pojawił się problem systemu windows i zostane on zamkniety

[Rethon]

Teraz mam coś takiego


A wczoraj formatowałem kompa

[Magik]

A wczoraj formatowałem kompa

heh//dziwny masz ten komp

podmien ten plik spod konsoli odzyskiwania//polecenie expand i jesli ten blad wywala na starcie wrzuc logi z HJT i combofix'a

[Rethon]

Przed chwilą jak uruchomiłem komputer ponownie to mu cos odbiło, system wariował, wyskawiwały jakieś błedy i sam sie wylogowywał. Log z HJT:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:27:23, on 2008-06-24
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\Program Files\VDOTool\TBPanel.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Winamp Remote\bin\OrbTray.exe
C:\Program Files\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.bearshare.com/pl/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
R3 - URLSearchHook: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTorr.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programy\ActiveX\AcroIEHelper.dll (file missing)
O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll
O2 - BHO: UrlHelper Class - {6D023EBF-70B8-45A6-9ED5-556515FA0FE4} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O2 - BHO: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTorr.dll
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BSMediaBar.dll
O3 - Toolbar: TorrentMan Toolbar - {7c5c0f58-e061-457d-9033-77307f5ed00c} - C:\Program Files\TorrentMan\tbTorr.dll
O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
O4 - HKLM\..\Run: [ccApp] "c:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Gainward] C:\Program Files\VDOTool\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background
O4 - HKCU\..\Run: [] logoff.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: ka.bat
O8 - Extra context menu item: &Winamp Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\SCIEPlgn.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{79BC4513-6716-4E48-9026-766735F95870}: NameServer = 194.204.159.1 217.98.63.164
O17 - HKLM\System\CS1\Services\Tcpip\..\{79BC4513-6716-4E48-9026-766735F95870}: NameServer = 194.204.159.1 217.98.63.164
O23 - Service: Kaspersky Anti-Virus 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 7.0\avp.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe (file missing)
O23 - Service: Symantec Settings Manager (ccSetMgr) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe (file missing)
O23 - Service: Forceware Web Interface (ForcewareWebInterface) - Apache Software Foundation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe
O23 - Service: Norton Protection Center Service (NSCService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE (file missing)
O23 - Service: ForceWare IP service (nSvcIp) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exe
O23 - Service: ForceWare user log service (nSvcLog) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 7147 bytes

[Magik]

Kod: Zaznacz wszystko

O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BSMediaBar.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Programy\ActiveX\AcroIEHelper.dll (file missing)
O4 - HKCU\..\Run: [] logoff.exe

to daj w HJT na fix i wklej jeszcze log z combofix'a

[Rethon]

ComboFix 08-06-20.4 - User 2008-06-24 18:51:19.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1410 [GMT 2:00]
Running from: C:\Documents and Settings\User\Pulpit\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-05-24 to 2008-06-24 )))))))))))))))))))))))))))))))
.

2008-06-24 17:13 . 2008-06-24 17:13 <DIR> d-------- C:\WINDOWS\Sun
2008-06-24 16:27 . 2008-06-24 16:27 <DIR> d-------- C:\Program Files\Trend Micro
2008-06-24 16:24 . 2002-09-29 00:00 51,823 --a------ C:\WINDOWS\system32\command.co_
2008-06-24 16:24 . 2008-06-24 16:24 27,136 --a------ C:\WINDOWS\Anty_16BitNT.exe
2008-06-24 16:13 . 2008-06-24 16:25 96,966 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-06-24 16:13 . 2008-06-24 16:25 88,774 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-06-24 16:12 . 2008-06-24 16:19 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab
2008-06-24 16:12 . 2008-06-24 19:02 557,344 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-06-24 16:12 . 2008-06-24 19:02 7,200 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-06-24 16:12 . 2008-06-24 16:18 1,796 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
2008-06-24 16:12 . 2008-06-24 16:18 1,220 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.idx
2008-06-24 16:08 . 2008-06-24 16:08 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files
2008-06-24 16:00 . 2008-06-24 16:00 <DIR> d-------- C:\WINDOWS\system32\pl-PL
2008-06-24 15:58 . 2008-06-24 15:58 <DIR> d-------- C:\WINDOWS\system32\XPSViewer
2008-06-24 15:58 . 2008-06-24 15:58 <DIR> d-------- C:\Program Files\Reference Assemblies
2008-06-24 15:58 . 2008-06-24 15:58 <DIR> d-------- C:\Program Files\MSBuild
2008-06-24 15:58 . 2006-06-29 13:07 14,048 --------- C:\WINDOWS\system32\spmsg2.dll
2008-06-24 15:56 . 2008-06-24 15:56 <DIR> d-------- C:\Program Files\MSXML 6.0
2008-06-24 14:10 . 2008-06-24 14:10 <DIR> d-------- C:\Program Files\Winamp Toolbar
2008-06-24 14:10 . 2008-06-24 14:10 <DIR> d-------- C:\Program Files\Winamp Remote
2008-06-24 14:10 . 2008-06-24 14:10 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar
2008-06-24 14:10 . 2008-06-24 14:11 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\OrbNetworks
2008-06-24 13:50 . 2008-06-24 14:11 <DIR> d-------- C:\Program Files\Winamp
2008-06-24 13:50 . 2008-06-24 14:11 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Winamp
2008-06-24 13:14 . 2008-06-24 13:14 <DIR> d-------- C:\Program Files\TorrentMan
2008-06-24 13:14 . 2008-06-24 13:14 <DIR> d-------- C:\Program Files\Conduit
2008-06-24 11:06 . 2008-06-24 11:06 <DIR> d-------- C:\Program Files\Sun
2008-06-24 11:06 . 2008-06-24 11:06 <DIR> d-------- C:\Program Files\Java
2008-06-24 11:06 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
2008-06-23 22:28 . 2008-06-23 22:29 <DIR> d-------- C:\Program Files\BearShare Applications
2008-06-23 22:28 . 2008-06-24 13:52 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\BearShare
2008-06-23 22:28 . 2007-11-22 16:00 483,328 --a------ C:\WINDOWS\system32\actskn45.ocx
2008-06-23 19:00 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys
2008-06-23 19:00 . 2008-06-14 20:01 273,024 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys
2008-06-23 17:59 . 2008-06-23 17:59 <DIR> d-------- C:\Program Files\updates
2008-06-23 17:59 . 2008-06-23 17:59 <DIR> d-------- C:\Program Files\uninstall
2008-06-23 17:59 . 2008-06-23 17:59 <DIR> d-------- C:\Program Files\searchplugins
2008-06-23 17:59 . 2008-06-23 17:59 <DIR> d-------- C:\Program Files\res
2008-06-23 17:59 . 2008-06-23 17:59 <DIR> d-------- C:\Program Files\plugins
2008-06-23 17:59 . 2008-06-23 17:59 <DIR> d-------- C:\Program Files\modules
2008-06-23 17:59 . 2008-06-23 17:59 <DIR> d-------- C:\Program Files\greprefs
2008-06-23 17:59 . 2008-06-24 18:10 <DIR> d-------- C:\Program Files\extensions
2008-06-23 17:59 . 2008-06-23 17:59 <DIR> d-------- C:\Program Files\dictionaries
2008-06-23 17:59 . 2008-06-23 17:59 <DIR> d-------- C:\Program Files\defaults
2008-06-23 17:59 . 2008-06-23 17:59 <DIR> d-------- C:\Program Files\components
2008-06-23 17:59 . 2008-06-23 17:59 <DIR> d-------- C:\Program Files\chrome
2008-06-23 17:59 . 2008-05-30 00:45 9,715,200 --a------ C:\Program Files\xul.dll
2008-06-23 17:59 . 2008-05-30 00:45 710,144 --a------ C:\Program Files\mozcrt19.dll
2008-06-23 17:59 . 2008-05-30 00:45 697,856 --a------ C:\Program Files\nss3.dll
2008-06-23 17:59 . 2008-05-30 00:45 695,808 --a------ C:\Program Files\js3250.dll
2008-06-23 17:59 . 2008-05-30 00:45 414,208 --a------ C:\Program Files\sqlite3.dll
2008-06-23 17:59 . 2008-05-30 00:45 307,712 --a------ C:\Program Files\firefox.exe
2008-06-23 17:59 . 2008-05-30 00:45 304,640 --a------ C:\Program Files\nssckbi.dll
2008-06-23 17:59 . 2008-05-30 00:45 241,664 --a------ C:\Program Files\updater.exe
2008-06-23 17:59 . 2008-05-29 16:24 233,472 --a------ C:\Program Files\freebl3.dll
2008-06-23 17:59 . 2008-05-30 00:45 198,144 --a------ C:\Program Files\nspr4.dll
2008-06-23 17:59 . 2008-05-30 00:45 185,856 --a------ C:\Program Files\crashreporter.exe
2008-06-23 17:59 . 2008-05-29 16:24 151,552 --a------ C:\Program Files\softokn3.dll
2008-06-23 17:59 . 2008-05-30 00:45 136,704 --a------ C:\Program Files\ssl3.dll
2008-06-23 17:59 . 2008-05-30 00:45 103,936 --a------ C:\Program Files\smime3.dll
2008-06-23 17:59 . 2008-05-30 00:45 103,936 --a------ C:\Program Files\nssdbm3.dll
2008-06-23 17:59 . 2008-05-30 00:45 87,552 --a------ C:\Program Files\nssutil3.dll
2008-06-23 17:59 . 2008-05-30 00:45 20,480 --a------ C:\Program Files\plc4.dll
2008-06-23 17:59 . 2008-05-30 00:45 17,920 --a------ C:\Program Files\xpcom.dll
2008-06-23 17:59 . 2008-05-30 00:45 17,408 --a------ C:\Program Files\plds4.dll
2008-06-23 17:59 . 2008-05-30 00:45 17,408 --a------ C:\Program Files\AccessibleMarshal.dll
2008-06-23 17:59 . 2008-06-23 17:59 0 --a------ C:\WINDOWS\nsreg.dat
2008-06-23 17:47 . 2008-06-24 18:59 558 --a------ C:\WINDOWS\DFC.INI
2008-06-23 17:44 . 2006-11-29 13:06 3,426,072 --a------ C:\WINDOWS\system32\d3dx9_32.dll
2008-06-23 17:43 . 2008-06-23 17:43 <DIR> d-------- C:\Program Files\VDOTool
2008-06-23 17:43 . 2007-03-16 10:11 12,256 --a------ C:\WINDOWS\system32\drivers\TBPanel.sys
2008-06-23 17:38 . 2008-06-23 18:22 <DIR> d-------- C:\Program Files\Symantec
2008-06-23 17:38 . 2008-06-23 18:15 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
2008-06-23 17:38 . 2008-06-23 18:21 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Symantec
2008-06-23 17:38 . 2005-09-16 17:20 108,168 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
2008-06-23 17:38 . 2005-09-16 17:20 87,768 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
2008-06-23 17:36 . 2006-04-11 02:32 51 --a------ C:\delnis.bat
2008-06-23 17:32 . 2008-06-23 17:33 <DIR> d-------- C:\Program Files\Analog Devices
2008-06-23 17:32 . 2001-09-11 14:20 1,285,632 --------- C:\WINDOWS\system32\SMMedia.dll
2008-06-23 17:32 . 2004-08-04 00:44 130,048 --a------ C:\WINDOWS\system32\ksproxy.ax
2008-06-23 17:32 . 2004-08-04 00:44 130,048 --a--c--- C:\WINDOWS\system32\dllcache\ksproxy.ax
2008-06-23 17:32 . 2004-08-03 23:08 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2008-06-23 17:32 . 2004-08-03 23:08 60,288 --a--c--- C:\WINDOWS\system32\dllcache\drmk.sys
2008-06-23 17:32 . 2005-05-04 08:20 53,248 --------- C:\WINDOWS\system32\wdmioctl.dll
2008-06-23 17:32 . 2006-07-10 14:42 49,152 --------- C:\WINDOWS\system32\DSndUp.exe
2008-06-23 17:32 . 2002-04-17 14:05 45,056 --------- C:\WINDOWS\system32\CleanUp.exe
2008-06-23 17:32 . 2006-10-16 16:10 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe
2008-06-23 17:28 . 2008-06-23 17:28 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
2008-06-23 17:28 . 2008-06-23 17:28 <DIR> d-------- C:\Program Files\DIFX
2008-06-23 17:28 . 2006-06-18 23:51 43,520 --a------ C:\WINDOWS\system32\drivers\AmdK8.sys
2008-06-23 17:22 . 2008-06-23 17:22 <DIR> d-------- C:\WINDOWS\ASUSInstAll
2008-06-23 17:20 . 2008-06-23 17:20 <DIR> d-------- C:\Program Files\NVIDIA Corporation
2008-06-23 17:20 . 2008-06-23 17:20 1,024 --a------ C:\.rnd
2008-06-23 17:20 . 2008-06-23 17:20 22 --a------ C:\WINDOWS\FileName
2008-06-23 17:13 . 2003-10-16 19:07 32,768 --a------ C:\WINDOWS\system32\WooDial2000.dll
2008-06-23 17:12 . 2008-06-23 17:12 <DIR> d-------- C:\Program Files\Thomson
2008-06-23 17:12 . 2008-06-23 17:32 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2008-06-23 17:12 . 2008-06-23 17:20 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2008-06-23 17:12 . 2003-12-08 11:53 70,688 --a------ C:\WINDOWS\system32\drivers\alcaudsl.sys
2008-06-23 17:12 . 2003-12-08 11:53 53,600 --a------ C:\WINDOWS\system32\drivers\alcan5wn.sys
2008-06-23 17:12 . 2003-12-08 11:53 5,606 --a------ C:\WINDOWS\system32\stci.dll
2008-06-23 17:12 . 2003-12-08 11:53 5,280 --a------ C:\WINDOWS\system32\drivers\alcawh.sys
2008-06-23 17:12 . 2003-12-08 11:53 3,968 --a------ C:\WINDOWS\system32\drivers\alcacr.sys
2008-06-23 17:11 . 2008-06-23 18:45 <DIR> d-------- C:\Program Files\Neostrada TP
2008-06-23 17:10 . 2008-06-23 17:10 1,409 --a------ C:\WINDOWS\system32\tmpB7CE2.FOT
2008-06-23 17:09 . 2008-06-23 17:09 942 --a------ C:\WINDOWS\mozver.dat
2008-06-23 17:07 . 2008-06-23 17:07 <DIR> d-------- C:\Program Files\E-Color Indicator
2008-06-23 17:06 . 2008-06-23 17:07 <DIR> d-------- C:\WINDOWS\system32\Color
2008-06-23 17:06 . 2008-06-23 17:07 <DIR> d-------- C:\Program Files\Common
2008-06-23 17:06 . 2008-06-23 17:06 <DIR> d-------- C:\Program Files\Colorific
2008-06-23 17:04 . 1998-10-29 16:45 306,688 --a------ C:\WINDOWS\IsUninst.exe
2008-06-23 17:03 . 2008-06-23 17:03 <DIR> d-------- C:\Program Files\Common Files\Adobe
2008-06-23 17:02 . 2008-06-23 17:36 8,809 --a------ C:\WINDOWS\Ascd_tmp.ini
2008-06-23 17:02 . 2004-08-12 02:00 5,810 -ra------ C:\WINDOWS\system32\drivers\ASACPI.sys
2008-06-23 17:01 . 2008-06-23 17:01 <DIR> d-------- C:\Program Files\Gadu-Gadu
2008-06-23 17:01 . 2008-06-23 22:15 <DIR> d-------- C:\Documents and Settings\User\Gadu-Gadu
2008-06-23 17:01 . 2008-06-23 17:01 <DIR> d-------- C:\Documents and Settings\User\Dane aplikacji\Gadu-Gadu
2008-06-23 17:01 . 2006-10-10 21:33 10,288 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-24 14:26 112,144 ----a-w C:\WINDOWS\system32\drivers\kl1.sys
2008-06-24 14:12 --------- d-----w C:\Program Files\Kaspersky Lab
2008-06-23 16:05 --------- d-----w C:\Program Files\Sateira
2008-06-23 15:59 19,305 ----a-w C:\Program Files\install.log
2008-06-23 15:07 5,936 ----a-w C:\Program Files\Colorific.ini
2008-06-23 14:56 --------- d-----w C:\Program Files\Common Files\Java
2008-06-23 14:48 --------- d-----w C:\Program Files\microsoft frontpage
2008-06-23 14:46 --------- d-----w C:\Program Files\Usługi online
2008-05-29 18:19 709 ----a-w C:\Program Files\updater.ini
2008-05-29 18:19 339 ----a-w C:\Program Files\README.txt
2008-05-29 18:19 220 ----a-w C:\Program Files\browserconfig.properties
2008-05-29 18:19 106 ----a-w C:\Program Files\old-homepage-default.properties
2008-05-29 14:24 981 ----a-w C:\Program Files\blocklist.xml
2008-05-29 14:24 476 ----a-w C:\Program Files\softokn3.chk
2008-05-29 14:24 476 ----a-w C:\Program Files\freebl3.chk
2008-05-29 14:24 44 ----a-w C:\Program Files\platform.ini
2008-05-29 14:24 31,393 ----a-w C:\Program Files\LICENSE
2008-05-29 14:24 2,025 ----a-w C:\Program Files\application.ini
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-07 05:16 1,291,264 ----a-w C:\WINDOWS\system32\quartz.dll
2008-04-21 07:03 662,016 ----a-w C:\WINDOWS\system32\wininet.dll
2008-04-07 15:51 680 ----a-w C:\Program Files\crashreporter-override.ini
2008-04-07 15:51 3,928 ----a-w C:\Program Files\crashreporter.ini
2008-03-25 08:20 219,936 ----a-w C:\WINDOWS\system32\msltus40.dll
2008-03-25 04:52 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:52 178,976 ----a-w C:\WINDOWS\system32\msjint40.dll
2002-02-11 09:35 172 ----a-w C:\Program Files\colorific.inf
2002-02-11 09:35 1,289 ----a-w C:\Program Files\Preset.inf
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{25CEE8EC-5730-41bc-8B58-22DDC8AB8C20}]
2008-03-20 00:36 1267040 --a------ C:\Program Files\Winamp Toolbar\winamptb.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D023EBF-70B8-45A6-9ED5-556515FA0FE4}]
2008-04-17 09:44 398776 --a------ C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7c5c0f58-e061-457d-9033-77307f5ed00c}]
2008-05-21 00:43 1526296 --a------ C:\Program Files\TorrentMan\tbTorr.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7C5C0F58-E061-457D-9033-77307F5ED00C}"= "C:\Program Files\TorrentMan\tbTorr.dll" [2008-05-21 00:43 1526296]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-03-20 00:36 1267040]

[HKEY_CLASSES_ROOT\clsid\{7c5c0f58-e061-457d-9033-77307f5ed00c}]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{EBF2BA02-9094-4C5A-858B-BB198F3D8DE2}"= C:\Program Files\Winamp Toolbar\winamptb.dll [2008-03-20 00:36 1267040]
"{7C5C0F58-E061-457D-9033-77307F5ED00C}"= C:\Program Files\TorrentMan\tbTorr.dll [2008-05-21 00:43 1526296]

[HKEY_CLASSES_ROOT\clsid\{ebf2ba02-9094-4c5a-858b-bb198f3d8de2}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand.1]
[HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}]
[HKEY_CLASSES_ROOT\WINAMPTB.AOLToolBand]

[HKEY_CLASSES_ROOT\clsid\{7c5c0f58-e061-457d-9033-77307f5ed00c}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-07-09 09:39 2119104]
"Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 03:54 507904]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
"WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 19:07 24576]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 11:38 866816]
"WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07 20480]
"WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07 53248]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 15:34 868352]
"ccApp"="c:\Program Files\Common Files\Symantec Shared\ccApp.exe" [ ]
"Gainward"="C:\Program Files\VDOTool\TBPanel.exe" [2007-04-23 19:19 2165536]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-04-12 17:44 8429568]
"nwiz"="nwiz.exe" [2007-04-12 17:44 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-04-12 17:44 81920]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-04-01 20:49 36352]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
ka.bat [2008-02-20 18:44:42 195]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.avrn"= D:\Programy\ACEMEG~1\SystemS\AVIDAV~1.DLL
"vidc.advj"= D:\Programy\ACEMEG~1\SystemS\AVIDAV~1.DLL
"vidc.mszh"= D:\Programy\ACEMEG~1\SystemS\avimszh.dll
"vidc.zlib"= D:\Programy\ACEMEG~1\SystemS\avizlib.dll
"vidc.cscd"= D:\Programy\ACEMEG~1\SystemS\camcodec.dll
"vidc.cvid"= D:\Programy\ACEMEG~1\SystemS\iccvid.dll
"msacm.trspch"= D:\Programy\ACEMEG~1\SystemS\tssoft32.acm
"vidc.em2v"= D:\Programy\ACEMEG~1\SystemS\etxcodec.dll
"vidc.mkvc"= D:\Programy\ACEMEG~1\SystemS\kmvidc32.dll
"vidc.hfyu"= D:\Programy\ACEMEG~1\SystemS\huffyuv.dll
"msacm.lameacm"= D:\Programy\ACEMEG~1\SystemS\lameacm.acm
"msacm.lhacm"= D:\Programy\ACEMEG~1\SystemS\lhacm.acm
"msacm.l3acm"= D:\Programy\ACEMEG~1\SystemS\l3codecp.acm
"vidc.sjpg"= D:\Programy\ACEMEG~1\SystemS\pmjpeg32.dll
"vidc.dmb2"= D:\Programy\ACEMEG~1\SystemS\pmjpeg32.dll
"vidc.gepj"= D:\Programy\ACEMEG~1\SystemS\pmjpeg32.dll
"vidc.qpeg"= D:\Programy\ACEMEG~1\SystemS\Qpeg32.dll
"vidc.q1.0"= D:\Programy\ACEMEG~1\SystemS\Qpeg32.dll
"msacm.sl_anet"= D:\Programy\ACEMEG~1\SystemS\sl_anet.acm
"vidc.tscc"= D:\Programy\ACEMEG~1\SystemS\tsccvid.dll
"vidc.vifp"= D:\Programy\ACEMEG~1\SystemS\vfcodec.dll
"vidc.wrpr"= D:\Programy\ACEMEG~1\SystemS\aviwrap.dll
"vidc.wnv1"= D:\Programy\ACEMEG~1\SystemS\wnvplay1.dll
"vidc.advs"= D:\Programy\ACEMEG~1\SystemS\Adaptec\Dvc.dll
"vidc.aflc"= D:\Programy\ACEMEG~1\SystemS\Autodesk\FLCCOD~1.DLL
"vidc.afli"= D:\Programy\ACEMEG~1\SystemS\Autodesk\FLCCOD~1.DLL
"vidc.aasc"= D:\Programy\ACEMEG~1\SystemS\Autodesk\Aasc32.dll
"vidc.aas4"= D:\Programy\ACEMEG~1\SystemS\Autodesk\Aasc32.dll
"vidc.asv1"= D:\Programy\ACEMEG~1\SystemS\ASUS\asusasv1.dll
"vidc.asv2"= D:\Programy\ACEMEG~1\SystemS\ASUS\asusasv2.dll
"vidc.asvx"= D:\Programy\ACEMEG~1\SystemS\ASUS\asusasv2.dll
"vidc.vcr1"= D:\Programy\ACEMEG~1\SystemS\ATI\ativcr1.dll
"vidc.vcr2"= D:\Programy\ACEMEG~1\SystemS\ATI\ativcr2.dll
"vidc.yv12"= D:\Programy\ACEMEG~1\SystemS\ATI\atiyuv12.DLL
"vidc.mwv1"= D:\Programy\ACEMEG~1\SystemS\Aware\icmw_32.dll
"vidc.bt20"= D:\Programy\ACEMEG~1\SystemS\BROOKT~1\btvvc32.drv
"vidc.y41p"= D:\Programy\ACEMEG~1\SystemS\BROOKT~1\btvvc32.drv
"msacm.pcdv"= D:\Programy\ACEMEG~1\SystemS\Canopus\pcdv.acm
"vidc.cdvc"= D:\Programy\ACEMEG~1\SystemS\Canopus\CSCCDVC.DLL
"vidc.ddvc"= D:\Programy\ACEMEG~1\SystemS\Canopus\CSCdvsd.DLL
"vidc.png1"= D:\Programy\ACEMEG~1\SystemS\Core\COREPN~1.DLL
"msacm.CoreFLAC_ACM"= D:\Programy\ACEMEG~1\SystemS\Core\COREFL~1.ACM
"vidc.davc"= D:\Programy\ACEMEG~1\SystemS\dicas\davcvfw.dll
"vidc.div3"= D:\Programy\ACEMEG~1\SystemS\DivX\DivXc32.dll
"vidc.div5"= D:\Programy\ACEMEG~1\SystemS\DivX\DivXc32.dll
"vidc.mpg3"= D:\Programy\ACEMEG~1\SystemS\DivX\DivXc32.dll
"vidc.div4"= D:\Programy\ACEMEG~1\SystemS\DivX\DivXc32f.dll
"vidc.div6"= D:\Programy\ACEMEG~1\SystemS\DivX\DivXc32f.dll
"vidc.ap41"= D:\Programy\ACEMEG~1\SystemS\DivX\DivXc32f.dll
"vidc.dvx4"= D:\Programy\ACEMEG~1\SystemS\DivX\divx4.dll
"vidc.divx"= D:\Programy\ACEMEG~1\SystemS\DivX\DivX520.dll
"msacm.divxa32"= D:\Programy\ACEMEG~1\SystemS\DivX\divxa32.acm
"vidc.frwd"= D:\Programy\ACEMEG~1\SystemS\Forward\frwd.dll
"vidc.frwt"= D:\Programy\ACEMEG~1\SystemS\Forward\frwd.dll
"vidc.frwa"= D:\Programy\ACEMEG~1\SystemS\Forward\frwt.dll
"vidc.frwu"= D:\Programy\ACEMEG~1\SystemS\Forward\frwu.dll
"vidc.glzw"= D:\Programy\ACEMEG~1\SystemS\Gabest\GLZW.dll
"vidc.gpeg"= D:\Programy\ACEMEG~1\SystemS\Gabest\GPEG.dll
"vidc.i263"= D:\Programy\ACEMEG~1\SystemS\Intel\i263_32.drv
"vidc.iv30"= D:\Programy\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv31"= D:\Programy\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv32"= D:\Programy\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv33"= D:\Programy\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv34"= D:\Programy\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv35"= D:\Programy\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv36"= D:\Programy\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv37"= D:\Programy\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv38"= D:\Programy\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv39"= D:\Programy\ACEMEG~1\SystemS\Intel\ir32_32.dll
"vidc.iv40"= D:\Programy\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv41"= D:\Programy\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv42"= D:\Programy\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv43"= D:\Programy\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv44"= D:\Programy\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv45"= D:\Programy\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv46"= D:\Programy\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv47"= D:\Programy\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv48"= D:\Programy\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv49"= D:\Programy\ACEMEG~1\SystemS\Intel\ir41_32.dll
"vidc.iv50"= D:\Programy\ACEMEG~1\SystemS\Intel\ir50_32.dll
"vidc.iyuv"= D:\Programy\ACEMEG~1\SystemS\Intel\iyuv_32.dll
"vidc.yvu9"= D:\Programy\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll
"vidc.ir21"= D:\Programy\ACEMEG~1\SystemS\Intel\IR21_R.DLL
"vidc.rt21"= D:\Programy\ACEMEG~1\SystemS\Intel\IR21_R.DLL
"msacm.imc"= D:\Programy\ACEMEG~1\SystemS\Intel\IMC32.ACM
"vidc.lead"= D:\Programy\ACEMEG~1\SystemS\LEAD\LCODCCMP.DLL
"vidc.dvsd"= D:\Programy\ACEMEG~1\SystemS\MAINCO~1\MCDVD_32.DLL
"vidc.dvc"= D:\Programy\ACEMEG~1\SystemS\MAINCO~1\MCDVD_32.DLL
"vidc.dvcs"= D:\Programy\ACEMEG~1\SystemS\MAINCO~1\MCDVD_32.DLL
"vidc.dcmj"= D:\Programy\ACEMEG~1\SystemS\MAINCO~1\MCMJPG32.DLL
"vidc.avi1"= D:\Programy\ACEMEG~1\SystemS\MAINCO~1\MCMJPG32.DLL
"vidc.avi2"= D:\Programy\ACEMEG~1\SystemS\MAINCO~1\MCMJPG32.DLL
"vidc.dv25"= D:\Programy\ACEMEG~1\SystemS\Matrox\DigiVCap.dll
"vidc.dv50"= D:\Programy\ACEMEG~1\SystemS\Matrox\DigiVCap.dll
"vidc.msmc"= D:\Programy\ACEMEG~1\SystemS\Matrox\DigiVCap.dll
"vidc.mmjp"= D:\Programy\ACEMEG~1\SystemS\Matrox\DigiVCap.dll
"vidc.mtx1"= D:\Programy\ACEMEG~1\SystemS\Matrox\DigiVCap.dll
"vidc.mtx2"= D:\Programy\ACEMEG~1\SystemS\Matrox\DigiVCap.dll
"vidc.mtx3"= D:\Programy\ACEMEG~1\SystemS\Matrox\DigiVCap.dll
"vidc.mtx4"= D:\Programy\ACEMEG~1\SystemS\Matrox\DigiVCap.dll
"vidc.mtx5"= D:\Programy\ACEMEG~1\SystemS\Matrox\DigiVCap.dll
"vidc.mtx6"= D:\Programy\ACEMEG~1\SystemS\Matrox\DigiVCap.dll
"vidc.mtx7"= D:\Programy\ACEMEG~1\SystemS\Matrox\DigiVCap.dll
"vidc.mtx8"= D:\Programy\ACEMEG~1\SystemS\Matrox\DigiVCap.dll
"vidc.mtx9"= D:\Programy\ACEMEG~1\SystemS\Matrox\DigiVCap.dll
"vidc.mmes"= D:\Programy\ACEMEG~1\SystemS\Matrox\DigiVCap.dll
"msacm.msadpcm"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\msadp32.acm
"msacm.imaadpcm"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\imaadp32.acm
"msacm.msg711"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\msg711.acm
"msacm.msg723"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\msg723.acm
"msacm.msgsm610"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\msgsm32.acm
"vidc.m261"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\msh261.drv
"vidc.m263"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\msh263.drv
"vidc.i420"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\msh263.drv
"vidc.mrle"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\msrle32.dll
"vidc.uyvy"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yuy2"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.yvyu"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\msyuv.dll
"vidc.msvc"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\msvidc32.dll
"vidc.cram"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\msvidc32.dll
"vidc.mpg4"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\mpg4c32.dll
"vidc.mp41"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\mpg4c32.dll
"vidc.mp42"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\mpg4c32.dll
"vidc.mp43"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\mpg4c32.dll
"vidc.mp4s"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\mpg4c32.dll
"vidc.mp4v"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\mpg4c32.dll
"vidc.wmv3"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\WMV9VCM.dll
"msacm.msaudio1"= D:\Programy\ACEMEG~1\SystemS\MICROS~1\msaud32.acm
"vidc.vixl"= D:\Programy\ACEMEG~1\SystemS\Miro\miroxl32.dll
"vidc.nt00"= D:\Programy\ACEMEG~1\SystemS\Newtek\ntcodec.dll
"msacm.vorbis"= D:\Programy\ACEMEG~1\SystemS\OGG\vorbis.acm
"vidc.vp30"= D:\Programy\ACEMEG~1\SystemS\ON2TEC~1\vp31vfw.dll
"vidc.vp31"= D:\Programy\ACEMEG~1\SystemS\ON2TEC~1\vp31vfw.dll
"vidc.vp60"= D:\Programy\ACEMEG~1\SystemS\ON2TEC~1\vp6vfw.dll
"vidc.vp61"= D:\Programy\ACEMEG~1\SystemS\ON2TEC~1\vp6vfw.dll
"vidc.pdvc"= D:\Programy\ACEMEG~1\SystemS\PANASO~1\idvcodec.dll
"vidc.ipdv"= D:\Programy\ACEMEG~1\SystemS\PANASO~1\idvcodec.dll
"vidc.pvw2"= D:\Programy\ACEMEG~1\SystemS\Pegasus\pvwv220.dll
"vidc.pimj"= D:\Programy\ACEMEG~1\SystemS\Pegasus\pvljpg20.dll
"vidc.mjpx"= D:\Programy\ACEMEG~1\SystemS\Pegasus\pvmjpg21.dll
"vidc.miro"= D:\Programy\ACEMEG~1\SystemS\Pinnacle\MIRODV~1.DLL
"vidc.dcap"= D:\Programy\ACEMEG~1\SystemS\Pinnacle\MIRODV~1.DLL
"vidc.mjpa"= D:\Programy\ACEMEG~1\SystemS\Pinnacle\RTMJPG~1.DLL
"vidc.gpjm"= D:\Programy\ACEMEG~1\SystemS\Pinnacle\RTMJPG~1.DLL
"vidc.pim1"= D:\Programy\ACEMEG~1\SystemS\Pinnacle\pclepim1.dll
"msacm.qmpeg"= D:\Programy\ACEMEG~1\SystemS\QDesign\qmpeg.acm
"vidc.rmp4"= D:\Programy\ACEMEG~1\SystemS\REALMA~1\rmp4.dll
"vidc.rud0"= D:\Programy\ACEMEG~1\SystemS\Rududu\rududu.dll
"msacm.at3"= D:\Programy\ACEMEG~1\SystemS\SONY\atrac3.acm
"vidc.sony"= D:\Programy\ACEMEG~1\SystemS\SONY\sonydv.dll
"vidc.dvcp"= D:\Programy\ACEMEG~1\SystemS\SONY\sonydv.dll
"vidc.s422"= D:\Programy\ACEMEG~1\SystemS\Tekram\tekyuv.dll
"vidc.t420"= D:\Programy\ACEMEG~1\SystemS\Toshiba\tsbyuv.dll
"vidc.y411"= D:\Programy\ACEMEG~1\SystemS\Toshiba\tsbyuv.dll
"vidc.vssv"= D:\Programy\ACEMEG~1\SystemS\VANGUA~1\vsscodec.dll
"msacm.voxacm160"= D:\Programy\ACEMEG~1\SystemS\VoxWare\vct3216.acm
"vidc.xvid"= D:\Programy\ACEMEG~1\SystemS\XviD\xvidvfw.dll

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^E-Color.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\E-Color.lnk
backup=C:\WINDOWS\pss\E-Color.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
--a------ 2007-07-09 09:39 2119104 C:\Program Files\Gadu-Gadu\gg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"=
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"=

R3 klim5;Kaspersky Anti-Virus NDIS Filter;C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 13:28]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7bffedc3-4142-11dd-ab4e-806d6172696f}]
\Shell\AutoRun\command - E:\Setup.exe

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-24 19:02:17
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-06-24 19:04:34
ComboFix-quarantined-files.txt 2008-06-24 17:04:20

Pre-Run: 71,610,511,360 bajtów wolnych
Post-Run: 71,658,610,688 bajtów wolnych

407 --- E O F --- 2008-06-24 13:28:57

Parę razy w czasie skanowania odezwał się mój antywirus.

[Magik]

hmmm
nic ciekawego nie widac

zrob dla pewnosci jeszcze

by Mario
Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt

+ to
http://forum.programosy.pl/program-szukajacy-trojanow-i-malware-vt97108.html

jak bedzie czysto to na pewno nie bedzie zaden syfek

[kahoona]

Rethon - wyłącz dla testów sprzętowy firewall nVidii - w BIOS.

[Rethon]

Niestety cięzko będzie mi to zrobic. Zablokowałem porty tym wwdc ok, ale trzeba uruchomic ponownie komputer a wtedy samo mi wylogowuje i jestem zmuszony wejsc do tryby awartyjnego i utworzyc nowe konta aby do nastepnego wylaczanie mógł jakos pracowac. Cos jak tutaj:
http://forum.idg.pl/lofiversion/index.php/t33180.html

[kahoona]

Kiedyś ten komputer wyłączyć musisz - inaczej 24/24 - a to już kaplica na prawdopodobnie uszkodzonym sprzęcie.
Sprzętowy firewall nVidii możesz wyłączyć tylko w BIOS - a być może to właśnie on spowodował wcześniejsze problemy i obecne błędy.

W każdym razie - masz go najprawdopodobniej uruchomiony i zainstalowany (ślady w HJThis! i dalej). Możesz spróbować wyłączenia tego urządzenia w menedżerze urządzeń.

Na sassera nie licz - raczej na uszkodzoną płytę główną.

[Rethon]

Dobra jakoś sie udało tego SDfixa:

SDFix: Version 1.197
Run by Administrator on 2008-06-25 at 21:35

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

No Trojan Files Found






Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-25 21:38:07
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]
"s1"=dword:2df9c43f
"s2"=dword:110480d0
"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:0d,ac,30,8c,17,e5,fe,0a,12,78,d9,ee,df,09,05,27,53,f4,95,96,4a,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,8f,33,7c,b6,b5,d1,8e,03,ab,e4,a3,06,f1,2b,87,f0,d1,..
"khjeh"=hex:3d,2f,f8,30,e0,a1,0a,a6,07,59,32,05,45,18,15,38,d6,45,2d,4b,d7,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:54,82,fb,30,48,f7,cc,06,c3,8f,e3,0b,4b,e5,fb,e5,ec,df,88,98,70,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:e1,a1,bf,94,7d,be,a9,28,1f,44,a4,85,b1,be,9d,a7,72,de,d1,42,e7,..
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]
"p0"="C:\Program Files\DAEMON Tools Lite\"
"h0"=dword:00000000
"khjeh"=hex:0d,ac,30,8c,17,e5,fe,0a,12,78,d9,ee,df,09,05,27,53,f4,95,96,4a,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]
"a0"=hex:20,01,00,00,8f,33,7c,b6,b5,d1,8e,03,ab,e4,a3,06,f1,2b,87,f0,d1,..
"khjeh"=hex:3d,2f,f8,30,e0,a1,0a,a6,07,59,32,05,45,18,15,38,d6,45,2d,4b,d7,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]
"khjeh"=hex:54,82,fb,30,48,f7,cc,06,c3,8f,e3,0b,4b,e5,fb,e5,ec,df,88,98,70,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41]
"khjeh"=hex:e1,a1,bf,94,7d,be,a9,28,1f,44,a4,85,b1,be,9d,a7,72,de,d1,42,e7,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe"="C:\\Program Files\\NVIDIA Corporation\\NetworkAccessManager\\Apache Group\\Apache2\\bin\\Apache.exe:*:Enabled:Apache HTTP Server"
"C:\\Program Files\\Winamp Remote\\bin\\Orb.exe"="C:\\Program Files\\Winamp Remote\\bin\\Orb.exe:*:Enabled:Orb"
"C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbTray.exe:*:Enabled:OrbTray"
"C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe"="C:\\Program Files\\Winamp Remote\\bin\\OrbStreamerClient.exe:*:Enabled:Orb Stream Client"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files :



Files with Hidden Attributes :


Finished!

Dodam, że przy starcie skanowania wyskoczyło mi cos takiego jak podałem na poprzedniej stronie tylko z sdfix.exe.

Odnosnie BIOSU to nie moge znalazc opcji wyłaczenia firewalla.

Tu jeszcze log z FixIEDef:

********************************************************************************
* *
* FixIEDef Log *
* Version 1.4.19.5850 *
* *
********************************************************************************

Created at 21:50:00 on Wednesday, June 25, 2008

Time Zone :

Logged On User : aaawe

Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2
OS Version : 5.1.2600
System Langauge : Polish
Keyboard Layout : Polish
Processor : X86 AMD Athlon(tm) 64 X2 Dual Core Processor 4200+

System Drive : C:\
Windows Directory : C:\WINDOWS
System Directory : C:\WINDOWS\system32

Total Physical Memory : 2146742272 bytes
Free Physical Memory : 1608132 bytes
Total Virtual Memory : 2097024 bytes
Free Virtual Memory : 2053364 bytes

Boot State : Normal boot

--------------------------------------------------------------------------------

!!! Files that have been deleted !!!

C:\WINDOWS\system32\actskn45.ocx
C:\WINDOWS\system32\LuResult.txt
C:\WINDOWS\system32\nmp.log

--------------------------------------------------------------------------------

!!! Directories that have been removed !!!

No malicious directories to be removed

--------------------------------------------------------------------------------

!!! Registry entries that have been removed !!!

No malicious Registry entries found

================================================================================

All Done

ShadowPuterDude

Safe Surfing!!!

[kahoona]

Przyznaję się - musiałem się pomylić z tym firewallem. Nie wiem, co mi przeskoczyło, wydawało mi się, że jest.

Pytanie z innej beczki - co z memtestem?

[Rethon]

Sprawdziłem dzis memtestem i wyszło 'no errors'. Wiec chyba z moim ramem jest wszystko w porzadku.