Powolna praca komputera tuż po formacie

**Posty:** 4 · przez **Freshmaker** 29 Lis 2010, 18:02

Mam problem z dużym zużyciem procesora przy ruchu kursorem może nawet dojść do 60% zużycia...

Mam Intela Pentium 4 3.00Ghz i 1gb ramu wiec napewno nie powinno tak byc

Logi z Otl

Kod: Zaznacz wszystko: OTL logfile created on: 2010-11-29 15:55:30 - Run 2 OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Norek\Moje dokumenty\Pobieranie Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1 023,00 Mb Total Physical Memory | 520,00 Mb Available Physical Memory | 51,00% Memory free 1,00 Gb Paging File | 1,00 Gb Available in Paging File | 59,00% Paging File free Paging file location(s): C:\pagefile.sys 100 100 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 111,80 Gb Total Space | 19,94 Gb Free Space | 17,84% Space Free | Partition Type: NTFS Drive D: | 830,59 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: KEMPIŃSKI | User Name: Norek | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (All) ==========[/color] PRC - [2010-11-15 19:59:30 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Norek\Moje dokumenty\Pobieranie\OTL.exe PRC - [2010-11-01 13:45:14 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe PRC - [2010-10-30 15:01:38 | 000,016,856 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\plugin-container.exe PRC - [2010-10-30 15:01:34 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2010-10-30 10:11:08 | 000,075,064 | ---- | M] () -- C:\WINDOWS\system32\PnkBstrA.exe PRC - [2010-10-07 09:04:26 | 012,661,344 | ---- | M] (GG Network S.A.) -- C:\Program Files\Gadu-Gadu 10\gg.exe PRC - [2010-09-07 16:12:02 | 002,838,912 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastUI.exe PRC - [2010-09-07 16:11:59 | 000,040,384 | ---- | M] (AVAST Software) -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe PRC - [2010-05-14 11:44:46 | 000,248,552 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Common Files\Java\Java Update\jusched.exe PRC - [2010-03-25 18:42:36 | 000,388,096 | ---- | M] (Trend Micro Inc.) -- C:\Program Files\hijack\Trend Micro\HiJackThis\HiJackThis.exe PRC - [2009-04-24 00:53:46 | 000,602,112 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\system32\ati2evxx.exe PRC - [2009-02-09 11:10:45 | 000,111,104 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\services.exe PRC - [2008-06-13 14:24:02 | 000,081,920 | ---- | M] (Firebird Project) -- C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe PRC - [2008-06-13 14:22:50 | 002,723,840 | ---- | M] (Firebird Project) -- C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe PRC - [2004-08-04 13:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2004-08-04 13:00:00 | 000,504,832 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\winlogon.exe PRC - [2004-08-04 13:00:00 | 000,070,144 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\notepad.exe PRC - [2004-08-04 13:00:00 | 000,057,856 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\spoolsv.exe PRC - [2004-08-04 13:00:00 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\smss.exe PRC - [2004-08-04 13:00:00 | 000,044,544 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\alg.exe PRC - [2004-08-04 13:00:00 | 000,033,280 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\rundll32.exe PRC - [2004-08-04 13:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [RPCSS] PRC - [2004-08-04 13:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [NETWORKSERVICE] PRC - [2004-08-04 13:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [NETSVCS] PRC - [2004-08-04 13:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [LOCALSERVICE] PRC - [2004-08-04 13:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [LOCALSERVICE] PRC - [2004-08-04 13:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [IMGSVC] PRC - [2004-08-04 13:00:00 | 000,014,336 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\svchost.exe [DCOMLAUNCH] PRC - [2004-08-04 13:00:00 | 000,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe PRC - [2004-08-04 13:00:00 | 000,013,312 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\lsass.exe PRC - [2004-08-04 13:00:00 | 000,006,144 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\csrss.exe PRC - [2004-01-26 10:38:38 | 000,866,816 | ---- | M] (THOMSON Telecom Belgium) -- C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe PRC - [2002-03-19 17:30:00 | 000,045,632 | ---- | M] () -- C:\WINDOWS\system32\TaskSwitch.exe [color=#E56717]========== Modules (All) ==========[/color] MOD - [2010-11-15 19:59:30 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Norek\Moje dokumenty\Pobieranie\OTL.exe MOD - [2010-04-16 16:37:04 | 000,474,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\shlwapi.dll MOD - [2009-06-25 09:48:08 | 000,056,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\secur32.dll MOD - [2009-04-15 16:18:19 | 000,584,192 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\rpcrt4.dll MOD - [2009-03-21 15:21:24 | 001,014,784 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\kernel32.dll MOD - [2009-02-09 11:22:08 | 000,686,080 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\advapi32.dll MOD - [2009-02-09 11:22:06 | 000,722,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ntdll.dll MOD - [2008-10-23 14:01:37 | 000,283,648 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\gdi32.dll MOD - [2008-07-03 14:16:27 | 008,483,328 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\shell32.dll MOD - [2004-08-04 13:00:00 | 001,281,024 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\ole32.dll MOD - [2004-08-04 13:00:00 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll MOD - [2004-08-04 13:00:00 | 000,996,352 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\setupapi.dll MOD - [2004-08-04 13:00:00 | 000,822,272 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\comres.dll MOD - [2004-08-04 13:00:00 | 000,729,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\userenv.dll MOD - [2004-08-04 13:00:00 | 000,578,560 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\user32.dll MOD - [2004-08-04 13:00:00 | 000,553,472 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\oleaut32.dll MOD - [2004-08-04 13:00:00 | 000,501,248 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\clbcatq.dll MOD - [2004-08-04 13:00:00 | 000,343,040 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msvcrt.dll MOD - [2004-08-04 13:00:00 | 000,279,552 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\comdlg32.dll MOD - [2004-08-04 13:00:00 | 000,219,648 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\uxtheme.dll MOD - [2004-08-04 13:00:00 | 000,185,856 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wbem\framedyn.dll MOD - [2004-08-04 13:00:00 | 000,146,432 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\winspool.drv MOD - [2004-08-04 13:00:00 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx MOD - [2004-08-04 13:00:00 | 000,083,456 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\olepro32.dll MOD - [2004-08-04 13:00:00 | 000,067,584 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\srclient.dll MOD - [2004-08-04 13:00:00 | 000,023,040 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\psapi.dll MOD - [2004-08-04 13:00:00 | 000,018,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\version.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ) SRV - [2010-09-07 16:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Web Scanner) SRV - [2010-09-07 16:11:59 | 000,040,384 | ---- | M] (AVAST Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Mail Scanner) SRV - [2010-09-07 16:11:59 | 000,040,384 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus) SRV - [2010-03-18 16:47:22 | 000,035,160 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe -- (aspnet_state) SRV - [2010-03-18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400) SRV - [2010-03-18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010-03-18 13:16:28 | 000,124,240 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe -- (NetTcpPortSharing) SRV - [2009-08-24 21:16:36 | 000,406,016 | ---- | M] (mst software GmbH, Germany) [On_Demand | Stopped] -- C:\Program Files\Ashampoo\Ashampoo WinOptimizer 7\Dfsdks.exe -- (DfSdkS) SRV - [2009-07-26 05:43:14 | 000,025,832 | ---- | M] (BioWare) [On_Demand | Stopped] -- C:\Program Files\Dragon Age\bin_ship\daupdatersvc.service.exe -- (DAUpdaterSvc) SRV - [2008-06-13 14:24:02 | 000,081,920 | ---- | M] (Firebird Project) [Auto | Running] -- C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe -- (FirebirdGuardianDefaultInstance) SRV - [2008-06-13 14:22:50 | 002,723,840 | ---- | M] (Firebird Project) [On_Demand | Running] -- C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe -- (FirebirdServerDefaultInstance) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\EagleNT.sys -- (EagleNT) DRV - [2010-11-28 16:24:31 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd) DRV - [2010-09-07 15:53:58 | 000,340,048 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx) DRV - [2010-09-07 15:52:25 | 000,046,672 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi) DRV - [2010-09-07 15:52:03 | 000,165,584 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP) DRV - [2010-09-07 15:47:46 | 000,023,376 | ---- | M] (AVAST Software) [Kernel | On_Demand | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr) DRV - [2010-09-07 15:47:19 | 000,100,176 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2) DRV - [2010-09-07 15:47:07 | 000,017,744 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2010-09-07 15:46:51 | 000,028,880 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2010-07-01 14:21:14 | 000,034,896 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ScreamingBAudio.sys -- (SCREAMINGBDRIVER) DRV - [2010-02-11 13:01:43 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6) DRV - [2009-04-24 02:30:57 | 004,049,408 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2007-07-15 02:37:04 | 000,027,992 | ---- | M] (EnTech Taiwan) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\pstrip.sys -- (PStrip) DRV - [2005-03-04 04:10:26 | 000,074,496 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp) DRV - [2004-10-15 12:50:20 | 000,015,295 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BrScnUsb.sys -- (BrScnUsb) DRV - [2004-08-03 23:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Sterownik NT karty Realtek RTL8139(A/B/C) DRV - [2003-12-08 10:53:48 | 000,053,600 | ---- | M] (THOMSON) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\alcan5wn.sys -- (alcan5wn) SpeedTouch USB ADSL PPP Networking Driver (NDISWAN) DRV - [2003-12-08 10:53:46 | 000,070,688 | ---- | M] (THOMSON) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\alcaudsl.sys -- (alcaudsl) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-861567501-1383384898-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2475029 IE - HKU\S-1-5-21-861567501-1383384898-682003330-1003\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.) IE - HKU\S-1-5-21-861567501-1383384898-682003330-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultthis.engineName: "MyAshampoo Customized Web Search" FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.startup.homepage: "www.google.pl" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.3.3 FF - prefs.js..extensions.enabledItems: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4}:3.2.3.3 FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6778 FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&q=" FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010-11-13 17:52:47 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010-11-23 15:22:11 | 000,000,000 | ---D | M] [2010-10-23 13:33:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Extensions [2010-11-28 16:38:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions [2010-10-27 17:12:44 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-11-25 14:30:32 | 000,000,000 | ---D | M] (MyAshampoo Community Toolbar) -- C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} [2010-11-25 14:30:30 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions\engine@conduit.com [2010-11-02 15:51:16 | 000,000,923 | ---- | M] () -- C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\searchplugins\conduit.xml [2010-11-28 16:38:43 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2010-11-26 15:21:21 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2010-11-01 13:45:26 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2010-11-01 13:45:14 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll [2010-10-12 21:19:45 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2010-10-12 21:19:45 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2010-10-12 21:19:45 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2010-10-12 21:19:45 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2010-10-12 21:19:45 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2010-10-12 21:19:45 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2004-08-04 13:00:00 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) O2 - BHO: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.) O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.) O4 - HKLM..\Run: [ATICustomerCare] C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\AvastUI.exe (AVAST Software) O4 - HKLM..\Run: [Cmaudio] File not found O4 - HKLM..\Run: [CoolSwitch] C:\WINDOWS\system32\TaskSwitch.exe () O4 - HKLM..\Run: [SpeedTouch USB Diagnostics] C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe (THOMSON Telecom Belgium) O4 - HKU\.DEFAULT..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe () O4 - HKU\S-1-5-18..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe () O4 - HKU\S-1-5-19..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe () O4 - HKU\S-1-5-20..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe () O4 - HKU\S-1-5-21-861567501-1383384898-682003330-1003..\Run: [Gadu-Gadu 10] C:\Program Files\Gadu-Gadu 10\gg.exe (GG Network S.A.) O4 - HKU\S-1-5-21-861567501-1383384898-682003330-1003..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (Safer Networking Limited) O4 - HKU\S-1-5-21-861567501-1383384898-682003330-1003..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-861567501-1383384898-682003330-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010-10-23 12:57:40 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2008-03-31 10:53:22 | 000,499,712 | R--- | M] () - D:\Autorun.exe -- [ CDFS ] O32 - AutoRun File - [2005-02-25 15:10:12 | 000,000,064 | R--- | M] () - D:\Autorun.inf -- [ CDFS ] O33 - MountPoints2\{b6612d43-deab-11df-b9d0-806d6172696f}\Shell - "" = AutoRun O33 - MountPoints2\{b6612d43-deab-11df-b9d0-806d6172696f}\Shell\AutoRun\command - "" = D:\Autorun.exe -- [2008-03-31 10:53:22 | 000,499,712 | R--- | M] () O33 - MountPoints2\E\Shell - "" = AutoRun O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found O34 - HKLM BootExecute: (autocheck autochk /r \??\C:) - File not found O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* NetSvcs: HidServ - C:\WINDOWS\System32\hidserv.dll File not found NetSvcs: Ias - File not found NetSvcs: Iprip - File not found NetSvcs: Irmon - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: WmdmPmSp - File not found [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-11-28 17:27:12 | 026,682,280 | ---- | C] (Konami Digital Entertainment Co., Ltd.) -- C:\Documents and Settings\Norek\Moje dokumenty\pes2011.exe [2010-11-28 17:12:35 | 011,867,264 | ---- | C] (Konami Digital Entertainment Co., Ltd.) -- C:\Documents and Settings\Norek\Pulpit\PES2011Patch101.exe [2010-11-28 17:10:08 | 016,254,800 | ---- | C] (Konami Digital Entertainment Co., Ltd.) -- C:\Documents and Settings\Norek\Pulpit\PES2011Patch102.exe [2010-11-28 16:52:59 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\SecuROM [2010-11-28 16:31:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\KONAMI [2010-11-28 16:24:20 | 000,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Lite [2010-11-28 16:23:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\DAEMON Tools Lite [2010-11-28 16:23:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite [2010-11-27 22:09:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Moje dokumenty\Downloads [2010-11-27 22:06:10 | 000,000,000 | ---D | C] -- C:\Program Files\uTorrent [2010-11-27 22:05:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\uTorrent [2010-11-27 17:51:51 | 000,000,000 | ---D | C] -- C:\BlueByte [2010-11-26 15:23:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\skypePM [2010-11-26 15:20:49 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype [2010-11-26 15:20:46 | 000,000,000 | R--D | C] -- C:\Program Files\Skype [2010-11-26 15:20:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\Skype [2010-11-26 15:20:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Skype [2010-11-25 15:22:35 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy [2010-11-25 15:22:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy [2010-11-25 15:04:21 | 000,000,000 | ---D | C] -- C:\Program Files\GameHike [2010-11-25 14:57:35 | 000,720,896 | ---- | C] (Indigo Rose Corporation) -- C:\WINDOWS\iun6002.exe [2010-11-25 14:57:34 | 000,000,000 | ---D | C] -- C:\Program Files\TuneXP [2010-11-25 14:30:39 | 000,000,000 | ---D | C] -- C:\Program Files\Conduit [2010-11-25 14:30:39 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\Conduit [2010-11-25 14:30:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\MyAshampoo [2010-11-25 14:30:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\ConduitEngine [2010-11-25 14:30:33 | 000,000,000 | ---D | C] -- C:\Program Files\ConduitEngine [2010-11-25 14:30:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\Temp [2010-11-25 14:30:29 | 000,000,000 | ---D | C] -- C:\Program Files\MyAshampoo [2010-11-25 14:30:21 | 000,028,160 | ---- | C] (mst software GmbH, Germany) -- C:\WINDOWS\System32\DfSdkBt.exe [2010-11-25 14:23:58 | 000,000,000 | ---D | C] -- C:\Program Files\Ashampoo [2010-11-25 14:17:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\Downloaded Installations [2010-11-24 21:25:11 | 000,000,000 | ---D | C] -- C:\Program Files\AnimeMT2 [2010-11-24 17:30:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\U3 [2010-11-23 16:02:40 | 000,000,000 | ---D | C] -- C:\Program Files\Odkurzacz [2010-11-23 15:22:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Adobe [2010-11-23 15:21:43 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe [2010-11-23 15:21:43 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe [2010-11-23 15:20:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\Adobe [2010-11-22 15:37:15 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Norek\Recent [2010-11-22 15:34:19 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2010-11-21 20:29:30 | 000,000,000 | ---D | C] -- C:\Metin2_PLllll [2010-11-19 16:46:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\appmgmt [2010-11-19 16:07:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\Screaming Bee [2010-11-19 16:07:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Screaming Bee [2010-11-16 20:00:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun [2010-11-15 20:02:29 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro [2010-11-15 20:02:27 | 000,000,000 | ---D | C] -- C:\rsit [2010-11-15 19:50:12 | 000,000,000 | ---D | C] -- C:\Program Files\hijack [2010-11-13 18:20:49 | 000,000,000 | ---D | C] -- C:\Program Files\xp-AntiSpy [2010-11-13 15:58:54 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\Brother [2010-11-12 20:42:01 | 000,000,000 | ---D | C] -- C:\Program Files\VB NS [2010-11-12 20:31:55 | 002,740,224 | ---- | C] (Firebird Project) -- C:\WINDOWS\System32\fbclient.dll [2010-11-12 20:31:42 | 000,000,000 | ---D | C] -- C:\Program Files\Kosztorysant NSs [2010-11-12 20:30:33 | 000,450,560 | ---- | C] (Firebird Project) -- C:\WINDOWS\System32\GDS32.DLL [2010-11-12 20:30:27 | 000,462,848 | ---- | C] (IBPhoenix) -- C:\WINDOWS\System32\Firebird2Control.cpl [2010-11-12 20:30:21 | 000,000,000 | ---D | C] -- C:\Program Files\Firebird [2010-11-12 20:26:43 | 000,000,000 | ---D | C] -- C:\Program Files\Kosztorysant NS [2010-11-07 17:09:54 | 000,000,000 | ---D | C] -- C:\Program Files\1C Publishing EU [2010-11-06 12:35:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\teamspeak2 [2010-11-06 12:34:52 | 000,000,000 | ---D | C] -- C:\Program Files\Teamspeak2_RC2 [2010-11-04 17:22:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\OpenOffice.org [2010-11-04 17:20:17 | 000,000,000 | ---D | C] -- C:\Program Files\OpenOffice.org 3 [2010-11-04 17:19:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Pulpit\OpenOffice.org 3.0 (pl) Installation Files [2010-11-02 18:19:08 | 000,000,000 | ---D | C] -- C:\Program Files\Ubisoft [2010-11-01 13:45:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Sun [2010-11-01 13:45:36 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java [2010-11-01 13:45:10 | 000,000,000 | ---D | C] -- C:\Program Files\Java [2010-11-01 13:43:24 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\Sun [2010-10-31 21:54:29 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Moje dokumenty\KONAMI [2010-10-31 21:47:22 | 000,000,000 | ---D | C] -- C:\Program Files\KONAMI [2010-10-31 21:25:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\IObit [2010-10-31 21:25:51 | 000,000,000 | ---D | C] -- C:\Program Files\IObit [2010-10-31 21:25:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\IObit [2010-10-31 20:51:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\pss [2010-10-31 20:45:52 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\pl-PL [2010-10-31 20:39:56 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET [2010-10-31 16:38:39 | 000,000,000 | ---D | C] -- C:\users [2010-10-31 16:38:20 | 000,107,888 | ---- | C] (Sony DADC Austria AG.) -- C:\WINDOWS\System32\CmdLineExt.dll [2010-10-31 16:24:08 | 000,000,000 | ---D | C] -- C:\Program Files\THQ [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-11-29 15:32:55 | 000,002,529 | ---- | M] () -- C:\Documents and Settings\Norek\Pulpit\HiJackThis.lnk [2010-11-29 15:29:57 | 000,555,118 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2010-11-29 15:29:57 | 000,493,054 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010-11-29 15:29:57 | 000,104,274 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2010-11-29 15:29:57 | 000,083,598 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010-11-29 15:25:55 | 000,000,260 | ---- | M] () -- C:\WINDOWS\tasks\WGASetup.job [2010-11-29 15:25:50 | 000,000,250 | ---- | M] () -- C:\WINDOWS\tasks\Game_Booster_Startup.job [2010-11-29 15:25:39 | 000,169,584 | ---- | M] () -- C:\WINDOWS\System32\ativvaxx.cap [2010-11-29 15:25:39 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010-11-28 16:24:33 | 000,001,613 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\DAEMON Tools Lite.lnk [2010-11-28 16:24:31 | 000,691,696 | ---- | M] () -- C:\WINDOWS\System32\drivers\sptd.sys [2010-11-27 22:06:10 | 000,000,630 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\µTorrent.lnk [2010-11-27 22:05:08 | 000,029,456 | ---- | M] () -- C:\Documents and Settings\Norek\Moje dokumenty\Pro.Evolution.Soccer.2011-RELOADED.torrent [2010-11-27 21:51:56 | 000,650,940 | ---- | M] () -- C:\Documents and Settings\Norek\Moje dokumenty\Beast Kills.png [2010-11-27 19:18:20 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Norek\Moje dokumenty\ts3_clientui-win32-12599-2010-11-27 19_18_20.468750.dmp [2010-11-27 19:16:20 | 000,192,747 | ---- | M] () -- C:\Documents and Settings\Norek\Moje dokumenty\ts3_clientui-win32-12599-2010-11-27 19_16_20.203125.dmp [2010-11-27 17:51:54 | 000,001,778 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Settlers IV - Złota Edycja.lnk [2010-11-27 00:00:00 | 016,254,800 | ---- | M] (Konami Digital Entertainment Co., Ltd.) -- C:\Documents and Settings\Norek\Pulpit\PES2011Patch102.exe [2010-11-26 15:23:45 | 000,000,056 | -H-- | M] () -- C:\WINDOWS\System32\ezsidmv.dat [2010-11-26 15:20:50 | 000,001,880 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk [2010-11-25 15:22:42 | 000,000,933 | ---- | M] () -- C:\Documents and Settings\Norek\Pulpit\Spybot - Search & Destroy.lnk [2010-11-25 14:57:28 | 000,720,896 | ---- | M] (Indigo Rose Corporation) -- C:\WINDOWS\iun6002.exe [2010-11-24 15:44:45 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010-11-23 21:16:54 | 000,017,831 | ---- | M] () -- C:\Documents and Settings\Norek\Pulpit\2funkcje.pdf [2010-11-23 16:03:01 | 000,000,741 | ---- | M] () -- C:\Documents and Settings\Norek\Pulpit\Menedżer Rejestru.lnk [2010-11-23 15:22:11 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Adobe Reader 9.lnk [2010-11-22 15:34:20 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\CCleaner.lnk [2010-11-22 15:32:35 | 000,000,211 | -HS- | M] () -- C:\boot.ini [2010-11-21 20:30:28 | 000,000,565 | ---- | M] () -- C:\Documents and Settings\Norek\Pulpit\Metin2 PL.lnk [2010-11-20 12:05:15 | 000,022,328 | ---- | M] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2010-11-19 15:07:17 | 000,214,520 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrB.xtr [2010-11-15 19:43:19 | 000,018,085 | ---- | M] () -- C:\Documents and Settings\Norek\Moje dokumenty\umowa budowlana.odt [2010-11-15 17:49:11 | 000,072,706 | ---- | M] () -- C:\Documents and Settings\Norek\Pulpit\tabliczka_mnozenia_www.gif [2010-11-14 10:33:10 | 000,006,966 | ---- | M] () -- C:\Documents and Settings\Norek\Moje dokumenty\config_mp.cfg [2010-11-13 18:26:45 | 000,036,864 | ---- | M] () -- C:\WINDOWS\System32\ctfmon.exe [2010-11-13 18:26:44 | 000,036,864 | ---- | M] () -- C:\WINDOWS\System32\dllcache\ctfmon.exe [2010-11-13 18:20:49 | 000,001,580 | ---- | M] () -- C:\Documents and Settings\Norek\Pulpit\xp-AntiSpy.lnk [2010-11-13 16:14:01 | 002,372,250 | ---- | M] () -- C:\Documents and Settings\Norek\Moje dokumenty\P1020194.JPG [2010-11-13 16:12:37 | 002,727,960 | ---- | M] () -- C:\Documents and Settings\Norek\Moje dokumenty\P1020193.JPG [2010-11-12 20:43:04 | 000,000,589 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Vademecum Budowlane NS.lnk [2010-11-12 20:31:56 | 000,000,700 | ---- | M] () -- C:\Documents and Settings\Norek\Pulpit\Kosztorysant NS.lnk [2010-11-09 19:33:32 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Norek\pes2010.exe [2010-11-07 17:09:54 | 000,001,681 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\NecroVisioN.lnk [2010-11-06 12:34:54 | 000,000,665 | ---- | M] () -- C:\Documents and Settings\Norek\Pulpit\Teamspeak 2 RC2.lnk [2010-11-05 15:51:25 | 000,114,176 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2010-11-04 17:21:26 | 000,000,967 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\OpenOffice.org 3.0.lnk [2010-11-04 17:16:17 | 000,000,404 | ---- | M] () -- C:\WINDOWS\BRWMARK.INI [2010-11-04 17:16:17 | 000,000,027 | ---- | M] () -- C:\WINDOWS\BRPP2KA.INI [2010-11-04 17:04:17 | 000,052,252 | ---- | M] () -- C:\Documents and Settings\Norek\Moje dokumenty\esrsr.xps [2010-11-04 16:28:53 | 000,052,301 | ---- | M] () -- C:\Documents and Settings\Norek\Moje dokumenty\sdxps.xps [2010-11-02 18:29:46 | 000,001,715 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Graj w Dark Messiah of Might and Magic w trybie dla jednego gracza.lnk [2010-10-31 21:47:19 | 000,001,571 | ---- | M] () -- C:\Documents and Settings\Norek\Pulpit\Pro Evolution Soccer 6.lnk [2010-10-31 20:51:01 | 000,000,664 | ---- | M] () -- C:\WINDOWS\System32\d3d9caps.dat [2010-10-31 16:38:21 | 000,107,888 | ---- | M] (Sony DADC Austria AG.) -- C:\WINDOWS\System32\CmdLineExt.dll [2010-10-31 16:37:09 | 000,001,942 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\S.T.A.L.K.E.R. - Shadow of Chernobyl.lnk [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-11-28 16:24:33 | 000,001,613 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\DAEMON Tools Lite.lnk [2010-11-28 16:24:30 | 000,691,696 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2010-11-27 22:06:10 | 000,000,630 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\µTorrent.lnk [2010-11-27 22:04:50 | 000,029,456 | ---- | C] () -- C:\Documents and Settings\Norek\Moje dokumenty\Pro.Evolution.Soccer.2011-RELOADED.torrent [2010-11-27 21:50:57 | 000,650,940 | ---- | C] () -- C:\Documents and Settings\Norek\Moje dokumenty\Beast Kills.png [2010-11-27 19:18:20 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Norek\Moje dokumenty\ts3_clientui-win32-12599-2010-11-27 19_18_20.468750.dmp [2010-11-27 19:16:20 | 000,192,747 | ---- | C] () -- C:\Documents and Settings\Norek\Moje dokumenty\ts3_clientui-win32-12599-2010-11-27 19_16_20.203125.dmp [2010-11-27 17:51:54 | 000,001,778 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Settlers IV - Złota Edycja.lnk [2010-11-26 15:23:45 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat [2010-11-26 15:20:50 | 000,001,880 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk [2010-11-25 15:22:42 | 000,000,933 | ---- | C] () -- C:\Documents and Settings\Norek\Pulpit\Spybot - Search & Destroy.lnk [2010-11-24 19:12:27 | 000,017,831 | ---- | C] () -- C:\Documents and Settings\Norek\Pulpit\2funkcje.pdf [2010-11-23 16:03:01 | 000,000,741 | ---- | C] () -- C:\Documents and Settings\Norek\Pulpit\Menedżer Rejestru.lnk [2010-11-23 15:22:11 | 000,001,729 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Adobe Reader 9.lnk [2010-11-22 15:34:20 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\CCleaner.lnk [2010-11-19 14:29:42 | 000,846,336 | ---- | C] () -- C:\pbsetup.exe [2010-11-15 19:50:12 | 000,002,529 | ---- | C] () -- C:\Documents and Settings\Norek\Pulpit\HiJackThis.lnk [2010-11-15 19:22:24 | 000,018,085 | ---- | C] () -- C:\Documents and Settings\Norek\Moje dokumenty\umowa budowlana.odt [2010-11-15 17:49:10 | 000,072,706 | ---- | C] () -- C:\Documents and Settings\Norek\Pulpit\tabliczka_mnozenia_www.gif [2010-11-13 18:20:49 | 000,001,580 | ---- | C] () -- C:\Documents and Settings\Norek\Pulpit\xp-AntiSpy.lnk [2010-11-13 16:14:00 | 002,372,250 | ---- | C] () -- C:\Documents and Settings\Norek\Moje dokumenty\P1020194.JPG [2010-11-13 16:12:36 | 002,727,960 | ---- | C] () -- C:\Documents and Settings\Norek\Moje dokumenty\P1020193.JPG [2010-11-12 20:43:04 | 000,000,589 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Vademecum Budowlane NS.lnk [2010-11-12 20:31:56 | 000,000,700 | ---- | C] () -- C:\Documents and Settings\Norek\Pulpit\Kosztorysant NS.lnk [2010-11-09 19:33:32 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Norek\pes2010.exe [2010-11-07 17:09:54 | 000,001,681 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\NecroVisioN.lnk [2010-11-06 12:34:54 | 000,000,665 | ---- | C] () -- C:\Documents and Settings\Norek\Pulpit\Teamspeak 2 RC2.lnk [2010-11-04 17:21:26 | 000,000,967 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\OpenOffice.org 3.0.lnk [2010-11-04 17:16:17 | 000,000,404 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI [2010-11-04 17:16:17 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI [2010-11-04 17:04:16 | 000,052,252 | ---- | C] () -- C:\Documents and Settings\Norek\Moje dokumenty\esrsr.xps [2010-11-04 16:28:51 | 000,052,301 | ---- | C] () -- C:\Documents and Settings\Norek\Moje dokumenty\sdxps.xps [2010-11-02 18:29:46 | 000,001,715 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Graj w Dark Messiah of Might and Magic w trybie dla jednego gracza.lnk [2010-11-01 17:00:22 | 000,358,150 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-S-1-5-21-861567501-1383384898-682003330-1003-0.dat [2010-10-31 23:04:50 | 000,113,726 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-System.dat [2010-10-31 21:47:19 | 000,001,571 | ---- | C] () -- C:\Documents and Settings\Norek\Pulpit\Pro Evolution Soccer 6.lnk [2010-10-31 21:25:59 | 000,000,250 | ---- | C] () -- C:\WINDOWS\tasks\Game_Booster_Startup.job [2010-10-31 20:51:01 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2010-10-31 16:37:09 | 000,001,942 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\S.T.A.L.K.E.R. - Shadow of Chernobyl.lnk [2010-10-29 18:31:09 | 000,015,360 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll [2010-10-29 12:17:14 | 000,022,328 | ---- | C] () -- C:\Documents and Settings\Norek\Dane aplikacji\PnkBstrK.sys [2010-10-23 19:21:25 | 000,022,328 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2010-10-23 18:52:10 | 000,000,319 | ---- | C] () -- C:\WINDOWS\game.ini [2010-10-23 17:12:25 | 000,004,608 | ---- | C] () -- C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010-10-23 14:46:14 | 000,004,293 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2010-10-23 13:25:40 | 000,005,606 | ---- | C] () -- C:\WINDOWS\System32\stci.dll [2010-10-23 13:09:05 | 000,028,672 | R--- | C] () -- C:\WINDOWS\System32\cmirmdrv.dll [2010-10-23 13:09:00 | 000,000,092 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI [2010-10-23 13:09:00 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI [2010-10-23 13:08:59 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Wininit.ini [2010-10-23 13:08:41 | 000,028,672 | ---- | C] () -- C:\WINDOWS\CMIRmDriver.dll [2010-10-23 13:07:00 | 000,003,815 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2010-10-23 13:06:59 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2010-07-09 20:00:32 | 000,041,872 | ---- | C] () -- C:\WINDOWS\System32\xfcodec.dll [2008-10-07 08:13:30 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll [2002-03-19 18:30:00 | 000,010,752 | ---- | C] () -- C:\WINDOWS\System32\mag.dll [2002-03-19 17:30:00 | 000,141,824 | ---- | C] () -- C:\WINDOWS\System32\msvdm.dll [color=#E56717]========== LOP Check ==========[/color] [2010-10-29 15:01:44 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Alwil Software [2010-10-25 20:11:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\BioWare [2010-11-28 16:24:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite [2010-10-23 13:42:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10 [2010-10-31 21:25:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\IObit [2010-11-28 16:31:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\KONAMI [2010-10-23 17:38:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\OpenFM [2010-11-19 16:08:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Screaming Bee [2010-11-28 16:28:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Norek\Dane aplikacji\DAEMON Tools Lite [2010-11-10 16:32:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Norek\Dane aplikacji\Gadu-Gadu 10 [2010-10-31 21:25:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Norek\Dane aplikacji\IObit [2010-10-23 17:38:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Norek\Dane aplikacji\OpenFM [2010-11-04 17:22:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Norek\Dane aplikacji\OpenOffice.org [2010-11-19 16:07:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Norek\Dane aplikacji\Screaming Bee [2010-10-24 09:40:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Norek\Dane aplikacji\TS3Client [2010-11-29 15:26:00 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Norek\Dane aplikacji\uTorrent [2010-11-29 15:25:50 | 000,000,250 | ---- | M] () -- C:\WINDOWS\Tasks\Game_Booster_Startup.job [2010-11-29 15:25:55 | 000,000,260 | ---- | M] () -- C:\WINDOWS\Tasks\WGASetup.job [color=#E56717]========== Purity Check ==========[/color] [color=#E56717]========== Custom Scans ==========[/color] [color=#A23BEC]< %systemdrive%\*.* >[/color] [2010-10-23 12:57:40 | 000,000,000 | ---- | M] () -- C:\AUTOEXEC.BAT [2010-11-22 15:32:35 | 000,000,211 | -HS- | M] () -- C:\boot.ini [2004-08-04 13:00:00 | 000,004,952 | RHS- | M] () -- C:\Bootfont.bin [2010-10-23 12:57:40 | 000,000,000 | ---- | M] () -- C:\CONFIG.SYS [2010-10-23 12:57:40 | 000,000,000 | RHS- | M] () -- C:\IO.SYS [2009-01-05 17:34:58 | 531,182,763 | ---- | M] () -- C:\Metin2_20080908.exe [2010-10-23 12:57:40 | 000,000,000 | RHS- | M] () -- C:\MSDOS.SYS [2004-08-04 13:00:00 | 000,047,564 | RHS- | M] () -- C:\NTDETECT.COM [2004-08-04 13:00:00 | 000,250,624 | RHS- | M] () -- C:\ntldr [2010-11-29 15:25:30 | 104,857,600 | -HS- | M] () -- C:\pagefile.sys [2008-11-12 16:10:46 | 000,846,336 | ---- | M] () -- C:\pbsetup.exe < End of report >

Przy Gmerze wylaczylo mi komputer ;o

A bym zapomniał miałem jakieś ataki na Windowsa ale blokował je Avast już ich nie pamiętam bo zablokowałem okienko by ich mi nie pokazywał mniej więcej co godzinę to wyskakiwało

**Posty:** 9184 · przez **MUTOPOMPKA** 29 Lis 2010, 20:52

No i tym sposobem jeśli JAKIKOLWIEK program mówi Ci, że masz jakieś ataki -> powinieneś INTERWENIOWAĆ, a nie zmykac, bo "okienko mnie wkurza". Do tego nie wiem, czy wiesz, ale instaluje się system oraz sterowniki potem antywirus i firewall PRZY WYŁĄCZONYM NECIE, gdyz jest najbezpieczniej. Ale po co to pisać, kiedy najłatwiej na forum jakieś polecieć i napisać posta, że komp muli po formacie, wyskakują jakies ataki ale wyłączyłem powadomienia, bo "okienko wyskakiwało".

To teraz napisz jeszcze co to za okienko było i co w nim pisałao.

PS. Masz syf w kompie. Tylko tyle napisze. Więc gratuluje "świeżego" kompa :]

**Posty:** 4 · przez **Freshmaker** 30 Lis 2010, 16:21

Tyle że avast blokował te połączenia więc ten ekranik jakoś nie był mi potrzebny... Po 2 nic nie moglem zrobić ;d Po 3 jeśli mam jakiś syf to chce to wiedzieć po to wstawiłem te logi A co do wyskakującego ekraniku to nie wiem nie pamiętam.

**Posty:** 14516 · przez **ToServeAndProtect** 30 Lis 2010, 16:49

AVAST jest do pupy

i możesz sobie za jego pomocą co najwyżej zaprzyjaźnić się z wirusami

czyli zacznij czyszczenie od usunięcia avasta i zainstalowaniu jakiegoś innego (darmowego, comodo, avg. płatnego, eset, kaspersky, norton). wszystko podczas wyłączonego neta

**Posty:** 18165 · przez **wojtas** 30 Lis 2010, 21:27

log z Gmera robiony w nieodpowiednich warunkach :

[Kernel | Boot | Running] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd)

poczytaj programy emulujące napędy

Uruchom OTL i w sekcji własne opcje skanowania / skrypt wklej:

:OTL
IE - HKU\S-1-5-21-861567501-1383384898-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.conduit.com?SearchSource=10&ctid=CT2475029
IE - HKU\S-1-5-21-861567501-1383384898-682003330-1003\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
FF - prefs.js..browser.search.defaultthis.engineName: "MyAshampoo Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms}"
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.3.3
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&q="
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Cmaudio] File not found
O32 - AutoRun File - [2008-03-31 10:53:22 | 000,499,712 | R--- | M] () - D:\Autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2005-02-25 15:10:12 | 000,000,064 | R--- | M] () - D:\Autorun.inf -- [ CDFS ]
O33 - MountPoints2\{b6612d43-deab-11df-b9d0-806d6172696f}\Shell - "" = AutoRun
O33 - MountPoints2\{b6612d43-deab-11df-b9d0-806d6172696f}\Shell\AutoRun\command - "" = D:\Autorun.exe -- [2008-03-31 10:53:22 | 000,499,712 | R--- | M] ()
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\LaunchU3.exe -- File not found

:Files
C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions\engine@conduit.com
C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\searchplugins\conduit.xml
C:\Program Files\Conduit
C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\Conduit
C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\MyAshampoo
C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\ConduitEngine
C:\Program Files\ConduitEngine
C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\Temp
C:\Program Files\MyAshampoo
C:\Program Files\Ashampoo

:Commands
[emptytemp]
[emptyflash]
[clearallrestorepoints]

Kliknij wykonaj skrypt. I potwierdź reset komputera .

Następnie uruchamiasz OTL z opcją skanuj. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia (zawartość notatnika, która otworzy się po restarcie). dajesz też log z Gmera i raporty ze skanu tych plikow :

C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\dllcache\ctfmon.exe

a skanujesz tu http://virusscan.jotti.org/

**Posty:** 4 · przez **Freshmaker** 01 Gru 2010, 19:28

Dziękuje już jest trochę lepiej o to co wyskoczyło po restarcie , ponowny log z otl przy gmerze zawiesiło mi komputer a tak przy okazji wyskakuje mi okienko czarne C:\WINDOWS\system32\ctfmon.exe wcześniej do tego był błąd ale teraz go nie ma. Gmera spróbuje jeszcze raz użyć.

Kod: Zaznacz wszystko: All processes killed ========== OTL ========== HKU\S-1-5-21-861567501-1383384898-682003330-1003\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully! Registry value HKEY_USERS\S-1-5-21-861567501-1383384898-682003330-1003\Software\Microsoft\Internet Explorer\URLSearchHooks\\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\ not found. File C:\Program Files\MyAshampoo\tbMyAs.dll not found. Prefs.js: "MyAshampoo Customized Web Search" removed from browser.search.defaultthis.engineName Prefs.js: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl Prefs.js: engine@conduit.com:3.2.3.3 removed from extensions.enabledItems Prefs.js: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&q=" removed from keyword.URL Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found. File C:\Program Files\ConduitEngine\ConduitEngine.dll not found. Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\ not found. File C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd. not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{30F9B915-B755-4826-820B-08FBA6BD249D} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found. File C:\Program Files\ConduitEngine\ConduitEngine.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\ not found. File C:\Program Files\MyAshampoo\tbMyAs.dll not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\Cmaudio deleted successfully. File D:\Autorun.exe not found. File move failed. D:\Autorun.inf scheduled to be moved on reboot. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b6612d43-deab-11df-b9d0-806d6172696f}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b6612d43-deab-11df-b9d0-806d6172696f}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{b6612d43-deab-11df-b9d0-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b6612d43-deab-11df-b9d0-806d6172696f}\ not found. File D:\Autorun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E\ not found. File E:\LaunchU3.exe not found. ========== FILES ========== C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\searchplugin folder moved successfully. C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\META-INF folder moved successfully. C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\lib folder moved successfully. C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\defaults folder moved successfully. C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\components folder moved successfully. C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}\chrome folder moved successfully. C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4} folder moved successfully. C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions\engine@conduit.com\searchplugin folder moved successfully. C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions\engine@conduit.com\META-INF folder moved successfully. C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions\engine@conduit.com\lib folder moved successfully. C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions\engine@conduit.com\DualPackage folder moved successfully. C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions\engine@conduit.com\defaults folder moved successfully. C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions\engine@conduit.com\components folder moved successfully. C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions\engine@conduit.com\chrome folder moved successfully. C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions\engine@conduit.com folder moved successfully. C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\searchplugins\conduit.xml moved successfully. File\Folder C:\Program Files\Conduit not found. File\Folder C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\Conduit not found. C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\MyAshampoo folder moved successfully. File\Folder C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\ConduitEngine not found. File\Folder C:\Program Files\ConduitEngine not found. C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\Temp\Logs folder moved successfully. C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\Temp folder moved successfully. File\Folder C:\Program Files\MyAshampoo not found. File\Folder C:\Program Files\Ashampoo not found. ========== COMMANDS ========== [EMPTYTEMP] User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: Norek ->Temp folder emptied: 12937900 bytes ->Temporary Internet Files folder emptied: 285027 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 89904832 bytes ->Flash cache emptied: 1209 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 155648 bytes %systemroot%\System32 .tmp files removed: 2596 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 375056 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 99,00 mb [EMPTYFLASH] User: All Users User: Default User User: LocalService User: NetworkService User: Norek ->Flash cache emptied: 0 bytes Total Flash Files Cleaned = 0,00 mb Restore points cleared and new OTL Restore Point set! OTL by OldTimer - Version 3.2.17.3 log created on 12012010_163813 Files\Folders moved on Reboot... File move failed. D:\Autorun.inf scheduled to be moved on reboot. Registry entries deleted on Reboot...

Kod: Zaznacz wszystko: OTL logfile created on: 2010-12-01 16:47:27 - Run 3 OTL by OldTimer - Version 3.2.17.3 Folder = C:\Documents and Settings\Norek\Moje dokumenty\Pobieranie Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1 023,00 Mb Total Physical Memory | 715,00 Mb Available Physical Memory | 70,00% Memory free 2,00 Gb Paging File | 2,00 Gb Available in Paging File | 88,00% Paging File free Paging file location(s): C:\pagefile.sys 1500 1500 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 111,80 Gb Total Space | 28,12 Gb Free Space | 25,15% Space Free | Partition Type: NTFS Drive D: | 7,92 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF Computer Name: KEMPIŃSKI | User Name: Norek | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-11-15 19:59:30 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Norek\Moje dokumenty\Pobieranie\OTL.exe PRC - [2010-10-30 15:01:34 | 000,912,344 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe PRC - [2009-12-17 09:00:45 | 000,345,088 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\mspaint.exe PRC - [2008-06-13 14:24:02 | 000,081,920 | ---- | M] (Firebird Project) -- C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe PRC - [2008-06-13 14:22:50 | 002,723,840 | ---- | M] (Firebird Project) -- C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe PRC - [2004-08-04 13:00:00 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2004-01-26 10:38:38 | 000,866,816 | ---- | M] (THOMSON Telecom Belgium) -- C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe PRC - [2002-03-19 17:30:00 | 000,045,632 | ---- | M] () -- C:\WINDOWS\system32\TaskSwitch.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-11-15 19:59:30 | 000,575,488 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Norek\Moje dokumenty\Pobieranie\OTL.exe MOD - [2004-08-04 13:00:00 | 001,050,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ) SRV - [2010-03-18 16:47:22 | 000,035,160 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe -- (aspnet_state) SRV - [2010-03-18 13:16:28 | 000,753,504 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe -- (WPFFontCache_v0400) SRV - [2010-03-18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2010-03-18 13:16:28 | 000,124,240 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe -- (NetTcpPortSharing) SRV - [2009-07-26 05:43:14 | 000,025,832 | ---- | M] (BioWare) [On_Demand | Stopped] -- C:\Program Files\Dragon Age\bin_ship\daupdatersvc.service.exe -- (DAUpdaterSvc) SRV - [2008-06-13 14:24:02 | 000,081,920 | ---- | M] (Firebird Project) [Auto | Running] -- C:\Program Files\Firebird\Firebird_2_1\bin\fbguard.exe -- (FirebirdGuardianDefaultInstance) SRV - [2008-06-13 14:22:50 | 002,723,840 | ---- | M] (Firebird Project) [On_Demand | Running] -- C:\Program Files\Firebird\Firebird_2_1\bin\fbserver.exe -- (FirebirdServerDefaultInstance) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | Disabled | Stopped] -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\EagleNT.sys -- (EagleNT) DRV - [2010-11-30 20:09:51 | 000,211,893 | ---- | M] () [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\IsDrv122.sys -- (IsDrv122) DRV - [2010-07-01 14:21:14 | 000,034,896 | ---- | M] (Screaming Bee LLC) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ScreamingBAudio.sys -- (SCREAMINGBDRIVER) DRV - [2010-02-11 13:01:43 | 000,226,880 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\tcpip6.sys -- (Tcpip6) DRV - [2009-04-24 02:30:57 | 004,049,408 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ati2mtag.sys -- (ati2mtag) DRV - [2007-07-15 02:37:04 | 000,027,992 | ---- | M] (EnTech Taiwan) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\pstrip.sys -- (PStrip) DRV - [2007-01-31 14:33:46 | 000,005,632 | ---- | M] (GRISOFT, s.r.o.) [Kernel | Boot | Running] -- C:\WINDOWS\System32\DRIVERS\avgarkt.sys -- (AVG Anti-Rootkit) DRV - [2007-01-18 13:00:28 | 000,003,968 | ---- | M] (GRISOFT, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AvgArCln.sys -- (AvgArCln) DRV - [2005-03-04 04:10:26 | 000,074,496 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtlnicxp.sys -- (RTL8023xp) DRV - [2004-10-15 12:50:20 | 000,015,295 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\BrScnUsb.sys -- (BrScnUsb) DRV - [2004-08-03 23:31:34 | 000,020,992 | ---- | M] (Realtek Semiconductor Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\RTL8139.sys -- (rtl8139) Sterownik NT karty Realtek RTL8139(A/B/C) DRV - [2003-12-08 10:53:48 | 000,053,600 | ---- | M] (THOMSON) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\alcan5wn.sys -- (alcan5wn) SpeedTouch USB ADSL PPP Networking Driver (NDISWAN) DRV - [2003-12-08 10:53:46 | 000,070,688 | ---- | M] (THOMSON) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\alcaudsl.sys -- (alcaudsl) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - prefs.js..browser.search.defaultthis.engineName: "" FF - prefs.js..browser.search.defaulturl: "" FF - prefs.js..browser.startup.homepage: "www.google.pl" FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0 FF - prefs.js..extensions.enabledItems: {AB2CE124-6272-4b12-94A9-7303C7397BD1}:5.0.0.6778 FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010-11-13 17:52:47 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.6.12\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010-11-23 15:22:11 | 000,000,000 | ---D | M] [2010-10-23 13:33:11 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Extensions [2010-12-01 16:40:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions [2010-10-27 17:12:44 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Norek\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-11-30 17:27:26 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions [2010-11-26 15:21:21 | 000,000,000 | ---D | M] (Skype extension) -- C:\Program Files\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1} [2010-11-01 13:45:26 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2010-11-01 13:45:14 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll [2010-10-12 21:19:45 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml [2010-10-12 21:19:45 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml [2010-10-12 21:19:45 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml [2010-10-12 21:19:45 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml [2010-10-12 21:19:45 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml [2010-10-12 21:19:45 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2004-08-04 13:00:00 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Skype Plug-In) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O4 - HKLM..\Run: [ATICustomerCare] C:\Program Files\ATI\ATICustomerCare\ATICustomerCare.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [CoolSwitch] C:\WINDOWS\system32\TaskSwitch.exe () O4 - HKLM..\Run: [SpeedTouch USB Diagnostics] C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe (THOMSON Telecom Belgium) O4 - HKCU..\Run: [ctfmon.exe] C:\WINDOWS\System32\ctfmon.exe () O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - HKCU..\Run: [Gadu-Gadu 10] C:\Program Files\Gadu-Gadu 10\gg.exe (GG Network S.A.) O4 - HKCU..\Run: [uTorrent] C:\Program Files\uTorrent\uTorrent.exe (BitTorrent, Inc.) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O9 - Extra Button: Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra 'Tools' menuitem : Skype Plug-In - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010-10-23 12:57:40 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2008-03-31 09:08:02 | 000,000,082 | R--- | M] () - D:\Autorun.inf -- [ UDF ] O33 - MountPoints2\{b6612d43-deab-11df-b9d0-806d6172696f}\Shell - "" = AutoRun O33 - MountPoints2\{b6612d43-deab-11df-b9d0-806d6172696f}\Shell\AutoRun\command - "" = D:\cda_menu.exe -- [2010-08-03 13:51:45 | 004,685,312 | R--- | M] () O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-12-01 16:38:13 | 000,000,000 | ---D | C] -- C:\_OTL [2010-11-30 21:01:54 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Moje dokumenty\Lost Via Domus [2010-11-30 20:01:20 | 001,774,432 | ---- | C] (McAfee, Inc.) -- C:\Documents and Settings\Norek\Moje dokumenty\Rootkit_Detective.exe [2010-11-30 15:46:40 | 000,000,000 | ---D | C] -- C:\Program Files\Electronic Arts [2010-11-30 15:29:02 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Norek\Recent [2010-11-30 15:24:50 | 000,003,968 | ---- | C] (GRISOFT, s.r.o.) -- C:\WINDOWS\System32\drivers\AvgArCln.sys [2010-11-30 15:24:47 | 000,000,000 | ---D | C] -- C:\Program Files\GRISOFT [2010-11-30 14:59:22 | 000,000,000 | ---D | C] -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\Adobe [2010-11-29 16:31:18 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump [2010-11-28 17:27:12 | 026,682,280 | ---- | C] (Konami Digital Entertainment Co., Ltd.) -- C:\Documents and Settings\Norek\Moje dokumenty\pes2011.exe [2010-11-28 17:12:35 | 011,867,264 | ---- | C] (Konami Digital Entertainment Co., Ltd.) -- C:\Documents and Settings\Norek\Pulpit\PES2011Patch101.exe [2010-11-28 17:10:08 | 016,254,800 | ---- | C] (Konami Digital Entertainment Co., Ltd.) -- C:\Documents and Settings\Norek\Pulpit\PES2011Patch102.exe [2010-11-28 16:52:59 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\SecuROM [2010-11-28 16:31:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\KONAMI [2010-11-28 16:24:20 | 000,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Lite [2010-11-28 16:23:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\DAEMON Tools Lite [2010-11-28 16:23:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite [2010-11-27 22:09:11 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Moje dokumenty\Downloads [2010-11-27 22:06:10 | 000,000,000 | ---D | C] -- C:\Program Files\uTorrent [2010-11-27 22:05:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\uTorrent [2010-11-27 17:51:51 | 000,000,000 | ---D | C] -- C:\BlueByte [2010-11-26 15:23:40 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\skypePM [2010-11-26 15:20:49 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype [2010-11-26 15:20:46 | 000,000,000 | R--D | C] -- C:\Program Files\Skype [2010-11-26 15:20:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\Skype [2010-11-26 15:20:36 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Skype [2010-11-25 15:22:35 | 000,000,000 | ---D | C] -- C:\Program Files\Spybot - Search & Destroy [2010-11-25 15:22:35 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy [2010-11-25 14:57:35 | 000,720,896 | ---- | C] (Indigo Rose Corporation) -- C:\WINDOWS\iun6002.exe [2010-11-25 14:57:34 | 000,000,000 | ---D | C] -- C:\Program Files\TuneXP [2010-11-25 14:17:13 | 000,000,000 | ---D | C] -- C:\WINDOWS\Downloaded Installations [2010-11-24 21:25:11 | 000,000,000 | ---D | C] -- C:\Program Files\AnimeMT2 [2010-11-24 17:30:31 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\U3 [2010-11-23 16:02:40 | 000,000,000 | ---D | C] -- C:\Program Files\Odkurzacz [2010-11-23 15:22:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Adobe [2010-11-23 15:21:43 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe [2010-11-23 15:21:43 | 000,000,000 | ---D | C] -- C:\Program Files\Adobe [2010-11-23 15:20:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\Adobe [2010-11-22 15:34:19 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner [2010-11-21 20:29:30 | 000,000,000 | ---D | C] -- C:\Metin2_PLllll [2010-11-19 16:46:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\appmgmt [2010-11-19 16:07:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\Screaming Bee [2010-11-19 16:07:09 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Screaming Bee [2010-11-16 20:00:17 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun [2010-11-15 20:02:29 | 000,000,000 | ---D | C] -- C:\Program Files\trend micro [2010-11-15 20:02:27 | 000,000,000 | ---D | C] -- C:\rsit [2010-11-15 19:50:12 | 000,000,000 | ---D | C] -- C:\Program Files\hijack [2010-11-13 15:58:54 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\Brother [2010-11-12 20:42:01 | 000,000,000 | ---D | C] -- C:\Program Files\VB NS [2010-11-12 20:31:56 | 001,339,392 | ---- | C] (IBM Corporation and others) -- C:\WINDOWS\System32\icudt30.dll [2010-11-12 20:31:56 | 000,675,840 | ---- | C] (IBM Corporation and others) -- C:\WINDOWS\System32\icuuc30.dll [2010-11-12 20:31:56 | 000,274,432 | ---- | C] (IBM Corporation and others) -- C:\WINDOWS\System32\icuin30.dll [2010-11-12 20:31:55 | 002,740,224 | ---- | C] (Firebird Project) -- C:\WINDOWS\System32\fbclient.dll [2010-11-12 20:31:42 | 000,000,000 | ---D | C] -- C:\Program Files\Kosztorysant NSs [2010-11-12 20:30:33 | 000,450,560 | ---- | C] (Firebird Project) -- C:\WINDOWS\System32\GDS32.DLL [2010-11-12 20:30:27 | 000,462,848 | ---- | C] (IBPhoenix) -- C:\WINDOWS\System32\Firebird2Control.cpl [2010-11-12 20:30:21 | 000,000,000 | ---D | C] -- C:\Program Files\Firebird [2010-11-12 20:26:43 | 000,000,000 | ---D | C] -- C:\Program Files\Kosztorysant NS [2010-11-07 17:09:54 | 000,000,000 | ---D | C] -- C:\Program Files\1C Publishing EU [2010-11-07 13:48:14 | 000,009,600 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\hidusb.sys [2010-11-06 12:35:02 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\teamspeak2 [2010-11-06 12:34:57 | 000,034,064 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\lhacm.acm [2010-11-06 12:34:52 | 000,000,000 | ---D | C] -- C:\Program Files\Teamspeak2_RC2 [2010-11-04 17:22:10 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Dane aplikacji\OpenOffice.org [2010-11-04 17:20:17 | 000,000,000 | ---D | C] -- C:\Program Files\OpenOffice.org 3 [2010-11-04 17:19:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Norek\Pulpit\OpenOffice.org 3.0 (pl) Installation Files [2010-11-04 17:14:41 | 012,413,330 | ---- | C] (Macrovision Corporation) -- C:\Documents and Settings\Norek\Moje dokumenty\CC3update.exe [2010-11-04 16:40:38 | 000,025,856 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbprint.sys [2010-11-04 16:40:34 | 000,031,616 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\usbccgp.sys [2010-11-02 18:19:08 | 000,000,000 | ---D | C] -- C:\Program Files\Ubisoft [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-12-01 16:48:35 | 000,555,118 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2010-12-01 16:48:35 | 000,493,054 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2010-12-01 16:48:35 | 000,104,274 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2010-12-01 16:48:35 | 000,083,598 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2010-12-01 16:44:17 | 000,000,250 | ---- | M] () -- C:\WINDOWS\tasks\Game_Booster_Startup.job [2010-12-01 16:44:15 | 000,169,584 | ---- | M] () -- C:\WINDOWS\System32\ativvaxx.cap [2010-12-01 16:44:15 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2010-11-30 21:01:01 | 000,001,718 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Lost - Zagubieni.lnk [2010-11-30 20:09:51 | 000,211,893 | ---- | M] () -- C:\WINDOWS\System32\drivers\IsDrv122.sys [2010-11-30 15:44:03 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2010-11-30 15:24:50 | 000,000,828 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\AVG Anti-Rootkit Free.lnk [2010-11-30 15:21:16 | 000,002,596 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT [2010-11-29 15:32:55 | 000,002,529 | ---- | M] () -- C:\Documents and Settings\Norek\Pulpit\HiJackThis.lnk [2010-11-28 16:24:33 | 000,001,613 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\DAEMON Tools Lite.lnk [2010-11-27 22:06:10 | 000,000,630 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\µTorrent.lnk [2010-11-27 22:05:08 | 000,029,456 | ---- | M] () -- C:\Documents and Settings\Norek\Moje dokumenty\Pro.Evolution.Soccer.2011-RELOADED.torrent [2010-11-27 21:51:56 | 000,650,940 | ---- | M] () -- C:\Documents and Settings\Norek\Moje dokumenty\Beast Kills.png [2010-11-27 19:18:20 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Norek\Moje dokumenty\ts3_clientui-win32-12599-2010-11-27 19_18_20.468750.dmp [2010-11-27 19:16:20 | 000,192,747 | ---- | M] () -- C:\Documents and Settings\Norek\Moje dokumenty\ts3_clientui-win32-12599-2010-11-27 19_16_20.203125.dmp [2010-11-27 17:51:54 | 000,001,778 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Settlers IV - Złota Edycja.lnk [2010-11-27 00:00:00 | 016,254,800 | ---- | M] (Konami Digital Entertainment Co., Ltd.) -- C:\Documents and Settings\Norek\Pulpit\PES2011Patch102.exe [2010-11-26 15:23:45 | 000,000,056 | -H-- | M] () -- C:\WINDOWS\System32\ezsidmv.dat [2010-11-26 15:20:50 | 000,001,880 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk [2010-11-25 15:22:42 | 000,000,933 | ---- | M] () -- C:\Documents and Settings\Norek\Pulpit\Spybot - Search & Destroy.lnk [2010-11-25 14:57:28 | 000,720,896 | ---- | M] (Indigo Rose Corporation) -- C:\WINDOWS\iun6002.exe [2010-11-23 21:16:54 | 000,017,831 | ---- | M] () -- C:\Documents and Settings\Norek\Pulpit\2funkcje.pdf [2010-11-23 16:03:01 | 000,000,741 | ---- | M] () -- C:\Documents and Settings\Norek\Pulpit\Menedżer Rejestru.lnk [2010-11-23 15:22:11 | 000,001,729 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Adobe Reader 9.lnk [2010-11-22 15:34:20 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\CCleaner.lnk [2010-11-22 15:32:35 | 000,000,211 | -HS- | M] () -- C:\boot.ini [2010-11-21 20:30:28 | 000,000,565 | ---- | M] () -- C:\Documents and Settings\Norek\Pulpit\Metin2 PL.lnk [2010-11-20 12:05:15 | 000,022,328 | ---- | M] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2010-11-19 15:07:17 | 000,214,520 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrB.xtr [2010-11-15 19:43:19 | 000,018,085 | ---- | M] () -- C:\Documents and Settings\Norek\Moje dokumenty\umowa budowlana.odt [2010-11-15 17:49:11 | 000,072,706 | ---- | M] () -- C:\Documents and Settings\Norek\Pulpit\tabliczka_mnozenia_www.gif [2010-11-14 10:33:10 | 000,006,966 | ---- | M] () -- C:\Documents and Settings\Norek\Moje dokumenty\config_mp.cfg [2010-11-13 18:26:45 | 000,036,864 | ---- | M] () -- C:\WINDOWS\System32\ctfmon.exe [2010-11-13 16:14:01 | 002,372,250 | ---- | M] () -- C:\Documents and Settings\Norek\Moje dokumenty\P1020194.JPG [2010-11-13 16:12:37 | 002,727,960 | ---- | M] () -- C:\Documents and Settings\Norek\Moje dokumenty\P1020193.JPG [2010-11-12 20:43:04 | 000,000,589 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Vademecum Budowlane NS.lnk [2010-11-12 20:31:56 | 000,000,700 | ---- | M] () -- C:\Documents and Settings\Norek\Pulpit\Kosztorysant NS.lnk [2010-11-09 19:33:32 | 000,000,000 | ---- | M] () -- C:\Documents and Settings\Norek\pes2010.exe [2010-11-08 10:32:38 | 000,296,448 | ---- | M] () -- C:\Documents and Settings\Norek\Moje dokumenty\gmer.exe [2010-11-06 12:34:57 | 000,034,064 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\lhacm.acm [2010-11-06 12:34:54 | 000,000,665 | ---- | M] () -- C:\Documents and Settings\Norek\Pulpit\Teamspeak 2 RC2.lnk [2010-11-05 15:51:25 | 000,114,176 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2010-11-04 17:21:26 | 000,000,967 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\OpenOffice.org 3.0.lnk [2010-11-04 17:16:17 | 000,000,404 | ---- | M] () -- C:\WINDOWS\BRWMARK.INI [2010-11-04 17:16:17 | 000,000,027 | ---- | M] () -- C:\WINDOWS\BRPP2KA.INI [2010-11-04 17:04:17 | 000,052,252 | ---- | M] () -- C:\Documents and Settings\Norek\Moje dokumenty\esrsr.xps [2010-11-04 16:28:53 | 000,052,301 | ---- | M] () -- C:\Documents and Settings\Norek\Moje dokumenty\sdxps.xps [2010-11-02 18:29:46 | 000,001,715 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Graj w Dark Messiah of Might and Magic w trybie dla jednego gracza.lnk [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-11-30 21:01:01 | 000,001,718 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Lost - Zagubieni.lnk [2010-11-30 20:09:51 | 000,211,893 | ---- | C] () -- C:\WINDOWS\System32\drivers\IsDrv122.sys [2010-11-30 15:24:50 | 000,000,828 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\AVG Anti-Rootkit Free.lnk [2010-11-28 16:24:33 | 000,001,613 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\DAEMON Tools Lite.lnk [2010-11-27 22:06:10 | 000,000,630 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\µTorrent.lnk [2010-11-27 22:04:50 | 000,029,456 | ---- | C] () -- C:\Documents and Settings\Norek\Moje dokumenty\Pro.Evolution.Soccer.2011-RELOADED.torrent [2010-11-27 21:50:57 | 000,650,940 | ---- | C] () -- C:\Documents and Settings\Norek\Moje dokumenty\Beast Kills.png [2010-11-27 19:18:20 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Norek\Moje dokumenty\ts3_clientui-win32-12599-2010-11-27 19_18_20.468750.dmp [2010-11-27 19:16:20 | 000,192,747 | ---- | C] () -- C:\Documents and Settings\Norek\Moje dokumenty\ts3_clientui-win32-12599-2010-11-27 19_16_20.203125.dmp [2010-11-27 17:51:54 | 000,001,778 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Settlers IV - Złota Edycja.lnk [2010-11-26 15:23:45 | 000,000,056 | -H-- | C] () -- C:\WINDOWS\System32\ezsidmv.dat [2010-11-26 15:20:50 | 000,001,880 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Skype.lnk [2010-11-25 15:22:42 | 000,000,933 | ---- | C] () -- C:\Documents and Settings\Norek\Pulpit\Spybot - Search & Destroy.lnk [2010-11-24 19:12:27 | 000,017,831 | ---- | C] () -- C:\Documents and Settings\Norek\Pulpit\2funkcje.pdf [2010-11-23 16:03:01 | 000,000,741 | ---- | C] () -- C:\Documents and Settings\Norek\Pulpit\Menedżer Rejestru.lnk [2010-11-23 15:22:11 | 000,001,729 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Adobe Reader 9.lnk [2010-11-22 15:34:20 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\CCleaner.lnk [2010-11-19 14:29:42 | 000,846,336 | ---- | C] () -- C:\pbsetup.exe [2010-11-15 19:50:12 | 000,002,529 | ---- | C] () -- C:\Documents and Settings\Norek\Pulpit\HiJackThis.lnk [2010-11-15 19:22:24 | 000,018,085 | ---- | C] () -- C:\Documents and Settings\Norek\Moje dokumenty\umowa budowlana.odt [2010-11-15 17:49:10 | 000,072,706 | ---- | C] () -- C:\Documents and Settings\Norek\Pulpit\tabliczka_mnozenia_www.gif [2010-11-13 16:14:00 | 002,372,250 | ---- | C] () -- C:\Documents and Settings\Norek\Moje dokumenty\P1020194.JPG [2010-11-13 16:12:36 | 002,727,960 | ---- | C] () -- C:\Documents and Settings\Norek\Moje dokumenty\P1020193.JPG [2010-11-12 20:43:04 | 000,000,589 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Vademecum Budowlane NS.lnk [2010-11-12 20:31:56 | 000,000,700 | ---- | C] () -- C:\Documents and Settings\Norek\Pulpit\Kosztorysant NS.lnk [2010-11-09 19:33:32 | 000,000,000 | ---- | C] () -- C:\Documents and Settings\Norek\pes2010.exe [2010-11-06 12:34:54 | 000,000,665 | ---- | C] () -- C:\Documents and Settings\Norek\Pulpit\Teamspeak 2 RC2.lnk [2010-11-04 17:21:26 | 000,000,967 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\OpenOffice.org 3.0.lnk [2010-11-04 17:16:17 | 000,000,404 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI [2010-11-04 17:16:17 | 000,000,027 | ---- | C] () -- C:\WINDOWS\BRPP2KA.INI [2010-11-04 17:04:16 | 000,052,252 | ---- | C] () -- C:\Documents and Settings\Norek\Moje dokumenty\esrsr.xps [2010-11-04 16:28:51 | 000,052,301 | ---- | C] () -- C:\Documents and Settings\Norek\Moje dokumenty\sdxps.xps [2010-11-02 18:29:46 | 000,001,715 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Graj w Dark Messiah of Might and Magic w trybie dla jednego gracza.lnk [2010-11-01 17:00:22 | 000,358,150 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-S-1-5-21-861567501-1383384898-682003330-1003-0.dat [2010-10-31 23:04:50 | 000,113,726 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\WPFFontCache_v0400-System.dat [2010-10-29 18:31:09 | 000,015,360 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll [2010-10-29 12:17:14 | 000,022,328 | ---- | C] () -- C:\Documents and Settings\Norek\Dane aplikacji\PnkBstrK.sys [2010-10-23 19:21:25 | 000,022,328 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys [2010-10-23 18:52:10 | 000,000,319 | ---- | C] () -- C:\WINDOWS\game.ini [2010-10-23 17:12:25 | 000,004,608 | ---- | C] () -- C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2010-10-23 14:46:14 | 000,004,293 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2010-10-23 13:25:40 | 000,005,606 | ---- | C] () -- C:\WINDOWS\System32\stci.dll [2010-10-23 13:09:05 | 000,028,672 | R--- | C] () -- C:\WINDOWS\System32\cmirmdrv.dll [2010-10-23 13:09:00 | 000,000,092 | ---- | C] () -- C:\WINDOWS\CMISETUP.INI [2010-10-23 13:09:00 | 000,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI [2010-10-23 13:08:59 | 000,000,000 | ---- | C] () -- C:\WINDOWS\Wininit.ini [2010-10-23 13:08:41 | 000,028,672 | ---- | C] () -- C:\WINDOWS\CMIRmDriver.dll [2010-10-23 13:07:00 | 000,003,815 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2010-10-23 13:06:59 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2010-07-09 20:00:32 | 000,041,872 | ---- | C] () -- C:\WINDOWS\System32\xfcodec.dll [2008-10-07 08:13:30 | 000,197,912 | ---- | C] () -- C:\WINDOWS\System32\physxcudart_20.dll [2002-03-19 18:30:00 | 000,010,752 | ---- | C] () -- C:\WINDOWS\System32\mag.dll [2002-03-19 17:30:00 | 000,141,824 | ---- | C] () -- C:\WINDOWS\System32\msvdm.dll < End of report >

Dodano Dzisiaj, 18:45:
Przy początkowym skanie wtedy kiedy włączam program wyskakuje mi takie coś

Uploaded with ImageShack.us

A to okienko po wlaczeniu systemu.

Uploaded with ImageShack.us

Dodano Dzisiaj, 19:28:
Deamona już nie mam jak by co ;d

**Posty:** 18165 · przez **wojtas** 01 Gru 2010, 20:50

a przeskanowanie pliku :

C:\WINDOWS\System32\ctfmon.exe
C:\WINDOWS\System32\dllcache\ctfmon.exe

tu http://virusscan.jotti.org/

ter w gmerze daj opcje szukaj jeśli masz zaznaczone jak tu:

gmer-opis-dzialania-vt117883.html

zrób pełny skan Malwarebytes Anti-Malware (zaktualizuj, usuń co znajdzie ) i pokaż na forum raport + log z Gmera + skan pliku

**Posty:** 4 · przez **Freshmaker** 01 Gru 2010, 21:05

A zapomniałem przeskanowałem nic nie wykryło. Zaraz zrobię resztę ;d A w gmerze właśnie gdy naciskam szukaj zawiesza mi komputer...

Zamiast Gmera spróbuj zamiennie wykonać log z Root Repeal

Dodano Dzisiaj, 16:46:

Kod: Zaznacz wszystko: ROOTREPEAL (c) AD, 2007-2009 ================================================== Scan Start Time: 2010/12/02 16:29 Program Version: Version 1.3.5.0 Windows Version: Windows XP SP2 ================================================== Drivers ------------------- Name: dump_atapi.sys Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys Address: 0xA8F15000 Size: 98304 File Visible: No Signed: - Status: - Name: dump_WMILIB.SYS Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS Address: 0xA8F44000 Size: 8192 File Visible: No Signed: - Status: - Name: rootrepeal.sys Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys Address: 0xAA6AB000 Size: 49152 File Visible: No Signed: - Status: - Hidden/Locked Files ------------------- Path: C:\System Volume Information\_restore{6F8BCD58-1E40-4565-B32A-4A31CE510F7B}\RP55\A0029969.ini Status: Visible to the Windows API, but not on disk. Path: C:\System Volume Information\_restore{6F8BCD58-1E40-4565-B32A-4A31CE510F7B}\RP55\A0029970.INI Status: Visible to the Windows API, but not on disk. Path: c:\documents and settings\norek\ustawienia lokalne\temp\browserview-27f3f78.htm Status: Size mismatch (API: 2165, Raw: 2150) Path: c:\documents and settings\norek\ustawienia lokalne\dane aplikacji\mozilla\firefox\profiles\kf49ky6y.default\cache\_cache_001_ Status: Size mismatch (API: 1256348, Raw: 1230513) Path: c:\documents and settings\norek\ustawienia lokalne\dane aplikacji\mozilla\firefox\profiles\kf49ky6y.default\cache\_cache_002_ Status: Size mismatch (API: 1841564, Raw: 1798225) Path: c:\documents and settings\norek\ustawienia lokalne\dane aplikacji\mozilla\firefox\profiles\kf49ky6y.default\cache\_cache_003_ Status: Size mismatch (API: 2925345, Raw: 2770638) Path: C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\Cache\06DC61E9d01 Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\Cache\A169F352d01 Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\Cache\BC22F575d01 Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\Cache\C1582A96d01 Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\Cache\C8D75698d01 Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\Cache\CA6AEF9Ad01 Status: Visible to the Windows API, but not on disk. Path: C:\Documents and Settings\Norek\Ustawienia lokalne\Dane aplikacji\Mozilla\Firefox\Profiles\kf49ky6y.default\Cache\CC1D2968d01 Status: Visible to the Windows API, but not on disk. ==EOF==

Dodano Dzisiaj, 18:21:
Teraz sam z siebie komputer skacze do 50% użycia procesora anty malware nic nie wykrył oprócz kilku śmieci do gry (prywatne serwery do gry metin 2)

Dodano Dzisiaj, 20:26:
Tak w ogóle po odinstalowaniu tego sptd nie zacina mi sie podczas ładowania systemu ten napis Windows takie przycięcia i dopiero wchodzi w pasek lądujący teraz tego nie mam lecz zainstalowałem to spowrotem bo i tak nic to nie dało w Gmerze teraz nie mogę w nic grac. Bo gdy włączam grę odrazu mam klatkowanie
, a w niektórych gram gram i nagle klatkowanie na 10 sec wcześniej tego nie było...

Kto jest na forum