Pswtool.netpass.fv - pomocy

**Posty:** 6 · przez **ADGOR** 05 Sie 2010, 20:13

Witam,
Koledzy pomóżcie,
Przyszłem z pracy, włączam komputer, system się ładuje, otwiera się ekran logowania, wpisuję hasło i za kilkanaście sekund pojawia sie czerwony ekran z komunikatem że nastapiły zmiany w ustawieniach windows i system może nie działać poprawnie. Mam do wyboru nacisną " zamknij" lub " dowiedz się więcej". Naciskam ten drugi i system przenosi mnie do przeglądarki urachamiając stronę microsoftu. Bez problemu moge przechodzić na inne strony ale nie mam dostępu do danych, pulpitu itp. Uruchamiając komputer w trybie awaryjnym mam dostęp do wszystkiego.
Dowiedziałem się, że mój syn zainstalował na komputerze gre "4story" musiał ściągnąć jakiś plik ze stronki i się zalogować (tak mi to opowiada). W trakcie gry pojawił się czerwony ekran i nic nie można było zrobić.

Program Spyware Terminator znalazł taki defekt: PSWTool.NetPass.fv - podobno jest to trojan, który miesza coś z hasłami. W żaden sposób nie mogę tego usunąć.

MOje oporogramowanie : Vista

Raport HIJackthis w załączniku
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:58:27, on 2010-08-05
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v8.00 (8.00.6001.18904)
Boot mode: Safe mode with network support

Running processes:
C:\Windows\Explorer.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Windows\Explorer.exe
C:\Users\ADGOR\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [WPCUMI] C:\Windows\system32\WpcUmi.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RtHDVCpl] RtHDVCpl.exe
O4 - HKLM\..\Run: [Skytel] Skytel.exe
O4 - HKLM\..\Run: [MSConfig] "C:\Windows\system32\msconfig.exe" /auto
O4 - HKCU\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
O4 - HKCU\..\RunOnce: [Shockwave Updater] C:\Windows\system32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident/4.0; SLCC1; .NET CLR 2.0.50727; Media Center PC 5.0; .NET CLR 3.5.30729; .NET CLR 3.0.30618)" -"http://www.gry.pl/gra/Deadly-City-Survival.html"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA SIECIOWA')
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\wpclsp.dll
O13 - Gopher Prefix:
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: tbr - {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - (no file)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: mks_vir (mks_services) - Unknown owner - C:\Program Files\mks_vir_9\bin\mks_services.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: Microsoft Office Diagnostics Service (odserv) - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe

--
End of file - 5965 bytes

**Posty:** 584 · przez **Andziorka** 05 Sie 2010, 23:54

Daj loga z OTL: otl-dds-combofix-vt117885.html

**Posty:** 2183 · przez **NieWiem** 06 Sie 2010, 13:28

Andziorka, zacznij się stosować do regulaminu.

ŻADNYCH LOGÓW ANI ICH SPRAWDZANIA DOPÓKI TEMAT NIE BĘDZIE REGULAMINOWY!

P.S. Z tamtego drugiego forum temat wyleciał dokładnie za to samo.

**Posty:** 6 · przez **ADGOR** 06 Sie 2010, 21:49

Witam,
Przepraszam jeżeli naruszyłem regulamin, być może nie przeczytałem wszystkiego dokładnie.

Niestety nie moge wygenerować tego loga z tego programu, nic mi się nie zapisuje. Czy jest inny sposób aby ustalic przyczynę tej awarii?. Niestety nie jestem biegły w tym zakresie. Bardzo prosze o pomoc.

Pozdrawiam i jeszcze raz przepraszam, jeżeli złamałem regulamin

Mam tylko coś takiego:
OTL logfile created on: 2010-08-06 21:36:34 - Run 1
OTL by OldTimer - Version 3.2.9.0 Folder = C:\Users\ADGOR
Windows Vista Unlicensed product (Version = 6.0.6000) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18904)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

1 022,00 Mb Total Physical Memory | 337,00 Mb Available Physical Memory | 33,00% Memory free
2,00 Gb Paging File | 1,00 Gb Available in Paging File | 62,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 116,44 Gb Total Space | 60,82 Gb Free Space | 52,23% Space Free | Partition Type: NTFS
Drive D: | 116,44 Gb Total Space | 101,52 Gb Free Space | 87,19% Space Free | Partition Type: NTFS
E: Drive not present or media not loaded
F: Drive not present or media not loaded
G: Drive not present or media not loaded
H: Drive not present or media not loaded
I: Drive not present or media not loaded

Computer Name: ADGOR-PC
Current User Name: ADGOR
Logged in as Administrator.

Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard

========== Processes (SafeList) ==========

PRC - [2010-08-06 21:29:58 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\ADGOR\OTL.com
PRC - [2010-08-04 22:28:51 | 000,488,960 | ---- | M] (Crawler.com) -- C:\Program Files\Spyware Terminator\sp_rsser.exe
PRC - [2009-09-15 13:56:43 | 000,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe
PRC - [2009-09-15 13:54:13 | 000,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
PRC - [2009-09-15 13:49:40 | 000,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
PRC - [2009-01-19 19:49:59 | 000,351,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SLUI.exe
PRC - [2006-11-02 11:44:50 | 000,088,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\audiodg.exe
PRC - [2005-09-30 19:22:50 | 000,096,341 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe

========== Modules (SafeList) ==========

MOD - [2010-08-06 21:29:58 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\ADGOR\OTL.com
MOD - [2006-11-02 11:44:49 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx
MOD - [2006-11-02 11:38:57 | 001,648,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll

========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped] -- C:\Program Files\mks_vir_9\bin\mks_services.exe -- (mks_services)
SRV - [2010-08-04 22:28:51 | 000,488,960 | ---- | M] (Crawler.com) [Auto | Running] -- C:\Program Files\Spyware Terminator\sp_rsser.exe -- (sp_rssrv)
SRV - [2009-09-15 13:56:43 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus)
SRV - [2009-09-15 13:56:28 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner)
SRV - [2009-09-15 13:54:13 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner)
SRV - [2009-09-15 13:49:40 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv)
SRV - [2009-01-19 20:23:35 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2008-11-04 02:06:28 | 000,441,712 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2005-09-30 19:22:50 | 000,096,341 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\EagleXNt.sys -- (EagleXNt)
DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\blbdrive.sys -- (blbdrive)
DRV - [2009-09-15 13:55:30 | 000,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2009-09-15 13:55:19 | 000,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2009-09-15 13:55:09 | 000,053,328 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2009-09-15 13:54:30 | 000,052,368 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2009-09-15 13:54:21 | 000,023,152 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr)
DRV - [2009-01-19 20:05:25 | 000,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\viaide.sys -- (viaide)
DRV - [2008-05-20 12:01:00 | 002,143,136 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2008-03-24 13:52:00 | 007,438,848 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2006-11-02 11:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300)
DRV - [2006-11-02 11:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx)
DRV - [2006-11-02 11:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor)
DRV - [2006-11-02 11:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci)
DRV - [2006-11-02 11:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci)
DRV - [2006-11-02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV)
DRV - [2006-11-02 11:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320)
DRV - [2006-11-02 11:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2)
DRV - [2006-11-02 11:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid)
DRV - [2006-11-02 11:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx)
DRV - [2006-11-02 11:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata)
DRV - [2006-11-02 11:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m)
DRV - [2006-11-02 11:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid)
DRV - [2006-11-02 11:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960)
DRV - [2006-11-02 11:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp)
DRV - [2006-11-02 11:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4)
DRV - [2006-11-02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor)
DRV - [2006-11-02 11:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx)
DRV - [2006-11-02 11:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas)
DRV - [2006-11-02 11:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI)
DRV - [2006-11-02 11:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2)
DRV - [2006-11-02 11:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs)
DRV - [2006-11-02 11:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc)
DRV - [2006-11-02 11:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid)
DRV - [2006-11-02 11:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi)
DRV - [2006-11-02 11:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS)
DRV - [2006-11-02 11:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx)
DRV - [2006-11-02 11:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC)
DRV - [2006-11-02 11:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3)
DRV - [2006-11-02 11:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x)
DRV - [2006-11-02 11:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi)
DRV - [2006-11-02 11:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas)
DRV - [2006-11-02 11:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide)
DRV - [2006-11-02 11:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide)
DRV - [2006-11-02 10:57:06 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\irsir.sys -- (irsir)
DRV - [2006-11-02 10:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)
DRV - [2006-11-02 10:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer)
DRV - [2006-11-02 10:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp)
DRV - [2006-11-02 10:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo)
DRV - [2006-11-02 10:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm)
DRV - [2006-11-02 10:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm)
DRV - [2006-11-02 09:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi)
DRV - [2006-11-02 09:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300)
DRV - [2006-11-02 09:30:56 | 000,047,104 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtnicxp.sys -- (RTL8023xp)
DRV - [2006-11-02 09:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-3493491198-1989506696-1376508787-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/
IE - HKU\S-1-5-21-3493491198-1989506696-1376508787-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKU\S-1-5-21-3493491198-1989506696-1376508787-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009-04-12 19:13:12 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird

O1 HOSTS File: ([2006-09-18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer)
O4 - HKLM..\Run: [MSConfig] C:\Windows\System32\msconfig.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-3493491198-1989506696-1376508787-1000..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation)
O4 - HKU\S-1-5-21-3493491198-1989506696-1376508787-1000..\RunOnce: [Shockwave Updater] C:\Windows\System32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -Mozilla\4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident\4.0; File not found
O7 - HKU\S-1-5-21-3493491198-1989506696-1376508787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3493491198-1989506696-1376508787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2
O7 - HKU\S-1-5-21-3493491198-1989506696-1376508787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.16.11 83.143.96.12
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\tbr {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - Reg Error: Key error. File not found
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img30.jpg
O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img30.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006-09-18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2010-08-06 21:29:52 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\ADGOR\OTL.com
[2010-08-05 19:24:47 | 000,000,000 | ---D | C] -- C:\Program Files\Odkurzacz
[2010-08-05 19:24:24 | 006,868,767 | ---- | C] (Franmo Software ) -- C:\Users\ADGOR\odk12.3.0.46setup.exe
[2010-08-05 19:11:50 | 000,000,000 | ---D | C] -- C:\Windows\pss
[2010-08-05 18:50:55 | 011,747,656 | ---- | C] (ParetoLogic ) -- C:\Users\ADGOR\Pareto_AV_Setup_RW.exe
[2010-08-05 18:44:21 | 000,000,000 | ---D | C] -- C:\ProgramData\RegCure
[2010-08-05 18:44:20 | 000,000,000 | ---D | C] -- C:\Program Files\RegCure
[2010-08-05 18:44:07 | 001,940,656 | ---- | C] (ParetoLogic Inc.) -- C:\Users\ADGOR\RegCureSetup_RW.exe
[2010-08-05 18:40:17 | 000,390,656 | ---- | C] (iS3, Inc.) -- C:\Users\ADGOR\STOPzilla_Setup.exe
[2010-08-04 22:45:43 | 000,000,000 | ---D | C] -- C:\Users\ADGOR\backups
[2010-08-04 22:43:38 | 000,401,720 | ---- | C] (Trend Micro Inc.) -- C:\Users\ADGOR\HiJackThis.exe
[2010-08-04 22:34:31 | 000,975,640 | ---- | C] (Proland Software) -- C:\Users\ADGOR\Desktop\Winvulscan.exe
[2010-08-04 22:28:53 | 000,000,000 | ---D | C] -- C:\Program Files\Crawler
[2010-08-04 22:28:51 | 000,000,000 | ---D | C] -- C:\Users\ADGOR\AppData\Roaming\Spyware Terminator
[2010-08-04 22:28:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Spyware Terminator
[2010-08-04 22:28:48 | 000,000,000 | ---D | C] -- C:\Program Files\Spyware Terminator
[2010-08-04 22:25:14 | 000,665,064 | ---- | C] (Crawler Inc. ) -- C:\Users\ADGOR\Desktop\SpywareTerminatorSetup.exe
[2010-08-04 22:14:54 | 075,917,128 | ---- | C] (Norman ASA) -- C:\Users\ADGOR\Desktop\Norman_Malware_Cleaner.exe
[2010-08-04 22:07:12 | 000,000,000 | ---D | C] -- C:\Users\ADGOR\Desktop\Magda
[2010-08-01 17:44:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Windows Genuine Advantage
[2010-07-30 19:02:50 | 000,000,000 | ---D | C] -- C:\Program Files\Gameforge4D
[2010-07-27 18:29:47 | 000,000,000 | ---D | C] -- C:\Users\ADGOR\AppData\Roaming\PeerNetworking
[2010-07-18 16:31:44 | 000,000,000 | -H-D | C] -- C:\Windows\pwpEst
[2010-07-18 16:31:39 | 000,000,000 | ---D | C] -- C:\Program Files\PhotoPrint
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2010-08-06 21:39:11 | 003,670,016 | -HS- | M] () -- C:\Users\ADGOR\NTUSER.DAT
[2010-08-06 21:39:00 | 000,000,432 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{BA7A1D5C-2B75-4F93-AA3C-8C23226715BF}.job
[2010-08-06 21:38:00 | 000,000,430 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{35F36304-3A3D-4817-AE23-0E6D2A20F2ED}.job
[2010-08-06 21:35:15 | 000,000,418 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{DEAB4468-921D-4FE7-8065-9FF1E34017B1}.job
[2010-08-06 21:29:58 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\ADGOR\OTL.com
[2010-08-06 21:26:55 | 000,003,952 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2010-08-06 21:26:55 | 000,003,952 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2010-08-06 21:26:55 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2010-08-06 21:26:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2010-08-06 21:26:38 | 1072,160,768 | -HS- | M] () -- C:\hiberfil.sys
[2010-08-05 20:26:22 | 000,000,680 | ---- | M] () -- C:\Users\ADGOR\AppData\Local\d3d9caps.dat
[2010-08-05 19:25:05 | 000,000,978 | ---- | M] () -- C:\Users\ADGOR\Desktop\Szybkie Czyszczenie Dysku.lnk
[2010-08-05 19:25:05 | 000,000,882 | ---- | M] () -- C:\Users\ADGOR\Desktop\Odkurzacz.lnk
[2010-08-05 19:24:29 | 006,868,767 | ---- | M] (Franmo Software ) -- C:\Users\ADGOR\odk12.3.0.46setup.exe
[2010-08-05 19:16:24 | 000,271,968 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2010-08-05 18:50:59 | 011,747,656 | ---- | M] (ParetoLogic ) -- C:\Users\ADGOR\Pareto_AV_Setup_RW.exe
[2010-08-05 18:50:45 | 000,390,656 | ---- | M] (iS3, Inc.) -- C:\Users\ADGOR\STOPzilla_Setup.exe
[2010-08-05 18:44:23 | 000,000,390 | ---- | M] () -- C:\Windows\tasks\RegCure Program Check.job
[2010-08-05 18:44:23 | 000,000,372 | ---- | M] () -- C:\Windows\tasks\RegCure.job
[2010-08-05 18:44:21 | 000,000,784 | ---- | M] () -- C:\Users\Public\Desktop\RegCure.lnk
[2010-08-05 18:44:11 | 001,940,656 | ---- | M] (ParetoLogic Inc.) -- C:\Users\ADGOR\RegCureSetup_RW.exe
[2010-08-04 22:43:38 | 000,401,720 | ---- | M] (Trend Micro Inc.) -- C:\Users\ADGOR\HiJackThis.exe
[2010-08-04 22:34:32 | 000,975,640 | ---- | M] (Proland Software) -- C:\Users\ADGOR\Desktop\Winvulscan.exe
[2010-08-04 22:29:38 | 000,000,919 | ---- | M] () -- C:\Users\Public\Desktop\Spyware Terminator.lnk
[2010-08-04 22:28:51 | 000,142,592 | ---- | M] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys
[2010-08-04 22:25:47 | 000,665,064 | ---- | M] (Crawler Inc. ) -- C:\Users\ADGOR\Desktop\SpywareTerminatorSetup.exe
[2010-08-04 22:16:13 | 075,917,128 | ---- | M] (Norman ASA) -- C:\Users\ADGOR\Desktop\Norman_Malware_Cleaner.exe
[2010-07-29 19:51:34 | 000,016,780 | ---- | M] () -- C:\Users\ADGOR\Desktop\Zeszyt1.xlsx
[2010-07-29 19:39:43 | 000,215,347 | ---- | M] () -- C:\Users\ADGOR\Desktop\20100727102432579.pdf
[2010-07-29 19:38:57 | 000,216,045 | ---- | M] () -- C:\Users\ADGOR\Desktop\20100726151512920.pdf
[2010-07-29 19:36:41 | 000,196,376 | ---- | M] () -- C:\Users\ADGOR\Desktop\20100728155540221.pdf
[2010-07-29 19:29:43 | 000,610,470 | ---- | M] () -- C:\Users\ADGOR\Desktop\20100729114736401.pdf
[2010-07-29 19:24:27 | 000,071,141 | ---- | M] () -- C:\Users\ADGOR\Desktop\zgĹ‚oszenie szkody przez call center.54770.pdf
[2010-07-29 19:22:02 | 000,568,454 | ---- | M] () -- C:\Users\ADGOR\Desktop\20100716115239785.pdf
[2010-07-29 18:15:16 | 000,843,140 | ---- | M] () -- C:\Users\ADGOR\Desktop\20100727163910098.pdf
[2010-07-28 21:10:50 | 000,025,286 | ---- | M] () -- C:\Users\ADGOR\Desktop\Opłaty stałe.xlsx
[2010-07-27 18:29:47 | 000,024,206 | ---- | M] () -- C:\Users\ADGOR\AppData\Roaming\UserTile.png
[2010-07-26 20:31:48 | 000,024,016 | ---- | M] () -- C:\Users\ADGOR\Desktop\arkusz zakupu pojazdu.xlsx
[2010-07-26 20:23:23 | 000,013,016 | ---- | M] () -- C:\Users\ADGOR\Desktop\oceny iii sem.xlsx
[2010-07-26 19:00:34 | 000,012,437 | ---- | M] () -- C:\Users\ADGOR\Desktop\zlecenia darek.xlsx
[2010-07-24 12:22:58 | 000,002,619 | ---- | M] () -- C:\Users\ADGOR\Desktop\Microsoft Office Excel 2007.lnk
[2010-07-19 23:16:53 | 000,057,105 | ---- | M] () -- C:\Users\ADGOR\Desktop\arkusz rozliczeń.xlsx
[2010-07-18 16:32:39 | 000,000,066 | ---- | M] () -- C:\Windows\System32\wscicwi75.dll
[2010-07-18 16:32:28 | 000,001,692 | ---- | M] () -- C:\Users\ADGOR\Desktop\PhotoPrint.lnk
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

========== Files Created - No Company Name ==========

[2010-08-06 21:34:47 | 000,040,814 | ---- | C] () -- C:\Users\ADGOR\Extras.Txt
[2010-08-06 21:33:51 | 000,060,342 | ---- | C] () -- C:\Users\ADGOR\OTL.Txt
[2010-08-06 08:03:41 | 1072,160,768 | -HS- | C] () -- C:\hiberfil.sys
[2010-08-05 19:25:05 | 000,000,978 | ---- | C] () -- C:\Users\ADGOR\Desktop\Szybkie Czyszczenie Dysku.lnk
[2010-08-05 19:25:05 | 000,000,882 | ---- | C] () -- C:\Users\ADGOR\Desktop\Odkurzacz.lnk
[2010-08-05 18:44:23 | 000,000,390 | ---- | C] () -- C:\Windows\tasks\RegCure Program Check.job
[2010-08-05 18:44:23 | 000,000,372 | ---- | C] () -- C:\Windows\tasks\RegCure.job
[2010-08-05 18:44:21 | 000,000,784 | ---- | C] () -- C:\Users\Public\Desktop\RegCure.lnk
[2010-08-04 22:44:23 | 000,005,966 | ---- | C] () -- C:\Users\ADGOR\hijackthis.log
[2010-08-04 22:29:38 | 000,000,919 | ---- | C] () -- C:\Users\Public\Desktop\Spyware Terminator.lnk
[2010-08-04 22:28:51 | 000,142,592 | ---- | C] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys
[2010-07-29 19:51:34 | 000,016,780 | ---- | C] () -- C:\Users\ADGOR\Desktop\Zeszyt1.xlsx
[2010-07-29 19:39:42 | 000,215,347 | ---- | C] () -- C:\Users\ADGOR\Desktop\20100727102432579.pdf
[2010-07-29 19:38:56 | 000,216,045 | ---- | C] () -- C:\Users\ADGOR\Desktop\20100726151512920.pdf
[2010-07-29 19:36:40 | 000,196,376 | ---- | C] () -- C:\Users\ADGOR\Desktop\20100728155540221.pdf
[2010-07-29 19:29:43 | 000,610,470 | ---- | C] () -- C:\Users\ADGOR\Desktop\20100729114736401.pdf
[2010-07-29 19:24:27 | 000,071,141 | ---- | C] () -- C:\Users\ADGOR\Desktop\zgĹ‚oszenie szkody przez call center.54770.pdf
[2010-07-29 19:22:01 | 000,568,454 | ---- | C] () -- C:\Users\ADGOR\Desktop\20100716115239785.pdf
[2010-07-29 18:15:15 | 000,843,140 | ---- | C] () -- C:\Users\ADGOR\Desktop\20100727163910098.pdf
[2010-07-28 19:46:41 | 000,025,286 | ---- | C] () -- C:\Users\ADGOR\Desktop\Opłaty stałe.xlsx
[2010-07-27 18:29:47 | 000,024,206 | ---- | C] () -- C:\Users\ADGOR\AppData\Roaming\UserTile.png
[2010-07-24 12:30:52 | 000,012,437 | ---- | C] () -- C:\Users\ADGOR\Desktop\zlecenia darek.xlsx
[2010-07-18 16:32:39 | 000,000,066 | ---- | C] () -- C:\Windows\System32\wscicwi75.dll
[2010-07-18 16:32:28 | 000,001,692 | ---- | C] () -- C:\Users\ADGOR\Desktop\PhotoPrint.lnk
[2009-12-27 22:41:35 | 000,178,176 | ---- | C] () -- C:\Windows\System32\unrar.dll
[2009-12-27 22:41:34 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini
[2009-12-27 22:41:33 | 000,881,664 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2009-12-27 22:41:32 | 000,205,824 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll
[2009-12-27 22:41:31 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll
[2009-12-27 22:41:31 | 000,000,547 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll.manifest
[2009-05-18 09:39:45 | 000,018,704 | ---- | C] () -- C:\Windows\System32\mksidsf.sys
[2009-04-12 19:13:48 | 000,000,025 | ---- | C] () -- C:\Windows\cdplayer.ini
[2009-02-28 17:22:36 | 000,139,128 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2006-11-02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006-11-02 12:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2006-11-02 10:56:52 | 000,028,672 | ---- | C] () -- C:\Windows\System32\dtsh.dll
[2006-11-02 10:55:41 | 000,014,848 | ---- | C] () -- C:\Windows\System32\wlaninst.dll
[2006-11-02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini

========== LOP Check ==========

[2009-06-02 21:56:45 | 000,000,000 | ---D | M] -- C:\Users\ADGOR\AppData\Roaming\Bullzip
[2010-06-30 20:30:09 | 000,000,000 | ---D | M] -- C:\Users\ADGOR\AppData\Roaming\Canon
[2009-04-29 18:41:40 | 000,000,000 | ---D | M] -- C:\Users\ADGOR\AppData\Roaming\gtk-2.0
[2010-07-02 22:32:30 | 000,000,000 | ---D | M] -- C:\Users\ADGOR\AppData\Roaming\maxup
[2009-06-02 23:23:36 | 000,000,000 | ---D | M] -- C:\Users\ADGOR\AppData\Roaming\Nowe Gadu-Gadu
[2009-06-02 21:21:04 | 000,000,000 | ---D | M] -- C:\Users\ADGOR\AppData\Roaming\OpenFM
[2010-07-27 18:29:47 | 000,000,000 | ---D | M] -- C:\Users\ADGOR\AppData\Roaming\PeerNetworking
[2010-08-05 20:01:44 | 000,000,000 | ---D | M] -- C:\Users\ADGOR\AppData\Roaming\Spyware Terminator
[2010-08-05 18:44:23 | 000,000,390 | ---- | M] () -- C:\Windows\Tasks\RegCure Program Check.job
[2010-08-05 18:44:23 | 000,000,372 | ---- | M] () -- C:\Windows\Tasks\RegCure.job
[2010-08-06 11:38:28 | 000,032,578 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2010-08-06 21:38:00 | 000,000,430 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{35F36304-3A3D-4817-AE23-0E6D2A20F2ED}.job
[2010-08-06 21:39:00 | 000,000,432 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{BA7A1D5C-2B75-4F93-AA3C-8C23226715BF}.job
[2010-08-06 21:35:15 | 000,000,418 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{DEAB4468-921D-4FE7-8065-9FF1E34017B1}.job

========== Purity Check ==========

< End of report >

**Posty:** 2183 · przez **NieWiem** 06 Sie 2010, 21:59

Temat zgłaszam jako uporczywie nieregulaminowy.

**Posty:** 6 · przez **ADGOR** 06 Sie 2010, 22:03

Witam,
Co mam zrobić aby był regulaminowy?

Jestem nowym użytownikiem, więc popełniam błędy. Prosze mnie uświadomić a w przyszłości nie będzie ze mna problemów.
POzdrawiam

**Posty:** 2183 · przez **NieWiem** 06 Sie 2010, 22:05

Prosze mnie uświadomić

Proszę przeczytać regulamin. To chyba jasne, że każdy user powinien go przeczytać.
obowiazkowe-zasady-wstawiania-logow-wazne-vt117887.html

**Posty:** 18165 · przez **wojtas** 06 Sie 2010, 23:54

temat otwieram , brakuje aby logi były w tagach code czyli [/ code] tu cały log [/ code] <-bez spacji między / a code

Autor postu otrzymał pochwałę

**Posty:** 6 · przez **ADGOR** 07 Sie 2010, 09:12

Witam,
Dziękuje za otwarcie tematu. POniżej log z programu gmer.

Kod: Zaznacz wszystko: GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-08-07 09:04:10 Windows 6.0.6000 Running: n8qdxo2f.exe; Driver: C:\Users\ADGOR\AppData\Local\Temp\kgrorpog.sys ---- User code sections - GMER 1.0.15 ---- .text C:\Program Files\Internet Explorer\iexplore.exe[236] USER32.dll!DialogBoxParamW 76BA129F 5 Bytes JMP 72795505 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[1440] USER32.dll!DialogBoxParamW 76BA129F 5 Bytes JMP 72795505 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2044] USER32.dll!DialogBoxParamW 76BA129F 5 Bytes JMP 72795505 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\Windows\Explorer.EXE[1380] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [7455FBC8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1380] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [7452B9AA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1380] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [7451A31F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1380] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [7451CBFF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1380] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [74518AB2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1380] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [7452CF28] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1380] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [74517D98] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1380] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [74517CFF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1380] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [74516A64] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1380] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [745AC1D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1380] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [74537F56] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1380] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [745190CD] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1380] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [74522179] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1380] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [745221A4] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1380] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [74527F1C] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1380] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [74527D3E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1380] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [745583D5] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6000.16782_none_9ea1072ec96e0be7\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) ---- Devices - GMER 1.0.15 ---- AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) ---- Files - GMER 1.0.15 ---- File C:\Users\ADGOR\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X6OEBAEY\expand_nor[1] 2864 bytes File C:\Users\ADGOR\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\X6OEBAEY\collapse_nor[1] 0 bytes ---- EOF - GMER 1.0.15 ----

A tutaj log z OTL:

Kod: Zaznacz wszystko: OTL logfile created on: 2010-08-06 21:36:34 - Run 1 OTL by OldTimer - Version 3.2.9.0 Folder = C:\Users\ADGOR Windows Vista Unlicensed product (Version = 6.0.6000) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18904) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1 022,00 Mb Total Physical Memory | 337,00 Mb Available Physical Memory | 33,00% Memory free 2,00 Gb Paging File | 1,00 Gb Available in Paging File | 62,00% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 116,44 Gb Total Space | 60,82 Gb Free Space | 52,23% Space Free | Partition Type: NTFS Drive D: | 116,44 Gb Total Space | 101,52 Gb Free Space | 87,19% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: ADGOR-PC Current User Name: ADGOR Logged in as Administrator. Current Boot Mode: Normal Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2010-08-06 21:29:58 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\ADGOR\OTL.com PRC - [2010-08-04 22:28:51 | 000,488,960 | ---- | M] (Crawler.com) -- C:\Program Files\Spyware Terminator\sp_rsser.exe PRC - [2009-09-15 13:56:43 | 000,138,680 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashServ.exe PRC - [2009-09-15 13:54:13 | 000,352,920 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe PRC - [2009-09-15 13:49:40 | 000,018,752 | ---- | M] (ALWIL Software) -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe PRC - [2009-01-19 19:49:59 | 000,351,232 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SLUI.exe PRC - [2006-11-02 11:44:50 | 000,088,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\audiodg.exe PRC - [2005-09-30 19:22:50 | 000,096,341 | ---- | M] (Canon Inc.) -- C:\Program Files\Canon\CAL\CALMAIN.exe [color=#E56717]========== Modules (SafeList) ==========[/color] MOD - [2010-08-06 21:29:58 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\ADGOR\OTL.com MOD - [2006-11-02 11:44:49 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msscript.ocx MOD - [2006-11-02 11:38:57 | 001,648,128 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6000.16386_none_5d07289e07e1d100\comctl32.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [Auto | Stopped] -- C:\Program Files\mks_vir_9\bin\mks_services.exe -- (mks_services) SRV - [2010-08-04 22:28:51 | 000,488,960 | ---- | M] (Crawler.com) [Auto | Running] -- C:\Program Files\Spyware Terminator\sp_rsser.exe -- (sp_rssrv) SRV - [2009-09-15 13:56:43 | 000,138,680 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\ashServ.exe -- (avast! Antivirus) SRV - [2009-09-15 13:56:28 | 000,254,040 | ---- | M] (ALWIL Software) [On_Demand | Stopped] -- C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe -- (avast! Mail Scanner) SRV - [2009-09-15 13:54:13 | 000,352,920 | ---- | M] (ALWIL Software) [On_Demand | Running] -- C:\Program Files\Alwil Software\Avast4\ashWebSv.exe -- (avast! Web Scanner) SRV - [2009-09-15 13:49:40 | 000,018,752 | ---- | M] (ALWIL Software) [Auto | Running] -- C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe -- (aswUpdSv) SRV - [2009-01-19 20:23:35 | 000,265,912 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2008-11-04 02:06:28 | 000,441,712 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2005-09-30 19:22:50 | 000,096,341 | ---- | M] (Canon Inc.) [Auto | Running] -- C:\Program Files\Canon\CAL\CALMAIN.exe -- (CCALib8) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkfwd.sys -- (NwlnkFwd) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\nwlnkflt.sys -- (NwlnkFlt) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\DRIVERS\ipinip.sys -- (IpInIp) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\EagleXNt.sys -- (EagleXNt) DRV - File not found [Kernel | Disabled | Stopped] -- C:\Windows\System32\drivers\blbdrive.sys -- (blbdrive) DRV - [2009-09-15 13:55:30 | 000,114,768 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP) DRV - [2009-09-15 13:55:19 | 000,020,560 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2009-09-15 13:55:09 | 000,053,328 | ---- | M] (ALWIL Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt) DRV - [2009-09-15 13:54:30 | 000,052,368 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi) DRV - [2009-09-15 13:54:21 | 000,023,152 | ---- | M] (ALWIL Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr.sys -- (aswRdr) DRV - [2009-01-19 20:05:25 | 000,020,024 | ---- | M] (VIA Technologies, Inc.) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\viaide.sys -- (viaide) DRV - [2008-05-20 12:01:00 | 002,143,136 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\RTKVHDA.sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM) DRV - [2008-03-24 13:52:00 | 007,438,848 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) DRV - [2006-11-02 11:51:45 | 000,900,712 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql2300.sys -- (ql2300) DRV - [2006-11-02 11:51:38 | 000,420,968 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adp94xx.sys -- (adp94xx) DRV - [2006-11-02 11:51:34 | 000,316,520 | ---- | M] (Emulex) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\elxstor.sys -- (elxstor) DRV - [2006-11-02 11:51:32 | 000,297,576 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpahci.sys -- (adpahci) DRV - [2006-11-02 11:51:25 | 000,235,112 | ---- | M] (ULi Electronics Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\uliahci.sys -- (uliahci) DRV - [2006-11-02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iastorv.sys -- (iaStorV) DRV - [2006-11-02 11:51:00 | 000,147,048 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu320.sys -- (adpu320) DRV - [2006-11-02 11:50:45 | 000,115,816 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata2.sys -- (ulsata2) DRV - [2006-11-02 11:50:41 | 000,112,232 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\vsmraid.sys -- (vsmraid) DRV - [2006-11-02 11:50:35 | 000,106,088 | ---- | M] (QLogic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ql40xx.sys -- (ql40xx) DRV - [2006-11-02 11:50:35 | 000,098,408 | ---- | M] (Promise Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ulsata.sys -- (UlSata) DRV - [2006-11-02 11:50:35 | 000,098,408 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\adpu160m.sys -- (adpu160m) DRV - [2006-11-02 11:50:24 | 000,088,680 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvraid.sys -- (nvraid) DRV - [2006-11-02 11:50:19 | 000,045,160 | ---- | M] (IBM Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nfrd960.sys -- (nfrd960) DRV - [2006-11-02 11:50:17 | 000,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iirsp.sys -- (iirsp) DRV - [2006-11-02 11:50:16 | 000,071,784 | ---- | M] (Silicon Integrated Systems) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid4.sys -- (SiSRaid4) DRV - [2006-11-02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\nvstor.sys -- (nvstor) DRV - [2006-11-02 11:50:11 | 000,071,272 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\djsvs.sys -- (aic78xx) DRV - [2006-11-02 11:50:10 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arcsas.sys -- (arcsas) DRV - [2006-11-02 11:50:10 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_scsi.sys -- (LSI_SCSI) DRV - [2006-11-02 11:50:10 | 000,038,504 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sisraid2.sys -- (SiSRaid2) DRV - [2006-11-02 11:50:10 | 000,037,480 | ---- | M] (Hewlett-Packard Company) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\hpcisss.sys -- (HpCISSs) DRV - [2006-11-02 11:50:09 | 000,067,688 | ---- | M] (Adaptec, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\arc.sys -- (arc) DRV - [2006-11-02 11:50:09 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteraid.sys -- (iteraid) DRV - [2006-11-02 11:50:07 | 000,035,944 | ---- | M] (Integrated Technology Express, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\iteatapi.sys -- (iteatapi) DRV - [2006-11-02 11:50:05 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_sas.sys -- (LSI_SAS) DRV - [2006-11-02 11:50:05 | 000,035,944 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\symc8xx.sys -- (Symc8xx) DRV - [2006-11-02 11:50:04 | 000,065,640 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\lsi_fc.sys -- (LSI_FC) DRV - [2006-11-02 11:50:03 | 000,034,920 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_u3.sys -- (Sym_u3) DRV - [2006-11-02 11:49:59 | 000,033,384 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\mraid35x.sys -- (Mraid35x) DRV - [2006-11-02 11:49:56 | 000,031,848 | ---- | M] (LSI Logic) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\sym_hi.sys -- (Sym_hi) DRV - [2006-11-02 11:49:53 | 000,028,776 | ---- | M] (LSI Logic Corporation) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\megasas.sys -- (megasas) DRV - [2006-11-02 11:49:28 | 000,016,488 | ---- | M] (CMD Technology, Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\cmdide.sys -- (cmdide) DRV - [2006-11-02 11:49:20 | 000,014,952 | ---- | M] (Acer Laboratories Inc.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\aliide.sys -- (aliide) DRV - [2006-11-02 10:57:06 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\irsir.sys -- (irsir) DRV - [2006-11-02 10:25:24 | 000,071,808 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM) DRV - [2006-11-02 10:24:47 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brusbser.sys -- (BrUsbSer) DRV - [2006-11-02 10:24:46 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltup.sys -- (BrFiltUp) DRV - [2006-11-02 10:24:45 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\brfiltlo.sys -- (BrFiltLo) DRV - [2006-11-02 10:24:44 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brserwdm.sys -- (BrSerWdm) DRV - [2006-11-02 10:24:44 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\brusbmdm.sys -- (BrUsbMdm) DRV - [2006-11-02 09:36:50 | 000,020,608 | ---- | M] (N-trig Innovative Technologies) [Kernel | Disabled | Stopped] -- C:\Windows\system32\drivers\ntrigdigi.sys -- (ntrigdigi) DRV - [2006-11-02 09:36:43 | 002,028,032 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\atikmdag.sys -- (R300) DRV - [2006-11-02 09:30:56 | 000,047,104 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtnicxp.sys -- (RTL8023xp) DRV - [2006-11-02 09:30:54 | 000,117,760 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\E1G60I32.sys -- (E1G60) Intel(R) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-3493491198-1989506696-1376508787-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ IE - HKU\S-1-5-21-3493491198-1989506696-1376508787-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-3493491198-1989506696-1376508787-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Firefox\Extensions\\{ABDE892B-13A8-4d1b-88E6-365A6E755758}: C:\Program Files\Real\RealPlayer\browserrecord [2009-04-12 19:13:12 | 000,000,000 | ---D | M] FF - HKLM\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird O1 HOSTS File: ([2006-09-18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (RealPlayer Download and Record Plugin for Internet Explorer) - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll (RealPlayer) O4 - HKLM..\Run: [MSConfig] C:\Windows\System32\msconfig.exe (Microsoft Corporation) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Skytel] C:\Windows\SkyTel.exe (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\Run: [WPCUMI] C:\Windows\System32\wpcumi.exe (Microsoft Corporation) O4 - HKU\S-1-5-19..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-20..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-3493491198-1989506696-1376508787-1000..\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.dll (Microsoft Corporation) O4 - HKU\S-1-5-21-3493491198-1989506696-1376508787-1000..\RunOnce: [Shockwave Updater] C:\Windows\System32\Adobe\Shockwave 11\SwHelper_1151601.exe -Update -1151601 -Mozilla\4.0 (compatible; MSIE 8.0; Windows NT 6.0; Trident\4.0; File not found O7 - HKU\S-1-5-21-3493491198-1989506696-1376508787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-3493491198-1989506696-1376508787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2 O7 - HKU\S-1-5-21-3493491198-1989506696-1376508787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.) O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe (PokerStars) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000007 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000024 - C:\Windows\System32\wpclsp.dll (Microsoft Corporation) O13 - gopher Prefix: missing O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.16.11 83.143.96.12 O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\tbr {4D25FB7A-8902-4291-960E-9ADA051CFBBF} - Reg Error: Key error. File not found O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O24 - Desktop WallPaper: C:\Windows\Web\Wallpaper\img30.jpg O24 - Desktop BackupWallPaper: C:\Windows\Web\Wallpaper\img30.jpg O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006-09-18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2010-08-06 21:29:52 | 000,574,976 | ---- | C] (OldTimer Tools) -- C:\Users\ADGOR\OTL.com [2010-08-05 19:24:47 | 000,000,000 | ---D | C] -- C:\Program Files\Odkurzacz [2010-08-05 19:24:24 | 006,868,767 | ---- | C] (Franmo Software ) -- C:\Users\ADGOR\odk12.3.0.46setup.exe [2010-08-05 19:11:50 | 000,000,000 | ---D | C] -- C:\Windows\pss [2010-08-05 18:50:55 | 011,747,656 | ---- | C] (ParetoLogic ) -- C:\Users\ADGOR\Pareto_AV_Setup_RW.exe [2010-08-05 18:44:21 | 000,000,000 | ---D | C] -- C:\ProgramData\RegCure [2010-08-05 18:44:20 | 000,000,000 | ---D | C] -- C:\Program Files\RegCure [2010-08-05 18:44:07 | 001,940,656 | ---- | C] (ParetoLogic Inc.) -- C:\Users\ADGOR\RegCureSetup_RW.exe [2010-08-05 18:40:17 | 000,390,656 | ---- | C] (iS3, Inc.) -- C:\Users\ADGOR\STOPzilla_Setup.exe [2010-08-04 22:45:43 | 000,000,000 | ---D | C] -- C:\Users\ADGOR\backups [2010-08-04 22:43:38 | 000,401,720 | ---- | C] (Trend Micro Inc.) -- C:\Users\ADGOR\HiJackThis.exe [2010-08-04 22:34:31 | 000,975,640 | ---- | C] (Proland Software) -- C:\Users\ADGOR\Desktop\Winvulscan.exe [2010-08-04 22:28:53 | 000,000,000 | ---D | C] -- C:\Program Files\Crawler [2010-08-04 22:28:51 | 000,000,000 | ---D | C] -- C:\Users\ADGOR\AppData\Roaming\Spyware Terminator [2010-08-04 22:28:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Spyware Terminator [2010-08-04 22:28:48 | 000,000,000 | ---D | C] -- C:\Program Files\Spyware Terminator [2010-08-04 22:25:14 | 000,665,064 | ---- | C] (Crawler Inc. ) -- C:\Users\ADGOR\Desktop\SpywareTerminatorSetup.exe [2010-08-04 22:14:54 | 075,917,128 | ---- | C] (Norman ASA) -- C:\Users\ADGOR\Desktop\Norman_Malware_Cleaner.exe [2010-08-04 22:07:12 | 000,000,000 | ---D | C] -- C:\Users\ADGOR\Desktop\Magda [2010-08-01 17:44:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Windows Genuine Advantage [2010-07-30 19:02:50 | 000,000,000 | ---D | C] -- C:\Program Files\Gameforge4D [2010-07-27 18:29:47 | 000,000,000 | ---D | C] -- C:\Users\ADGOR\AppData\Roaming\PeerNetworking [2010-07-18 16:31:44 | 000,000,000 | -H-D | C] -- C:\Windows\pwpEst [2010-07-18 16:31:39 | 000,000,000 | ---D | C] -- C:\Program Files\PhotoPrint [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2010-08-06 21:39:11 | 003,670,016 | -HS- | M] () -- C:\Users\ADGOR\NTUSER.DAT [2010-08-06 21:39:00 | 000,000,432 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{BA7A1D5C-2B75-4F93-AA3C-8C23226715BF}.job [2010-08-06 21:38:00 | 000,000,430 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{35F36304-3A3D-4817-AE23-0E6D2A20F2ED}.job [2010-08-06 21:35:15 | 000,000,418 | -H-- | M] () -- C:\Windows\tasks\User_Feed_Synchronization-{DEAB4468-921D-4FE7-8065-9FF1E34017B1}.job [2010-08-06 21:29:58 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Users\ADGOR\OTL.com [2010-08-06 21:26:55 | 000,003,952 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2010-08-06 21:26:55 | 000,003,952 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2010-08-06 21:26:55 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT [2010-08-06 21:26:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2010-08-06 21:26:38 | 1072,160,768 | -HS- | M] () -- C:\hiberfil.sys [2010-08-05 20:26:22 | 000,000,680 | ---- | M] () -- C:\Users\ADGOR\AppData\Local\d3d9caps.dat [2010-08-05 19:25:05 | 000,000,978 | ---- | M] () -- C:\Users\ADGOR\Desktop\Szybkie Czyszczenie Dysku.lnk [2010-08-05 19:25:05 | 000,000,882 | ---- | M] () -- C:\Users\ADGOR\Desktop\Odkurzacz.lnk [2010-08-05 19:24:29 | 006,868,767 | ---- | M] (Franmo Software ) -- C:\Users\ADGOR\odk12.3.0.46setup.exe [2010-08-05 19:16:24 | 000,271,968 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2010-08-05 18:50:59 | 011,747,656 | ---- | M] (ParetoLogic ) -- C:\Users\ADGOR\Pareto_AV_Setup_RW.exe [2010-08-05 18:50:45 | 000,390,656 | ---- | M] (iS3, Inc.) -- C:\Users\ADGOR\STOPzilla_Setup.exe [2010-08-05 18:44:23 | 000,000,390 | ---- | M] () -- C:\Windows\tasks\RegCure Program Check.job [2010-08-05 18:44:23 | 000,000,372 | ---- | M] () -- C:\Windows\tasks\RegCure.job [2010-08-05 18:44:21 | 000,000,784 | ---- | M] () -- C:\Users\Public\Desktop\RegCure.lnk [2010-08-05 18:44:11 | 001,940,656 | ---- | M] (ParetoLogic Inc.) -- C:\Users\ADGOR\RegCureSetup_RW.exe [2010-08-04 22:43:38 | 000,401,720 | ---- | M] (Trend Micro Inc.) -- C:\Users\ADGOR\HiJackThis.exe [2010-08-04 22:34:32 | 000,975,640 | ---- | M] (Proland Software) -- C:\Users\ADGOR\Desktop\Winvulscan.exe [2010-08-04 22:29:38 | 000,000,919 | ---- | M] () -- C:\Users\Public\Desktop\Spyware Terminator.lnk [2010-08-04 22:28:51 | 000,142,592 | ---- | M] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys [2010-08-04 22:25:47 | 000,665,064 | ---- | M] (Crawler Inc. ) -- C:\Users\ADGOR\Desktop\SpywareTerminatorSetup.exe [2010-08-04 22:16:13 | 075,917,128 | ---- | M] (Norman ASA) -- C:\Users\ADGOR\Desktop\Norman_Malware_Cleaner.exe [2010-07-29 19:51:34 | 000,016,780 | ---- | M] () -- C:\Users\ADGOR\Desktop\Zeszyt1.xlsx [2010-07-29 19:39:43 | 000,215,347 | ---- | M] () -- C:\Users\ADGOR\Desktop\20100727102432579.pdf [2010-07-29 19:38:57 | 000,216,045 | ---- | M] () -- C:\Users\ADGOR\Desktop\20100726151512920.pdf [2010-07-29 19:36:41 | 000,196,376 | ---- | M] () -- C:\Users\ADGOR\Desktop\20100728155540221.pdf [2010-07-29 19:29:43 | 000,610,470 | ---- | M] () -- C:\Users\ADGOR\Desktop\20100729114736401.pdf [2010-07-29 19:24:27 | 000,071,141 | ---- | M] () -- C:\Users\ADGOR\Desktop\zgĹ‚oszenie szkody przez call center.54770.pdf [2010-07-29 19:22:02 | 000,568,454 | ---- | M] () -- C:\Users\ADGOR\Desktop\20100716115239785.pdf [2010-07-29 18:15:16 | 000,843,140 | ---- | M] () -- C:\Users\ADGOR\Desktop\20100727163910098.pdf [2010-07-28 21:10:50 | 000,025,286 | ---- | M] () -- C:\Users\ADGOR\Desktop\Opłaty stałe.xlsx [2010-07-27 18:29:47 | 000,024,206 | ---- | M] () -- C:\Users\ADGOR\AppData\Roaming\UserTile.png [2010-07-26 20:31:48 | 000,024,016 | ---- | M] () -- C:\Users\ADGOR\Desktop\arkusz zakupu pojazdu.xlsx [2010-07-26 20:23:23 | 000,013,016 | ---- | M] () -- C:\Users\ADGOR\Desktop\oceny iii sem.xlsx [2010-07-26 19:00:34 | 000,012,437 | ---- | M] () -- C:\Users\ADGOR\Desktop\zlecenia darek.xlsx [2010-07-24 12:22:58 | 000,002,619 | ---- | M] () -- C:\Users\ADGOR\Desktop\Microsoft Office Excel 2007.lnk [2010-07-19 23:16:53 | 000,057,105 | ---- | M] () -- C:\Users\ADGOR\Desktop\arkusz rozliczeń.xlsx [2010-07-18 16:32:39 | 000,000,066 | ---- | M] () -- C:\Windows\System32\wscicwi75.dll [2010-07-18 16:32:28 | 000,001,692 | ---- | M] () -- C:\Users\ADGOR\Desktop\PhotoPrint.lnk [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2010-08-06 21:34:47 | 000,040,814 | ---- | C] () -- C:\Users\ADGOR\Extras.Txt [2010-08-06 21:33:51 | 000,060,342 | ---- | C] () -- C:\Users\ADGOR\OTL.Txt [2010-08-06 08:03:41 | 1072,160,768 | -HS- | C] () -- C:\hiberfil.sys [2010-08-05 19:25:05 | 000,000,978 | ---- | C] () -- C:\Users\ADGOR\Desktop\Szybkie Czyszczenie Dysku.lnk [2010-08-05 19:25:05 | 000,000,882 | ---- | C] () -- C:\Users\ADGOR\Desktop\Odkurzacz.lnk [2010-08-05 18:44:23 | 000,000,390 | ---- | C] () -- C:\Windows\tasks\RegCure Program Check.job [2010-08-05 18:44:23 | 000,000,372 | ---- | C] () -- C:\Windows\tasks\RegCure.job [2010-08-05 18:44:21 | 000,000,784 | ---- | C] () -- C:\Users\Public\Desktop\RegCure.lnk [2010-08-04 22:44:23 | 000,005,966 | ---- | C] () -- C:\Users\ADGOR\hijackthis.log [2010-08-04 22:29:38 | 000,000,919 | ---- | C] () -- C:\Users\Public\Desktop\Spyware Terminator.lnk [2010-08-04 22:28:51 | 000,142,592 | ---- | C] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys [2010-07-29 19:51:34 | 000,016,780 | ---- | C] () -- C:\Users\ADGOR\Desktop\Zeszyt1.xlsx [2010-07-29 19:39:42 | 000,215,347 | ---- | C] () -- C:\Users\ADGOR\Desktop\20100727102432579.pdf [2010-07-29 19:38:56 | 000,216,045 | ---- | C] () -- C:\Users\ADGOR\Desktop\20100726151512920.pdf [2010-07-29 19:36:40 | 000,196,376 | ---- | C] () -- C:\Users\ADGOR\Desktop\20100728155540221.pdf [2010-07-29 19:29:43 | 000,610,470 | ---- | C] () -- C:\Users\ADGOR\Desktop\20100729114736401.pdf [2010-07-29 19:24:27 | 000,071,141 | ---- | C] () -- C:\Users\ADGOR\Desktop\zgĹ‚oszenie szkody przez call center.54770.pdf [2010-07-29 19:22:01 | 000,568,454 | ---- | C] () -- C:\Users\ADGOR\Desktop\20100716115239785.pdf [2010-07-29 18:15:15 | 000,843,140 | ---- | C] () -- C:\Users\ADGOR\Desktop\20100727163910098.pdf [2010-07-28 19:46:41 | 000,025,286 | ---- | C] () -- C:\Users\ADGOR\Desktop\Opłaty stałe.xlsx [2010-07-27 18:29:47 | 000,024,206 | ---- | C] () -- C:\Users\ADGOR\AppData\Roaming\UserTile.png [2010-07-24 12:30:52 | 000,012,437 | ---- | C] () -- C:\Users\ADGOR\Desktop\zlecenia darek.xlsx [2010-07-18 16:32:39 | 000,000,066 | ---- | C] () -- C:\Windows\System32\wscicwi75.dll [2010-07-18 16:32:28 | 000,001,692 | ---- | C] () -- C:\Users\ADGOR\Desktop\PhotoPrint.lnk [2009-12-27 22:41:35 | 000,178,176 | ---- | C] () -- C:\Windows\System32\unrar.dll [2009-12-27 22:41:34 | 000,000,038 | ---- | C] () -- C:\Windows\avisplitter.ini [2009-12-27 22:41:33 | 000,881,664 | ---- | C] () -- C:\Windows\System32\xvidcore.dll [2009-12-27 22:41:32 | 000,205,824 | ---- | C] () -- C:\Windows\System32\xvidvfw.dll [2009-12-27 22:41:31 | 000,085,504 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll [2009-12-27 22:41:31 | 000,000,547 | ---- | C] () -- C:\Windows\System32\ff_vfw.dll.manifest [2009-05-18 09:39:45 | 000,018,704 | ---- | C] () -- C:\Windows\System32\mksidsf.sys [2009-04-12 19:13:48 | 000,000,025 | ---- | C] () -- C:\Windows\cdplayer.ini [2009-02-28 17:22:36 | 000,139,128 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2006-11-02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll [2006-11-02 12:25:44 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll [2006-11-02 10:56:52 | 000,028,672 | ---- | C] () -- C:\Windows\System32\dtsh.dll [2006-11-02 10:55:41 | 000,014,848 | ---- | C] () -- C:\Windows\System32\wlaninst.dll [2006-11-02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [color=#E56717]========== LOP Check ==========[/color] [2009-06-02 21:56:45 | 000,000,000 | ---D | M] -- C:\Users\ADGOR\AppData\Roaming\Bullzip [2010-06-30 20:30:09 | 000,000,000 | ---D | M] -- C:\Users\ADGOR\AppData\Roaming\Canon [2009-04-29 18:41:40 | 000,000,000 | ---D | M] -- C:\Users\ADGOR\AppData\Roaming\gtk-2.0 [2010-07-02 22:32:30 | 000,000,000 | ---D | M] -- C:\Users\ADGOR\AppData\Roaming\maxup [2009-06-02 23:23:36 | 000,000,000 | ---D | M] -- C:\Users\ADGOR\AppData\Roaming\Nowe Gadu-Gadu [2009-06-02 21:21:04 | 000,000,000 | ---D | M] -- C:\Users\ADGOR\AppData\Roaming\OpenFM [2010-07-27 18:29:47 | 000,000,000 | ---D | M] -- C:\Users\ADGOR\AppData\Roaming\PeerNetworking [2010-08-05 20:01:44 | 000,000,000 | ---D | M] -- C:\Users\ADGOR\AppData\Roaming\Spyware Terminator [2010-08-05 18:44:23 | 000,000,390 | ---- | M] () -- C:\Windows\Tasks\RegCure Program Check.job [2010-08-05 18:44:23 | 000,000,372 | ---- | M] () -- C:\Windows\Tasks\RegCure.job [2010-08-06 11:38:28 | 000,032,578 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2010-08-06 21:38:00 | 000,000,430 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{35F36304-3A3D-4817-AE23-0E6D2A20F2ED}.job [2010-08-06 21:39:00 | 000,000,432 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{BA7A1D5C-2B75-4F93-AA3C-8C23226715BF}.job [2010-08-06 21:35:15 | 000,000,418 | -H-- | M] () -- C:\Windows\Tasks\User_Feed_Synchronization-{DEAB4468-921D-4FE7-8065-9FF1E34017B1}.job [color=#E56717]========== Purity Check ==========[/color] < End of report >

**Posty:** 18165 · przez **wojtas** 07 Sie 2010, 18:40

. zrób skan Malwarebytes Anti-Malware (zaktualizuj, usuń co znajdzie )

zaktualizuj avasta

**Posty:** 6 · przez **ADGOR** 07 Sie 2010, 19:33

Witam,
NIestety ten program nic nie wykrył. Avast zaktualizowany - liczba zarażonych plików 0

Tylko Spyware Terminator wykrył zagrożenie (04.08.2010) - usunąłem niby zarażone pliki ale nadal jest to samo:

Kod: Zaznacz wszystko: Logfile of Spyware Terminator v2.7.2.125 (db:4.008.004.000) Scan Time: 2010-08-04 22:30:53 length: 1021 s Platform: VISTA (6.0.0.6000) User: Admin Boot Mode: Safe Scan type: %Custom_Scan% Scanned Objects: 66514 (Critical:1) Filter: No System items, No Safe items, No Invalid items Running Processes iexplore.exe [Microsoft Corporation] : C:\Program Files\Internet Explorer\iexplore.exe iexplore.exe [Microsoft Corporation] : C:\Program Files\Internet Explorer\iexplore.exe Internet Settings R - HKLM\Software\Microsoft\Internet Explorer\Main, Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R - HKLM\System\CurrentControlSet\Services\Tcpip\Parameters, Domain = R - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Telephony, DomainName = BHO 02 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - [Adobe Systems Incorporated] : C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll 02 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - [RealPlayer] : C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll StartUps 04 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, Nowe Gadu-Gadu : [GG Network S.A.] : C:\Program Files\NOWE GADU-GADU\GG.EXE 04 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, Shockwave Updater : [Adobe Systems, Inc.] : C:\Windows\system32\ADOBE\SHOCKWAVE 11\SWHELPER_1151601.EXE 04 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, SunJavaUpdateSched : [Sun Microsystems, Inc.] : C:\Program Files\Common Files\JAVA\JAVA UPDATE\JUSCHED.EXE 04 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, RtHDVCpl : [Realtek Semiconductor] : C:\Windows\RtHDVCpl.exe 04 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run, Skytel : [Realtek Semiconductor Corp.] : C:\Windows\Skytel.exe Shell Extensions CLSID_PreviewMime - {92dbad9f-5025-49b0-9078-2d78f935e341} - [Microsoft Corporation] : C:\Windows\system32\inetcomm.dll CLSID_PreviewEmail - {b9815375-5d7f-4ce2-9245-c9d4da436930} - [Microsoft Corporation] : C:\Windows\system32\inetcomm.dll CLSID_PreviewHtml - {f8b8412b-dea3-4130-b36c-5e8be73106ac} - [Microsoft Corporation] : C:\Windows\system32\inetcomm.dll Shell Message Handler - {5FA29220-36A1-40f9-89C6-F4B384B7642E} - [Microsoft Corporation] : C:\Windows\system32\inetcomm.dll CompressedFolder - {E88DCCE0-B7B3-11d1-A9F0-00AA0060FA31} - [Microsoft Corporation] : C:\Windows\system32\zipfldr.dll Compressed (zipped) Folder Right Drag Handler - {BD472F60-27FA-11cf-B8B4-444553540000} - [Microsoft Corporation] : C:\Windows\system32\zipfldr.dll Compressed (zipped) Folder SendTo Target - {888DCA60-FC0A-11CF-8F0F-00C04FD7D062} - [Microsoft Corporation] : C:\Windows\system32\zipfldr.dll Compressed (zipped) Folder Context Menu - {b8cdcb65-b1bf-4b42-9428-1dfdb7ee92af} - [Microsoft Corporation] : C:\Windows\system32\zipfldr.dll Compressed (zipped) Folder DropHandler - {ed9d80b9-d157-457b-9192-0e7280313bf0} - [Microsoft Corporation] : C:\Windows\system32\zipfldr.dll Windows Photo Gallery Viewer Video Verbs - {E598560B-28D5-46aa-A14A-8A3BEA34B576} - [Microsoft Corporation] : C:\Program Files\Windows Photo Gallery\PhotoViewer.dll &Windows Media Player - {0a4286ea-e355-44fb-8086-af3df7645bd9} - [Microsoft Corporation] : C:\Program Files\Windows Media Player\wmpband.dll - {BB6B2374-3D79-41DB-87F4-896C91846510} - [Microsoft Corporation] : C:\Windows\system32\emdmgmt.dll Windows Photo Gallery Viewer Autoplay Handler - {9D687A4C-1404-41ef-A089-883B6FBECDE6} - [Microsoft Corporation] : C:\Windows\system32\RUNDLL32.EXE Portable Media Devices - {640167b4-59b0-47a6-b335-a6b3c0695aea} - [Microsoft Corporation] : C:\Windows\system32\audiodev.dll PhotoAcqDropTarget - {00f20eb5-8fd6-4d9d-b75e-36801766c8f1} - [Microsoft Corporation] : C:\Program Files\Windows Photo Gallery\PhotoAcq.dll Windows Photo Gallery Viewer Image Verbs - {FFE2A43C-56B9-4bf5-9A79-CC6D4285608A} - [Microsoft Corporation] : C:\Program Files\Windows Photo Gallery\PhotoViewer.dll Tablet PC Input Panel - {15D633E2-AD00-465b-9EC7-F56B7CDF8E27} - [Microsoft Corporation] : C:\Program Files\Common Files\microsoft shared\ink\TipBand.dll Windows gadget DropTarget - {6b9228da-9c15-419e-856c-19e768a13bdc} - [Microsoft Corporation] : C:\Program Files\Windows Sidebar\sbdrop.dll RealOne Player Context Menu Class - {F0CB00CD-5A07-4D91-97F5-A8C92CDA93E4} - [RealNetworks, Inc.] : C:\Program Files\Real\RealPlayer\rpshell.dll PDFTransformer2.PDFTContextMenu.1 - {4FED14EE-8086-4b0c-A0DE-C27042ED1296} - [ABBYY Software] : C:\Program Files\ABBYY PDF Transformer 2.0\PDFTContextMenu.dll Protocol Handler MHTML Asynchronous Pluggable Protocol Handler - {05300401-BCBC-11d0-85E3-00C04FD85AB4} - [Microsoft Corporation] : C:\Windows\system32\inetcomm.dll Services 23 - [Microsoft Corporation] : C:\Windows\system32\DRIVERS\flpydisk.sys 23 - [Microsoft Corporation] : C:\Windows\system32\DRIVERS\mrxsmb10.sys 23 - [Realtek Semiconductor Corporation] : C:\Windows\system32\DRIVERS\Rtnicxp.sys 23 - [VIA Technologies, Inc.] : C:\Windows\system32\drivers\viaide.sys Threat Files <PSWTool.NetPass.fv> : C:\Users\ADGOR\passwordfox\PasswordFox.exe Advanced Files Report %PROGRAMFILES%\Internet Explorer\iexplore.exe [Microsoft Corporation] [Windows® Internet Explorer] MD5=9F52FBE99C749E3F32C75124F09F1B03 SIZE=638232 %SYSDIR%\Macromed\Flash\Flash10h.ocx [Adobe Systems, Inc.] [Shockwave Flash] MD5=F366D1694E4D244A73F4E52817C38D5B SIZE=5712336 %PROGRAMFILES%\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll [Adobe Systems Incorporated] [AcroIEHelper Library] MD5=FC7850324464E4D19A24A03D882B5CC4 SIZE=54248 %SYSDIR%\inetcomm.dll [Microsoft Corporation] [Microsoft® Windows® Operating System] MD5=2497E0909F2136C9F6B190FCF1E54BBD SIZE=737792 %SYSDIR%\zipfldr.dll [Microsoft Corporation] [System operacyjny Microsoft® Windows®] MD5=C9F8C752ED450D74A51FC4DA40B0DA16 SIZE=338432 %PROGRAMFILES%\Windows Photo Gallery\PhotoViewer.dll [Microsoft Corporation] [System operacyjny Microsoft® Windows®] MD5=7CB1C510F55B2D5E3DE24823839D320D SIZE=2313216 %PROGRAMFILES%\Windows Media Player\wmpband.dll [Microsoft Corporation] [System operacyjny Microsoft® Windows®] MD5=4AEED1FBB53F915CBE30671793776A80 SIZE=99328 %SYSDIR%\emdmgmt.dll [Microsoft Corporation] [System operacyjny Microsoft® Windows®] MD5=3226FDA08988526E819E364E8CCE4CEE SIZE=560640 %SYSDIR%\RUNDLL32.EXE [Microsoft Corporation] [System operacyjny Microsoft® Windows®] MD5=4B555106290BD117334E9A08761C035A SIZE=44544 %SYSDIR%\audiodev.dll [Microsoft Corporation] [System operacyjny Microsoft® Windows®] MD5=BC59360E14159C67FF257FB424F3B723 SIZE=244224 %PROGRAMFILES%\Windows Photo Gallery\PhotoAcq.dll [Microsoft Corporation] [System operacyjny Microsoft® Windows®] MD5=571B269F346E518F0D2BB7B067ECFFCD SIZE=1030656 %COMMONFILES%\microsoft shared\ink\TipBand.dll [Microsoft Corporation] [System operacyjny Microsoft® Windows®] MD5=A8F2BB769FA35F9C2867746B671EB662 SIZE=114688 %PROGRAMFILES%\Windows Sidebar\sbdrop.dll [Microsoft Corporation] [System operacyjny Microsoft® Windows®] MD5=1690302570CC80160F68B604E6806802 SIZE=66048 %PROGRAMFILES%\Real\RealPlayer\rpshell.dll [RealNetworks, Inc.] [RealPlayer] MD5=E56ADA1922D173913EF98470FC4788DF SIZE=63016 %PROGRAMFILES%\ABBYY PDF Transformer 2.0\PDFTContextMenu.dll [ABBYY Software] [PDF Transformer] MD5=D6D5EC85CC054ECB93DDEB53AF69C96C SIZE=319488 %SYSDIR%\svchost.exe -k netsvcs %SYSDIR%\svchost.exe -k LocalServiceNoNetwork %SYSDIR%\svchost.exe -k NetworkService %SYSDIR%\svchost.exe -k DcomLaunch %SYSDIR%\svchost.exe -k LocalServiceNetworkRestricted %SYSDIR%\DRIVERS\flpydisk.sys [Microsoft Corporation] [Microsoft® Windows® Operating System] MD5=6603957EFF5EC62D25075EA8AC27DE68 SIZE=20480 %SYSDIR%\svchost.exe -k LocalService %SYSDIR%\DRIVERS\mrxsmb10.sys [Microsoft Corporation] [Microsoft® Windows® Operating System] MD5=47E13AB23371BE3279EEF22BBFA2C1BE SIZE=211968 %SYSDIR%\svchost.exe -k LocalSystemNetworkRestricted %SYSDIR%\svchost.exe -k NetworkServiceNetworkRestricted %SYSDIR%\svchost.exe -k rpcss %SYSDIR%\DRIVERS\Rtnicxp.sys [Realtek Semiconductor Corporation] [Realtek 10/100 NIC Family all in one NDIS Driver] MD5=959EF612D2CCFDB6D9E443F8E3655013 SIZE=47104 %SYSDIR%\drivers\viaide.sys [VIA Technologies, Inc.] [VIA PCI IDE MINI Driver] MD5=48C9B50CDDD51A205F7AA1639B3D4822 SIZE=20024 %SYSDIR%\svchost.exe -k secsvcs %SYSDIR%\mscoree.dll [Microsoft Corporation] [Microsoft® .NET Framework] MD5=C99248B969A799B771F484CD68BCB96E SIZE=282112 End of Report

A to raport z mbam:

Kod: Zaznacz wszystko: Malwarebytes' Anti-Malware 1.46 www.malwarebytes.org Wersja bazy: 4404 Windows 6.0.6000 (Safe Mode) Internet Explorer 8.0.6001.18904 2010-08-07 18:53:45 mbam-log-2010-08-07 (18-53-45).txt Typ skanowania: Szybkie skanowanie Przeskanowano obiektów: 126505 Upłynęło: 4 minut(y), 29 sekund(y) Zainfekowanych procesów w pamięci: 0 Zainfekowanych modułów w pamięci: 0 Zainfekowanych kluczy rejestru: 0 Zainfekowanych wartości rejestru: 0 Zainfekowane informacje rejestru systemowego: 0 Zainfekowanych folderów: 0 Zainfekowanych plików: 0 Zainfekowanych procesów w pamięci: (Nie znaleziono zagrożeń) Zainfekowanych modułów w pamięci: (Nie znaleziono zagrożeń) Zainfekowanych kluczy rejestru: (Nie znaleziono zagrożeń) Zainfekowanych wartości rejestru: (Nie znaleziono zagrożeń) Zainfekowane informacje rejestru systemowego: (Nie znaleziono zagrożeń) Zainfekowanych folderów: (Nie znaleziono zagrożeń) Zainfekowanych plików: (Nie znaleziono zagrożeń)

**Posty:** 18165 · przez **wojtas** 07 Sie 2010, 19:37

jesli tego pliku nie znasz to go usuń :

C:\Users\ADGOR\passwordfox\PasswordFox.exe
system masz czysty

**Posty:** 6 · przez **ADGOR** 07 Sie 2010, 19:45

Witaj,
Adgor- tam zapisuje większość programów. Ten plik oczywiście usunąłem, jednak problem nie ustąpił. Czy mozliwe jest aby zrobił takie zmiany, że konieczna będzie ponowna instalacja systemu?
Pzdr

Dodano Dzisiaj, 20:43:
WOJTAS dziękuję za poświęcony czas. System ruszył poprzez funkcję "przywarcacanie systemu" zadałem datę większą jak 5 dni i już jest wszystko w porządku. Widoczne został zmieniony jakś folder systemowy. Jeszcze raz dziękuję i życzę wszystki wszystkiego najlepszego.

Pozdrawiam
Adgor

Kto jest na forum