Rozlączenie internetu co 15 min

**Posty:** 492 · przez **DuZI** 14 Lip 2009, 14:20

witam jak w temacie...
od kilku dni internet mi się rozłącza a za chwile sam łączy się ponownie... srednio tak co 15 min

logi:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:03:17, on 2009-07-14 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\acs.exe C:\WINDOWS\system32\CTsvcCDA.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\TP-LINK\TWCU\TWCU.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\soundman.exe C:\WINDOWS\system32\Rundll32.exe C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe C:\Documents and Settings\Ja\Menu Start\Programy\Autostart\Hide IP Proxy Updater.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Opera\opera.exe C:\Program Files\Winamp\Winamp.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Documents and Settings\Ja\Pulpit\Demo\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = socks= R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = plimus.com,www.plimus.com,regnow.com,www.regnow.com, R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: IEVkbdBHO - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [TWCU] "C:\Program Files\TP-LINK\TWCU\TWCU.exe" -nogui O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd O4 - HKLM\..\Run: [SoundMan] soundman.exe O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O4 - Startup: Hide IP Proxy Updater.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O4 - Global Startup: Reboot.exe O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200 O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{D008C859-0C31-4941-BB61-E6071729BB78}: NameServer = 194.204.159.1 194.204.152.34 O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll,C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll O23 - Service: TP-LINK Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\acs.exe O23 - Service: Kaspersky Anti-Virus (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- End of file - 5540 bytes

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 59, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "MSMSGS" = ""C:\Program Files\Messenger\msmsgs.exe" /background" [MS] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}" = ""C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"" ["Nero AG"] "DAEMON Tools Lite" = ""C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun" ["DT Soft Ltd"] "Creative Detector" = "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe /R" ["Creative Technology Ltd"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "TWCU" = ""C:\Program Files\TP-LINK\TWCU\TWCU.exe" -nogui" [empty string] "AVP" = ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe"" ["Kaspersky Lab"] "NeroFilterCheck" = "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" ["Nero AG"] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre6\bin\jusched.exe"" ["Sun Microsystems, Inc."] "Cmaudio" = "RunDll32 cmicnfg.cpl,CMICtrlWnd" [MS] "SoundMan" = "soundman.exe" ["Avance Logic, Inc."] "P17Helper" = "Rundll32 P17.dll,P17Helper" [MS] "UpdReg" = "C:\WINDOWS\UpdReg.EXE" ["Creative Technology Ltd."] "CTSysVol" = "C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r" ["Creative Technology Ltd"] "CTRegRun" = "C:\WINDOWS\CTRegRun.EXE" ["Creative Technology Ltd "] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C}\(Default) = "IEVkbdBHO" -> {HKLM...CLSID} = "IEVkbdBHO Class" \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll" ["Kaspersky Lab"] {DBC80044-A445-435b-BC74-9C25C1C588A9}\(Default) = (no title provided) -> {HKLM...CLSID} = "Java(tm) Plug-In 2 SSV Helper" \InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\jp2ssv.dll" ["Sun Microsystems, Inc."] {E7E6F031-17CE-4C07-BC86-EABFE594F69C}\(Default) = "JQSIEStartDetectorImpl" -> {HKLM...CLSID} = "JQSIEStartDetectorImpl Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll" ["Sun Microsystems, Inc."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{85E0B171-04FA-11D1-B7DA-00A0C90348D6}" = "Statystyki ochrony WWW" -> {HKLM...CLSID} = "Statystyki ochrony WWW" \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll" ["Kaspersky Lab"] "{2BB59FC0-31E8-42DA-9D3C-E9A52953853B}" = "ImageResizer Shell Extension" -> {HKLM...CLSID} = "ImageResizer Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\VSO\IMAGER~1\RSZShell.dll" ["VSO Software SARL"] "{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "-" -> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero 9\Nero CoverDesigner\CoverEdExtension.dll" [file not found] "{79BC0345-1015-11D2-A299-006008312725}" = "blue.shell" -> {HKLM...CLSID} = "///FAST project settings" \InProcServer32\(Default) = "C:\Program Files\Pinnacle\VideoSpin\Programs\BlueShellExt.dll" [file not found] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> klogon\DLLName = "C:\WINDOWS\system32\klogon.dll" ["Kaspersky Lab"] HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}" -> {HKLM...CLSID} = "NeroCoverEdContextMenu Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero 9\Nero CoverDesigner\CoverEdExtension.dll" [file not found] Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ShellEx.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ShellEx.dll" ["Kaspersky Lab"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ ImageResizer\(Default) = "{2BB59FC0-31E8-42DA-9D3C-E9A52953853B}" -> {HKLM...CLSID} = "ImageResizer Shell Extension" \InProcServer32\(Default) = "C:\PROGRA~1\VSO\IMAGER~1\RSZShell.dll" ["VSO Software SARL"] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "HonorAutoRunSetting" = (REG_DWORD) dword:0x00000001 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ CTPlayAudioOnArrival\ "Provider" = "@C:\Program Files\Creative\MediaSource\CTCMS.CRL,-14345" "InvokeProgID" = "CTAutoPL.AudioCDPlayer.1" "InvokeVerb" = "open" HKLM\SOFTWARE\Classes\CTAutoPL.AudioCDPlayer.1\shell\open\command\(Default) = ""C:\Program Files\Creative\MediaSource\CTCMS.exe" /T=CLASSKEY_AudioCD IN %L PlayNow" ["Creative Technology Ltd"] CTPlayMusicFilesOnArrival\ "Provider" = "@C:\Program Files\Creative\MediaSource\CTCMS.CRL,-14345" "InvokeProgID" = "CTAutoPL.MusicFilesPlayer.1" "InvokeVerb" = "open" HKLM\SOFTWARE\Classes\CTAutoPL.MusicFilesPlayer.1\shell\open\command\(Default) = ""C:\Program Files\Creative\MediaSource\CTCMS.exe" /Organizer" ["Creative Technology Ltd"] NeroAutoPlay9AudioToNeroDigital\ "Provider" = "Nero Burning ROM" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "AudioToNeroDigital_PlayCDAudioOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\AudioToNeroDigital_PlayCDAudioOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 9\Nero Burning ROM\Nero.exe /Dialog:SaveTracks %L" [file not found] NeroAutoPlay9CDAudio\ "Provider" = "Nero Express" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "CDAudio_HandleCDBurningOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\CDAudio_HandleCDBurningOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 9\Nero Express\NeroExpress.exe -w /New:AudioCD" [file not found] NeroAutoPlay9CopyCD\ "Provider" = "Nero Express" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "CopyCD_PlayMusicFilesOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\CopyCD_PlayMusicFilesOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 9\Nero Express\NeroExpress.exe -w /Dialog:DiscCopy" [file not found] NeroAutoPlay9DataDisc\ "Provider" = "Nero Express" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "DataDisc_HandleCDBurningOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\DataDisc_HandleCDBurningOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 9\Nero Express\NeroExpress.exe -w /New:ISODisc" [file not found] NeroAutoPlay9RipCD\ "Provider" = "Nero Burning ROM" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "RipCD_PlayCDAudioOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\RipCD_PlayCDAudioOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 9\Nero Burning ROM\Nero.exe /Dialog:SaveTracks %L" [file not found] Picasa2ImportPicturesOnArrival\ "Provider" = "Picasa3" "InvokeProgID" = "picasa2.autoplay" "InvokeVerb" = "import" HKLM\SOFTWARE\Classes\picasa2.autoplay\shell\import\command\(Default) = "C:\Program Files\Google\Picasa3\Picasa3.exe "%1"" ["Google Inc."] VSOImageResizerAutoplay_741406\ "Provider" = "VSO Image Resizer" "InvokeProgID" = "VSOImageResizerAutoplay" "InvokeVerb" = "VSOImageResizerAutoplay_741406" HKLM\SOFTWARE\Classes\VSOImageResizerAutoplay\shell\VSOImageResizerAutoplay_741406\command\(Default) = "C:\Program Files\VSO\Image Resizer\Resize.exe %L\" ["VSO Software SARL"] Startup items in "Ja" & "All Users" startup folders: ---------------------------------------------------- C:\Documents and Settings\Ja\Menu Start\Programy\Autostart <<!>> "Hide IP Proxy Updater.exe" [null data] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS] <<!>> "Reboot.exe" [null data] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 15 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ HKLM\SOFTWARE\Classes\CLSID\{85E0B171-04FA-11D1-B7DA-00A0C90348D6}\(Default) = "Statystyki ochrony WWW" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll" ["Kaspersky Lab"] HKLM\SOFTWARE\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Research" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\ {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\ "ButtonText" = "Statystyki ochrony WWW" {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Research" {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINDOWS\system32\CTsvcCDA.EXE" ["Creative Technology Ltd"] Java Quick Starter, JavaQuickStarterService, ""C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf"" ["Sun Microsystems, Inc."] Karta wydajności WMI, WmiApSrv, "C:\WINDOWS\System32\wbem\wmiapsrv.exe" [MS] NMIndexingService, NMIndexingService, ""C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe"" ["Nero AG"] TP-LINK Configuration Service, ACS, "C:\WINDOWS\System32\acs.exe" [null data] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] ---------- (launch time: 2009-07-14 14:08:51) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + The search for DESKTOP.INI DLL launch points on all local fixed drives took 273 seconds. ---------- (total run time: 523 seconds)

**Posty:** 18165 · przez **wojtas** 15 Lip 2009, 10:56

Pobierz OTL i daj z niego loga

**Posty:** 40 · przez **bvhjtfu** 15 Lip 2009, 11:28

Hm mi sie net rozlaczl przez to, ze mialem stary komputer serio.
Mialem z Dialogu, i rozlaczal sie, robilem roznymi metodami zeby dzialal, i wychodzilo, ale za duzo sie pieprzenia itp. pzdr.

**Posty:** 492 · przez **DuZI** 15 Lip 2009, 13:08

log z OTL

Kod: Zaznacz wszystko: OTL logfile created on: 2009-07-15 13:00:53 - Run 1 OTL by OldTimer - Version 3.0.7.1 Folder = C:\Documents and Settings\Ja\Pulpit Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 511,48 Mb Total Physical Memory | 291,63 Mb Available Physical Memory | 57,02% Memory free 1,21 Gb Paging File | 0,89 Gb Available in Paging File | 73,62% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 14,63 Gb Total Space | 0,18 Gb Free Space | 1,22% Space Free | Partition Type: FAT32 Drive D: | 34,68 Gb Total Space | 3,56 Gb Free Space | 10,27% Space Free | Partition Type: NTFS Drive E: | 25,19 Gb Total Space | 1,90 Gb Free Space | 7,54% Space Free | Partition Type: FAT32 F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: ***** Current User Name: Ja Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2005-12-30 08:15:16 | 00,036,864 | ---- | M] () -- C:\WINDOWS\System32\acs.exe PRC - [1999-12-13 03:01:00 | 00,044,032 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\System32\CTsvcCDA.EXE PRC - [2009-06-06 14:59:06 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe PRC - [2004-10-11 11:20:30 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wdfmgr.exe PRC - [2004-08-04 00:44:20 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE PRC - [2004-08-04 00:44:30 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wscntfy.exe PRC - [2006-10-17 16:11:46 | 00,380,928 | ---- | M] () -- C:\Program Files\TP-LINK\TWCU\TWCU.exe PRC - [2009-06-06 14:59:06 | 00,148,888 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe PRC - [2001-10-09 04:21:00 | 00,124,416 | ---- | M] (Avance Logic, Inc.) -- C:\WINDOWS\soundman.exe PRC - [2005-02-15 16:10:16 | 00,057,344 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe PRC - [2007-06-27 19:03:40 | 00,152,872 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe PRC - [2004-12-02 18:23:34 | 00,102,400 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe PRC - [2007-06-27 19:04:00 | 00,279,848 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe PRC - [2008-12-17 11:39:56 | 00,033,982 | ---- | M] () -- C:\Documents and Settings\Ja\Menu Start\Programy\Autostart\Hide IP Proxy Updater.exe PRC - [2007-06-27 19:04:00 | 01,213,736 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe PRC - [2008-03-20 11:04:46 | 02,127,296 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\gg.exe PRC - [2005-09-01 19:04:28 | 01,144,320 | ---- | M] (Nullsoft) -- C:\Program Files\Winamp\Winamp.exe PRC - [2008-12-10 22:32:46 | 00,098,816 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe PRC - [2009-07-15 12:59:20 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ja\Pulpit\OTL.exe [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2005-12-30 08:15:16 | 00,036,864 | ---- | M] () -- C:\WINDOWS\System32\acs.exe -- (ACS [Auto | Running]) SRV - [2005-09-23 07:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped]) SRV - [2009-02-14 09:10:42 | 00,206,088 | ---- | M] (Kaspersky Lab) -- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe -- (AVP [Auto | Stopped]) SRV - [2005-09-23 07:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) SRV - [1999-12-13 03:01:00 | 00,044,032 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\System32\CTsvcCDA.EXE -- (Creative Service for CDROM Access [Auto | Running]) SRV - [2008-07-31 23:16:30 | 00,136,120 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc [On_Demand | Stopped]) SRV - [2004-08-04 00:44:08 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running]) SRV - [2009-06-06 14:59:06 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running]) SRV - [2007-06-27 19:04:00 | 00,279,848 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService [On_Demand | Running]) SRV - [2003-07-28 12:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped]) SRV - [2004-10-11 11:20:30 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wdfmgr.exe -- (UMWdf [Auto | Running]) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-02-13 20:00:24 | 00,021,275 | ---- | M] (Meetinghouse Data Communications) -- C:\WINDOWS\System32\DRIVERS\AegisP.sys -- (AegisP [Auto | Running]) DRV - [2001-10-09 04:21:00 | 00,285,533 | ---- | M] (Avance Logic, Inc.) -- C:\WINDOWS\System32\drivers\ALCXWDM.SYS -- (ALCXWDM [On_Demand | Running]) DRV - [2005-12-21 10:16:34 | 00,470,048 | ---- | M] (Atheros Communications, Inc.) -- C:\WINDOWS\System32\DRIVERS\ar5211.sys -- (AR5211 [On_Demand | Running]) DRV - [2006-06-09 22:58:22 | 01,373,120 | ---- | M] (C-Media Inc) -- C:\WINDOWS\System32\drivers\cmuda.sys -- (cmuda [On_Demand | Stopped]) DRV - [2005-01-10 12:15:24 | 00,138,752 | R--- | M] (Creative Technology Ltd) -- C:\WINDOWS\System32\DRIVERS\ctsfm2k.sys -- (ctsfm2k [On_Demand | Running]) DRV - [2004-08-03 23:08:22 | 00,010,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\DRIVERS\gameenum.sys -- (gameenum [On_Demand | Running]) DRV - [2009-05-22 11:46:42 | 00,010,536 | ---- | M] () -- C:\WINDOWS\System32\drivers\hmonitor.sys -- (hmonitor [System | Running]) DRV - [2008-07-21 17:34:36 | 00,121,872 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\system32\drivers\kl1.sys -- (kl1 [Boot | Running]) DRV - [2009-02-14 09:10:42 | 00,033,808 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\system32\drivers\klbg.sys -- (klbg [Boot | Running]) DRV - [2009-02-14 09:10:42 | 00,226,832 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\System32\DRIVERS\klif.sys -- (KLIF [System | Running]) DRV - [2008-04-30 17:06:48 | 00,024,592 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\System32\DRIVERS\klim5.sys -- (klim5 [On_Demand | Running]) DRV - [2001-08-17 22:00:04 | 00,002,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\msmpu401.sys -- (ms_mpu401 [On_Demand | Running]) DRV - [2004-08-03 22:29:56 | 01,897,408 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Running]) DRV - [2001-08-17 20:50:26 | 00,731,648 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\DRIVERS\nv4.sys -- (nv4 [On_Demand | Stopped]) DRV - [2005-01-10 12:15:30 | 00,106,496 | R--- | M] (Creative Technology Ltd.) -- C:\WINDOWS\System32\DRIVERS\ctoss2k.sys -- (ossrv [On_Demand | Running]) DRV - [2005-07-07 10:14:30 | 01,389,056 | R--- | M] (Creative Technology Ltd.) -- C:\WINDOWS\System32\drivers\P17.sys -- (P17 [On_Demand | Running]) DRV - [2001-08-17 21:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running]) DRV - [2008-07-31 23:17:06 | 00,043,872 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running]) DRV - [2001-07-22 02:41:32 | 00,027,440 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped]) DRV - [2009-06-10 12:51:50 | 00,721,904 | ---- | M] () -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd [Boot | Running]) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = plimus.com,www.plimus.com,regnow.com,www.regnow.com, IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = socks= FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009-06-06 14:59:06 | 00,000,000 | ---D | M] O1 HOSTS File: (742 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll (Kaspersky Lab) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe (Kaspersky Lab) O4 - HKLM..\Run: [Cmaudio] File not found O4 - HKLM..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE (Creative Technology Ltd ) O4 - HKLM..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe (Creative Technology Ltd) O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [P17Helper] C:\WINDOWS\System32\P17.DLL () O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\soundman.exe (Avance Logic, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [TWCU] C:\Program Files\TP-LINK\TWCU\TWCU.exe () O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE (Creative Technology Ltd.) O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - HKCU..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe (Creative Technology Ltd) O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd) O4 - HKCU..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Reboot.exe () O4 - Startup: C:\Documents and Settings\Ja\Menu Start\Programy\Autostart\Hide IP Proxy Updater.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.) O9 - Extra Button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll (Kaspersky Lab) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\mzvkbd.dll (Kaspersky Lab) O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\mzvkbd3.dll (Kaspersky Lab) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\System32\klogon.dll (Kaspersky Lab) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-02-24 14:53:04 | 00,000,011 | -HS- | M] () - C:\autorun.inf -- [ FAT32 ] O32 - AutoRun File - [2009-02-13 19:45:02 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ] O32 - AutoRun File - [2006-07-30 20:20:12 | 00,000,959 | RHS- | M] () - D:\autorun.bin -- [ NTFS ] O32 - AutoRun File - [2009-02-23 19:08:26 | 00,000,011 | -HS- | M] () - D:\autorun.inf -- [ NTFS ] O32 - AutoRun File - [2006-06-14 07:26:38 | 00,000,024 | RHS- | M] () - D:\autorun.txt -- [ NTFS ] O32 - AutoRun File - [2007-10-02 18:56:46 | 00,000,000 | RHS- | M] () - D:\autorun.wsh -- [ NTFS ] O32 - AutoRun File - [2009-02-24 14:52:10 | 00,000,011 | -HS- | M] () - E:\autorun.inf -- [ FAT32 ] O32 - AutoRun File - [2006-07-30 20:20:12 | 00,000,959 | RHS- | M] () - E:\autorun.bin -- [ FAT32 ] O32 - AutoRun File - [2006-06-14 07:26:38 | 00,000,024 | RHS- | M] () - E:\autorun.txt -- [ FAT32 ] O32 - AutoRun File - [2007-10-03 14:01:26 | 00,000,000 | RHS- | M] () - E:\autorun.wsh -- [ FAT32 ] O33 - MountPoints2\{2c35fe70-fa8a-11dd-ab7e-0019e08bd1e6}\Shell\AutoRun\command - "" = I:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe -- File not found O33 - MountPoints2\{2c35fe70-fa8a-11dd-ab7e-0019e08bd1e6}\Shell\open\command - "" = I:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe -- File not found O33 - MountPoints2\{2c71b720-0645-11de-abaf-0019e08bd1e6}\Shell\AutoRun\command - "" = H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe -- File not found O33 - MountPoints2\{2c71b720-0645-11de-abaf-0019e08bd1e6}\Shell\open\command - "" = H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe -- File not found O33 - MountPoints2\{2c71b721-0645-11de-abaf-0019e08bd1e6}\Shell\AutoRun\command - "" = I:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe -- File not found O33 - MountPoints2\{2c71b721-0645-11de-abaf-0019e08bd1e6}\Shell\open\command - "" = I:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe -- File not found O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - File not found [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [3 C:\WINDOWS\*.tmp files] [2009-07-15 12:59:15 | 00,513,536 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Ja\Pulpit\OTL.exe [2009-07-15 11:07:34 | 12,759,455 | ---- | C] () -- C:\Documents and Settings\Ja\Pulpit\03-e_mine_vs_disko_punks_-_to_france_(muzic_loverz_club_remix)- www.4clubbers.pl.mp3 [2009-07-15 10:42:27 | 00,000,000 | ---D | C] -- C:\WINDOWS\LastGood [2009-07-14 18:08:40 | 00,000,000 | ---D | C] -- C:\Program Files\NOS [2009-07-14 18:08:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\NOS [2009-07-02 17:01:25 | 00,000,196 | ---- | C] () -- C:\WINDOWS\System32\drivers\ALCICH.DAT [2009-07-02 16:10:14 | 00,090,112 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\Updreg.EXE [2009-07-02 16:09:25 | 00,005,627 | R--- | C] () -- C:\WINDOWS\System32\Ludap17.ini [2009-07-02 16:09:25 | 00,000,039 | R--- | C] () -- C:\WINDOWS\System32\ctzapxx.ini [2009-07-02 14:33:26 | 00,000,000 | ---D | C] -- C:\Program Files\Avance Sound Manager [2009-07-02 14:33:23 | 00,000,000 | ---D | C] -- C:\Program Files\AvRack [2009-07-02 14:33:22 | 00,285,533 | ---- | C] (Avance Logic, Inc.) -- C:\WINDOWS\System32\drivers\ALCXWDM.SYS [2009-07-02 14:33:22 | 00,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini [2009-07-02 14:33:21 | 00,217,088 | ---- | C] (Avance Logic, Inc.) -- C:\WINDOWS\alcupd.exe [2009-07-02 14:33:21 | 00,151,552 | ---- | C] (Avance Logic, Inc.) -- C:\WINDOWS\alcrmv.exe [2009-07-02 14:33:21 | 00,124,416 | ---- | C] (Avance Logic, Inc.) -- C:\WINDOWS\soundman.exe [2009-07-02 14:33:10 | 00,000,025 | ---- | C] () -- C:\WINDOWS\mixerdef.ini [2009-07-02 14:31:26 | 00,000,000 | ---D | C] -- C:\Program Files\C-Media [2009-07-02 14:31:20 | 00,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI [2009-07-02 14:30:47 | 00,311,296 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Reboot.exe [2009-07-02 14:30:46 | 00,381,440 | ---- | C] () -- C:\WINDOWS\System32\Counter.exe [2009-07-02 14:30:45 | 00,387,584 | ---- | C] () -- C:\WINDOWS\System32\LostRun.exe [2009-07-02 14:30:44 | 00,351,232 | ---- | C] () -- C:\WINDOWS\System32\CheckPath.exe [2009-07-02 14:30:42 | 00,532,480 | ---- | C] () -- C:\WINDOWS\System32\DeleteFiles.exe [2009-07-02 14:30:40 | 00,382,464 | ---- | C] () -- C:\WINDOWS\System32\Restart.exe [2009-07-02 14:30:39 | 00,374,784 | ---- | C] () -- C:\WINDOWS\System32\RunAP.exe [2009-07-02 14:14:40 | 00,044,032 | ---- | C] (Creative Technology Ltd) -- C:\WINDOWS\System32\CTSVCCDA.EXE [2009-07-02 14:14:40 | 00,025,088 | ---- | C] (Creative Technology Ltd) -- C:\WINDOWS\System32\CTSVCCTL.EXE [2009-07-02 14:05:34 | 00,000,347 | ---- | C] () -- C:\WINDOWS\CTWave32.INI [2009-07-02 13:19:32 | 00,000,586 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Hmonitor.lnk [2009-07-02 13:19:31 | 00,010,536 | ---- | C] () -- C:\WINDOWS\System32\drivers\Hmonitor.sys [2009-07-02 13:19:31 | 00,000,000 | ---D | C] -- C:\Program Files\Hmonitor [2009-07-02 13:10:12 | 53,639,9872 | -HS- | C] () -- C:\hiberfil.sys [2009-07-02 13:06:56 | 00,000,000 | -HSD | C] -- C:\WINDOWS\CSC [2009-07-02 12:41:58 | 00,000,000 | -HSD | C] -- C:\FOUND.001 [2009-07-01 10:33:18 | 03,894,304 | ---- | C] () -- C:\Documents and Settings\Ja\Pulpit\MY MUSIC.wav [2009-06-26 21:39:02 | 00,000,000 | -H-D | C] -- C:\WINDOWS\$MSI31Uninstall_KB893803v2$ [2009-06-22 11:53:03 | 13,699,164 | ---- | C] () -- C:\Documents and Settings\Ja\Pulpit\reckless.wav [2009-06-18 09:51:52 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ja\Pulpit\Massive_Presets [2009-06-18 09:49:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ja\Pulpit\massive [2009-06-10 12:51:47 | 00,721,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2009-03-21 13:38:32 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2009-03-19 13:29:38 | 00,000,093 | ---- | C] () -- C:\WINDOWS\FxLoader.INI [2009-02-20 15:42:54 | 00,000,072 | ---- | C] () -- C:\WINDOWS\sbwin.ini [2009-02-14 12:13:03 | 00,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll [2009-02-14 12:13:03 | 00,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll [2009-02-14 12:13:03 | 00,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll [2009-02-14 12:13:03 | 00,000,205 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll [2009-02-14 12:13:03 | 00,000,073 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll [2009-02-13 21:21:04 | 00,000,159 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini [2009-02-13 21:20:17 | 00,001,232 | ---- | C] () -- C:\WINDOWS\wincmd.ini [2009-02-13 20:46:21 | 00,000,155 | ---- | C] () -- C:\WINDOWS\winamp.ini [2009-02-13 20:32:53 | 00,000,784 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2009-02-13 20:03:26 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2009-02-13 20:00:21 | 00,258,048 | ---- | C] () -- C:\WINDOWS\System32\wgapi.dll [2008-12-19 16:15:58 | 04,338,246 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll [2008-12-17 18:41:18 | 00,884,237 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll [2008-12-17 18:22:58 | 00,093,184 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll [2008-12-17 18:22:48 | 00,057,344 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2008-12-17 18:17:34 | 00,239,247 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll [2008-12-17 17:59:54 | 00,560,802 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll [2008-12-11 12:27:02 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2005-05-03 13:38:42 | 00,064,512 | R--- | C] () -- C:\WINDOWS\System32\P17.dll [2004-11-24 20:25:52 | 00,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\drvc.dll [2004-10-03 18:50:54 | 00,129,024 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll [2003-10-02 12:48:18 | 00,053,248 | R--- | C] () -- C:\WINDOWS\System32\P17CPI.dll [2003-02-19 01:26:28 | 00,028,672 | ---- | C] () -- C:\WINDOWS\System32\cmirmdrv.dll [2002-04-11 03:41:06 | 00,065,536 | R--- | C] ( ) -- C:\WINDOWS\System32\A3d.dll [2001-07-22 02:41:32 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2001-07-21 22:16:20 | 00,000,615 | ---- | C] () -- C:\WINDOWS\win.ini [2001-07-21 22:15:52 | 00,000,231 | ---- | C] () -- C:\WINDOWS\system.ini [1999-01-22 16:46:58 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [3 C:\WINDOWS\*.tmp files] [2009-07-15 12:59:20 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ja\Pulpit\OTL.exe [2009-07-15 12:09:56 | 00,000,155 | ---- | M] () -- C:\WINDOWS\winamp.ini [2009-07-15 11:09:02 | 12,759,455 | ---- | M] () -- C:\Documents and Settings\Ja\Pulpit\03-e_mine_vs_disko_punks_-_to_france_(muzic_loverz_club_remix)- www.4clubbers.pl.mp3 [2009-07-15 10:38:50 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-07-15 10:38:48 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-07-15 10:38:46 | 53,639,9872 | -HS- | M] () -- C:\hiberfil.sys [2009-07-15 10:38:40 | 00,000,196 | ---- | M] () -- C:\WINDOWS\System32\drivers\ALCICH.DAT [2009-07-14 22:44:34 | 00,408,608 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.dat [2009-07-14 22:44:34 | 00,008,224 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.dat [2009-07-14 22:44:34 | 00,005,320 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.idx [2009-07-14 22:44:34 | 00,001,108 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.idx [2009-07-14 14:44:44 | 00,001,232 | ---- | M] () -- C:\WINDOWS\wincmd.ini [2009-07-14 14:43:58 | 00,000,159 | ---- | M] () -- C:\WINDOWS\wcx_ftp.ini [2009-07-14 14:03:00 | 00,001,344 | ---- | M] () -- C:\Documents and Settings\Ja\Pulpit\HijackThis.lnk [2009-07-13 18:00:14 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2009-07-11 13:47:16 | 00,000,087 | ---- | M] () -- C:\WINDOWS\System32\ssprs.tgz [2009-07-11 13:47:16 | 00,000,073 | ---- | M] () -- C:\WINDOWS\System32\ssprs.dll [2009-07-11 13:47:14 | 00,000,219 | ---- | M] () -- C:\WINDOWS\System32\lsprst7.tgz [2009-07-11 13:47:14 | 00,000,205 | ---- | M] () -- C:\WINDOWS\System32\lsprst7.dll [2009-07-02 17:46:52 | 00,001,844 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Creative Product Registration.lnk [2009-07-02 16:16:42 | 00,000,584 | ---- | M] () -- C:\WINDOWS\System32\settingsbkup.sfm [2009-07-02 16:16:42 | 00,000,584 | ---- | M] () -- C:\WINDOWS\System32\settings.sfm [2009-07-02 14:33:12 | 00,000,025 | ---- | M] () -- C:\WINDOWS\mixerdef.ini [2009-07-02 14:31:24 | 00,000,026 | ---- | M] () -- C:\WINDOWS\CMCDPLAY.INI [2009-07-02 14:05:36 | 00,000,347 | ---- | M] () -- C:\WINDOWS\CTWave32.INI [2009-07-02 13:44:50 | 04,837,142 | -H-- | M] () -- C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\IconCache.db [2009-07-02 13:19:34 | 00,000,586 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Hmonitor.lnk [2009-07-01 17:55:54 | 00,012,288 | ---- | M] () -- C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-06-22 13:18:30 | 13,699,164 | ---- | M] () -- C:\Documents and Settings\Ja\Pulpit\reckless.wav [2009-06-16 11:46:16 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl < End of report >

extras.txt

Kod: Zaznacz wszystko: OTL Extras logfile created on: 2009-07-15 13:00:53 - Run 1 OTL by OldTimer - Version 3.0.7.1 Folder = C:\Documents and Settings\Ja\Pulpit Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 511,48 Mb Total Physical Memory | 291,63 Mb Available Physical Memory | 57,02% Memory free 1,21 Gb Paging File | 0,89 Gb Available in Paging File | 73,62% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 14,63 Gb Total Space | 0,18 Gb Free Space | 1,22% Space Free | Partition Type: FAT32 Drive D: | 34,68 Gb Total Space | 3,56 Gb Free Space | 10,27% Space Free | Partition Type: NTFS Drive E: | 25,19 Gb Total Space | 1,90 Gb Free Space | 7,54% Space Free | Partition Type: FAT32 F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: *** Current User Name: Ja Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Extra Registry (SafeList) ==========[/color] [color=#E56717]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation) [color=#E56717]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] "DisableMonitoring" = 1 "" = [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List] "1900:UDP" = 1900:UDP:LocalSubNet:Disabled:@xpsp2res.dll,-22007 "2869:TCP" = 2869:TCP:LocalSubNet:Disabled:@xpsp2res.dll,-22008 [color=#E56717]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] [2008-07-29 07:04:00 | 01,091,768 | ---- | M] (C. Ghisler & Co.) -- C:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows [2008-03-20 11:04:46 | 02,127,296 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\GG.EXE:*:Enabled:Gadu-Gadu - program główny File not found -- C:\Program Files\Pinnacle\VideoSpin\Programs\RM.exe:*:Enabled:Render Manager File not found -- C:\Program Files\Pinnacle\VideoSpin\Programs\umi.exe:*:Enabled:umi File not found -- C:\Program Files\Pinnacle\VideoSpin\Programs\VideoSpin.exe:*:Enabled:Pinnacle VideoSpin File not found -- C:\Program Files\BearShare\BearShare.exe:*:Enabled:BearShare [2008-12-10 22:32:46 | 00,098,816 | ---- | M] (Opera Software) -- C:\Program Files\Opera\OPERA.EXE:*:Enabled:Opera Internet Browser [2009-06-10 11:10:52 | 00,274,224 | ---- | M] (BitTorrent, Inc.) -- C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent [color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{00000415-78E1-11D2-B60F-006097C998E7}" = Microsoft Office 2000 Premium "{1B1DDAD2-C704-49F8-8FC2-18DAAD9A87C5}" = Sound Blaster Audigy "{1BC4026B-1957-4514-9058-2B542557F143}" = Opera 9.63 "{26A24AE4-039D-4CA4-87B4-2F83216013FF}" = Java(TM) 6 Update 13 "{28006915-2739-4EBE-B5E8-49B25D32EB33}" = TP-LINK Client Installation Program "{2E0C1913-886B-4C5C-8DAF-D1E649CE5FCC}" = Creative MediaSource "{350C97C2-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{3EE51BAD-9916-49C7-90BA-3D500B031E0C}_is1" = VSO Image Resizer 2.1.7.4 "{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml "{6580C5A3-2336-4EC5-85F1-3448C5F6208A}" = Kaspersky Anti-Virus 2009 "{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0 "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{90170409-6000-11D3-8CFE-0150048383C9}" = Microsoft Office FrontPage 2003 "{91C0B95B-B83A-4828-A775-BBE2DD421045}" = Nero 7 Premium "{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Avance AC'97 Audio "Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin "ASIO4ALL" = ASIO4ALL "Audacity_is1" = Audacity 1.2.6 "C-Media Audio Driver" = C-Media WDM Audio Driver "DDDP_is1" = discoDSP Discovery Pro "Gadu-Gadu" = Gadu-Gadu 7.7 "Hardware sensors monitor 4.4_is1" = Hardware sensors monitor 4.4 "HijackThis" = HijackThis 2.0.2 "InstallWIX_{6580C5A3-2336-4EC5-85F1-3448C5F6208A}" = Kaspersky Anti-Virus 2009 "IsoBuster_is1" = IsoBuster 2.5 "Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0 "Native Instruments Massive" = Native Instruments Massive "NI Service Center" = NI Service Center "Novation V-Station v1.20-H2O" = Novation V-Station v1.20-H2O "Picasa 3" = Picasa 3 "Totalcmd" = Total Commander (Remove or Repair) "Winamp" = Winamp (remove only) "Windows Media Format Runtime" = Windows Media Format Runtime "Windows XP Service Pack" = Windows XP Service Pack 2 "WinRAR archiver" = Archiwizator WinRAR [color=#E56717]========== HKEY_CURRENT_USER Uninstall List ==========[/color] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "uTorrent" = µTorrent [color=#E56717]========== Last 10 Event Log Errors ==========[/color] [ Application Events ] Error - 2009-06-29 15:25:20 | Computer Name = 95764856-HW7JYU | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd opera.exe, wersja 9.63.10476.0, moduł powodujący błąd opera.dll, wersja 9.63.10476.0, adres błędu 0x0004a0f7. Error - 2009-07-01 12:30:31 | Computer Name = 95764856-HW7JYU | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca opera.exe, wersja 9.63.10476.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-07-02 06:01:35 | Computer Name = 95764856-HW7JYU | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca opera.exe, wersja 9.63.10476.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-07-02 06:45:53 | Computer Name = 95764856-HW7JYU | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca winamp.exe, wersja 5.0.1.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-07-02 06:59:46 | Computer Name = 95764856-HW7JYU | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca winamp.exe, wersja 5.0.1.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-07-02 07:21:10 | Computer Name = 95764856-HW7JYU | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca winamp.exe, wersja 5.0.1.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-07-02 07:42:28 | Computer Name = 95764856-HW7JYU | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca HelpCtr.exe, wersja 5.1.2600.2180, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-07-02 07:42:41 | Computer Name = 95764856-HW7JYU | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca winamp.exe, wersja 5.0.1.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-07-02 07:49:17 | Computer Name = 95764856-HW7JYU | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca winamp.exe, wersja 5.0.1.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-07-02 11:06:33 | Computer Name = 95764856-HW7JYU | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca opera.exe, wersja 9.63.10476.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. [ System Events ] Error - 2009-07-01 02:59:35 | Computer Name = 95764856-HW7JYU | Source = i8042prt | ID = 327702 Description = Nie można ustawić szybkości próbkowania myszy. Error - 2009-07-02 07:07:25 | Computer Name = 95764856-HW7JYU | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd „%1084” podczas próby uruchomienia usługi EventSystem z argumentami „” w celu uruchomienia serwera: {1BE1F766-5536-11D1-B726-00C04FB926AF} Error - 2009-07-02 07:08:33 | Computer Name = 95764856-HW7JYU | Source = Service Control Manager | ID = 7026 Description = Nie można załadować następujących sterowników startu rozruchowego lub systemowego: AmdK7 Fips kl1 klbg KLIF Error - 2009-07-02 07:08:41 | Computer Name = 95764856-HW7JYU | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd „%1084” podczas próby uruchomienia usługi EventSystem z argumentami „” w celu uruchomienia serwera: {1BE1F766-5536-11D1-B726-00C04FB926AF} Error - 2009-07-02 07:09:02 | Computer Name = 95764856-HW7JYU | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd „%1084” podczas próby uruchomienia usługi EventSystem z argumentami „” w celu uruchomienia serwera: {1BE1F766-5536-11D1-B726-00C04FB926AF} Error - 2009-07-02 07:09:06 | Computer Name = 95764856-HW7JYU | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd „%1084” podczas próby uruchomienia usługi EventSystem z argumentami „” w celu uruchomienia serwera: {1BE1F766-5536-11D1-B726-00C04FB926AF} < End of report >

**Posty:** 18165 · przez **wojtas** 15 Lip 2009, 15:35

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Reboot.exe ()
O32 - AutoRun File - [2009-02-24 14:53:04 | 00,000,011 | -HS- | M] () - C:\autorun.inf -- [ FAT32 ]
O32 - AutoRun File - [2006-07-30 20:20:12 | 00,000,959 | RHS- | M] () - D:\autorun.bin -- [ NTFS ]
O32 - AutoRun File - [2009-02-23 19:08:26 | 00,000,011 | -HS- | M] () - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2006-06-14 07:26:38 | 00,000,024 | RHS- | M] () - D:\autorun.txt -- [ NTFS ]
O32 - AutoRun File - [2007-10-02 18:56:46 | 00,000,000 | RHS- | M] () - D:\autorun.wsh -- [ NTFS ]
O32 - AutoRun File - [2009-02-24 14:52:10 | 00,000,011 | -HS- | M] () - E:\autorun.inf -- [ FAT32 ]
O32 - AutoRun File - [2006-07-30 20:20:12 | 00,000,959 | RHS- | M] () - E:\autorun.bin -- [ FAT32 ]
O32 - AutoRun File - [2006-06-14 07:26:38 | 00,000,024 | RHS- | M] () - E:\autorun.txt -- [ FAT32 ]
O32 - AutoRun File - [2007-10-03 14:01:26 | 00,000,000 | RHS- | M] () - E:\autorun.wsh -- [ FAT32 ]
O33 - MountPoints2\{2c35fe70-fa8a-11dd-ab7e-0019e08bd1e6}\Shell\AutoRun\command - "" = I:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe -- File not found
O33 - MountPoints2\{2c35fe70-fa8a-11dd-ab7e-0019e08bd1e6}\Shell\open\command - "" = I:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe -- File not found
O33 - MountPoints2\{2c71b720-0645-11de-abaf-0019e08bd1e6}\Shell\AutoRun\command - "" = H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe -- File not found
O33 - MountPoints2\{2c71b720-0645-11de-abaf-0019e08bd1e6}\Shell\open\command - "" = H:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe -- File not found
O33 - MountPoints2\{2c71b721-0645-11de-abaf-0019e08bd1e6}\Shell\AutoRun\command - "" = I:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe -- File not found
O33 - MountPoints2\{2c71b721-0645-11de-abaf-0019e08bd1e6}\Shell\open\command - "" = I:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\spoolsv.exe -- File not found

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db1b3e60-05ac-11de-a5d3-00001cd72a97}]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .

Następnie uruchamiasz OTL z opcją Run Scan. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia kompa

**Posty:** 492 · przez **DuZI** 15 Lip 2009, 16:00

zrobiłem tak jak mówisz i przy koncy wyskoczył mi jakiś błąd "range check error" kliknalem jeszcze raz Run Fix i doszło do końca, potwierdziłem reset.

nowe logi:

Kod: Zaznacz wszystko: OTL logfile created on: 2009-07-15 15:56:15 - Run 2 OTL by OldTimer - Version 3.0.7.1 Folder = C:\Documents and Settings\Ja\Pulpit Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 511,48 Mb Total Physical Memory | 244,55 Mb Available Physical Memory | 47,81% Memory free 1,21 Gb Paging File | 0,98 Gb Available in Paging File | 81,16% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 14,63 Gb Total Space | 2,18 Gb Free Space | 14,90% Space Free | Partition Type: FAT32 Drive D: | 34,68 Gb Total Space | 3,56 Gb Free Space | 10,27% Space Free | Partition Type: NTFS Drive E: | 25,19 Gb Total Space | 1,90 Gb Free Space | 7,54% Space Free | Partition Type: FAT32 F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: *** Current User Name: Ja Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2005-12-30 08:15:16 | 00,036,864 | ---- | M] () -- C:\WINDOWS\System32\acs.exe PRC - [1999-12-13 03:01:00 | 00,044,032 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\System32\CTsvcCDA.EXE PRC - [2009-06-06 14:59:06 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe PRC - [2004-10-11 11:20:30 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wdfmgr.exe PRC - [2004-08-04 00:44:20 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE PRC - [2004-08-04 00:44:30 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wscntfy.exe PRC - [2006-10-17 16:11:46 | 00,380,928 | ---- | M] () -- C:\Program Files\TP-LINK\TWCU\TWCU.exe PRC - [2009-06-06 14:59:06 | 00,148,888 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe PRC - [2001-10-09 04:21:00 | 00,124,416 | ---- | M] (Avance Logic, Inc.) -- C:\WINDOWS\soundman.exe PRC - [2005-02-15 16:10:16 | 00,057,344 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe PRC - [2007-06-27 19:03:40 | 00,152,872 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe PRC - [2004-12-02 18:23:34 | 00,102,400 | ---- | M] (Creative Technology Ltd) -- C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe PRC - [2007-06-27 19:04:00 | 00,279,848 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe PRC - [2008-12-17 11:39:56 | 00,033,982 | ---- | M] () -- C:\Documents and Settings\Ja\Menu Start\Programy\Autostart\Hide IP Proxy Updater.exe PRC - [2007-06-27 19:04:00 | 01,213,736 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe PRC - [2004-08-04 00:44:30 | 00,218,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wbem\wmiprvse.exe PRC - [2004-08-04 00:44:30 | 00,218,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wbem\wmiprvse.exe PRC - [2008-12-10 22:32:46 | 00,098,816 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe PRC - [2009-07-15 15:49:26 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ja\Pulpit\OTL.exe [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2005-12-30 08:15:16 | 00,036,864 | ---- | M] () -- C:\WINDOWS\System32\acs.exe -- (ACS [Auto | Running]) SRV - [2005-09-23 07:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped]) SRV - [2009-02-14 09:10:42 | 00,206,088 | ---- | M] (Kaspersky Lab) -- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe -- (AVP [Auto | Stopped]) SRV - [2005-09-23 07:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) SRV - [1999-12-13 03:01:00 | 00,044,032 | ---- | M] (Creative Technology Ltd) -- C:\WINDOWS\System32\CTsvcCDA.EXE -- (Creative Service for CDROM Access [Auto | Running]) SRV - [2008-07-31 23:16:30 | 00,136,120 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc [On_Demand | Stopped]) SRV - [2004-08-04 00:44:08 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running]) SRV - [2009-06-06 14:59:06 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running]) SRV - [2007-06-27 19:04:00 | 00,279,848 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe -- (NMIndexingService [On_Demand | Running]) SRV - [2003-07-28 12:28:22 | 00,089,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped]) SRV - [2004-10-11 11:20:30 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wdfmgr.exe -- (UMWdf [Auto | Running]) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2009-02-13 20:00:24 | 00,021,275 | ---- | M] (Meetinghouse Data Communications) -- C:\WINDOWS\System32\DRIVERS\AegisP.sys -- (AegisP [Auto | Running]) DRV - [2001-10-09 04:21:00 | 00,285,533 | ---- | M] (Avance Logic, Inc.) -- C:\WINDOWS\System32\drivers\ALCXWDM.SYS -- (ALCXWDM [On_Demand | Running]) DRV - [2005-12-21 10:16:34 | 00,470,048 | ---- | M] (Atheros Communications, Inc.) -- C:\WINDOWS\System32\DRIVERS\ar5211.sys -- (AR5211 [On_Demand | Running]) DRV - [2006-06-09 22:58:22 | 01,373,120 | ---- | M] (C-Media Inc) -- C:\WINDOWS\System32\drivers\cmuda.sys -- (cmuda [On_Demand | Stopped]) DRV - [2005-01-10 12:15:24 | 00,138,752 | R--- | M] (Creative Technology Ltd) -- C:\WINDOWS\System32\DRIVERS\ctsfm2k.sys -- (ctsfm2k [On_Demand | Running]) DRV - [2004-08-03 23:08:22 | 00,010,624 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\DRIVERS\gameenum.sys -- (gameenum [On_Demand | Running]) DRV - [2009-05-22 11:46:42 | 00,010,536 | ---- | M] () -- C:\WINDOWS\System32\drivers\hmonitor.sys -- (hmonitor [System | Running]) DRV - [2008-07-21 17:34:36 | 00,121,872 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\system32\drivers\kl1.sys -- (kl1 [Boot | Running]) DRV - [2009-02-14 09:10:42 | 00,033,808 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\system32\drivers\klbg.sys -- (klbg [Boot | Running]) DRV - [2009-02-14 09:10:42 | 00,226,832 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\System32\DRIVERS\klif.sys -- (KLIF [System | Running]) DRV - [2008-04-30 17:06:48 | 00,024,592 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\System32\DRIVERS\klim5.sys -- (klim5 [On_Demand | Running]) DRV - [2001-08-17 22:00:04 | 00,002,944 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\msmpu401.sys -- (ms_mpu401 [On_Demand | Running]) DRV - [2004-08-03 22:29:56 | 01,897,408 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Running]) DRV - [2001-08-17 20:50:26 | 00,731,648 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\DRIVERS\nv4.sys -- (nv4 [On_Demand | Stopped]) DRV - [2005-01-10 12:15:30 | 00,106,496 | R--- | M] (Creative Technology Ltd.) -- C:\WINDOWS\System32\DRIVERS\ctoss2k.sys -- (ossrv [On_Demand | Running]) DRV - [2005-07-07 10:14:30 | 01,389,056 | R--- | M] (Creative Technology Ltd.) -- C:\WINDOWS\System32\drivers\P17.sys -- (P17 [On_Demand | Running]) DRV - [2001-08-17 21:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running]) DRV - [2008-07-31 23:17:06 | 00,043,872 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running]) DRV - [2001-07-22 02:41:32 | 00,027,440 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped]) DRV - [2009-06-10 12:51:50 | 00,721,904 | ---- | M] () -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd [Boot | Running]) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = plimus.com,www.plimus.com,regnow.com,www.regnow.com, IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = socks= FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009-06-06 14:59:06 | 00,000,000 | ---D | M] O1 HOSTS File: (742 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\ievkbd.dll (Kaspersky Lab) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe (Kaspersky Lab) O4 - HKLM..\Run: [Cmaudio] File not found O4 - HKLM..\Run: [CTRegRun] C:\WINDOWS\CTRegRun.EXE (Creative Technology Ltd ) O4 - HKLM..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe (Creative Technology Ltd) O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG) O4 - HKLM..\Run: [P17Helper] C:\WINDOWS\System32\P17.DLL () O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\soundman.exe (Avance Logic, Inc.) O4 - HKLM..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM..\Run: [TWCU] C:\Program Files\TP-LINK\TWCU\TWCU.exe () O4 - HKLM..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE (Creative Technology Ltd.) O4 - HKCU..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG) O4 - HKCU..\Run: [Creative Detector] C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe (Creative Technology Ltd) O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd) O4 - HKCU..\Run: [MSMSGS] C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE (Microsoft Corporation) O4 - Startup: C:\Documents and Settings\Ja\Menu Start\Programy\Autostart\Hide IP Proxy Updater.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.) O9 - Extra Button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\SCIEPlgn.dll (Kaspersky Lab) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\SYSTEM\OLE DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Program Files\Common Files\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\mzvkbd.dll (Kaspersky Lab) O20 - AppInit_DLLs: (C:\PROGRA~1\KASPER~1\KASPER~1\mzvkbd3.dll) - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\mzvkbd3.dll (Kaspersky Lab) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\klogon: DllName - C:\WINDOWS\system32\klogon.dll - C:\WINDOWS\System32\klogon.dll (Kaspersky Lab) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-02-13 19:45:02 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ FAT32 ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - File not found [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [3 C:\WINDOWS\*.tmp files] [2009-07-15 15:51:04 | 00,000,000 | ---D | C] -- C:\_OTL [2009-07-15 15:49:20 | 00,513,536 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Ja\Pulpit\OTL.exe [2009-07-15 11:07:34 | 12,759,455 | ---- | C] () -- C:\Documents and Settings\Ja\Pulpit\03-e_mine_vs_disko_punks_-_to_france_(muzic_loverz_club_remix)- www.4clubbers.pl.mp3 [2009-07-14 18:08:40 | 00,000,000 | ---D | C] -- C:\Program Files\NOS [2009-07-14 18:08:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\NOS [2009-07-02 17:01:25 | 00,000,196 | ---- | C] () -- C:\WINDOWS\System32\drivers\ALCICH.DAT [2009-07-02 16:10:14 | 00,090,112 | ---- | C] (Creative Technology Ltd.) -- C:\WINDOWS\Updreg.EXE [2009-07-02 16:09:25 | 00,005,627 | R--- | C] () -- C:\WINDOWS\System32\Ludap17.ini [2009-07-02 16:09:25 | 00,000,039 | R--- | C] () -- C:\WINDOWS\System32\ctzapxx.ini [2009-07-02 14:33:26 | 00,000,000 | ---D | C] -- C:\Program Files\Avance Sound Manager [2009-07-02 14:33:23 | 00,000,000 | ---D | C] -- C:\Program Files\AvRack [2009-07-02 14:33:22 | 00,285,533 | ---- | C] (Avance Logic, Inc.) -- C:\WINDOWS\System32\drivers\ALCXWDM.SYS [2009-07-02 14:33:22 | 00,000,164 | ---- | C] () -- C:\WINDOWS\avrack.ini [2009-07-02 14:33:21 | 00,217,088 | ---- | C] (Avance Logic, Inc.) -- C:\WINDOWS\alcupd.exe [2009-07-02 14:33:21 | 00,151,552 | ---- | C] (Avance Logic, Inc.) -- C:\WINDOWS\alcrmv.exe [2009-07-02 14:33:21 | 00,124,416 | ---- | C] (Avance Logic, Inc.) -- C:\WINDOWS\soundman.exe [2009-07-02 14:33:10 | 00,000,025 | ---- | C] () -- C:\WINDOWS\mixerdef.ini [2009-07-02 14:31:26 | 00,000,000 | ---D | C] -- C:\Program Files\C-Media [2009-07-02 14:31:20 | 00,000,026 | ---- | C] () -- C:\WINDOWS\CMCDPLAY.INI [2009-07-02 14:30:46 | 00,381,440 | ---- | C] () -- C:\WINDOWS\System32\Counter.exe [2009-07-02 14:30:45 | 00,387,584 | ---- | C] () -- C:\WINDOWS\System32\LostRun.exe [2009-07-02 14:30:44 | 00,351,232 | ---- | C] () -- C:\WINDOWS\System32\CheckPath.exe [2009-07-02 14:30:42 | 00,532,480 | ---- | C] () -- C:\WINDOWS\System32\DeleteFiles.exe [2009-07-02 14:30:40 | 00,382,464 | ---- | C] () -- C:\WINDOWS\System32\Restart.exe [2009-07-02 14:30:39 | 00,374,784 | ---- | C] () -- C:\WINDOWS\System32\RunAP.exe [2009-07-02 14:14:40 | 00,044,032 | ---- | C] (Creative Technology Ltd) -- C:\WINDOWS\System32\CTSVCCDA.EXE [2009-07-02 14:14:40 | 00,025,088 | ---- | C] (Creative Technology Ltd) -- C:\WINDOWS\System32\CTSVCCTL.EXE [2009-07-02 14:05:34 | 00,000,347 | ---- | C] () -- C:\WINDOWS\CTWave32.INI [2009-07-02 13:19:32 | 00,000,586 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Hmonitor.lnk [2009-07-02 13:19:31 | 00,010,536 | ---- | C] () -- C:\WINDOWS\System32\drivers\Hmonitor.sys [2009-07-02 13:19:31 | 00,000,000 | ---D | C] -- C:\Program Files\Hmonitor [2009-07-02 13:10:12 | 53,639,9872 | -HS- | C] () -- C:\hiberfil.sys [2009-07-02 13:06:56 | 00,000,000 | -HSD | C] -- C:\WINDOWS\CSC [2009-07-02 12:41:58 | 00,000,000 | -HSD | C] -- C:\FOUND.001 [2009-07-01 10:33:18 | 03,894,304 | ---- | C] () -- C:\Documents and Settings\Ja\Pulpit\MY MUSIC.wav [2009-06-26 21:39:02 | 00,000,000 | -H-D | C] -- C:\WINDOWS\$MSI31Uninstall_KB893803v2$ [2009-06-22 11:53:03 | 10,747,856 | ---- | C] () -- C:\Documents and Settings\Ja\Pulpit\reckless.wav [2009-06-18 09:51:52 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ja\Pulpit\Massive_Presets [2009-06-18 09:49:40 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Ja\Pulpit\massive [2009-06-10 12:51:47 | 00,721,904 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2009-03-21 13:38:32 | 00,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2009-03-19 13:29:38 | 00,000,093 | ---- | C] () -- C:\WINDOWS\FxLoader.INI [2009-02-20 15:42:54 | 00,000,072 | ---- | C] () -- C:\WINDOWS\sbwin.ini [2009-02-14 12:13:03 | 00,001,025 | ---- | C] () -- C:\WINDOWS\System32\sysprs7.dll [2009-02-14 12:13:03 | 00,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth2.dll [2009-02-14 12:13:03 | 00,001,025 | ---- | C] () -- C:\WINDOWS\System32\clauth1.dll [2009-02-14 12:13:03 | 00,000,205 | ---- | C] () -- C:\WINDOWS\System32\lsprst7.dll [2009-02-14 12:13:03 | 00,000,073 | ---- | C] () -- C:\WINDOWS\System32\ssprs.dll [2009-02-13 21:21:04 | 00,000,159 | ---- | C] () -- C:\WINDOWS\wcx_ftp.ini [2009-02-13 21:20:17 | 00,001,232 | ---- | C] () -- C:\WINDOWS\wincmd.ini [2009-02-13 20:46:21 | 00,000,155 | ---- | C] () -- C:\WINDOWS\winamp.ini [2009-02-13 20:32:53 | 00,000,784 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2009-02-13 20:03:26 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2009-02-13 20:00:21 | 00,258,048 | ---- | C] () -- C:\WINDOWS\System32\wgapi.dll [2008-12-19 16:15:58 | 04,338,246 | ---- | C] () -- C:\WINDOWS\System32\libavcodec.dll [2008-12-17 18:41:18 | 00,884,237 | ---- | C] () -- C:\WINDOWS\System32\ff_x264.dll [2008-12-17 18:22:58 | 00,093,184 | ---- | C] () -- C:\WINDOWS\System32\ff_wmv9.dll [2008-12-17 18:22:48 | 00,057,344 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2008-12-17 18:17:34 | 00,239,247 | ---- | C] () -- C:\WINDOWS\System32\ff_theora.dll [2008-12-17 17:59:54 | 00,560,802 | ---- | C] () -- C:\WINDOWS\System32\libmplayer.dll [2008-12-11 12:27:02 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2005-05-03 13:38:42 | 00,064,512 | R--- | C] () -- C:\WINDOWS\System32\P17.dll [2004-11-24 20:25:52 | 00,335,872 | ---- | C] ( ) -- C:\WINDOWS\System32\drvc.dll [2004-10-03 18:50:54 | 00,129,024 | ---- | C] () -- C:\WINDOWS\System32\ff_mpeg2enc.dll [2003-10-02 12:48:18 | 00,053,248 | R--- | C] () -- C:\WINDOWS\System32\P17CPI.dll [2003-02-19 01:26:28 | 00,028,672 | ---- | C] () -- C:\WINDOWS\System32\cmirmdrv.dll [2002-04-11 03:41:06 | 00,065,536 | R--- | C] ( ) -- C:\WINDOWS\System32\A3d.dll [2001-07-22 02:41:32 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2001-07-21 22:16:20 | 00,000,615 | ---- | C] () -- C:\WINDOWS\win.ini [2001-07-21 22:15:52 | 00,000,231 | ---- | C] () -- C:\WINDOWS\system.ini [1999-01-22 16:46:58 | 00,065,536 | ---- | C] () -- C:\WINDOWS\System32\MSRTEDIT.DLL [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [3 C:\WINDOWS\*.tmp files] [2009-07-15 15:54:44 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-07-15 15:54:42 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-07-15 15:54:40 | 53,639,9872 | -HS- | M] () -- C:\hiberfil.sys [2009-07-15 15:54:34 | 00,000,196 | ---- | M] () -- C:\WINDOWS\System32\drivers\ALCICH.DAT [2009-07-15 15:53:46 | 00,408,608 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.dat [2009-07-15 15:53:46 | 00,008,224 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.dat [2009-07-15 15:53:46 | 00,005,320 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.idx [2009-07-15 15:53:46 | 00,001,108 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox2.idx [2009-07-15 15:49:26 | 00,513,536 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Ja\Pulpit\OTL.exe [2009-07-15 15:15:02 | 00,000,155 | ---- | M] () -- C:\WINDOWS\winamp.ini [2009-07-14 14:44:44 | 00,001,232 | ---- | M] () -- C:\WINDOWS\wincmd.ini [2009-07-14 14:43:58 | 00,000,159 | ---- | M] () -- C:\WINDOWS\wcx_ftp.ini [2009-07-13 18:00:14 | 00,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2009-07-11 14:53:24 | 03,894,304 | ---- | M] () -- C:\Documents and Settings\Ja\Pulpit\MY MUSIC.wav [2009-07-11 13:47:16 | 00,000,087 | ---- | M] () -- C:\WINDOWS\System32\ssprs.tgz [2009-07-11 13:47:16 | 00,000,073 | ---- | M] () -- C:\WINDOWS\System32\ssprs.dll [2009-07-11 13:47:14 | 00,000,219 | ---- | M] () -- C:\WINDOWS\System32\lsprst7.tgz [2009-07-11 13:47:14 | 00,000,205 | ---- | M] () -- C:\WINDOWS\System32\lsprst7.dll [2009-07-02 17:46:52 | 00,001,844 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Creative Product Registration.lnk [2009-07-02 16:16:42 | 00,000,584 | ---- | M] () -- C:\WINDOWS\System32\settingsbkup.sfm [2009-07-02 16:16:42 | 00,000,584 | ---- | M] () -- C:\WINDOWS\System32\settings.sfm [2009-07-02 14:33:12 | 00,000,025 | ---- | M] () -- C:\WINDOWS\mixerdef.ini [2009-07-02 14:31:24 | 00,000,026 | ---- | M] () -- C:\WINDOWS\CMCDPLAY.INI [2009-07-02 14:05:36 | 00,000,347 | ---- | M] () -- C:\WINDOWS\CTWave32.INI [2009-07-02 13:44:50 | 04,837,142 | -H-- | M] () -- C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\IconCache.db [2009-07-02 13:19:34 | 00,000,586 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Hmonitor.lnk [2009-07-01 17:55:54 | 00,012,288 | ---- | M] () -- C:\Documents and Settings\Ja\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-06-16 11:46:16 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl < End of report >

**Posty:** 18165 · przez **wojtas** 15 Lip 2009, 17:28

1.Uruchom OTL z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware

**Posty:** 492 · przez **DuZI** 15 Lip 2009, 18:37

Kod: Zaznacz wszystko: Malwarebytes' Anti-Malware 1.39 Wersja bazy definicji: 2421 Windows 5.1.2600 Dodatek Service Pack 2 2009-07-15 18:36:15 mbam-log-2009-07-15 (18-36-10).txt Typ skanowania: Szybkie skanowanie Przeskanowane obiekty: 86795 Upłynęło: 6 minute(s), 4 second(s) Zainfekowane procesy w pamięci: 0 Zainfekowane moduły pamięci: 0 Zainfekowane klucze rejestru: 3 Zainfekowane wartości rejestru: 0 Zainfekowane pliki rejestru: 0 Zainfekowane foldery: 5 Zainfekowane pliki: 5 Zainfekowane procesy w pamięci: (Nie wykryto groźnych plików) Zainfekowane moduły pamięci: (Nie wykryto groźnych plików) Zainfekowane klucze rejestru: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{37b85a21-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{37b85a29-692b-4205-9cad-2626e4993404} (Adware.MyWebSearch) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\MyGlobalSearch (Adware.BookedSpace) -> No action taken. Zainfekowane wartości rejestru: (Nie wykryto groźnych plików) Zainfekowane pliki rejestru: (Nie wykryto groźnych plików) Zainfekowane foldery: C:\Program Files\MyGlobalSearch (Adware.MyWebSearch) -> No action taken. c:\program files\myglobalsearch\bar (Adware.MyWebSearch) -> No action taken. c:\program files\myglobalsearch\bar\History (Adware.MyWebSearch) -> No action taken. c:\program files\myglobalsearch\bar\Settings (Adware.MyWebSearch) -> No action taken. c:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013 (Trojan.Agent) -> No action taken. Zainfekowane pliki: c:\WINDOWS\system32\temp1.exe (Trojan.Downloader) -> No action taken. c:\WINDOWS\system32\temp2.exe (Trojan.Downloader) -> No action taken. c:\host.exe (Trojan.Dropper) -> No action taken. c:\program files\myglobalsearch\bar\History\search (Adware.MyWebSearch) -> No action taken. c:\RECYCLER\s-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini (Trojan.Agent) -> No action taken.

wykryło 13 virusów to wzialem 'usun zaznaczone' i reset kompa

**Posty:** 18165 · przez **wojtas** 15 Lip 2009, 19:49

Daj loga z combofixa ale zainstaluj wraz z nim konsolę odzyskiwania ( instrukcja programu )

**Posty:** 492 · przez **DuZI** 16 Lip 2009, 10:58

Kod: Zaznacz wszystko: ComboFix 09-07-14.08 - Ja 2009-07-16 10:43.1.1 - FAT32x86 Microsoft Windows XP Professional [GMT 2:00] Uruchomiony z: c:\documents and settings\Ja\Pulpit\ComboFix.exe AV: Kaspersky Anti-Virus *On-access scanning disabled* (Outdated) . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\autorun.inf c:\windows\system32\Data c:\windows\system32\lsprst7.dll c:\windows\system32\ssprs.dll D:\host.exe E:\host.exe . ((((((((((((((((((((((((( Pliki utworzone od 2009-06-16 do 2009-07-16 ))))))))))))))))))))))))))))))) . 2009-07-15 16:28 . 2009-07-15 16:28 -------- d-----w- c:\documents and settings\Ja\Dane aplikacji\Malwarebytes 2009-07-15 16:28 . 2009-07-13 11:36 38160 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2009-07-15 16:28 . 2009-07-15 16:28 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware 2009-07-15 16:28 . 2009-07-15 16:28 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\Malwarebytes 2009-07-15 16:28 . 2009-07-13 11:36 19096 ----a-w- c:\windows\system32\drivers\mbam.sys 2009-07-14 16:08 . 2009-07-14 16:08 -------- d-----w- c:\program files\NOS 2009-07-14 16:08 . 2009-07-14 16:08 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\NOS 2009-07-14 16:03 . 2009-07-14 16:05 1878984 ----a-w- c:\documents and settings\Ja\Dane aplikacji\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe 2009-07-02 15:01 . 2009-07-16 08:52 196 ----a-w- c:\windows\system32\drivers\ALCICH.DAT 2009-07-02 14:10 . 2000-05-10 23:00 90112 ------w- c:\windows\Updreg.EXE 2009-07-02 12:33 . 2009-07-02 12:33 -------- d-----w- c:\program files\Avance Sound Manager 2009-07-02 12:33 . 2009-07-02 12:33 -------- d-----w- c:\program files\AvRack 2009-07-02 12:33 . 2001-10-09 02:21 285533 ----a-w- c:\windows\system32\drivers\ALCXWDM.SYS 2009-07-02 12:33 . 2001-10-09 02:21 217088 ------w- c:\windows\alcupd.exe 2009-07-02 12:33 . 2001-10-09 02:21 151552 ------w- c:\windows\alcrmv.exe 2009-07-02 12:33 . 2001-10-09 02:21 124416 ------w- c:\windows\soundman.exe 2009-07-02 12:31 . 2009-07-02 12:31 -------- d-----w- c:\program files\C-Media 2009-07-02 12:30 . 2001-08-30 07:16 381440 ----a-w- c:\windows\system32\Counter.exe 2009-07-02 12:30 . 2001-07-25 04:27 387584 ----a-w- c:\windows\system32\LostRun.exe 2009-07-02 12:30 . 2001-04-27 08:23 351232 ----a-w- c:\windows\system32\CheckPath.exe 2009-07-02 12:30 . 2001-03-19 09:50 532480 ----a-w- c:\windows\system32\DeleteFiles.exe 2009-07-02 12:30 . 2001-07-25 04:23 382464 ----a-w- c:\windows\system32\Restart.exe 2009-07-02 12:30 . 2001-07-24 10:59 374784 ----a-w- c:\windows\system32\RunAP.exe 2009-07-02 12:14 . 1999-12-13 01:01 44032 ------w- c:\windows\system32\CTSVCCDA.EXE 2009-07-02 12:14 . 1999-11-18 01:00 25088 ------w- c:\windows\system32\CTSVCCTL.EXE 2009-07-02 11:19 . 2009-07-02 11:19 -------- d-----w- c:\program files\Hmonitor 2009-07-02 11:19 . 2009-05-22 09:46 10536 ----a-w- c:\windows\system32\drivers\Hmonitor.sys 2009-07-02 10:41 . 2009-07-02 10:41 -------- d-sh--w- C:\FOUND.001 . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-07-16 08:52 . 2009-02-14 06:56 8224 --sha-w- c:\windows\system32\drivers\fidbox2.dat 2009-07-16 08:52 . 2009-02-14 06:56 5320 --sha-w- c:\windows\system32\drivers\fidbox.idx 2009-07-16 08:52 . 2009-02-14 06:56 408608 --sha-w- c:\windows\system32\drivers\fidbox.dat 2009-07-16 08:52 . 2009-02-14 06:56 1108 --sha-w- c:\windows\system32\drivers\fidbox2.idx 2009-06-10 10:59 . 2009-06-10 10:59 -------- d-----w- c:\program files\Smart Projects 2009-06-10 10:54 . 2009-06-10 10:54 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\DAEMON Tools Lite 2009-06-10 10:54 . 2009-06-10 10:54 -------- d-----w- c:\program files\DAEMON Tools Toolbar 2009-06-10 10:54 . 2009-06-10 10:54 -------- d-----w- c:\program files\DAEMON Tools Lite 2009-06-10 10:51 . 2009-06-10 10:51 721904 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-06-10 10:51 . 2009-06-10 10:51 -------- d-----w- c:\documents and settings\Ja\Dane aplikacji\DAEMON Tools Lite 2009-06-10 09:10 . 2009-06-10 09:10 -------- d-----w- c:\program files\uTorrent 2009-06-10 09:10 . 2009-06-10 09:10 -------- d-----w- c:\documents and settings\Ja\Dane aplikacji\uTorrent 2009-06-06 12:59 . 2009-06-06 12:59 410984 ----a-w- c:\windows\system32\deploytk.dll 2009-06-06 12:58 . 2009-06-06 12:58 -------- d-----w- c:\program files\Java 2009-06-06 12:58 . 2009-06-06 12:57 152576 ----a-w- c:\documents and settings\Ja\Dane aplikacji\Sun\Java\jre1.6.0_13\lzma.dll 2009-05-31 15:53 . 2009-05-31 15:53 -------- d-----w- c:\program files\BearShare 2009-05-25 08:53 . 2009-05-25 08:53 1700352 ----a-w- c:\windows\system32\gdiplus.dll 2009-05-25 08:47 . 2009-05-25 08:47 -------- d-----w- c:\program files\Common Files\Native Instruments 2009-05-16 11:11 . 2009-02-13 18:21 19272 ----a-w- c:\documents and settings\Ja\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-05-16 08:51 . 2001-10-26 14:15 74450 ----a-w- c:\windows\system32\perfc015.dat 2009-05-16 08:51 . 2001-10-26 14:15 448348 ----a-w- c:\windows\system32\perfh015.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872] "Creative Detector"="c:\program files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 102400] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "TWCU"="c:\program files\TP-LINK\TWCU\TWCU.exe" [2006-10-17 380928] "AVP"="c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [2009-02-14 206088] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-06-06 148888] "UpdReg"="c:\windows\UpdReg.EXE" [2000-05-10 90112] "CTSysVol"="c:\program files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-02-15 57344] "SoundMan"="soundman.exe" - c:\windows\soundman.exe [2001-10-09 124416] "P17Helper"="P17.dll" - c:\windows\system32\P17.dll [2005-05-03 64512] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\Ja\Menu Start\Programy\Autostart\ Hide IP Proxy Updater.exe [2008-12-17 33982] [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Microsoft Office.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Microsoft Office.lnk backup=c:\windows\pss\Microsoft Office.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Ja^Menu Start^Programy^Autostart^Hide IP Proxy Updater.exe] path=c:\documents and settings\Ja\Menu Start\Programy\Autostart\Hide IP Proxy Updater.exe backup=c:\windows\pss\Hide IP Proxy Updater.exeStartup [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\totalcmd\\TOTALCMD.EXE"= "c:\\Program Files\\Gadu-Gadu\\GG.EXE"= "c:\\Program Files\\Opera\\OPERA.EXE"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= R0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2008-01-29 33808] R3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\drivers\klim5.sys [2008-04-30 24592] . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-Cmaudio - cmicnfg.cpl . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ uInternet Connection Wizard,ShellNext = iexplore uInternet Settings,ProxyServer = socks= uInternet Settings,ProxyOverride = plimus.com,www.plimus.com,regnow.com,www.regnow.com, IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200 TCP: {D008C859-0C31-4941-BB61-E6071729BB78} = 194.204.159.1 194.204.152.34 DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab . ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-07-16 10:54 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- ZABLOKOWANE KLUCZE REJESTRU --------------------- [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "cd042efbbd7f7af1647644e76e06692b"=hex:e2,63,26,f1,3f,c8,ff,68,28,76,3d,54,35, b1,71,e1,c8,28,51,af,b0,29,a3,98,84,c5,fe,f9,0c,49,66,35,e2,63,26,f1,3f,c8,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "bca643cdc5c2726b20d2ecedcc62c59b"=hex:71,3b,04,66,8b,46,0d,96,b4,93,74,2a,32, 99,a1,b7,71,3b,04,66,8b,46,0d,96,11,ed,44,5e,8d,85,35,55,6a,9c,d6,61,af,45,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "2c81e34222e8052573023a60d06dd016"=hex:ff,7c,85,e0,43,d4,0e,fe,e8,a5,7c,0f,47, 71,bd,9f,25,da,ec,7e,55,20,c9,26,9f,8b,ae,f7,b7,c7,72,3e,ff,7c,85,e0,43,d4,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "2582ae41fb52324423be06337561aa48"=hex:6b,65,49,6a,7e,99,74,f7,5f,52,49,e1,52, 35,8e,6b,3e,1e,9e,e0,57,5a,93,61,26,41,16,ae,61,72,5a,d6,86,8c,21,01,be,91,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "caaeda5fd7a9ed7697d9686d4b818472"=hex:f5,1d,4d,73,a8,13,5c,05,bc,a4,83,18,aa, 1f,ec,a4,cd,44,cd,b9,a6,33,6c,cd,00,18,a1,d2,54,b4,3b,38,f5,1d,4d,73,a8,13,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:b0,18,ed,a7,3f,8d,37,a4,6f,e8,a1,7e,3a, b2,27,e9,b0,18,ed,a7,3f,8d,37,a4,79,83,f4,15,73,ff,67,9b,df,20,58,62,78,6b,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "4d370831d2c43cd13623e232fed27b7b"=hex:31,77,e1,ba,b1,f8,68,02,31,97,4e,cb,03, 03,ec,72,31,77,e1,ba,b1,f8,68,02,ae,31,4b,24,b6,2a,e4,97,fb,a7,78,e6,12,2f,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,de,ec,e1,a0,c4, db,69,83,83,6c,56,8b,a0,85,96,ab,e1,8c,16,34,e0,1d,da,da,01,3a,48,fc,e8,04,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "1fac81b91d8e3c5aa4b0a51804d844a3"=hex:f6,0f,4e,58,98,5b,89,c9,ce,d5,3f,12,f1, a7,6e,4d,51,fa,6e,91,28,9e,14,cc,90,ba,4c,af,d9,34,70,16,f6,0f,4e,58,98,5b,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "f5f62a6129303efb32fbe080bb27835b"=hex:3d,ce,ea,26,2d,45,aa,78,14,86,3e,aa,ec, d0,bf,6d,b1,cd,45,5a,a8,c4,f8,b9,11,cc,e8,07,1f,32,b0,5d,3d,ce,ea,26,2d,45,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:e3,0e,66,d5,eb,bc,2f,6b,90,ee,70,cc,85, 4d,3b,0a,e3,0e,66,d5,eb,bc,2f,6b,8a,c0,a5,5e,c2,9e,2c,83,2a,b7,cc,b5,b9,7f,\ [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*] "ThreadingModel"="Apartment" @="c:\\WINDOWS\\system32\\OLE32.DLL" "8a8aec57dd6508a385616fbc86791ec2"=hex:6c,43,2d,1e,aa,22,2f,9c,7c,13,79,36,19, 97,3f,ed,fa,ea,66,7f,d4,3b,6b,70,3b,02,76,fe,de,0b,06,1a,6c,43,2d,1e,aa,22,\ . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'explorer.exe'(516) c:\windows\system32\msi.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\SYSTEM32\ACS.EXE c:\windows\SYSTEM32\CTSVCCDA.EXE c:\program files\JAVA\JRE6\BIN\JQS.EXE c:\windows\SYSTEM32\WDFMGR.EXE c:\windows\SYSTEM32\WSCNTFY.EXE c:\windows\SYSTEM32\WBEM\WMIAPSRV.EXE c:\windows\SYSTEM32\RUNDLL32.EXE c:\program files\COMMON FILES\AHEAD\LIB\NMINDEXINGSERVICE.EXE c:\program files\COMMON FILES\AHEAD\LIB\NMINDEXSTORESVR.EXE . ************************************************************************** . Czas ukończenia: 2009-07-16 10:56 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-07-16 08:56 Przed: 2 620 686 336 bajtów wolnych Po: 3 122 003 968 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptIn 222 --- E O F --- 2009-06-26 19:39

**Posty:** 18165 · przez **wojtas** 16 Lip 2009, 22:52

czysto

Autor postu otrzymał pochwałę