat [2001-07-21 23:06:04 | 000,673,088 | ---- | C] () -- C:\WINDOWS.0\System32\mlang.dat [2001-07-21 22:54:16 | 000,000,741 | ---- | C] () -- C:\WINDOWS.0\System32\noise.dat [1996-04-04 00:03:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS.0\System32\giveio.sys [color=#E56717]========== LOP Check ==========[/color] [2011-01-30 18:18:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\2K Sports [2011-06-18 15:44:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Auslogics [2011-08-26 17:05:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\BITS [2011-04-29 18:12:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\bsbandmltbpi [2011-04-25 12:16:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\BSplayer [2011-02-07 20:40:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\DAEMON Tools Lite [2011-07-09 13:33:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Dev-Cpp [2011-04-10 14:25:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\FlashGet [2011-04-10 14:25:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\FlashGetBHO [2011-08-23 17:11:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Gadu-Gadu 10 [2011-04-10 19:52:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Games [2011-01-30 23:17:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\GanymedeNet [2011-07-16 14:22:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\imeshbandmltbpi [2011-08-25 12:02:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\ipla [2011-04-29 18:13:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\mediabarbs [2011-07-16 14:23:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\mediabarim [2011-04-05 17:24:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\ML [2011-01-30 19:52:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Opera [2011-08-04 18:53:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\RDRM [2011-03-12 11:35:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Samsung [2011-03-20 13:51:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Scilab [2011-02-07 19:52:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Sports Interactive [2011-04-26 00:41:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\uTorrent [2010-12-11 14:06:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ALLConverter [2010-12-06 18:41:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ashampoo [2010-12-08 20:11:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite [2010-12-31 00:00:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ipla [2011-01-08 12:37:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\KONAMI [2010-12-24 11:19:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\OpenFM [2010-12-07 19:45:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Samsung [2010-12-08 20:22:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Sports Interactive [2011-04-10 19:50:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\AlawarWrapper [2011-02-07 19:53:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\DAEMON Tools Lite [2011-02-24 18:17:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\Gadu-Gadu 10 [2011-08-04 18:53:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\ipla [2011-06-10 12:06:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\MGS [2011-08-04 18:54:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\RDRM [2011-03-22 19:34:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\Samsung [2011-02-07 19:54:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\Sports Interactive [2011-02-21 17:24:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\Wru [2010-12-11 11:30:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dane aplikacji\2K Sports [2010-12-06 18:41:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dane aplikacji\Ashampoo [2011-01-27 22:12:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dane aplikacji\BSplayer [2010-12-12 16:49:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dane aplikacji\BSplayer Pro [2010-12-08 20:16:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dane aplikacji\DAEMON Tools Lite [2010-12-05 13:17:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dane aplikacji\Dev-Cpp [2011-01-14 17:36:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dane aplikacji\FreeBurner [2010-12-17 23:02:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dane aplikacji\GanymedeNet [2010-12-31 00:26:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dane aplikacji\ipla [2011-01-07 14:41:34 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dane aplikacji\Nowe Gadu-Gadu [2010-12-05 21:11:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dane aplikacji\OpenFM [2010-12-05 15:16:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dane aplikacji\Opera [2011-01-02 16:52:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dane aplikacji\PhotoFiltre [2010-12-31 15:36:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dane aplikacji\PLT Scheme [2010-12-31 00:00:38 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dane aplikacji\RDRM [2010-12-07 19:35:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dane aplikacji\Samsung [2010-12-23 14:28:52 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dane aplikacji\Sports Interactive [2011-01-14 17:44:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dane aplikacji\Toolbar4 [2011-01-29 14:25:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\user\Dane aplikacji\uTorrent [2011-08-26 18:50:40 | 000,000,258 | ---- | M] () -- C:\WINDOWS.0\Tasks\WGASetup.job [color=#E56717]========== Purity Check ==========[/color] < End of report >

Kod: Zaznacz wszystko: OTL Extras logfile created on: 2011-08-26 18:54:17 - Run 1 OTL by OldTimer - Version 3.2.26.5 Folder = C:\Documents and Settings\adm\Moje dokumenty\Pobieranie Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 2,00 Gb Total Physical Memory | 1,55 Gb Available Physical Memory | 77,35% Memory free 3,85 Gb Paging File | 3,55 Gb Available in Paging File | 92,25% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS.0 | %ProgramFiles% = C:\Program Files Drive C: | 149,04 Gb Total Space | 13,39 Gb Free Space | 8,99% Space Free | Partition Type: NTFS Computer Name: SDF-4CFC9C4B323 | User Name: adm | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* .url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l [HKEY_USERS\S-1-5-21-1454471165-790525478-1417001333-1003\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) [color=#E56717]========== Shell Spawning ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* exefile [open] -- "%1" %* InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 1 "FirewallDisableNotify" = 1 "UpdatesDisableNotify" = 1 "AntiVirusOverride" = 1 "FirewallOverride" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [color=#E56717]========== System Restore Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore] "DisableSR" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr] "Start" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService] "Start" = 2 [color=#E56717]========== Firewall Settings ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 0 "DoNotAllowExceptions" = 0 "DisableNotifications" = 1 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0 "DoNotAllowExceptions" = 0 "DisableNotifications" = 1 [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "C:\Program Files\2K Sports\NBA 2K11\nba2k11.exe" = C:\Program Files\2K Sports\NBA 2K11\nba2k11.exe:*:Enabled:2K Sports NBA 2K11 -- (2K Sports) "C:\Program Files\Opera 11.00 beta\opera.exe" = C:\Program Files\Opera 11.00 beta\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software) "C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.) "C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpiscnapp.exe:*:Enabled:hpiscnapp.exe -- (Hewlett-Packard) "C:\Program Files\SopCast\adv\SopAdver.exe" = C:\Program Files\SopCast\adv\SopAdver.exe:*:Enabled:SopCast Adver -- (www.sopcast.com) "C:\Program Files\SopCast\SopCast.exe" = C:\Program Files\SopCast\SopCast.exe:*:Enabled:SopCast Main Application -- (www.sopcast.com) "C:\Casino\ParadiseCasino\casino.exe" = C:\Casino\ParadiseCasino\casino.exe:*:Enabled:casino -- () "C:\Program Files\Sports Interactive\Football Manager 2011\fm.exe" = C:\Program Files\Sports Interactive\Football Manager 2011\fm.exe:*:Enabled:Football Manager 2011 -- (Sports Interactive) "C:\Program Files\Google\Google Earth\client\googleearth.exe" = C:\Program Files\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth -- (Google) "C:\Program Files\Wru\Wru.exe" = C:\Program Files\Wru\Wru.exe:*:Disabled:Wru P2P Client -- (Lavorate Sp.z.o.o.) "C:\Program Files\Gadu-Gadu 10\gg.exe" = C:\Program Files\Gadu-Gadu 10\gg.exe:*:Enabled:Gadu-Gadu 10 -- (GG Network S.A.) "C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe" = C:\Program Files\Samsung\Samsung New PC Studio\npsasvr.exe:*:Enabled:KTF MUSIC AoD Server -- (PeeringPortal) "C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe" = C:\Program Files\Samsung\Samsung New PC Studio\npsvsvr.exe:*:Enabled:KTF MUSIC VoD Server -- (PeeringPortal) "C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe" = C:\Program Files\FlashGet Network\FlashGet 3\FlashGet3.exe:*:Enabled:Flashget3 -- (Trend Media Corporation Limited) [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{02B244A2-7F6A-42E8-A36F-8C385D7A1625}" = Gothic III "{036FD544-AED6-3F33-856D-A2292D0CF471}" = Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - PLK "{0F7C2E47-089E-4d23-B9F7-39BE00100776}" = Toolbox "{15FA5ED6-2F98-4B5E-AF0B-18E5F4723FAD}_is1" = Cities In Motion "{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{1F9A5CFA-BF15-46E7-A723-A654EA29D6F7}" = Mulimedia Logic "{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer "{26A24AE4-039D-4CA4-87B4-2F83216023FF}" = Java(TM) 6 Update 23 "{28C2DED6-325B-4CC7-983A-1777C8F7FBAB}" = RealUpgrade 1.1 "{321320E1-0E5A-36CB-9E52-F3B201B8C4D4}" = Microsoft .NET Framework 4 Client Profile PLK Language Pack "{34D52D01-C65D-4A29-99E0-E02030597B4F}_is1" = Cities In Motion - Patch 1.0.17 "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{4DBF3C3D-5B6D-45B2-A08B-B06490E2666F}_is1" = Wru! 1.1.3 "{4E8444C5-766E-4f4d-82F8-BB83E2FBB42A}" = HP Deskjet F2200 All-In-One Driver 10.0 Rel .3 "{71A51A91-E7D3-11DB-A386-005056C00008}" = Vimicro USB2.0 UVC PC Camera "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{7770E71B-2D43-4800-9CB3-5B6CAAEBEBEA}" = RealNetworks - Microsoft Visual C++ 2008 Runtime "{7C77393F-8237-3825-A88A-AFAF3C69C072}" = Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - PLK "{80533B67-C407-485D-8B5D-63BB8ED9D878}" = Scan "{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8D8024F1-2945-49A5-9B78-5AB7B11D7942}_is1" = Auslogics Registry Cleaner "{90120000-0010-0409-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (English) 12 "{90120000-0015-0409-0000-0000000FF1CE}" = Microsoft Office Access MUI (English) 2007 "{90120000-0015-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0016-0409-0000-0000000FF1CE}" = Microsoft Office Excel MUI (English) 2007 "{90120000-0016-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0018-0409-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (English) 2007 "{90120000-0018-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0019-0409-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (English) 2007 "{90120000-0019-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001A-0409-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (English) 2007 "{90120000-001A-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001B-0409-0000-0000000FF1CE}" = Microsoft Office Word MUI (English) 2007 "{90120000-001B-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{ABDDE972-355B-4AF1-89A8-DA50B7B5C045}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007 "{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{F580DDD5-8D37-4998-968E-EBB76BB86787}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-001F-0C0A-0000-0000000FF1CE}" = Microsoft Office Proof (Spanish) 2007 "{90120000-001F-0C0A-0000-0000000FF1CE}_ENTERPRISE_{187308AB-5FA7-4F14-9AB9-D290383A10D9}" = Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2) "{90120000-002C-0409-0000-0000000FF1CE}" = Microsoft Office Proofing (English) 2007 "{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007 "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{3D019598-7B59-447A-80AE-815B703B84FF}" = Security Update for Microsoft Office system 2007 (972581) "{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{926CC8AE-8414-43DF-8EB4-CF26D9C3C663}" = "{90120000-0044-0409-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (English) 2007 "{90120000-0044-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-006E-0409-0000-0000000FF1CE}" = Microsoft Office Shared MUI (English) 2007 "{90120000-006E-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00A1-0409-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (English) 2007 "{90120000-00A1-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-00BA-0409-0000-0000000FF1CE}" = Microsoft Office Groove MUI (English) 2007 "{90120000-00BA-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0114-0409-0000-0000000FF1CE}" = Microsoft Office Groove Setup Metadata MUI (English) 2007 "{90120000-0114-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0115-0409-0000-0000000FF1CE}" = Microsoft Office Shared Setup Metadata MUI (English) 2007 "{90120000-0115-0409-0000-0000000FF1CE}_ENTERPRISE_{DE5A002D-8122-4278-A7EE-3121E7EA254E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90120000-0117-0409-0000-0000000FF1CE}" = Microsoft Office Access Setup Metadata MUI (English) 2007 "{90120000-0117-0409-0000-0000000FF1CE}_ENTERPRISE_{2FC4457D-409E-466F-861F-FB0CB796B53E}" = Microsoft Office 2007 Service Pack 2 (SP2) "{90850415-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003 "{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2 "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AC76BA86-7AD7-1045-7B44-A94000000001}" = Adobe Reader 9.4.0 - Polish "{AF7E85DC-317C-47F5-810E-B82EE093A612}" = Samsung New PC Studio USB Driver Installer "{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2 "{c6922d7f-c698-4d9e-9671-8b3de04d1511}" = DJ_AIO_03_F2200_Software_Min "{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}" = PlayReady PC Runtime x86 "{CD95D125-2992-4858-B3EF-5F6FB52FBAD6}" = Skype Toolbars "{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1 "{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones "{D651CB41-D92C-4639-BC24-9A926FEA24D2}" = Gothic 3 - Zmierzch Bogów "{DCB4319C-D746-475B-B604-3D42C5564383}" = Prince of Persia The Sands of Time (Demo) "{E51B4CD9-A0A6-4324-B26A-31B3F2DE26CE}" = Black and White "{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1 "{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX "{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio "{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer "{F31E509D-3597-324E-83CF-0C160B2320F0}" = Microsoft .NET Framework 3.5 Language Pack - plk "7-Zip" = 7-Zip 9.20 "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus "BearShare 2 MediaBar" = MediaBar "betway" = Betway.com "CamStudio" = CamStudio "Dominion Wars" = Dominion Wars "ENTERPRISE" = Microsoft Office Enterprise 2007 "FlashGet 3.7" = FlashGet 3.7 "Football Manager 2011" = Football Manager 2011 "Gadu-Gadu 10" = Gadu-Gadu 10 "GameCenter_is1" = GameCenter 1.3.0.5 "iMesh 1 MediaBar" = MediaBar "InstallShield_{AF7E85DC-317C-47F5-810E-B82EE093A612}" = Samsung New PC Studio USB Driver Installer "InstallShield_{F193FC0E-9E18-40FC-A974-509A1BDD240A}" = Samsung New PC Studio "ipla" = ipla 2.3.3 "KLiteCodecPack_is1" = K-Lite Codec Pack 6.2.0 (Basic) "Microsoft .NET Framework 3.5 Language Pack - plk" = Pakiet językowy programu Microsoft .NET Framework 3.5 — PLK "Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1 "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile PLK Language Pack" = Polski pakiet językowy dla programu Microsoft .NET Framework 4 Client Profile "Mozilla Firefox 6.0 (x86 pl)" = Mozilla Firefox 6.0 (x86 pl) "NVIDIA Drivers" = NVIDIA Drivers "ProtectDisc Driver 10" = ProtectDisc Helper Driver 10 "RealPlayer 12.0" = RealPlayer "SopCast" = SopCast 3.2.4 "SpeedFan" = SpeedFan (remove only) "uTorrent" = µTorrent "VDOTool_is1" = VDOTool 5.1 "vShare.tv plugin" = vShare.tv plugin 1.3 "WinRAR archiver" = Archiwizator WinRAR "XpsEPSC" = XML Paper Specification Shared Components Pack 1.0 "XPSEPSCLP" = XML Paper Specification Shared Components Language Pack 1.0 [color=#E56717]========== HKEY_USERS Uninstall List ==========[/color] [HKEY_USERS\S-1-5-21-1454471165-790525478-1417001333-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "Counter-Strike 1.6: New Era" = Counter-Strike 1.6: New Era [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Application Events ] Error - 2011-05-29 10:39:22 | Computer Name = SDF-4CFC9C4B323 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd fm.exe, wersja 11.2.1.33429, moduł powodujący błąd fm.exe, wersja 11.2.1.33429, adres błędu 0x01032ea2. Error - 2011-06-03 07:59:09 | Computer Name = SDF-4CFC9C4B323 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd fm.exe, wersja 11.2.1.33429, moduł powodujący błąd fm.exe, wersja 11.2.1.33429, adres błędu 0x01032ea2. Error - 2011-06-09 08:08:20 | Computer Name = SDF-4CFC9C4B323 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca gg.exe, wersja 10.3.2.12444, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2011-06-10 03:23:09 | Computer Name = SDF-4CFC9C4B323 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd betway.exe, wersja 16.3.2.8539, moduł powodujący błąd betway.exe, wersja 16.3.2.8539, adres błędu 0x000020ab. Error - 2011-06-10 03:23:20 | Computer Name = SDF-4CFC9C4B323 | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd betway.exe, wersja 16.3.2.8539, moduł powodujący błąd betway.exe, wersja 16.3.2.8539, adres błędu 0x000020ab. Error - 2011-06-11 03:08:44 | Computer Name = SDF-4CFC9C4B323 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca gg.exe, wersja 10.3.2.12444, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2011-06-11 03:08:44 | Computer Name = SDF-4CFC9C4B323 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca firefox.exe, wersja 1.9.2.4127, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2011-06-11 13:31:00 | Computer Name = SDF-4CFC9C4B323 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca gg.exe, wersja 10.3.2.12444, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2011-06-15 08:05:35 | Computer Name = SDF-4CFC9C4B323 | Source = ESENT | ID = 490 Description = svchost (1056) Próba otwarcia pliku "C:\WINDOWS.0\system32\CatRoot2\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\catdb" w trybie odczytu lub zapisu zakończyła się niepomyślnie z błędem systemowym 32 (0x00000020): "Proces nie może uzyskać dostępu do pliku, ponieważ jest on używany przez inny proces. ". Operacja otwierania pliku zostanie zakończona z błędem -1032 (0xfffffbf8). Error - 2011-06-20 08:04:08 | Computer Name = SDF-4CFC9C4B323 | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca gg.exe, wersja 10.3.2.12444, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. [ System Events ] Error - 2011-08-24 02:13:28 | Computer Name = SDF-4CFC9C4B323 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Cardex z powodu następującego błędu: %%183 Error - 2011-08-24 10:47:31 | Computer Name = SDF-4CFC9C4B323 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Cardex z powodu następującego błędu: %%183 Error - 2011-08-25 00:37:16 | Computer Name = SDF-4CFC9C4B323 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Cardex z powodu następującego błędu: %%183 Error - 2011-08-26 03:24:18 | Computer Name = SDF-4CFC9C4B323 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Cardex z powodu następującego błędu: %%183 Error - 2011-08-26 08:33:27 | Computer Name = SDF-4CFC9C4B323 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Cardex z powodu następującego błędu: %%183 Error - 2011-08-26 09:01:44 | Computer Name = SDF-4CFC9C4B323 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Cardex z powodu następującego błędu: %%183 Error - 2011-08-26 09:05:11 | Computer Name = SDF-4CFC9C4B323 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Cardex z powodu następującego błędu: %%183 Error - 2011-08-26 09:12:22 | Computer Name = SDF-4CFC9C4B323 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Cardex z powodu następującego błędu: %%183 Error - 2011-08-26 09:14:29 | Computer Name = SDF-4CFC9C4B323 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Cardex z powodu następującego błędu: %%183 Error - 2011-08-26 10:20:42 | Computer Name = SDF-4CFC9C4B323 | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi Cardex z powodu następującego błędu: %%183 < End of report >

**Posty:** 18165 · przez **wojtas** 26 Sie 2011, 19:07

odinstaluj w dodaj usuń : Wru! 1.1.3, MediaBar ( BearShare 2 MediaBar ) , iMesh 1 MediaBar, vShare.tv plugin 1.3

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL
PRC - [2011-08-26 17:12:02 | 000,183,296 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\dwm.exe
PRC - [2011-08-26 17:11:40 | 000,188,416 | ---- | M] () -- C:\Documents and Settings\adm\Ustawienia lokalne\Temp\csrss.exe
PRC - [2011-08-26 17:11:19 | 000,179,200 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\Microsoft\conhost.exe
FF - prefs.js..browser.search.defaultengine: "Web Search"
FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..keyword.URL: "http://search.bearshare.com/web?src=ffb&systemid=2&q="
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
[2011-06-17 14:49:21 | 000,000,000 | ---D | M] (MediaBar) -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\extensions\{28387537-e3f9-4ed7-860c-11e69af4a8a0}
[2011-04-03 17:04:28 | 000,000,000 | ---D | M] (vShare) -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\extensions\vshare@toolbar
[2010-09-14 17:18:25 | 000,002,506 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\searchplugins\BearShareWebSearch.xml
[2010-09-02 12:39:28 | 000,002,486 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\searchplugins\iMeshWebSearch.xml
[2011-07-11 22:34:02 | 000,000,633 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\searchplugins\startsear.xml
[2010-09-14 17:18:25 | 000,002,506 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\BearShareWebSearch.xml
[2010-09-02 12:39:28 | 000,002,486 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\iMeshWebSearch.xml
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKU\S-1-5-21-1454471165-790525478-1417001333-1003\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O4 - HKLM..\Run: [KernelFaultCheck] File not found
O4 - HKU\S-1-5-21-1454471165-790525478-1417001333-1003..\Run: [Abami] C:\WINDOWS.0\qademsn.dll (Agere Systems)
O4 - HKU\.DEFAULT..\RunOnce: [nltide_2] File not found
O4 - HKU\S-1-5-18..\RunOnce: [nltide_2] File not found
O4 - HKU\S-1-5-19..\RunOnce: [nltide_2] File not found
O4 - HKU\S-1-5-20..\RunOnce: [nltide_2] File not found
F3 - HKU\S-1-5-21-1454471165-790525478-1417001333-1003 WinNT: Load - (C:\DOCUME~1\adm\USTAWI~1\Temp\csrss.exe) - C:\Documents and Settings\adm\Ustawienia lokalne\Temp\csrss.exe ()
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O20 - AppInit_DLLs: (C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\datamngr.dll) - C:\Program Files\BearShare Applications\MediaBar\Datamngr\datamngr.dll (MusicLab, LLC)
O20 - AppInit_DLLs: (C:\PROGRA~1\BEARSH~1\MediaBar\Datamngr\IEBHO.dll) - C:\Program Files\BearShare Applications\MediaBar\Datamngr\IEBHO.dll (MusicLab, LLC)
O20 - HKU\S-1-5-21-1454471165-790525478-1417001333-1003 Winlogon: Shell - (C:\Documents and Settings\adm\Dane aplikacji\dwm.exe) - C:\Documents and Settings\adm\Dane aplikacji\dwm.exe ()
[2011-08-25 16:43:54 | 000,000,644 | ---- | M] () -- C:\WINDOWS.0\System32\secustat.dat
[2011-08-25 16:29:02 | 000,002,942 | ---- | M] () -- C:\WINDOWS.0\System32\secushr.dat
[2011-08-23 17:38:35 | 000,027,769 | ---- | C] () -- C:\Documents and Settings\adm\Dane aplikacji\72AA.956
[2011-08-20 15:44:35 | 403,778,820 | ---- | C] () -- C:\Documents and Settings\adm\Moje dokumenty\aqw.uha
[2011-04-19 21:53:37 | 000,014,642 | -HS- | C] () -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\64uy677iby72x2r4gj86f3kdb27y451070j3kvldf2
[2011-04-19 21:53:37 | 000,014,642 | -HS- | C] () -- C:\Documents and Settings\adm\Ustawienia lokalne\Dane aplikacji\64uy677iby72x2r4gj86f3kdb27y451070j3kvldf2
[2011-04-10 14:31:45 | 000,000,644 | ---- | C] () -- C:\WINDOWS.0\System32\secustat.dat
[2011-02-21 17:24:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\Wru
[2011-08-26 18:50:40 | 000,000,258 | ---- | M] () -- C:\WINDOWS.0\Tasks\WGASetup.job

:Commands
[emptytemp]
[emptyflash]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia (zawartość notatnika, która otworzy się po restarcie).

**Posty:** 143 · przez **Cipher** 26 Sie 2011, 20:45

Usunałem to co pisałeś (poza imesh mediabar, ktrego nie ma - musiałem wczesniej kiedyś pewnei usunąci został tylko jakiś ślad).

przy wykonaj skrypt blue screen i reset...

**Posty:** 2183 · przez **NieWiem** 26 Sie 2011, 20:57

czy po resecie komputer chodzi normalnie?
spróbuj powtórzyć wykonanie skryptu.

**Posty:** 143 · przez **Cipher** 26 Sie 2011, 21:44

tak chodzi normalnie żadnych innych komplikacji, przy ponownej próbie znów to samo

nie wiem czy to ma jakiś związek ale pojawiają mi sie ikony takie w stylu ukrytych tzn. wiecie jak wygląda ikona gdy dajemy wytnij lub gdy włączamy pokazywanie ukrytych folderów? tak jakby były troche mniej wyraziste, przezroczyste.

kilka takich ikon pojawiło mi się niz tego ni z owego w moich dokumentach to jakieś zdjecia ktorych nigdy nei sciagalem, wczesniej był tez jakis plik typu windowsowskiego na pulpicie w takim stylu

**Posty:** 2183 · przez **NieWiem** 26 Sie 2011, 21:48

Dobrze, w takim razie spróbujemy zrobić to innymi metodami.

Pobierz AVZ od Z-Olega
link

Wypakuj na pulpicie i uruchom. Zrób aktualizację wciskając przycisk

Jeśli zwróci błąd, wybierz inne źródło.

Potem idź do menu File - wybierz Standard Scripts.
Zaznacz opcję Advanced System Analysis i wybierz Execute selected Scripts. Zatwierdź i poczekaj na ukończenie pracy.

Idź do Folderu avz4, znajdź folder LOG. Znajdziesz tam plik virusinfo_syscheck.zip - wrzuć go na http://www.speedyshare.com i podaj mi linka do paczki.

**Posty:** 143 · przez **Cipher** 26 Sie 2011, 22:53

aktualizacja zrobiła się bez błędu

http://www.speedyshare.com/files/30050767/virusinfo_syscheck.zip

**Posty:** 2183 · przez **NieWiem** 27 Sie 2011, 09:52

Wiemy już wszystko. Na pewno będzie Cię czekała zmiana wszystkich haseł, ponieważ trojany które siedzą u Ciebie zajmują się ich wykradaniem. Al,e to później, jak już je usuniemy.

Będziemy robić dość delikatną operację ponieważ podmienione są bardzo ważne komponenty systemowe, więc trzy razy się upewnij że wszystko dobrze zrobiłeś. Rób dokładnie w takiej kolejności jak podaję.

Otwórz systemowy notatnik (notepad.exe) i wklej do niego następujący tekst:

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "shell"="explorer.exe"

Plik - zapisz jako - typ: wszystkie pliki - nazwa: fix.reg
Następnie plik ten zapisz bezpośrednio na dysku C: bo tak będzie w komendach.

Pobierz The Avenger od swandog46:

download

Upewnij się że opcja "Scan for rootkits" jest zaznaczona.

W głównym oknie programu wklej:

Kod: Zaznacz wszystko: Files to delete: C:\Documents and Settings\adm\Dane aplikacji\dwm.exe C:\Documents and Settings\adm\Ustawienia lokalne\Temp\csrss.exe C:\Documents and Settings\adm\Dane aplikacji\Microsoft\conhost.exe Programs to launch on reboot: C:\fix.reg

Kliknij Execute i zaakceptuj restart.
Komputer może się uruchomić nawet dwa razy podczas tego rstartu.

Wklej raport z operacji. Wykonaj także nowego loga z OTL, jak za pierwszym razem.

**Posty:** 143 · przez **Cipher** 27 Sie 2011, 10:39

Zrobiłem tak jak piszesz i po restarcie info czy chce dodac wpisy fix.reg do rejestru - dałem tak.

nastepnie dzieje sie to co dzialo sie wczoraj gdy moj antywirus 'zajal' sie tymi zarazonymi plikami, jest informacja ze brakuje pliku csrss.exe i znów nie działa mi połaczenie z internetem

teraz zalogowałem sie na drugi system ktory mam na komputerze i stad pisze tego posta. nei wiem czy da sie tamto jakos naprawic czy znow bede musial ratowac sie przywracaniem systemu?

**Posty:** 18165 · przez **wojtas** 27 Sie 2011, 13:12

daj nowe logi

i wyniki operacji

**Posty:** 143 · przez **Cipher** 27 Sie 2011, 13:34

Kod: Zaznacz wszystko: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! File "C:\Documents and Settings\adm\Dane aplikacji\dwm.exe" deleted successfully. File "C:\Documents and Settings\adm\Ustawienia lokalne\Temp\csrss.exe" deleted successfully. File "C:\Documents and Settings\adm\Dane aplikacji\Microsoft\conhost.exe" deleted successfully. Program "C:\fix.reg" successfully queued to run on reboot. Completed script processing. ******************* Finished! Terminate.

Kod: Zaznacz wszystko: OTL logfile created on: 2011-08-28 13:24:00 - Run 2 OTL by OldTimer - Version 3.2.26.5 Folder = C:\Documents and Settings\adm\Moje dokumenty\Pobieranie Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 2,00 Gb Total Physical Memory | 1,59 Gb Available Physical Memory | 79,67% Memory free 3,85 Gb Paging File | 3,54 Gb Available in Paging File | 92,09% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS.0 | %ProgramFiles% = C:\Program Files Drive C: | 149,04 Gb Total Space | 13,47 Gb Free Space | 9,04% Space Free | Partition Type: NTFS Computer Name: SDF-4CFC9C4B323 | User Name: adm | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2011-08-26 18:53:21 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\adm\Moje dokumenty\Pobieranie\OTL.exe PRC - [2011-06-30 12:17:30 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe PRC - [2011-05-01 10:35:23 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe PRC - [2011-01-31 14:31:24 | 000,273,544 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe PRC - [2010-09-22 18:12:16 | 000,015,800 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Adobe\Reader 9.0\Reader\AcroRd32Info.exe PRC - [2010-08-02 16:09:55 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe PRC - [2010-07-29 12:20:16 | 000,238,952 | ---- | M] (Teruten) -- C:\WINDOWS.0\system32\FsUsbExService.Exe PRC - [2010-07-29 12:17:08 | 000,095,576 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe PRC - [2010-01-14 22:11:00 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe PRC - [2008-06-16 02:02:00 | 000,135,168 | ---- | M] (Vimicro Corporation) -- C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe PRC - [2008-04-14 21:21:18 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS.0\explorer.exe PRC - [2007-04-23 19:19:50 | 002,165,536 | ---- | M] (Palit Microsystems, Inc.) -- C:\Program Files\VDOTool\TBPANEL.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2010-09-22 21:12:20 | 000,016,832 | ---- | M] () -- C:\Program Files\Adobe\Reader 9.0\Reader\ViewerPS.dll MOD - [2010-06-17 15:27:22 | 000,355,688 | ---- | M] () -- C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll MOD - [2009-12-22 01:27:38 | 007,528,448 | ---- | M] () -- c:\Program Files\Adobe\Reader 9.0\Reader\RdLang32.POL MOD - [2009-02-27 20:04:20 | 000,311,296 | ---- | M] () -- C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\pdfshell.POL MOD - [2009-02-27 13:52:56 | 000,258,048 | ---- | M] () -- C:\Program Files\Adobe\Reader 9.0\Reader\sqlite.dll MOD - [2009-01-18 15:50:02 | 000,417,792 | ---- | M] () -- C:\Program Files\Adobe\Reader 9.0\Reader\AdobeXMP.dll MOD - [2008-04-14 21:20:38 | 000,014,336 | ---- | M] () -- C:\WINDOWS.0\system32\msdmo.dll MOD - [1998-10-31 04:55:56 | 000,005,120 | ---- | M] () -- C:\Program Files\VDOTool\TBMANAGE.DLL [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Disabled | Stopped] -- -- (HidServ) SRV - [2011-06-30 12:17:30 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011-05-01 10:35:23 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010-07-29 12:20:16 | 000,238,952 | ---- | M] (Teruten) [Auto | Running] -- C:\WINDOWS.0\system32\FsUsbExService.Exe -- (FsUsbExService) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2011-06-30 12:17:31 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS.0\system32\drivers\avipbb.sys -- (avipbb) DRV - [2011-06-30 12:17:31 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS.0\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2010-12-18 15:33:56 | 000,021,696 | ---- | M] (Almico Software) [Kernel | Boot | Running] -- C:\WINDOWS.0\system32\speedfan.sys -- (speedfan) DRV - [2010-06-17 15:27:22 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS.0\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010-06-17 15:27:12 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2010-06-14 05:02:54 | 000,036,608 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS.0\system32\FsUsbExDisk.Sys -- (FsUsbExDisk) DRV - [2009-09-21 13:25:36 | 000,121,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS.0\system32\drivers\ss_bmdm.sys -- (ss_bmdm) DRV - [2009-09-21 13:25:36 | 000,090,112 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS.0\system32\drivers\ss_bbus.sys -- (ss_bbus) SAMSUNG USB Mobile Device (WDM) DRV - [2009-09-21 13:25:36 | 000,014,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS.0\system32\drivers\ss_bmdfl.sys -- (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter) DRV - [2008-06-16 01:58:00 | 000,476,160 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS.0\system32\drivers\vvftUVC.sys -- (vvftUVC) DRV - [2008-06-16 01:58:00 | 000,250,240 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS.0\system32\drivers\VMUVC.sys -- (VMUVC) DRV - [2007-07-24 12:15:20 | 000,328,824 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\WINDOWS.0\system32\drivers\ACEDRV10.sys -- (acedrv10) DRV - [2007-07-11 12:50:26 | 000,201,848 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\WINDOWS.0\system32\drivers\acehlp10.sys -- (acehlp10) DRV - [2007-03-16 10:11:38 | 000,012,256 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS.0\System32\drivers\TBPanel.sys -- (TBPanel) DRV - [2007-03-16 10:11:38 | 000,012,256 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS.0\system32\drivers\TBPanel.sys -- (Cardex) DRV - [2006-08-14 14:51:28 | 000,105,344 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS.0\system32\DRIVERS\nvata.sys -- (nvata) DRV - [2006-07-11 21:38:30 | 000,020,480 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS.0\system32\drivers\nvnetbus.sys -- (nvnetbus) DRV - [2006-07-11 21:38:28 | 000,057,856 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS.0\system32\drivers\NVENETFD.sys -- (NVENETFD) DRV - [2006-03-18 10:18:00 | 000,392,960 | R--- | M] (Sensaura) [Kernel | On_Demand | Running] -- C:\WINDOWS.0\system32\drivers\senfilt.sys -- (SenFiltService) DRV - [1996-04-04 00:03:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS.0\system32\giveio.sys -- (giveio) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:56545 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultengine: "Web Search" FF - prefs.js..browser.search.defaultenginename: "Web Search" FF - prefs.js..browser.search.order.1: "Web Search" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://startsear.ch/?aff=1" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.2 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {1FD91A9C-410C-4090-BBCC-55D3450EF433}:1.0 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.9 FF - prefs.js..keyword.URL: "http://search.bearshare.com/web?src=ffb&systemid=2&q=" FF - prefs.js..network.proxy.http: "127.0.0.1" FF - prefs.js..network.proxy.http_port: 56545 FF - prefs.js..network.proxy.type: 1 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS.0\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60129.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS.0\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.633: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.633: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.633: C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.633: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-01-31 14:31:34 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011-08-24 23:19:12 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011-08-26 19:40:05 | 000,000,000 | ---D | M] [2011-08-26 19:39:11 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Extensions [2011-08-26 19:39:21 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\extensions [2011-07-15 14:47:32 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2011-04-03 17:04:28 | 000,000,000 | ---D | M] (vShare) -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\extensions\vshare@toolbar [2010-09-14 17:18:25 | 000,002,506 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\searchplugins\BearShareWebSearch.xml [2010-09-02 12:39:28 | 000,002,486 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\searchplugins\iMeshWebSearch.xml [2011-07-11 22:34:02 | 000,000,633 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\searchplugins\startsear.xml [2011-04-25 12:53:15 | 000,001,583 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\searchplugins\web-search.xml [2011-08-26 19:39:11 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2010-12-05 17:44:23 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} File not found (No name found) -- [2011-02-05 17:12:34 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2011-02-18 11:15:33 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS.0\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION [2011-08-12 11:02:21 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2010-08-20 13:35:08 | 000,636,408 | ---- | M] (Ganymede Technologies) -- C:\Program Files\mozilla firefox\plugins\NPBILLARD8.dll [2010-12-05 17:44:15 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2011-08-12 08:21:25 | 000,002,767 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml [2010-09-14 17:18:25 | 000,002,506 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\BearShareWebSearch.xml [2011-08-12 08:21:25 | 000,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml [2010-09-02 12:39:28 | 000,002,486 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\iMeshWebSearch.xml [2011-08-12 08:21:25 | 000,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml [2011-08-12 08:21:25 | 000,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml [2011-08-12 08:21:25 | 000,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml [2011-08-12 08:21:25 | 000,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2001-10-26 16:15:16 | 000,000,742 | ---- | M]) - C:\WINDOWS.0\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (MediaBar) - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - File not found O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.) O2 - BHO: (FlashGetBHO) - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Documents and Settings\adm\Dane aplikacji\FlashGetBHO\FlashGetBHO3.dll (Trend Media Group) O2 - BHO: (MediaBar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - File not found O3 - HKLM\..\Toolbar: (no name) - !{2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found. O3 - HKLM\..\Toolbar: (no name) - !{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - No CLSID value found. O3 - HKLM\..\Toolbar: (MediaBar) - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - File not found O3 - HKLM\..\Toolbar: (MediaBar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - File not found O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found. O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [conhost] File not found O4 - HKLM..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe (Palit Microsystems, Inc.) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS.0\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS.0\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS.0\System32\nwiz.exe () O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [VMonitorVMUVC] C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe (Vimicro Corporation) O4 - HKCU..\Run: [Abami] C:\WINDOWS.0\qademsn.dll (Agere Systems) O4 - HKCU..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.) F3 - HKCU WinNT: Load - (C:\DOCUME~1\adm\USTAWI~1\Temp\csrss.exe) - File not found O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Download all by FlashGet3 - C:\Documents and Settings\adm\Dane aplikacji\FlashGetBHO\GetAllUrl.htm () O8 - Extra context menu item: Download by FlashGet3 - C:\Documents and Settings\adm\Dane aplikacji\FlashGetBHO\GetUrl.htm () O8 - Extra context menu item: Funkcja Google Sidewiki - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll (Google Inc.) O8 - Extra context menu item: 使用快车3下载 - C:\Documents and Settings\adm\Dane aplikacji\FlashGetBHO\GetUrl.htm () O8 - Extra context menu item: 使用快车3下载全部链接 - C:\Documents and Settings\adm\Dane aplikacji\FlashGetBHO\GetAllUrl.htm () O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.204.159.1 194.204.152.34 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS.0\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS.0\system32\userinit.exe) - C:\WINDOWS.0\system32\userinit.exe (Microsoft Corporation) O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\WINDOWS.0\explorer.exe (Microsoft Corporation) O20 - HKCU Winlogon: Shell - (C:\Documents and Settings\adm\Dane aplikacji\dwm.exe) - File not found O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\WINDOWS.0\Web\Wallpaper\Idylla.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS.0\Web\Wallpaper\Idylla.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010-12-05 13:43:07 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O35 - HKCU\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKCU\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2011-08-28 10:27:55 | 000,000,000 | ---D | C] -- C:\Avenger [2011-08-27 22:41:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\adm\Pulpit\avz4 [2011-08-27 00:09:09 | 000,000,000 | ---D | C] -- C:\_OTL [2011-08-26 17:05:51 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\adm\Dane aplikacji\SecuROM [2011-08-25 14:31:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\adm\Ustawienia lokalne\Dane aplikacji\Wheelman [2011-08-25 14:31:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\adm\Ustawienia lokalne\Dane aplikacji\PC [2011-08-25 14:04:35 | 000,000,000 | ---D | C] -- C:\Program Files\Midway Games [2011-08-20 13:07:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS.0\Menu Start\Programy\7-Zip [2011-08-20 13:07:32 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip [2011-08-16 11:08:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\adm\Pulpit\lapt [2011-08-04 18:54:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\RDRM [2011-08-04 18:48:27 | 000,000,000 | ---D | C] -- C:\Program Files\PlayReady [2011-07-31 14:14:13 | 000,000,000 | ---D | C] -- C:\foty [2010-12-26 13:27:05 | 016,528,896 | ---- | C] (Spellbound Entertainment AG) -- C:\Program Files\Arcania.exe [2010-12-26 13:26:57 | 000,279,880 | ---- | C] (Sony DADC Austria AG) -- C:\Program Files\paul.dll [4 C:\WINDOWS.0\*.tmp files -> C:\WINDOWS.0\*.tmp -> ] [1 C:\WINDOWS.0\System32\*.tmp files -> C:\WINDOWS.0\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2011-08-28 13:26:24 | 000,000,558 | ---- | M] () -- C:\WINDOWS.0\DFC.INI [2011-08-28 13:21:22 | 000,000,258 | ---- | M] () -- C:\WINDOWS.0\tasks\WGASetup.job [2011-08-28 13:21:14 | 000,001,026 | ---- | M] () -- C:\WINDOWS.0\tasks\GoogleUpdateTaskMachineCore.job [2011-08-28 13:21:14 | 000,000,274 | ---- | M] () -- C:\WINDOWS.0\tasks\RealUpgradeLogonTaskS-1-5-21-1454471165-790525478-1417001333-1003.job [2011-08-28 13:21:12 | 000,002,048 | --S- | M] () -- C:\WINDOWS.0\bootstat.dat [2011-08-28 10:30:00 | 000,001,030 | ---- | M] () -- C:\WINDOWS.0\tasks\GoogleUpdateTaskMachineUA.job [2011-08-28 10:26:23 | 000,000,138 | ---- | M] () -- C:\fix.reg [2011-08-28 09:29:05 | 000,002,206 | ---- | M] () -- C:\WINDOWS.0\System32\wpa.dbl [2011-08-27 22:53:27 | 000,000,282 | ---- | M] () -- C:\WINDOWS.0\tasks\RealUpgradeScheduledTaskS-1-5-21-1454471165-790525478-1417001333-1003.job [2011-08-25 22:01:30 | 000,208,332 | ---- | M] () -- C:\Documents and Settings\adm\Pulpit\36c80ac8d910900bfed9.jpg [2011-08-25 21:55:42 | 000,929,538 | ---- | M] () -- C:\Documents and Settings\adm\Pulpit\c374a5cf8f47e3dc2a09.jpg [2011-08-25 21:55:25 | 000,821,220 | ---- | M] () -- C:\Documents and Settings\adm\Pulpit\5cb6724fe97b1f37bbdf.jpg [2011-08-25 21:50:43 | 000,027,769 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\72AA.956 [2011-08-25 21:47:05 | 000,481,714 | ---- | M] () -- C:\Documents and Settings\adm\Pulpit\tapetahx9.jpg [2011-08-25 16:43:54 | 000,000,644 | ---- | M] () -- C:\WINDOWS.0\System32\secustat.dat [2011-08-25 16:29:02 | 000,002,942 | ---- | M] () -- C:\WINDOWS.0\System32\secushr.dat [2011-08-24 17:36:32 | 000,030,208 | ---- | M] () -- C:\Documents and Settings\adm\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011-08-20 16:00:59 | 403,778,820 | ---- | M] () -- C:\Documents and Settings\adm\Moje dokumenty\aqw.uha [2011-08-19 14:43:56 | 000,024,241 | ---- | M] () -- C:\Documents and Settings\adm\Pulpit\92164222.jpg [2011-08-15 13:32:00 | 000,000,803 | ---- | M] () -- C:\Documents and Settings\adm\Pulpit\Internet Explorer.lnk [4 C:\WINDOWS.0\*.tmp files -> C:\WINDOWS.0\*.tmp -> ] [1 C:\WINDOWS.0\System32\*.tmp files -> C:\WINDOWS.0\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2011-08-28 10:26:23 | 000,000,138 | ---- | C] () -- C:\fix.reg [2011-08-25 22:01:29 | 000,208,332 | ---- | C] () -- C:\Documents and Settings\adm\Pulpit\36c80ac8d910900bfed9.jpg [2011-08-25 21:55:41 | 000,929,538 | ---- | C] () -- C:\Documents and Settings\adm\Pulpit\c374a5cf8f47e3dc2a09.jpg [2011-08-25 21:55:24 | 000,821,220 | ---- | C] () -- C:\Documents and Settings\adm\Pulpit\5cb6724fe97b1f37bbdf.jpg [2011-08-25 21:47:04 | 000,481,714 | ---- | C] () -- C:\Documents and Settings\adm\Pulpit\tapetahx9.jpg [2011-08-25 16:06:57 | 000,002,942 | ---- | C] () -- C:\WINDOWS.0\System32\secushr.dat [2011-08-24 23:19:13 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS.0\Menu Start\Programy\Mozilla Firefox.lnk [2011-08-23 17:38:35 | 000,027,769 | ---- | C] () -- C:\Documents and Settings\adm\Dane aplikacji\72AA.956 [2011-08-20 15:44:35 | 403,778,820 | ---- | C] () -- C:\Documents and Settings\adm\Moje dokumenty\aqw.uha [2011-08-19 14:43:56 | 000,024,241 | ---- | C] () -- C:\Documents and Settings\adm\Pulpit\92164222.jpg [2011-08-15 13:32:00 | 000,000,803 | ---- | C] () -- C:\Documents and Settings\adm\Pulpit\Internet Explorer.lnk [2011-04-19 21:53:37 | 000,014,642 | -HS- | C] () -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\64uy677iby72x2r4gj86f3kdb27y451070j3kvldf2 [2011-04-19 21:53:37 | 000,014,642 | -HS- | C] () -- C:\Documents and Settings\adm\Ustawienia lokalne\Dane aplikacji\64uy677iby72x2r4gj86f3kdb27y451070j3kvldf2 [2011-04-10 14:31:45 | 000,000,644 | ---- | C] () -- C:\WINDOWS.0\System32\secustat.dat [2011-04-10 14:26:11 | 000,000,025 | ---- | C] () -- C:\WINDOWS.0\libem.INI [2011-03-22 19:20:45 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\adm\Dane aplikacji\$_hpcst$.hpc [2011-03-22 19:20:41 | 000,110,592 | ---- | C] () -- C:\WINDOWS.0\System32\FsUsbExDevice.Dll [2011-03-22 19:20:41 | 000,036,608 | ---- | C] () -- C:\WINDOWS.0\System32\FsUsbExDisk.Sys [2011-02-20 10:24:48 | 000,069,632 | ---- | C] () -- C:\WINDOWS.0\System32\xmltok.dll [2011-02-20 10:24:48 | 000,036,864 | ---- | C] () -- C:\WINDOWS.0\System32\xmlparse.dll [2011-02-11 12:09:49 | 000,123,392 | ---- | C] () -- C:\WINDOWS.0\System32\UnCasino5.exe [2011-02-07 16:38:54 | 000,000,056 | -H-- | C] () -- C:\WINDOWS.0\System32\ezsidmv.dat [2011-01-31 15:54:46 | 000,146,136 | ---- | C] () -- C:\WINDOWS.0\hpoins27.dat [2011-01-31 15:54:46 | 000,000,932 | ---- | C] () -- C:\WINDOWS.0\hpomdl27.dat [2011-01-31 15:07:23 | 000,030,208 | ---- | C] () -- C:\Documents and Settings\adm\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011-01-31 15:07:12 | 000,165,376 | ---- | C] () -- C:\WINDOWS.0\System32\unrar.dll [2011-01-31 15:07:12 | 000,000,038 | ---- | C] () -- C:\WINDOWS.0\avisplitter.ini [2011-01-31 15:07:09 | 000,810,496 | ---- | C] () -- C:\WINDOWS.0\System32\xvidcore.dll [2011-01-31 15:07:09 | 000,183,808 | ---- | C] () -- C:\WINDOWS.0\System32\xvidvfw.dll [2011-01-31 15:07:09 | 000,080,896 | ---- | C] () -- C:\WINDOWS.0\System32\ff_vfw.dll [2011-01-30 23:30:03 | 000,004,381 | ---- | C] () -- C:\WINDOWS.0\ODBCINST.INI [2011-01-30 23:27:12 | 000,269,392 | ---- | C] () -- C:\WINDOWS.0\System32\FNTCACHE.DAT [2011-01-30 23:17:41 | 000,000,004 | ---- | C] () -- C:\WINDOWS.0\System32\proc-503976190.bin [2011-01-30 23:15:22 | 000,000,000 | ---- | C] () -- C:\WINDOWS.0\nsreg.dat [2011-01-30 22:56:29 | 000,000,558 | ---- | C] () -- C:\WINDOWS.0\DFC.INI [2011-01-30 22:54:36 | 001,626,112 | ---- | C] () -- C:\WINDOWS.0\System32\nwiz.exe [2011-01-30 22:54:36 | 001,339,392 | ---- | C] () -- C:\WINDOWS.0\System32\nvdspsch.exe [2011-01-30 22:54:36 | 000,442,368 | ---- | C] () -- C:\WINDOWS.0\System32\nvappbar.exe [2011-01-30 22:54:36 | 000,425,984 | ---- | C] () -- C:\WINDOWS.0\System32\keystone.exe [2011-01-30 22:54:34 | 001,703,936 | ---- | C] () -- C:\WINDOWS.0\System32\nvwdmcpl.dll [2011-01-30 22:54:34 | 001,474,560 | ---- | C] () -- C:\WINDOWS.0\System32\nview.dll [2011-01-30 22:54:34 | 001,019,904 | ---- | C] () -- C:\WINDOWS.0\System32\nvwimg.dll [2011-01-30 22:54:34 | 000,466,944 | ---- | C] () -- C:\WINDOWS.0\System32\nvshell.dll [2011-01-30 22:54:34 | 000,286,720 | ---- | C] () -- C:\WINDOWS.0\System32\nvnt4cpl.dll [2011-01-30 22:54:33 | 000,929,744 | ---- | C] () -- C:\WINDOWS.0\System32\nvucode.bin [2011-01-30 22:42:07 | 000,002,048 | --S- | C] () -- C:\WINDOWS.0\bootstat.dat [2011-01-30 22:35:14 | 000,021,856 | ---- | C] () -- C:\WINDOWS.0\System32\emptyregdb.dat [2010-12-28 00:28:24 | 002,698,827 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-S-1-5-21-1659004503-1580818891-682003330-1003-0.dat [2010-12-27 01:19:26 | 000,837,498 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-System.dat [2010-12-26 13:27:05 | 000,300,460 | ---- | C] () -- C:\Program Files\dfe [2010-12-26 13:26:57 | 001,085,440 | ---- | C] () -- C:\Program Files\rldata.dll [2010-12-26 13:26:57 | 000,190,976 | ---- | C] () -- C:\Program Files\rld.dll [2010-12-26 13:26:57 | 000,153,046 | ---- | C] () -- C:\Program Files\lang.ini [2010-12-26 13:26:57 | 000,043,874 | ---- | C] () -- C:\Program Files\GameServices.ini [2010-12-26 13:26:49 | 093,153,894 | ---- | C] () -- C:\Program Files\Crack.zip [2009-08-21 16:58:40 | 000,122,880 | ---- | C] () -- C:\WINDOWS.0\System32\AitVirtualComInstall.exe [2009-07-20 20:10:48 | 000,307,200 | ---- | C] () -- C:\WINDOWS.0\System32\InstallVCOM.exe [2008-05-04 17:39:34 | 000,002,560 | ---- | C] () -- C:\WINDOWS.0\System32\ViaClassCoInstaller.dll [2008-04-14 21:46:20 | 000,001,804 | ---- | C] () -- C:\WINDOWS.0\System32\Dcache.bin [2007-10-25 17:26:10 | 000,005,632 | ---- | C] () -- C:\WINDOWS.0\System32\drivers\StarOpen.sys [2006-12-31 06:27:08 | 000,004,569 | ---- | C] () -- C:\WINDOWS.0\System32\secupd.dat [2001-10-26 16:45:16 | 000,533,814 | ---- | C] () -- C:\WINDOWS.0\System32\perfh015.dat [2001-10-26 16:45:16 | 000,313,828 | ---- | C] () -- C:\WINDOWS.0\System32\perfi015.dat [2001-10-26 16:45:16 | 000,093,818 | ---- | C] () -- C:\WINDOWS.0\System32\perfc015.dat [2001-10-26 16:45:16 | 000,034,990 | ---- | C] () -- C:\WINDOWS.0\System32\perfd015.dat [2001-08-23 13:30:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS.0\System32\oembios.bin [2001-08-23 13:30:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS.0\System32\oembios.dat [2001-08-17 22:00:24 | 000,474,168 | ---- | C] () -- C:\WINDOWS.0\System32\perfh009.dat [2001-08-17 22:00:24 | 000,272,128 | ---- | C] () -- C:\WINDOWS.0\System32\perfi009.dat [2001-08-17 22:00:24 | 000,028,626 | ---- | C] () -- C:\WINDOWS.0\System32\perfd009.dat [2001-08-17 22:00:22 | 000,075,856 | ---- | C] () -- C:\WINDOWS.0\System32\perfc009.dat [2001-08-17 21:45:38 | 000,046,258 | ---- | C] () -- C:\WINDOWS.0\System32\mib.bin [2001-07-21 23:06:48 | 000,218,003 | ---- | C] () -- C:\WINDOWS.0\System32\dssec.dat [2001-07-21 23:06:04 | 000,673,088 | ---- | C] () -- C:\WINDOWS.0\System32\mlang.dat [2001-07-21 22:54:16 | 000,000,741 | ---- | C] () -- C:\WINDOWS.0\System32\noise.dat [1996-04-04 00:03:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS.0\System32\giveio.sys [color=#E56717]========== LOP Check ==========[/color] [2011-01-30 18:18:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\2K Sports [2011-06-18 15:44:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Auslogics [2011-08-26 17:05:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\BITS [2011-04-29 18:12:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\bsbandmltbpi [2011-04-25 12:16:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\BSplayer [2011-02-07 20:40:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\DAEMON Tools Lite [2011-07-09 13:33:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Dev-Cpp [2011-04-10 14:25:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\FlashGet [2011-04-10 14:25:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\FlashGetBHO [2011-08-23 17:11:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Gadu-Gadu 10 [2011-04-10 19:52:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Games [2011-01-30 23:17:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\GanymedeNet [2011-07-16 14:22:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\imeshbandmltbpi [2011-08-25 12:02:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\ipla [2011-04-05 17:24:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\ML [2011-01-30 19:52:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Opera [2011-08-04 18:53:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\RDRM [2011-03-12 11:35:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Samsung [2011-03-20 13:51:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Scilab [2011-02-07 19:52:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Sports Interactive [2011-04-26 00:41:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\uTorrent [2011-04-10 19:50:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\AlawarWrapper [2011-02-07 19:53:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\DAEMON Tools Lite [2011-02-24 18:17:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\Gadu-Gadu 10 [2011-08-04 18:53:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\ipla [2011-06-10 12:06:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\MGS [2011-08-04 18:54:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\RDRM [2011-03-22 19:34:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\Samsung [2011-02-07 19:54:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\Sports Interactive [2011-08-28 13:21:22 | 000,000,258 | ---- | M] () -- C:\WINDOWS.0\Tasks\WGASetup.job [color=#E56717]========== Purity Check ==========[/color] < End of report >

**Posty:** 18165 · przez **wojtas** 27 Sie 2011, 17:15

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej: (jak bedzie reset spróbuj a awaryjnym)

rocesses
killallprocesses

:OTL
FF - prefs.js..browser.search.defaultengine: "Web Search"
FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..keyword.URL: "http://search.bearshare.com/web?src=ffb&systemid=2&q="
[2010-09-14 17:18:25 | 000,002,506 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\searchplugins\BearShareWebSearch.xml
[2010-09-02 12:39:28 | 000,002,486 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\searchplugins\iMeshWebSearch.xml
[2011-07-11 22:34:02 | 000,000,633 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\searchplugins\startsear.xml
[2011-04-25 12:53:15 | 000,001,583 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\searchplugins\web-search.xml
[2010-09-14 17:18:25 | 000,002,506 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\BearShareWebSearch.xml
[2010-09-02 12:39:28 | 000,002,486 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\iMeshWebSearch.xml
O2 - BHO: (MediaBar) - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - File not found
O2 - BHO: (MediaBar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - File not found
O3 - HKLM\..\Toolbar: (no name) - !{2318C2B1-4965-11d4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - !{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} - No CLSID value found.
O3 - HKLM\..\Toolbar: (MediaBar) - {28387537-e3f9-4ed7-860c-11e69af4a8a0} - File not found
O3 - HKLM\..\Toolbar: (MediaBar) - {c2d64ff7-0ab8-4263-89c9-ea3b0f8f050c} - File not found
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O4 - HKLM..\Run: [conhost] File not found
F3 - HKCU WinNT: Load - (C:\DOCUME~1\adm\USTAWI~1\Temp\csrss.exe) - File not found
O4 - HKCU..\Run: [Abami] C:\WINDOWS.0\qademsn.dll (Agere Systems)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O20 - HKCU Winlogon: Shell - (C:\Documents and Settings\adm\Dane aplikacji\dwm.exe) - File not found
[2011-08-25 16:43:54 | 000,000,644 | ---- | M] () -- C:\WINDOWS.0\System32\secustat.dat
[2011-08-25 16:29:02 | 000,002,942 | ---- | M] () -- C:\WINDOWS.0\System32\secushr.da
[2011-04-19 21:53:37 | 000,014,642 | -HS- | C] () -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\64uy677iby72x2r4gj86f3kdb27y451070j3kvldf2
[2011-04-19 21:53:37 | 000,014,642 | -HS- | C] () -- C:\Documents and Settings\adm\Ustawienia lokalne\Dane aplikacji\64uy677iby72x2r4gj86f3kdb27y451070j3kvldf2
[2011-04-10 14:31:45 | 000,000,644 | ---- | C] () -- C:\WINDOWS.0\System32\secustat.dat

:Commands
[emptytemp]
[emptyflash]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia (zawartość notatnika, która otworzy się po restarcie).

**Posty:** 143 · przez **Cipher** 27 Sie 2011, 17:56

co tam ma byc gdzie usmieszek?

**Posty:** 18165 · przez **wojtas** 27 Sie 2011, 18:50

jak skopiujesz bedzie wszystko dobrze...

**Posty:** 143 · przez **Cipher** 27 Sie 2011, 20:18

Zrobiło się bez reseta ale po resecie zapomniałem zapisać loga z wykonywania tego skryptu (da się go jakoś teraz odzyskać?), pisało coś w pierwsze linijce, że 'all cośtam killed'

log z kolejnego skanowania

Kod: Zaznacz wszystko: OTL logfile created on: 2011-08-28 20:09:01 - Run 3 OTL by OldTimer - Version 3.2.26.5 Folder = C:\Documents and Settings\adm\Moje dokumenty\Pobieranie Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 7.0.5730.13) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 2,00 Gb Total Physical Memory | 1,62 Gb Available Physical Memory | 80,99% Memory free 3,85 Gb Paging File | 3,56 Gb Available in Paging File | 92,57% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS.0 | %ProgramFiles% = C:\Program Files Drive C: | 149,04 Gb Total Space | 17,79 Gb Free Space | 11,94% Space Free | Partition Type: NTFS Computer Name: SDF-4CFC9C4B323 | User Name: adm | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2011-08-26 18:53:21 | 000,580,096 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\adm\Moje dokumenty\Pobieranie\OTL.exe PRC - [2011-06-30 12:17:30 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe PRC - [2011-05-01 10:35:23 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe PRC - [2011-01-31 14:31:24 | 000,273,544 | ---- | M] (RealNetworks, Inc.) -- C:\Program Files\Real\RealPlayer\Update\realsched.exe PRC - [2010-08-02 16:09:55 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe PRC - [2010-07-29 12:20:16 | 000,238,952 | ---- | M] (Teruten) -- C:\WINDOWS.0\system32\FsUsbExService.Exe PRC - [2010-07-29 12:17:08 | 000,095,576 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe PRC - [2010-01-14 22:11:00 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe PRC - [2008-06-16 02:02:00 | 000,135,168 | ---- | M] (Vimicro Corporation) -- C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe PRC - [2008-04-14 21:21:18 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS.0\explorer.exe PRC - [2007-04-23 19:19:50 | 002,165,536 | ---- | M] (Palit Microsystems, Inc.) -- C:\Program Files\VDOTool\TBPANEL.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2010-06-17 15:27:22 | 000,355,688 | ---- | M] () -- C:\Program Files\Avira\AntiVir Desktop\sqlite3.dll MOD - [2009-02-27 20:04:20 | 000,311,296 | ---- | M] () -- C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\pdfshell.POL MOD - [2008-04-14 21:20:38 | 000,014,336 | ---- | M] () -- C:\WINDOWS.0\system32\msdmo.dll MOD - [1998-10-31 04:55:56 | 000,005,120 | ---- | M] () -- C:\Program Files\VDOTool\TBMANAGE.DLL [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Disabled | Stopped] -- -- (HidServ) SRV - [2011-06-30 12:17:30 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011-05-01 10:35:23 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010-07-29 12:20:16 | 000,238,952 | ---- | M] (Teruten) [Auto | Running] -- C:\WINDOWS.0\system32\FsUsbExService.Exe -- (FsUsbExService) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2011-06-30 12:17:31 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS.0\system32\drivers\avipbb.sys -- (avipbb) DRV - [2011-06-30 12:17:31 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\WINDOWS.0\system32\drivers\avgntflt.sys -- (avgntflt) DRV - [2010-12-18 15:33:56 | 000,021,696 | ---- | M] (Almico Software) [Kernel | Boot | Running] -- C:\WINDOWS.0\system32\speedfan.sys -- (speedfan) DRV - [2010-06-17 15:27:22 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\WINDOWS.0\system32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010-06-17 15:27:12 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio) DRV - [2010-06-14 05:02:54 | 000,036,608 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS.0\system32\FsUsbExDisk.Sys -- (FsUsbExDisk) DRV - [2009-09-21 13:25:36 | 000,121,856 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS.0\system32\drivers\ss_bmdm.sys -- (ss_bmdm) DRV - [2009-09-21 13:25:36 | 000,090,112 | ---- | M] (MCCI) [Kernel | On_Demand | Stopped] -- C:\WINDOWS.0\system32\drivers\ss_bbus.sys -- (ss_bbus) SAMSUNG USB Mobile Device (WDM) DRV - [2009-09-21 13:25:36 | 000,014,976 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS.0\system32\drivers\ss_bmdfl.sys -- (ss_bmdfl) SAMSUNG USB Mobile Modem (Filter) DRV - [2008-06-16 01:58:00 | 000,476,160 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS.0\system32\drivers\vvftUVC.sys -- (vvftUVC) DRV - [2008-06-16 01:58:00 | 000,250,240 | ---- | M] (Vimicro Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS.0\system32\drivers\VMUVC.sys -- (VMUVC) DRV - [2007-07-24 12:15:20 | 000,328,824 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\WINDOWS.0\system32\drivers\ACEDRV10.sys -- (acedrv10) DRV - [2007-07-11 12:50:26 | 000,201,848 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\WINDOWS.0\system32\drivers\acehlp10.sys -- (acehlp10) DRV - [2007-03-16 10:11:38 | 000,012,256 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Auto | Running] -- C:\WINDOWS.0\System32\drivers\TBPanel.sys -- (TBPanel) DRV - [2007-03-16 10:11:38 | 000,012,256 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS.0\system32\drivers\TBPanel.sys -- (Cardex) DRV - [2006-08-14 14:51:28 | 000,105,344 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS.0\system32\DRIVERS\nvata.sys -- (nvata) DRV - [2006-07-11 21:38:30 | 000,020,480 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS.0\system32\drivers\nvnetbus.sys -- (nvnetbus) DRV - [2006-07-11 21:38:28 | 000,057,856 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS.0\system32\drivers\NVENETFD.sys -- (NVENETFD) DRV - [2006-03-18 10:18:00 | 000,392,960 | R--- | M] (Sensaura) [Kernel | On_Demand | Running] -- C:\WINDOWS.0\system32\drivers\senfilt.sys -- (SenFiltService) DRV - [1996-04-04 00:03:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS.0\system32\giveio.sys -- (giveio) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://startsear.ch/?aff=1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:56545 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultengine: "" FF - prefs.js..browser.search.defaultenginename: "" FF - prefs.js..browser.search.order.1: "" FF - prefs.js..browser.search.selectedEngine: "Google" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "http://startsear.ch/?aff=1" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {ABDE892B-13A8-4d1b-88E6-365A6E755758}:14.0.2 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {1FD91A9C-410C-4090-BBCC-55D3450EF433}:1.0 FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.9 FF - prefs.js..network.proxy.http: "127.0.0.1" FF - prefs.js..network.proxy.http_port: 56545 FF - prefs.js..network.proxy.type: 1 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS.0\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60129.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS.0\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=12.0.1.633: C:\Program Files\Real\RealPlayer\Netscape6\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprjplug;version=12.0.1.633: C:\Program Files\Real\RealPlayer\Netscape6\nprjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprphtml5videoshim;version=12.0.1.633: C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\Real\RealPlayer\BrowserRecordPlugin\MozillaPlugins\nprphtml5videoshim.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=12.0.1.633: C:\Program Files\Real\RealPlayer\Netscape6\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\Real\RealPlayer\BrowserRecordPlugin\Firefox\Ext [2011-01-31 14:31:34 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011-08-24 23:19:12 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 6.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011-08-26 19:40:05 | 000,000,000 | ---D | M] [2011-08-26 19:39:11 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Extensions [2011-08-26 19:39:21 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\extensions [2011-07-15 14:47:32 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d} [2011-04-03 17:04:28 | 000,000,000 | ---D | M] (vShare) -- C:\Documents and Settings\adm\Dane aplikacji\Mozilla\Firefox\Profiles\dv4bjz40.default\extensions\vshare@toolbar [2011-08-26 19:39:11 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2010-12-05 17:44:23 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} File not found (No name found) -- [2011-02-05 17:12:34 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2011-02-18 11:15:33 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\WINDOWS.0\MICROSOFT.NET\FRAMEWORK\V3.5\WINDOWS PRESENTATION FOUNDATION\DOTNETASSISTANTEXTENSION [2011-08-12 11:02:21 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2010-08-20 13:35:08 | 000,636,408 | ---- | M] (Ganymede Technologies) -- C:\Program Files\mozilla firefox\plugins\NPBILLARD8.dll [2010-12-05 17:44:15 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2011-08-12 08:21:25 | 000,002,767 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml [2011-08-12 08:21:25 | 000,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml [2011-08-12 08:21:25 | 000,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml [2011-08-12 08:21:25 | 000,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml [2011-08-12 08:21:25 | 000,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml [2011-08-12 08:21:25 | 000,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2001-10-26 16:15:16 | 000,000,742 | ---- | M]) - C:\WINDOWS.0\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll (RealPlayer) O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.6406.1642\swg.dll (Google Inc.) O2 - BHO: (FlashGetBHO) - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Documents and Settings\adm\Dane aplikacji\FlashGetBHO\FlashGetBHO3.dll (Trend Media Group) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe (Palit Microsystems, Inc.) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS.0\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS.0\System32\NvMcTray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS.0\System32\nwiz.exe () O4 - HKLM..\Run: [TkBellExe] C:\Program Files\Real\RealPlayer\update\realsched.exe (RealNetworks, Inc.) O4 - HKLM..\Run: [VMonitorVMUVC] C:\Program Files\Vimicro Corporation\VMUVC\VMonitor.exe (Vimicro Corporation) O4 - HKCU..\Run: [Abami] File not found O4 - HKCU..\Run: [AutoStartNPSAgent] C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Download all by FlashGet3 - C:\Documents and Settings\adm\Dane aplikacji\FlashGetBHO\GetAllUrl.htm () O8 - Extra context menu item: Download by FlashGet3 - C:\Documents and Settings\adm\Dane aplikacji\FlashGetBHO\GetUrl.htm () O8 - Extra context menu item: Funkcja Google Sidewiki - C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll (Google Inc.) O8 - Extra context menu item: 使用快车3下载 - C:\Documents and Settings\adm\Dane aplikacji\FlashGetBHO\GetUrl.htm () O8 - Extra context menu item: 使用快车3下载全部链接 - C:\Documents and Settings\adm\Dane aplikacji\FlashGetBHO\GetAllUrl.htm () O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.204.159.1 194.204.152.34 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\WINDOWS.0\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS.0\system32\userinit.exe) - C:\WINDOWS.0\system32\userinit.exe (Microsoft Corporation) O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\WINDOWS.0\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\WINDOWS.0\Web\Wallpaper\Idylla.bmp O24 - Desktop BackupWallPaper: C:\WINDOWS.0\Web\Wallpaper\Idylla.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010-12-05 13:43:07 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O35 - HKCU\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKCU\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2011-08-28 15:21:38 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro [2011-08-28 15:08:40 | 000,000,000 | ---D | C] -- C:\_OTL [2011-08-28 10:27:55 | 000,000,000 | ---D | C] -- C:\Avenger [2011-08-27 22:41:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\adm\Pulpit\avz4 [2011-08-26 17:05:51 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\adm\Dane aplikacji\SecuROM [2011-08-25 14:31:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\adm\Ustawienia lokalne\Dane aplikacji\Wheelman [2011-08-25 14:31:45 | 000,000,000 | ---D | C] -- C:\Documents and Settings\adm\Ustawienia lokalne\Dane aplikacji\PC [2011-08-25 14:04:35 | 000,000,000 | ---D | C] -- C:\Program Files\Midway Games [2011-08-20 13:07:33 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS.0\Menu Start\Programy\7-Zip [2011-08-20 13:07:32 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip [2011-08-16 11:08:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\adm\Pulpit\lapt [2011-08-04 18:54:05 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\RDRM [2011-08-04 18:48:27 | 000,000,000 | ---D | C] -- C:\Program Files\PlayReady [2011-07-31 14:14:13 | 000,000,000 | ---D | C] -- C:\foty [2010-12-26 13:27:05 | 016,528,896 | ---- | C] (Spellbound Entertainment AG) -- C:\Program Files\Arcania.exe [2010-12-26 13:26:57 | 000,279,880 | ---- | C] (Sony DADC Austria AG) -- C:\Program Files\paul.dll [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2011-08-28 20:11:02 | 000,000,558 | ---- | M] () -- C:\WINDOWS.0\DFC.INI [2011-08-28 20:06:26 | 000,000,258 | ---- | M] () -- C:\WINDOWS.0\tasks\WGASetup.job [2011-08-28 20:05:49 | 000,001,026 | ---- | M] () -- C:\WINDOWS.0\tasks\GoogleUpdateTaskMachineCore.job [2011-08-28 20:05:49 | 000,000,274 | ---- | M] () -- C:\WINDOWS.0\tasks\RealUpgradeLogonTaskS-1-5-21-1454471165-790525478-1417001333-1003.job [2011-08-28 20:05:47 | 000,002,048 | --S- | M] () -- C:\WINDOWS.0\bootstat.dat [2011-08-28 13:30:00 | 000,001,030 | ---- | M] () -- C:\WINDOWS.0\tasks\GoogleUpdateTaskMachineUA.job [2011-08-28 10:26:23 | 000,000,138 | ---- | M] () -- C:\fix.reg [2011-08-28 09:29:05 | 000,002,206 | ---- | M] () -- C:\WINDOWS.0\System32\wpa.dbl [2011-08-27 22:53:27 | 000,000,282 | ---- | M] () -- C:\WINDOWS.0\tasks\RealUpgradeScheduledTaskS-1-5-21-1454471165-790525478-1417001333-1003.job [2011-08-25 22:01:30 | 000,208,332 | ---- | M] () -- C:\Documents and Settings\adm\Pulpit\36c80ac8d910900bfed9.jpg [2011-08-25 21:55:42 | 000,929,538 | ---- | M] () -- C:\Documents and Settings\adm\Pulpit\c374a5cf8f47e3dc2a09.jpg [2011-08-25 21:55:25 | 000,821,220 | ---- | M] () -- C:\Documents and Settings\adm\Pulpit\5cb6724fe97b1f37bbdf.jpg [2011-08-25 21:50:43 | 000,027,769 | ---- | M] () -- C:\Documents and Settings\adm\Dane aplikacji\72AA.956 [2011-08-25 21:47:05 | 000,481,714 | ---- | M] () -- C:\Documents and Settings\adm\Pulpit\tapetahx9.jpg [2011-08-25 16:29:02 | 000,002,942 | ---- | M] () -- C:\WINDOWS.0\System32\secushr.dat [2011-08-24 17:36:32 | 000,030,208 | ---- | M] () -- C:\Documents and Settings\adm\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011-08-20 16:00:59 | 403,778,820 | ---- | M] () -- C:\Documents and Settings\adm\Moje dokumenty\aqw.uha [2011-08-19 14:43:56 | 000,024,241 | ---- | M] () -- C:\Documents and Settings\adm\Pulpit\92164222.jpg [2011-08-15 13:32:00 | 000,000,803 | ---- | M] () -- C:\Documents and Settings\adm\Pulpit\Internet Explorer.lnk [color=#E56717]========== Files Created - No Company Name ==========[/color] [2011-08-28 10:26:23 | 000,000,138 | ---- | C] () -- C:\fix.reg [2011-08-25 22:01:29 | 000,208,332 | ---- | C] () -- C:\Documents and Settings\adm\Pulpit\36c80ac8d910900bfed9.jpg [2011-08-25 21:55:41 | 000,929,538 | ---- | C] () -- C:\Documents and Settings\adm\Pulpit\c374a5cf8f47e3dc2a09.jpg [2011-08-25 21:55:24 | 000,821,220 | ---- | C] () -- C:\Documents and Settings\adm\Pulpit\5cb6724fe97b1f37bbdf.jpg [2011-08-25 21:47:04 | 000,481,714 | ---- | C] () -- C:\Documents and Settings\adm\Pulpit\tapetahx9.jpg [2011-08-25 16:06:57 | 000,002,942 | ---- | C] () -- C:\WINDOWS.0\System32\secushr.dat [2011-08-24 23:19:13 | 000,000,730 | ---- | C] () -- C:\Documents and Settings\All Users.WINDOWS.0\Menu Start\Programy\Mozilla Firefox.lnk [2011-08-23 17:38:35 | 000,027,769 | ---- | C] () -- C:\Documents and Settings\adm\Dane aplikacji\72AA.956 [2011-08-20 15:44:35 | 403,778,820 | ---- | C] () -- C:\Documents and Settings\adm\Moje dokumenty\aqw.uha [2011-08-19 14:43:56 | 000,024,241 | ---- | C] () -- C:\Documents and Settings\adm\Pulpit\92164222.jpg [2011-08-15 13:32:00 | 000,000,803 | ---- | C] () -- C:\Documents and Settings\adm\Pulpit\Internet Explorer.lnk [2011-04-10 14:26:11 | 000,000,025 | ---- | C] () -- C:\WINDOWS.0\libem.INI [2011-03-22 19:20:45 | 000,002,528 | ---- | C] () -- C:\Documents and Settings\adm\Dane aplikacji\$_hpcst$.hpc [2011-03-22 19:20:41 | 000,110,592 | ---- | C] () -- C:\WINDOWS.0\System32\FsUsbExDevice.Dll [2011-03-22 19:20:41 | 000,036,608 | ---- | C] () -- C:\WINDOWS.0\System32\FsUsbExDisk.Sys [2011-02-20 10:24:48 | 000,069,632 | ---- | C] () -- C:\WINDOWS.0\System32\xmltok.dll [2011-02-20 10:24:48 | 000,036,864 | ---- | C] () -- C:\WINDOWS.0\System32\xmlparse.dll [2011-02-11 12:09:49 | 000,123,392 | ---- | C] () -- C:\WINDOWS.0\System32\UnCasino5.exe [2011-02-07 16:38:54 | 000,000,056 | -H-- | C] () -- C:\WINDOWS.0\System32\ezsidmv.dat [2011-01-31 15:54:46 | 000,146,136 | ---- | C] () -- C:\WINDOWS.0\hpoins27.dat [2011-01-31 15:54:46 | 000,000,932 | ---- | C] () -- C:\WINDOWS.0\hpomdl27.dat [2011-01-31 15:07:23 | 000,030,208 | ---- | C] () -- C:\Documents and Settings\adm\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011-01-31 15:07:12 | 000,165,376 | ---- | C] () -- C:\WINDOWS.0\System32\unrar.dll [2011-01-31 15:07:12 | 000,000,038 | ---- | C] () -- C:\WINDOWS.0\avisplitter.ini [2011-01-31 15:07:09 | 000,810,496 | ---- | C] () -- C:\WINDOWS.0\System32\xvidcore.dll [2011-01-31 15:07:09 | 000,183,808 | ---- | C] () -- C:\WINDOWS.0\System32\xvidvfw.dll [2011-01-31 15:07:09 | 000,080,896 | ---- | C] () -- C:\WINDOWS.0\System32\ff_vfw.dll [2011-01-30 23:30:03 | 000,004,381 | ---- | C] () -- C:\WINDOWS.0\ODBCINST.INI [2011-01-30 23:27:12 | 000,269,392 | ---- | C] () -- C:\WINDOWS.0\System32\FNTCACHE.DAT [2011-01-30 23:17:41 | 000,000,004 | ---- | C] () -- C:\WINDOWS.0\System32\proc-503976190.bin [2011-01-30 23:15:22 | 000,000,000 | ---- | C] () -- C:\WINDOWS.0\nsreg.dat [2011-01-30 22:56:29 | 000,000,558 | ---- | C] () -- C:\WINDOWS.0\DFC.INI [2011-01-30 22:54:36 | 001,626,112 | ---- | C] () -- C:\WINDOWS.0\System32\nwiz.exe [2011-01-30 22:54:36 | 001,339,392 | ---- | C] () -- C:\WINDOWS.0\System32\nvdspsch.exe [2011-01-30 22:54:36 | 000,442,368 | ---- | C] () -- C:\WINDOWS.0\System32\nvappbar.exe [2011-01-30 22:54:36 | 000,425,984 | ---- | C] () -- C:\WINDOWS.0\System32\keystone.exe [2011-01-30 22:54:34 | 001,703,936 | ---- | C] () -- C:\WINDOWS.0\System32\nvwdmcpl.dll [2011-01-30 22:54:34 | 001,474,560 | ---- | C] () -- C:\WINDOWS.0\System32\nview.dll [2011-01-30 22:54:34 | 001,019,904 | ---- | C] () -- C:\WINDOWS.0\System32\nvwimg.dll [2011-01-30 22:54:34 | 000,466,944 | ---- | C] () -- C:\WINDOWS.0\System32\nvshell.dll [2011-01-30 22:54:34 | 000,286,720 | ---- | C] () -- C:\WINDOWS.0\System32\nvnt4cpl.dll [2011-01-30 22:54:33 | 000,929,744 | ---- | C] () -- C:\WINDOWS.0\System32\nvucode.bin [2011-01-30 22:42:07 | 000,002,048 | --S- | C] () -- C:\WINDOWS.0\bootstat.dat [2011-01-30 22:35:14 | 000,021,856 | ---- | C] () -- C:\WINDOWS.0\System32\emptyregdb.dat [2010-12-28 00:28:24 | 002,698,827 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-S-1-5-21-1659004503-1580818891-682003330-1003-0.dat [2010-12-27 01:19:26 | 000,837,498 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-System.dat [2010-12-26 13:27:05 | 000,300,460 | ---- | C] () -- C:\Program Files\dfe [2010-12-26 13:26:57 | 001,085,440 | ---- | C] () -- C:\Program Files\rldata.dll [2010-12-26 13:26:57 | 000,190,976 | ---- | C] () -- C:\Program Files\rld.dll [2010-12-26 13:26:57 | 000,153,046 | ---- | C] () -- C:\Program Files\lang.ini [2010-12-26 13:26:57 | 000,043,874 | ---- | C] () -- C:\Program Files\GameServices.ini [2010-12-26 13:26:49 | 093,153,894 | ---- | C] () -- C:\Program Files\Crack.zip [2009-08-21 16:58:40 | 000,122,880 | ---- | C] () -- C:\WINDOWS.0\System32\AitVirtualComInstall.exe [2009-07-20 20:10:48 | 000,307,200 | ---- | C] () -- C:\WINDOWS.0\System32\InstallVCOM.exe [2008-05-04 17:39:34 | 000,002,560 | ---- | C] () -- C:\WINDOWS.0\System32\ViaClassCoInstaller.dll [2008-04-14 21:46:20 | 000,001,804 | ---- | C] () -- C:\WINDOWS.0\System32\Dcache.bin [2007-10-25 17:26:10 | 000,005,632 | ---- | C] () -- C:\WINDOWS.0\System32\drivers\StarOpen.sys [2006-12-31 06:27:08 | 000,004,569 | ---- | C] () -- C:\WINDOWS.0\System32\secupd.dat [2001-10-26 16:45:16 | 000,533,814 | ---- | C] () -- C:\WINDOWS.0\System32\perfh015.dat [2001-10-26 16:45:16 | 000,313,828 | ---- | C] () -- C:\WINDOWS.0\System32\perfi015.dat [2001-10-26 16:45:16 | 000,093,818 | ---- | C] () -- C:\WINDOWS.0\System32\perfc015.dat [2001-10-26 16:45:16 | 000,034,990 | ---- | C] () -- C:\WINDOWS.0\System32\perfd015.dat [2001-08-23 13:30:00 | 013,107,200 | ---- | C] () -- C:\WINDOWS.0\System32\oembios.bin [2001-08-23 13:30:00 | 000,004,463 | ---- | C] () -- C:\WINDOWS.0\System32\oembios.dat [2001-08-17 22:00:24 | 000,474,168 | ---- | C] () -- C:\WINDOWS.0\System32\perfh009.dat [2001-08-17 22:00:24 | 000,272,128 | ---- | C] () -- C:\WINDOWS.0\System32\perfi009.dat [2001-08-17 22:00:24 | 000,028,626 | ---- | C] () -- C:\WINDOWS.0\System32\perfd009.dat [2001-08-17 22:00:22 | 000,075,856 | ---- | C] () -- C:\WINDOWS.0\System32\perfc009.dat [2001-08-17 21:45:38 | 000,046,258 | ---- | C] () -- C:\WINDOWS.0\System32\mib.bin [2001-07-21 23:06:48 | 000,218,003 | ---- | C] () -- C:\WINDOWS.0\System32\dssec.dat [2001-07-21 23:06:04 | 000,673,088 | ---- | C] () -- C:\WINDOWS.0\System32\mlang.dat [2001-07-21 22:54:16 | 000,000,741 | ---- | C] () -- C:\WINDOWS.0\System32\noise.dat [1996-04-04 00:03:26 | 000,005,248 | ---- | C] () -- C:\WINDOWS.0\System32\giveio.sys [color=#E56717]========== LOP Check ==========[/color] [2011-01-30 18:18:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\2K Sports [2011-06-18 15:44:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Auslogics [2011-08-26 17:05:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\BITS [2011-04-29 18:12:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\bsbandmltbpi [2011-04-25 12:16:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\BSplayer [2011-02-07 20:40:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\DAEMON Tools Lite [2011-07-09 13:33:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Dev-Cpp [2011-04-10 14:25:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\FlashGet [2011-04-10 14:25:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\FlashGetBHO [2011-08-23 17:11:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Gadu-Gadu 10 [2011-04-10 19:52:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Games [2011-01-30 23:17:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\GanymedeNet [2011-07-16 14:22:50 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\imeshbandmltbpi [2011-08-25 12:02:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\ipla [2011-04-05 17:24:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\ML [2011-01-30 19:52:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Opera [2011-08-04 18:53:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\RDRM [2011-03-12 11:35:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Samsung [2011-03-20 13:51:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Scilab [2011-02-07 19:52:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\Sports Interactive [2011-04-26 00:41:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\adm\Dane aplikacji\uTorrent [2011-04-10 19:50:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\AlawarWrapper [2011-02-07 19:53:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\DAEMON Tools Lite [2011-02-24 18:17:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\Gadu-Gadu 10 [2011-08-04 18:53:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\ipla [2011-06-10 12:06:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\MGS [2011-08-04 18:54:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\RDRM [2011-03-22 19:34:35 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\Samsung [2011-02-07 19:54:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users.WINDOWS.0\Dane aplikacji\Sports Interactive [2011-08-28 20:06:26 | 000,000,258 | ---- | M] () -- C:\WINDOWS.0\Tasks\WGASetup.job [color=#E56717]========== Purity Check ==========[/color] < End of report >

**Posty:** 18165 · przez **wojtas** 28 Sie 2011, 11:16

popatrz czy nie ma w folderze C:\_OTL

W programie Autoruns
W karcie Logon wyłącz te pozycje :

O4 - HKCU..\Run: [Abami] File not found

*Uruchom OTL z opcji sprzątanie.
* wykonaj optymalizację Windowsa ( instrukcja dla Windowsa XP, lecz w innych systemach jest podobnie )
* zrób pełny skan Malwarebytes Anti-Malware (zaktualizuj, usuń co znajdzie )
* Skasuj stan przywracania systemu

Zaktualizuj zabezpieczenia:
>>> Adobe Reader (bez Free McAfee® Security Scan Plus)
>>> Internet Explorer 8
>>> Java™ 6
>>> Adobe Flash Player

napisz jak sytuacja z komputerem

Kto jest na forum