Proszę o sprawdzenie loga - podejrzewam trojany

**Posty:** 33 · przez **tegie04** 28 Wrz 2009, 18:56

Witam, proszę o sprawdzenie loga, ponieważ mój komputer od jakiegoś czasu totalnie muli, optymalizowałem wszystko wg poradników, defragmentacja była robiona. Poza muleniem wyskakują dziwne okienka i nie jestem zadowololny z pracy mojego systemu, czasem się resetuje, jest masa dziwnych procesów i wogóle przedziwne rzeczy potrafią się dziać. Myślałem już o formacie ale to ostateczność więc zwracam się o pomoc tutaj... dodam że kompa skanowałem ad-adware oraz avira antivirem. Oto log z otl'a:

Kod: Zaznacz wszystko: OTL logfile created on: 2009-09-28 18:51:33 - Run 1 OTL by OldTimer - Version 3.0.16.0 Folder = D:\różne\instalki Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1023,48 Mb Total Physical Memory | 419,18 Mb Available Physical Memory | 40,96% Memory free 2,40 Gb Paging File | 1,73 Gb Available in Paging File | 72,13% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 19,53 Gb Total Space | 1,26 Gb Free Space | 6,44% Space Free | Partition Type: NTFS Drive D: | 129,51 Gb Total Space | 18,42 Gb Free Space | 14,22% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: TET Current User Name: tonyww44 Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2009-02-25 23:27:41 | 00,602,112 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe PRC - [2009-02-25 23:27:41 | 00,602,112 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe PRC - [2009-05-13 16:48:22 | 00,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe PRC - [2009-05-11 10:15:50 | 00,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe PRC - [2009-04-07 00:12:24 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe PRC - [2003-10-16 18:07:10 | 00,024,576 | ---- | M] () -- C:\Program Files\Neostrada TP\CnxMon.exe PRC - [2004-01-26 11:38:38 | 00,866,816 | ---- | M] (THOMSON Telecom Belgium) -- C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe PRC - [2003-10-16 18:07:12 | 00,053,248 | ---- | M] (France Télécom R&D) -- C:\Program Files\Neostrada TP\TaskBarIcon.exe PRC - [2009-03-02 13:08:47 | 00,209,153 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe PRC - [2005-01-28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wdfmgr.exe PRC - [2009-09-18 08:57:02 | 00,036,352 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Temp\wpv641253178221.exe PRC - [2008-12-18 14:32:52 | 00,049,152 | ---- | M] (Advanced Micro Devices Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe PRC - [2009-06-20 13:26:55 | 00,065,024 | ---- | M] () -- C:\WINDOWS\System32\18869.exe PRC - [2008-12-18 13:19:44 | 00,049,152 | ---- | M] (ATI Technologies Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe PRC - [2003-10-16 18:07:12 | 00,626,688 | ---- | M] (France Télécom R&D) -- C:\Program Files\Neostrada TP\NeostradaTP.exe PRC - [2007-11-06 01:50:44 | 00,116,032 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe PRC - [2003-10-16 18:07:10 | 00,200,704 | ---- | M] (France Télécom R&D) -- C:\Program Files\Neostrada TP\ComComp.exe PRC - [2004-08-04 00:44:22 | 00,093,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe PRC - [2003-10-16 18:07:12 | 00,020,480 | ---- | M] (France Télécom R&D) -- C:\Program Files\Neostrada TP\Watch.exe PRC - [2009-08-28 13:13:02 | 00,832,808 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe PRC - [2009-09-28 16:45:27 | 02,855,080 | ---- | M] () -- D:\różne\instalki\aawsepersonal(programosy.pl).exe PRC - [2007-11-14 12:54:24 | 02,131,392 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\gg.exe PRC - [2004-08-04 00:44:20 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2009-09-24 14:39:26 | 02,768,696 | ---- | M] (www.BitComet.com) -- C:\Program Files\BitComet\BitComet.exe PRC - [2008-03-17 20:57:34 | 01,307,648 | ---- | M] (Nullsoft) -- C:\Program Files\Winamp\winamp.exe PRC - [2004-08-04 00:44:30 | 00,218,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wbem\wmiprvse.exe PRC - [2004-08-04 00:44:20 | 00,010,752 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dumprep.exe PRC - [2004-08-04 00:44:20 | 00,180,224 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dwwin.exe PRC - [2004-08-04 00:44:20 | 00,010,752 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dumprep.exe PRC - [2004-08-04 00:44:20 | 00,180,224 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dwwin.exe PRC - [2009-09-28 18:51:02 | 00,518,144 | ---- | M] (OldTimer Tools) -- D:\różne\instalki\OTL.exe [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2009-05-13 16:48:22 | 00,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService [Auto | Running]) SRV - [2009-05-11 10:15:50 | 00,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService [Auto | Running]) SRV - [2005-09-23 07:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped]) SRV - [2009-02-25 23:27:41 | 00,602,112 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe -- (Ati HotKey Poller [Auto | Running]) SRV - [2009-02-25 15:15:00 | 00,593,920 | ---- | M] () -- C:\WINDOWS\System32\ati2sgag.exe -- (ATI Smart [Auto | Stopped]) SRV - [2005-09-23 07:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) SRV - [2004-08-04 00:44:08 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running]) SRV - [2007-11-06 21:16:54 | 00,217,088 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll -- (hpqcxs08 [On_Demand | Running]) SRV - [2007-11-06 21:16:54 | 00,139,264 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll -- (hpqddsvc [Auto | Running]) SRV - [2009-06-20 13:26:55 | 00,065,024 | ---- | M] () -- C:\WINDOWS\System32\18869.exe -- (ipfw [Auto | Running]) SRV - [2009-04-07 00:12:24 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running]) SRV - [2006-11-08 16:35:36 | 00,043,520 | ---- | M] (Hewlett-Packard) -- C:\WINDOWS\System32\HPZinw12.dll -- (Net Driver HPZ12 [Auto | Running]) SRV - [2006-10-26 19:49:34 | 00,441,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv [On_Demand | Stopped]) SRV - [2006-10-26 13:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped]) SRV - [2006-11-08 16:35:38 | 00,053,248 | ---- | M] (Hewlett-Packard) -- C:\WINDOWS\System32\HPZipm12.dll -- (Pml Driver HPZ12 [Auto | Running]) SRV - [2008-11-11 09:38:06 | 00,620,544 | ---- | M] (Nokia.) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer [On_Demand | Stopped]) SRV - [2005-01-28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wdfmgr.exe -- (UMWdf [Auto | Running]) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2003-12-08 11:53:48 | 00,053,600 | ---- | M] (THOMSON) -- C:\WINDOWS\System32\DRIVERS\alcan5wn.sys -- (alcan5wn [On_Demand | Running]) DRV - [2003-12-08 11:53:46 | 00,070,688 | ---- | M] (THOMSON) -- C:\WINDOWS\System32\DRIVERS\alcaudsl.sys -- (alcaudsl [On_Demand | Running]) DRV - [2006-07-01 23:32:26 | 00,043,520 | ---- | M] (Advanced Micro Devices) -- C:\WINDOWS\System32\DRIVERS\AmdK8.sys -- (AmdK8 [System | Running]) DRV - [2009-02-26 00:58:57 | 03,565,568 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\DRIVERS\ati2mtag.sys -- (ati2mtag [On_Demand | Running]) DRV - [2009-02-13 12:35:05 | 00,011,608 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio [System | Running]) DRV - [2009-03-24 16:08:22 | 00,055,640 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\DRIVERS\avgntflt.sys -- (avgntflt [Auto | Running]) DRV - [2009-03-30 10:33:07 | 00,096,104 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\DRIVERS\avipbb.sys -- (avipbb [System | Running]) DRV - [2006-11-24 14:47:50 | 00,040,136 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\Drivers\ET5Drv.sys -- (ET5Drv [On_Demand | Stopped]) DRV - [2009-07-06 17:56:13 | 00,016,608 | ---- | M] (Windows (R) 2000 DDK provider) -- C:\WINDOWS\gdrv.sys -- (gdrv [On_Demand | Stopped]) DRV - [2005-01-07 17:07:18 | 00,138,752 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\System32\DRIVERS\HDAudBus.sys -- (HDAudBus [On_Demand | Running]) DRV - [2007-10-30 11:25:53 | 00,049,920 | R--- | M] (HP) -- C:\WINDOWS\System32\DRIVERS\HPZid412.sys -- (HPZid412 [On_Demand | Stopped]) DRV - [2007-10-30 11:25:54 | 00,016,496 | R--- | M] (HP) -- C:\WINDOWS\System32\DRIVERS\HPZipr12.sys -- (HPZipr12 [On_Demand | Stopped]) DRV - [2007-10-30 11:25:55 | 00,021,568 | R--- | M] (HP) -- C:\WINDOWS\System32\DRIVERS\HPZius12.sys -- (HPZius12 [On_Demand | Stopped]) DRV - [2008-12-11 11:24:20 | 04,959,232 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\System32\drivers\RtkHDAud.sys -- (IntcAzAudAddService [On_Demand | Running]) DRV - [2009-05-11 13:04:59 | 00,026,240 | ---- | M] (WIPFW Project.) -- C:\WINDOWS\System32\DRIVERS\ip_fw.sys -- (ip_fw [On_Demand | Running]) DRV - [2004-08-13 04:56:20 | 00,005,810 | R--- | M] () -- C:\WINDOWS\System32\DRIVERS\ASACPI.sys -- (MTsensor [On_Demand | Stopped]) DRV - [2008-09-15 07:56:24 | 00,017,664 | ---- | M] (Nokia) -- C:\WINDOWS\System32\drivers\ccdcmb.sys -- (nmwcd [On_Demand | Stopped]) DRV - [2008-09-15 07:56:24 | 00,022,016 | ---- | M] (Nokia) -- C:\WINDOWS\System32\drivers\ccdcmbo.sys -- (nmwcdc [On_Demand | Stopped]) DRV - [2008-07-01 19:40:06 | 00,023,217 | ---- | M] (INCA Internet Co., Ltd.) -- D:\Gry\Lineage 2\Gracia 2\Lineage II\System\npkcrypt.sys -- (npkcrypt [On_Demand | Stopped]) DRV - [2004-08-03 22:29:56 | 01,897,408 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Stopped]) DRV - [2006-10-18 16:31:38 | 00,105,472 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata [Boot | Running]) DRV - [2006-11-27 16:33:50 | 00,058,368 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\DRIVERS\NVENETFD.sys -- (NVENETFD [On_Demand | Running]) DRV - [2006-11-27 16:33:54 | 00,019,968 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\DRIVERS\nvnetbus.sys -- (nvnetbus [On_Demand | Running]) DRV - [2008-08-26 09:26:12 | 00,018,816 | ---- | M] (Nokia) -- C:\WINDOWS\System32\DRIVERS\pccsmcfd.sys -- (pccsmcfd [On_Demand | Stopped]) DRV - [2001-08-17 23:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running]) DRV - [2007-03-08 01:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running]) DRV - [2004-08-03 22:31:34 | 00,020,992 | ---- | M] (Realtek Semiconductor Corporation) -- C:\WINDOWS\System32\DRIVERS\RTL8139.SYS -- (rtl8139 [On_Demand | Stopped]) DRV - [2004-07-17 11:36:38 | 00,027,440 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped]) DRV - [2009-05-11 10:12:24 | 00,028,520 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\DRIVERS\ssmdrv.sys -- (ssmdrv [System | Running]) DRV - [2008-09-15 07:56:24 | 00,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) -- C:\WINDOWS\System32\DRIVERS\usbser_lowerflt.sys -- (upperdev [On_Demand | Stopped]) DRV - [2004-08-03 23:08:44 | 00,025,600 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usbser.sys -- (usbser [On_Demand | Stopped]) DRV - [2008-09-15 07:56:34 | 00,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) -- C:\WINDOWS\System32\DRIVERS\usbser_lowerfltj.sys -- (UsbserFilt [On_Demand | Stopped]) DRV - [2006-02-23 05:38:32 | 00,009,728 | R--- | M] (VIA Technologies, Inc.) -- C:\WINDOWS\system32\DRIVERS\videX32.sys -- (videX32 [Boot | Running]) DRV - [2006-02-23 05:39:06 | 00,011,264 | R--- | M] (VIA Technologies,Inc) -- C:\WINDOWS\system32\DRIVERS\xfilt.sys -- (xfilt [Boot | Running]) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://users.iptelecom.net.ua/~codecs/ IE - URLSearchHook: {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Neostrada TP\SearchPageURL.dll () IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009-04-07 00:12:25 | 00,000,000 | ---D | M] O1 HOSTS File: (861 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: a następnie O1 - Hosts: komentarze (takie jak te) można wstawiać w poszczególnych O1 - Hosts: oznaczając je symbolem '#'. O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 85.187.181.253 l2authd.lineage2.com O1 - Hosts: 85.187.181.253 nProtect.lineage2.com O1 - Hosts: 127.0.0.1 microsoft O1 - Hosts: 192.168.0.1 google.com O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll (BitComet) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\ETcall.exe () O4 - HKLM..\Run: [Internet Connection Wizard Setup Tool] C:\Program Files\Internet Explorer\Connection Wizard\icwsetup.exe () O4 - HKLM..\Run: [SpeedTouch USB Diagnostics] C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe (THOMSON Telecom Belgium) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [sysgif32] C:\WINDOWS\Temp\wpv641253178221.exe (Microsoft Corporation) O4 - HKLM..\Run: [WooCnxMon] C:\Program Files\Neostrada TP\CnxMon.exe () O4 - HKLM..\Run: [WOOTASKBARICON] C:\Program Files\Neostrada TP\TaskBarIcon.exe (France Télécom R&D) O4 - HKLM..\Run: [WOOWATCH] C:\Program Files\Neostrada TP\Watch.exe (France Télécom R&D) O4 - HKLM..\RunOnce: [AAW] C:\Program Files\Lavasoft\Ad-Aware SE Personal\Ad-Aware.exe (Lavasoft Sweden) O4 - Startup: C:\Documents and Settings\tonyww44\Menu Start\Programy\Autostart\ikowin32.exe (Microsoft Corporation) O4 - Startup: C:\Documents and Settings\tonyww44\Menu Start\Programy\Autostart\rncsys32.exe (Vxdavuu Vytlumognup) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Pobierz wszystkie VIdeo za pomocą BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com) O8 - Extra context menu item: Pobierz wszystko za pomocą BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com) O8 - Extra context menu item: Pobierz za pomocą BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com) O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll (BitComet) O9 - Extra Button: Zaznaczanie HP Smart - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) O9 - Extra Button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-1_4_0_03-win.cab (Java Plug-in 1.4.0_03) O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\sdra64.exe) - C:\WINDOWS\System32\sdra64.exe [FILE handle not seen by OS] O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\Ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-04-06 22:25:51 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2009-07-06 17:02:37 | 00,000,055 | RHS- | M] () - C:\autorun.inf -- [ NTFS ] O32 - Unable to obtain root file information for disk D:\ O33 - MountPoints2\{7791f8c5-9c52-11de-96d6-000e50b2832c}\Shell\AutoRun\command - "" = F:\RECYCLER32\dmgr.exe -- File not found O33 - MountPoints2\{7791f8c5-9c52-11de-96d6-000e50b2832c}\Shell\open\command - "" = F:\RECYCLER32\dmgr.exe -- File not found O33 - MountPoints2\{a6904674-22f4-11de-9c55-806d6172696f}\Shell\AutoRun\command - "" = 2nuk.com O33 - MountPoints2\{a6904674-22f4-11de-9c55-806d6172696f}\Shell\open\Command - "" = 2nuk.com O33 - MountPoints2\{d93604bc-8b27-11de-96b6-000e50b2832c}\Shell - "" = AutoRun O33 - MountPoints2\{d93604bc-8b27-11de-96b6-000e50b2832c}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found O33 - MountPoints2\{d93604be-8b27-11de-96b6-000e50b2832c}\Shell\AutoRun\command - "" = F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe -- File not found O33 - MountPoints2\{d93604be-8b27-11de-96b6-000e50b2832c}\Shell\open\command - "" = F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe -- File not found O33 - MountPoints2\{e816d1f4-6644-11de-861b-806d6172696f}\Shell\AutoRun\command - "" = E:\2nuk.com -- File not found O33 - MountPoints2\{e816d1f4-6644-11de-861b-806d6172696f}\Shell\open\Command - "" = E:\2nuk.com -- File not found O33 - MountPoints2\{e816d1f5-6644-11de-861b-806d6172696f}\Shell\AutoRun\command - "" = G:\2nuk.com -- File not found O33 - MountPoints2\{e816d1f5-6644-11de-861b-806d6172696f}\Shell\open\Command - "" = G:\2nuk.com -- File not found O33 - MountPoints2\E\Shell - "" = AutoRun O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\Run.exe -- File not found O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - File not found [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2009-09-28 18:45:30 | 00,000,000 | ---D | C] -- C:\Program Files\trend micro [2009-09-28 18:45:29 | 00,000,000 | ---D | C] -- C:\rsit [2009-09-28 16:46:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\tonyww44\Dane aplikacji\Lavasoft [2009-09-28 16:46:08 | 00,000,841 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Ad-Aware SE Personal.lnk [2009-09-28 16:46:07 | 00,000,000 | ---D | C] -- C:\Program Files\Lavasoft [2009-09-26 15:53:40 | 00,000,000 | ---D | C] -- C:\Downloads [2009-09-26 15:53:08 | 00,000,722 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\BitComet.lnk [2009-09-26 15:53:05 | 00,000,000 | ---D | C] -- C:\Program Files\BitComet [2009-09-24 20:57:45 | 00,000,027 | ---- | C] () -- C:\Documents and Settings\tonyww44\Pulpit\sledzik.css [2009-09-21 17:27:03 | 00,000,726 | ---- | C] () -- C:\Documents and Settings\tonyww44\Pulpit\Counter Strike 1.6 Non Steam.lnk [2009-09-21 17:14:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\tonyww44\Moje dokumenty\Freedom Fighters [2009-09-19 12:22:34 | 00,000,000 | ---D | C] -- C:\Documents and Settings\tonyww44\Moje dokumenty\Dane gry Powrót Króla tm [2009-09-05 13:12:49 | 00,000,000 | ---D | C] -- C:\Documents and Settings\tonyww44\Moje dokumenty\CelebrityDeathmatch [2009-08-02 04:27:41 | 00,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.INI [2009-07-06 16:50:26 | 00,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI [2009-06-30 15:36:10 | 00,093,056 | ---- | C] () -- C:\WINDOWS\System32\drivers\e7225b4f.sys [2009-04-27 22:10:33 | 00,000,816 | ---- | C] () -- C:\WINDOWS\System32\l2host.ini [2009-04-13 03:19:54 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2009-04-07 00:31:00 | 00,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009-04-07 00:30:55 | 00,755,027 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2009-04-07 00:30:55 | 00,159,839 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009-04-07 00:30:53 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2009-04-07 00:30:51 | 00,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009-04-07 00:30:51 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009-04-06 22:56:17 | 00,005,606 | ---- | C] () -- C:\WINDOWS\System32\stci.dll [2009-04-06 22:55:42 | 00,041,068 | ---- | C] () -- C:\WINDOWS\System32\ActPanel.dll [2009-04-06 22:32:19 | 00,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys [2009-04-06 22:32:18 | 00,019,633 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2009-04-06 22:32:11 | 00,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2004-08-04 00:44:00 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2004-07-17 11:36:38 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2001-07-22 00:16:20 | 00,000,512 | ---- | C] () -- C:\WINDOWS\win.ini [2001-07-22 00:15:52 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [1 C:\WINDOWS\System32\*.tmp files] [3 C:\WINDOWS\*.tmp files] [2009-09-28 18:00:00 | 00,000,290 | -H-- | M] () -- C:\WINDOWS\tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job [2009-09-28 17:47:31 | 00,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2009-09-28 17:02:04 | 00,099,328 | ---- | M] () -- C:\Documents and Settings\tonyww44\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-09-28 16:46:08 | 00,000,841 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Ad-Aware SE Personal.lnk [2009-09-28 16:43:16 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-09-28 16:43:11 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-09-28 16:42:01 | 04,236,016 | -H-- | M] () -- C:\Documents and Settings\tonyww44\Ustawienia lokalne\Dane aplikacji\IconCache.db [2009-09-26 15:53:08 | 00,000,722 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\BitComet.lnk [2009-09-24 20:57:45 | 00,000,027 | ---- | M] () -- C:\Documents and Settings\tonyww44\Pulpit\sledzik.css [2009-09-24 11:15:31 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009-09-21 17:27:58 | 00,000,726 | ---- | M] () -- C:\Documents and Settings\tonyww44\Pulpit\Counter Strike 1.6 Non Steam.lnk [2009-09-04 00:05:43 | 00,251,595 | ---- | M] () -- C:\_crash.dmp [2009-09-03 15:51:15 | 00,000,592 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Opera.lnk [2009-09-03 00:13:16 | 00,000,038 | ---- | M] () -- C:\WINDOWS\avisplitter.INI [2009-09-01 03:41:54 | 00,000,512 | ---- | M] () -- C:\WINDOWS\win.ini [2009-09-01 03:41:54 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2009-09-01 03:41:54 | 00,000,223 | RHS- | M] () -- C:\boot.ini < End of report >

**Posty:** 18165 · przez **wojtas** 28 Wrz 2009, 20:41

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O4 - HKLM..\Run: [sysgif32] C:\WINDOWS\Temp\wpv641253178221.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\tonyww44\Menu Start\Programy\Autostart\ikowin32.exe (Microsoft Corporation)
O4 - Startup: C:\Documents and Settings\tonyww44\Menu Start\Programy\Autostart\rncsys32.exe (Vxdavuu Vytlumognup)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\sdra64.exe) - C:\WINDOWS\System32\sdra64.exe [FILE handle not seen by OS]
O32 - AutoRun File - [2009-07-06 17:02:37 | 00,000,055 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O32 - Unable to obtain root file information for disk D:\
O33 - MountPoints2\{7791f8c5-9c52-11de-96d6-000e50b2832c}\Shell\AutoRun\command - "" = F:\RECYCLER32\dmgr.exe -- File not found
O33 - MountPoints2\{7791f8c5-9c52-11de-96d6-000e50b2832c}\Shell\open\command - "" = F:\RECYCLER32\dmgr.exe -- File not found
O33 - MountPoints2\{a6904674-22f4-11de-9c55-806d6172696f}\Shell\AutoRun\command - "" = 2nuk.com
O33 - MountPoints2\{a6904674-22f4-11de-9c55-806d6172696f}\Shell\open\Command - "" = 2nuk.com
O33 - MountPoints2\{d93604bc-8b27-11de-96b6-000e50b2832c}\Shell - "" = AutoRun
O33 - MountPoints2\{d93604bc-8b27-11de-96b6-000e50b2832c}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -- File not found
O33 - MountPoints2\{d93604be-8b27-11de-96b6-000e50b2832c}\Shell\AutoRun\command - "" = F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe -- File not found
O33 - MountPoints2\{d93604be-8b27-11de-96b6-000e50b2832c}\Shell\open\command - "" = F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe -- File not found
O33 - MountPoints2\{e816d1f4-6644-11de-861b-806d6172696f}\Shell\AutoRun\command - "" = E:\2nuk.com -- File not found
O33 - MountPoints2\{e816d1f4-6644-11de-861b-806d6172696f}\Shell\open\Command - "" = E:\2nuk.com -- File not found
O33 - MountPoints2\{e816d1f5-6644-11de-861b-806d6172696f}\Shell\AutoRun\command - "" = G:\2nuk.com -- File not found
O33 - MountPoints2\{e816d1f5-6644-11de-861b-806d6172696f}\Shell\open\Command - "" = G:\2nuk.com -- File not found

:Files
C:\WINDOWS\System32\drivers\e7225b4f.sys
C:\WINDOWS\tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db1b3e60-05ac-11de-a5d3-00001cd72a97}]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .

Następnie uruchamiasz OTL z opcją Run Scan. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia kompa

**Posty:** 33 · przez **tegie04** 28 Wrz 2009, 23:35

=> raport z czyszczenia kompa

Kod: Zaznacz wszystko: All processes killed ========== OTL ========== Process explorer.exe killed successfully! Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\sysgif32 deleted successfully. C:\WINDOWS\Temp\wpv641253178221.exe moved successfully. C:\Documents and Settings\tonyww44\Menu Start\Programy\Autostart\ikowin32.exe moved successfully. C:\Documents and Settings\tonyww44\Menu Start\Programy\Autostart\rncsys32.exe moved successfully. Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\UserInit:C:\WINDOWS\system32\sdra64.exe deleted successfully. File move failed. C:\WINDOWS\System32\sdra64.exe scheduled to be moved on reboot. C:\autorun.inf moved successfully. File not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7791f8c5-9c52-11de-96d6-000e50b2832c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7791f8c5-9c52-11de-96d6-000e50b2832c}\ not found. File F:\RECYCLER32\dmgr.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{7791f8c5-9c52-11de-96d6-000e50b2832c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{7791f8c5-9c52-11de-96d6-000e50b2832c}\ not found. File F:\RECYCLER32\dmgr.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a6904674-22f4-11de-9c55-806d6172696f}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a6904674-22f4-11de-9c55-806d6172696f}\ not found. File 2nuk.com not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{a6904674-22f4-11de-9c55-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{a6904674-22f4-11de-9c55-806d6172696f}\ not found. File 2nuk.com not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d93604bc-8b27-11de-96b6-000e50b2832c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d93604bc-8b27-11de-96b6-000e50b2832c}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d93604bc-8b27-11de-96b6-000e50b2832c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d93604bc-8b27-11de-96b6-000e50b2832c}\ not found. File F:\LaunchU3.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d93604be-8b27-11de-96b6-000e50b2832c}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d93604be-8b27-11de-96b6-000e50b2832c}\ not found. File F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{d93604be-8b27-11de-96b6-000e50b2832c}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{d93604be-8b27-11de-96b6-000e50b2832c}\ not found. File F:\RECYCLER\S-1-5-21-1482476501-1644491937-682003330-1013\ise32.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e816d1f4-6644-11de-861b-806d6172696f}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e816d1f4-6644-11de-861b-806d6172696f}\ not found. File E:\2nuk.com not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e816d1f4-6644-11de-861b-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e816d1f4-6644-11de-861b-806d6172696f}\ not found. File E:\2nuk.com not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e816d1f5-6644-11de-861b-806d6172696f}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e816d1f5-6644-11de-861b-806d6172696f}\ not found. File G:\2nuk.com not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{e816d1f5-6644-11de-861b-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e816d1f5-6644-11de-861b-806d6172696f}\ not found. File G:\2nuk.com not found. ========== FILES ========== C:\WINDOWS\System32\drivers\e7225b4f.sys moved successfully. C:\WINDOWS\tasks\{783AF354-B514-42d6-970E-3E8BF0A5279C}.job moved successfully. ========== REGISTRY ========== Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db1b3e60-05ac-11de-a5d3-00001cd72a97}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{db1b3e60-05ac-11de-a5d3-00001cd72a97}\ not found. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"SuperHidden"|dword:00000001 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"Hidden"|dword:00000001 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"ShowSuperHidden"|dword:00000001 /E : value set successfully! HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\\"CheckedValue"|dword:00000001 /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden\ deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden\\@|"" /E : value set successfully! ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\NetworkService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33170 bytes User: tonyww44 File delete failed. C:\Documents and Settings\tonyww44\Ustawienia lokalne\Temp\GLC19.tmp scheduled to be deleted on reboot. File delete failed. C:\Documents and Settings\tonyww44\Ustawienia lokalne\Temp\GLK1A.tmp scheduled to be deleted on reboot. ->Temp folder emptied: 992099839 bytes File delete failed. C:\Documents and Settings\tonyww44\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 16182715 bytes ->Java cache emptied: 7622225 bytes ->Opera cache emptied: 28244413 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 2114584 bytes %systemroot%\System32 .tmp files removed: 2596 bytes File delete failed. C:\WINDOWS\temp\Perflib_Perfdata_790.dat scheduled to be deleted on reboot. File delete failed. C:\WINDOWS\temp\wpv641253178221.exe scheduled to be deleted on reboot. Windows Temp folder emptied: 1994120 bytes RecycleBin emptied: 185343296 bytes Total Files Cleaned = 1176,58 mb OTL by OldTimer - Version 3.0.16.0 log created on 09282009_232726 Files\Folders moved on Reboot... File move failed. C:\WINDOWS\System32\sdra64.exe scheduled to be moved on reboot. C:\Documents and Settings\tonyww44\Ustawienia lokalne\Temp\GLC19.tmp moved successfully. File\Folder C:\Documents and Settings\tonyww44\Ustawienia lokalne\Temp\GLK1A.tmp not found! File\Folder C:\WINDOWS\temp\Perflib_Perfdata_790.dat not found! C:\WINDOWS\temp\wpv641253178221.exe moved successfully. Registry entries deleted on Reboot...

=> nowy log

Kod: Zaznacz wszystko: OTL logfile created on: 2009-09-28 23:32:48 - Run 2 OTL by OldTimer - Version 3.0.16.0 Folder = D:\różne\instalki Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1023,48 Mb Total Physical Memory | 544,77 Mb Available Physical Memory | 53,23% Memory free 2,40 Gb Paging File | 1,92 Gb Available in Paging File | 79,90% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 19,53 Gb Total Space | 2,24 Gb Free Space | 11,45% Space Free | Partition Type: NTFS Drive D: | 129,51 Gb Total Space | 18,67 Gb Free Space | 14,41% Space Free | Partition Type: NTFS E: Drive not present or media not loaded F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: TET Current User Name: tonyww44 Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2009-02-25 23:27:41 | 00,602,112 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe PRC - [2009-02-25 23:27:41 | 00,602,112 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe PRC - [2009-05-13 16:48:22 | 00,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe PRC - [2004-08-04 00:44:20 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE PRC - [2009-05-11 10:15:50 | 00,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe PRC - [2009-04-07 00:12:24 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe PRC - [2005-01-28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wdfmgr.exe PRC - [2009-06-20 13:26:55 | 00,065,024 | ---- | M] () -- C:\WINDOWS\System32\18869.exe PRC - [2004-08-04 00:44:26 | 00,070,144 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\notepad.exe PRC - [2003-10-16 18:07:10 | 00,024,576 | ---- | M] () -- C:\Program Files\Neostrada TP\CnxMon.exe PRC - [2004-01-26 11:38:38 | 00,866,816 | ---- | M] (THOMSON Telecom Belgium) -- C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe PRC - [2003-10-16 18:07:12 | 00,053,248 | ---- | M] (France Télécom R&D) -- C:\Program Files\Neostrada TP\TaskBarIcon.exe PRC - [2009-03-02 13:08:47 | 00,209,153 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe PRC - [2008-12-18 14:32:52 | 00,049,152 | ---- | M] (Advanced Micro Devices Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe PRC - [2007-01-03 20:38:44 | 00,207,680 | ---- | M] () -- C:\Program Files\Gigabyte\ET5\GUI.exe PRC - [2008-12-18 13:19:44 | 00,049,152 | ---- | M] (ATI Technologies Inc.) -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe PRC - [2008-12-29 12:40:30 | 00,687,560 | ---- | M] (DT Soft Ltd) -- C:\Program Files\DAEMON Tools Lite\daemon.exe PRC - [2009-08-28 13:13:02 | 00,832,808 | ---- | M] (Opera Software) -- C:\Program Files\Opera\Opera.exe PRC - [2003-10-16 18:07:12 | 00,626,688 | ---- | M] (France Télécom R&D) -- C:\Program Files\Neostrada TP\NeostradaTP.exe PRC - [2003-10-16 18:07:10 | 00,200,704 | ---- | M] (France Télécom R&D) -- C:\Program Files\Neostrada TP\ComComp.exe PRC - [2004-08-04 00:44:30 | 00,218,112 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wbem\wmiprvse.exe PRC - [2003-10-16 18:07:12 | 00,020,480 | ---- | M] (France Télécom R&D) -- C:\Program Files\Neostrada TP\Watch.exe PRC - [2009-09-28 18:51:02 | 00,518,144 | ---- | M] (OldTimer Tools) -- D:\różne\instalki\OTL.exe [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - [2009-05-13 16:48:22 | 00,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService [Auto | Running]) SRV - [2009-05-11 10:15:50 | 00,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService [Auto | Running]) SRV - [2005-09-23 07:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped]) SRV - [2009-02-25 23:27:41 | 00,602,112 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\Ati2evxx.exe -- (Ati HotKey Poller [Auto | Running]) SRV - [2009-02-25 15:15:00 | 00,593,920 | ---- | M] () -- C:\WINDOWS\System32\ati2sgag.exe -- (ATI Smart [Auto | Stopped]) SRV - [2005-09-23 07:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) SRV - [2004-08-04 00:44:08 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running]) SRV - [2007-11-06 21:16:54 | 00,217,088 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\Digital Imaging\bin\hpqcxs08.dll -- (hpqcxs08 [On_Demand | Running]) SRV - [2007-11-06 21:16:54 | 00,139,264 | ---- | M] (Hewlett-Packard Co.) -- C:\Program Files\HP\Digital Imaging\bin\hpqddsvc.dll -- (hpqddsvc [Auto | Running]) SRV - [2009-06-20 13:26:55 | 00,065,024 | ---- | M] () -- C:\WINDOWS\System32\18869.exe -- (ipfw [Auto | Running]) SRV - [2009-04-07 00:12:24 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running]) SRV - [2006-11-08 16:35:36 | 00,043,520 | ---- | M] (Hewlett-Packard) -- C:\WINDOWS\System32\HPZinw12.dll -- (Net Driver HPZ12 [Auto | Running]) SRV - [2006-10-26 19:49:34 | 00,441,136 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE -- (odserv [On_Demand | Stopped]) SRV - [2006-10-26 13:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose [On_Demand | Stopped]) SRV - [2006-11-08 16:35:38 | 00,053,248 | ---- | M] (Hewlett-Packard) -- C:\WINDOWS\System32\HPZipm12.dll -- (Pml Driver HPZ12 [Auto | Running]) SRV - [2008-11-11 09:38:06 | 00,620,544 | ---- | M] (Nokia.) -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer [On_Demand | Stopped]) SRV - [2005-01-28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\wdfmgr.exe -- (UMWdf [Auto | Running]) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - [2003-12-08 11:53:48 | 00,053,600 | ---- | M] (THOMSON) -- C:\WINDOWS\System32\DRIVERS\alcan5wn.sys -- (alcan5wn [On_Demand | Running]) DRV - [2003-12-08 11:53:46 | 00,070,688 | ---- | M] (THOMSON) -- C:\WINDOWS\System32\DRIVERS\alcaudsl.sys -- (alcaudsl [On_Demand | Running]) DRV - [2006-07-01 23:32:26 | 00,043,520 | ---- | M] (Advanced Micro Devices) -- C:\WINDOWS\System32\DRIVERS\AmdK8.sys -- (AmdK8 [System | Running]) DRV - [2009-02-26 00:58:57 | 03,565,568 | ---- | M] (ATI Technologies Inc.) -- C:\WINDOWS\System32\DRIVERS\ati2mtag.sys -- (ati2mtag [On_Demand | Running]) DRV - [2009-02-13 12:35:05 | 00,011,608 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio [System | Running]) DRV - [2009-03-24 16:08:22 | 00,055,640 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\DRIVERS\avgntflt.sys -- (avgntflt [Auto | Running]) DRV - [2009-03-30 10:33:07 | 00,096,104 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\DRIVERS\avipbb.sys -- (avipbb [System | Running]) DRV - [2006-11-24 14:47:50 | 00,040,136 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\Drivers\ET5Drv.sys -- (ET5Drv [On_Demand | Running]) DRV - [2009-07-06 17:56:13 | 00,016,608 | ---- | M] (Windows (R) 2000 DDK provider) -- C:\WINDOWS\gdrv.sys -- (gdrv [On_Demand | Stopped]) DRV - [2005-01-07 17:07:18 | 00,138,752 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\System32\DRIVERS\HDAudBus.sys -- (HDAudBus [On_Demand | Running]) DRV - [2007-10-30 11:25:53 | 00,049,920 | R--- | M] (HP) -- C:\WINDOWS\System32\DRIVERS\HPZid412.sys -- (HPZid412 [On_Demand | Stopped]) DRV - [2007-10-30 11:25:54 | 00,016,496 | R--- | M] (HP) -- C:\WINDOWS\System32\DRIVERS\HPZipr12.sys -- (HPZipr12 [On_Demand | Stopped]) DRV - [2007-10-30 11:25:55 | 00,021,568 | R--- | M] (HP) -- C:\WINDOWS\System32\DRIVERS\HPZius12.sys -- (HPZius12 [On_Demand | Stopped]) DRV - [2008-12-11 11:24:20 | 04,959,232 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\System32\drivers\RtkHDAud.sys -- (IntcAzAudAddService [On_Demand | Running]) DRV - [2009-05-11 13:04:59 | 00,026,240 | ---- | M] (WIPFW Project.) -- C:\WINDOWS\System32\DRIVERS\ip_fw.sys -- (ip_fw [On_Demand | Running]) DRV - [2004-08-13 04:56:20 | 00,005,810 | R--- | M] () -- C:\WINDOWS\System32\DRIVERS\ASACPI.sys -- (MTsensor [On_Demand | Stopped]) DRV - [2008-09-15 07:56:24 | 00,017,664 | ---- | M] (Nokia) -- C:\WINDOWS\System32\drivers\ccdcmb.sys -- (nmwcd [On_Demand | Stopped]) DRV - [2008-09-15 07:56:24 | 00,022,016 | ---- | M] (Nokia) -- C:\WINDOWS\System32\drivers\ccdcmbo.sys -- (nmwcdc [On_Demand | Stopped]) DRV - [2008-07-01 19:40:06 | 00,023,217 | ---- | M] (INCA Internet Co., Ltd.) -- D:\Gry\Lineage 2\Gracia 2\Lineage II\System\npkcrypt.sys -- (npkcrypt [On_Demand | Stopped]) DRV - [2004-08-03 22:29:56 | 01,897,408 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Stopped]) DRV - [2006-10-18 16:31:38 | 00,105,472 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nvata.sys -- (nvata [Boot | Running]) DRV - [2006-11-27 16:33:50 | 00,058,368 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\DRIVERS\NVENETFD.sys -- (NVENETFD [On_Demand | Running]) DRV - [2006-11-27 16:33:54 | 00,019,968 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\System32\DRIVERS\nvnetbus.sys -- (nvnetbus [On_Demand | Running]) DRV - [2008-08-26 09:26:12 | 00,018,816 | ---- | M] (Nokia) -- C:\WINDOWS\System32\DRIVERS\pccsmcfd.sys -- (pccsmcfd [On_Demand | Stopped]) DRV - [2001-08-17 23:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running]) DRV - [2007-03-08 01:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running]) DRV - [2004-08-03 22:31:34 | 00,020,992 | ---- | M] (Realtek Semiconductor Corporation) -- C:\WINDOWS\System32\DRIVERS\RTL8139.SYS -- (rtl8139 [On_Demand | Stopped]) DRV - [2004-07-17 11:36:38 | 00,027,440 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped]) DRV - [2009-09-28 20:36:39 | 00,717,296 | ---- | M] () -- C:\WINDOWS\System32\Drivers\sptd.sys -- (sptd [Boot | Running]) DRV - [2009-05-11 10:12:24 | 00,028,520 | ---- | M] (Avira GmbH) -- C:\WINDOWS\System32\DRIVERS\ssmdrv.sys -- (ssmdrv [System | Running]) DRV - [2008-09-15 07:56:24 | 00,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) -- C:\WINDOWS\System32\DRIVERS\usbser_lowerflt.sys -- (upperdev [On_Demand | Stopped]) DRV - [2004-08-03 23:08:44 | 00,025,600 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\drivers\usbser.sys -- (usbser [On_Demand | Stopped]) DRV - [2008-09-15 07:56:34 | 00,008,064 | ---- | M] (Windows (R) Codename Longhorn DDK provider) -- C:\WINDOWS\System32\DRIVERS\usbser_lowerfltj.sys -- (UsbserFilt [On_Demand | Stopped]) DRV - [2006-02-23 05:38:32 | 00,009,728 | R--- | M] (VIA Technologies, Inc.) -- C:\WINDOWS\system32\DRIVERS\videX32.sys -- (videX32 [Boot | Running]) DRV - [2006-02-23 05:39:06 | 00,011,264 | R--- | M] (VIA Technologies,Inc) -- C:\WINDOWS\system32\DRIVERS\xfilt.sys -- (xfilt [Boot | Running]) DRV - [2007-01-12 18:34:48 | 00,019,776 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\Program Files\Gigabyte\ET5\markfun.w32 -- (MarkFun_NT [On_Demand | Running]) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&pver=6&ar=msnhome IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://users.iptelecom.net.ua/~codecs/ IE - URLSearchHook: {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\Neostrada TP\SearchPageURL.dll () IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Firefox\extensions\\jqs@sun.com: C:\Program Files\Java\jre6\lib\deploy\jqs\ff [2009-04-07 00:12:25 | 00,000,000 | ---D | M] O1 HOSTS File: (861 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O1 - Hosts: a następnie O1 - Hosts: komentarze (takie jak te) można wstawiać w poszczególnych O1 - Hosts: oznaczając je symbolem '#'. O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 85.187.181.253 l2authd.lineage2.com O1 - Hosts: 85.187.181.253 nProtect.lineage2.com O1 - Hosts: 127.0.0.1 microsoft O1 - Hosts: 192.168.0.1 google.com O2 - BHO: (HP Print Enhancer) - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll (Hewlett-Packard Co.) O2 - BHO: (Adobe PDF Link Helper) - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated) O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll (BitComet) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O2 - BHO: (HP Smart BHO Class) - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [EasyTuneV] C:\Program Files\Gigabyte\ET5\ETcall.exe () O4 - HKLM..\Run: [Internet Connection Wizard Setup Tool] C:\Program Files\Internet Explorer\Connection Wizard\icwsetup.exe () O4 - HKLM..\Run: [SpeedTouch USB Diagnostics] C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe (THOMSON Telecom Belgium) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [WooCnxMon] C:\Program Files\Neostrada TP\CnxMon.exe () O4 - HKLM..\Run: [WOOTASKBARICON] C:\Program Files\Neostrada TP\TaskBarIcon.exe (France Télécom R&D) O4 - HKLM..\Run: [WOOWATCH] C:\Program Files\Neostrada TP\Watch.exe (France Télécom R&D) O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\daemon.exe (DT Soft Ltd) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O8 - Extra context menu item: Pobierz wszystkie VIdeo za pomocą BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com) O8 - Extra context menu item: Pobierz wszystko za pomocą BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com) O8 - Extra context menu item: Pobierz za pomocą BitComet - C:\Program Files\BitComet\BitComet.exe (www.BitComet.com) O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files\BitComet\tools\BitCometBHO_1.3.7.16.dll (BitComet) O9 - Extra Button: Zaznaczanie HP Smart - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) O9 - Extra Button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation) O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\WINDOWS\System32\rsvpsp.dll (Microsoft Corporation) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-1_4_0_03-win.cab (Java Plug-in 1.4.0_03) O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_05-windows-i586.cab (Java Plug-in 1.6.0_05) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp - No CLSID value found O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp - No CLSID value found O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\sdra64.exe) - C:\WINDOWS\System32\sdra64.exe () O20 - Winlogon\Notify\AtiExtEvent: DllName - Ati2evxx.dll - C:\WINDOWS\System32\Ati2evxx.dll (ATI Technologies Inc.) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-04-06 22:25:51 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - Unable to obtain root file information for disk D:\ O33 - MountPoints2\E\Shell - "" = AutoRun O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\Run.exe -- File not found O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - File not found [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2009-09-28 23:32:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\tonyww44\Dane aplikacji\DAEMON Tools Pro [2009-09-28 23:32:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\tonyww44\Dane aplikacji\DAEMON Tools [2009-09-28 23:30:52 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite [2009-09-28 23:30:50 | 00,001,613 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\DAEMON Tools Lite.lnk [2009-09-28 23:30:47 | 00,000,000 | ---D | C] -- C:\Program Files\DAEMON Tools Lite [2009-09-28 20:36:38 | 00,717,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\sptd.sys [2009-09-28 20:36:32 | 00,000,000 | ---D | C] -- C:\Documents and Settings\tonyww44\Dane aplikacji\DAEMON Tools Lite [2009-09-28 18:45:30 | 00,000,000 | ---D | C] -- C:\Program Files\trend micro [2009-09-28 18:45:29 | 00,000,000 | ---D | C] -- C:\rsit [2009-09-28 16:46:25 | 00,000,000 | ---D | C] -- C:\Documents and Settings\tonyww44\Dane aplikacji\Lavasoft [2009-09-28 16:46:08 | 00,000,841 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Ad-Aware SE Personal.lnk [2009-09-28 16:46:07 | 00,000,000 | ---D | C] -- C:\Program Files\Lavasoft [2009-09-26 15:53:40 | 00,000,000 | ---D | C] -- C:\Downloads [2009-09-26 15:53:08 | 00,000,722 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\BitComet.lnk [2009-09-26 15:53:05 | 00,000,000 | ---D | C] -- C:\Program Files\BitComet [2009-09-24 20:57:45 | 00,000,027 | ---- | C] () -- C:\Documents and Settings\tonyww44\Pulpit\sledzik.css [2009-09-21 17:27:03 | 00,000,726 | ---- | C] () -- C:\Documents and Settings\tonyww44\Pulpit\Counter Strike 1.6 Non Steam.lnk [2009-09-21 17:14:08 | 00,000,000 | ---D | C] -- C:\Documents and Settings\tonyww44\Moje dokumenty\Freedom Fighters [2009-09-19 12:22:34 | 00,000,000 | ---D | C] -- C:\Documents and Settings\tonyww44\Moje dokumenty\Dane gry Powrót Króla tm [2009-09-07 00:57:40 | 00,000,000 | -HSD | C] -- C:\WINDOWS\System32\lowsec [2009-09-05 13:12:49 | 00,000,000 | ---D | C] -- C:\Documents and Settings\tonyww44\Moje dokumenty\CelebrityDeathmatch [2009-08-02 04:27:41 | 00,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.INI [2009-07-06 16:50:26 | 00,000,010 | ---- | C] () -- C:\WINDOWS\WININIT.INI [2009-04-27 22:10:33 | 00,000,816 | ---- | C] () -- C:\WINDOWS\System32\l2host.ini [2009-04-13 03:19:54 | 00,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2009-04-07 00:31:00 | 00,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009-04-07 00:30:55 | 00,755,027 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2009-04-07 00:30:55 | 00,159,839 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009-04-07 00:30:53 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2009-04-07 00:30:51 | 00,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009-04-07 00:30:51 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009-04-06 22:56:17 | 00,005,606 | ---- | C] () -- C:\WINDOWS\System32\stci.dll [2009-04-06 22:55:42 | 00,041,068 | ---- | C] () -- C:\WINDOWS\System32\ActPanel.dll [2009-04-06 22:32:19 | 00,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys [2009-04-06 22:32:18 | 00,019,633 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini [2009-04-06 22:32:11 | 00,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS [2004-08-04 00:44:00 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2004-07-17 11:36:38 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2001-07-22 00:16:20 | 00,000,512 | ---- | C] () -- C:\WINDOWS\win.ini [2001-07-22 00:15:52 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2009-09-28 23:30:50 | 00,001,613 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\DAEMON Tools Lite.lnk [2009-09-28 23:29:37 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-09-28 23:29:34 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-09-28 20:36:39 | 00,717,296 | ---- | M] () -- C:\WINDOWS\System32\drivers\sptd.sys [2009-09-28 17:47:31 | 00,000,116 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini [2009-09-28 17:02:04 | 00,099,328 | ---- | M] () -- C:\Documents and Settings\tonyww44\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-09-28 16:46:08 | 00,000,841 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Ad-Aware SE Personal.lnk [2009-09-28 16:42:01 | 04,236,016 | -H-- | M] () -- C:\Documents and Settings\tonyww44\Ustawienia lokalne\Dane aplikacji\IconCache.db [2009-09-26 15:53:08 | 00,000,722 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\BitComet.lnk [2009-09-24 20:57:45 | 00,000,027 | ---- | M] () -- C:\Documents and Settings\tonyww44\Pulpit\sledzik.css [2009-09-24 11:15:31 | 00,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009-09-21 17:27:58 | 00,000,726 | ---- | M] () -- C:\Documents and Settings\tonyww44\Pulpit\Counter Strike 1.6 Non Steam.lnk [2009-09-04 00:05:43 | 00,251,595 | ---- | M] () -- C:\_crash.dmp [2009-09-03 15:51:15 | 00,000,592 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Opera.lnk [2009-09-03 00:13:16 | 00,000,038 | ---- | M] () -- C:\WINDOWS\avisplitter.INI [2009-09-01 03:41:54 | 00,000,512 | ---- | M] () -- C:\WINDOWS\win.ini [2009-09-01 03:41:54 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2009-09-01 03:41:54 | 00,000,223 | RHS- | M] () -- C:\boot.ini < End of report >

**Posty:** 18165 · przez **wojtas** 29 Wrz 2009, 21:27

Daj loga z combofixa ale zainstaluj wraz z nim konsolę odzyskiwania ( instrukcja programu )

**Posty:** 33 · przez **tegie04** 29 Wrz 2009, 23:36

=> log z combofixa:

Kod: Zaznacz wszystko: ComboFix 09-09-28.01 - tonyww44 2009-09-29 23:17.1.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.1023.714 [GMT 2:00] Uruchomiony z: c:\documents and settings\tonyww44\Pulpit\ComboFix.exe AV: AntiVir Desktop *On-access scanning enabled* (Outdated) {AD166499-45F9-482A-A743-FDD3350758C7} * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\documents and settings\tonyww44\Dane aplikacji\wiaserva.log c:\program files\Internet Explorer\Connection Wizard\icwsetup.exe c:\windows\system32\18869.exe c:\windows\system32\Drivers\ip_fw.sys c:\windows\system32\ieuinit.inf c:\windows\system32\lowsec c:\windows\system32\lowsec\local.ds c:\windows\system32\lowsec\user.ds c:\windows\system32\sdra64.exe D:\autorun.inf . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_IPFW -------\Legacy_IP_FW -------\Service_AVPsys -------\Service_ip_fw -------\Service_ipfw ((((((((((((((((((((((((( Pliki utworzone od 2009-08-28 do 2009-09-29 ))))))))))))))))))))))))))))))) . 2009-09-28 21:32 . 2009-09-28 21:32 -------- d-----w- c:\documents and settings\tonyww44\Dane aplikacji\DAEMON Tools Pro 2009-09-28 21:32 . 2009-09-28 21:32 -------- d-----w- c:\documents and settings\tonyww44\Dane aplikacji\DAEMON Tools 2009-09-28 21:30 . 2009-09-28 21:30 -------- d-----w- c:\documents and settings\All Users\Dane aplikacji\DAEMON Tools Lite 2009-09-28 21:30 . 2009-09-28 21:30 -------- d-----w- c:\program files\DAEMON Tools Lite 2009-09-28 18:36 . 2009-09-28 18:36 717296 ----a-w- c:\windows\system32\drivers\sptd.sys 2009-09-28 18:36 . 2009-09-28 22:36 -------- d-----w- c:\documents and settings\tonyww44\Dane aplikacji\DAEMON Tools Lite 2009-09-28 16:45 . 2009-09-28 16:45 -------- d-----w- c:\program files\trend micro 2009-09-28 16:45 . 2009-09-28 16:45 -------- d-----w- C:\rsit 2009-09-28 14:46 . 2009-09-28 14:46 -------- d-----w- c:\documents and settings\tonyww44\Dane aplikacji\Lavasoft 2009-09-28 14:46 . 2009-09-28 14:46 -------- d-----w- c:\program files\Lavasoft 2009-09-26 13:53 . 2009-09-26 13:53 -------- d-----w- C:\Downloads 2009-09-26 13:53 . 2009-09-29 14:31 -------- d-----w- c:\program files\BitComet . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-09-29 21:32 . 2009-04-30 06:22 -------- d-----w- c:\documents and settings\tonyww44\Dane aplikacji\HPAppData 2009-09-29 21:17 . 2009-04-06 20:54 -------- d-----w- c:\program files\Neostrada TP 2009-09-29 19:14 . 2009-04-06 22:23 -------- d-----w- c:\program files\Lineage II 2009-09-14 18:43 . 2009-08-17 17:27 -------- d-----w- c:\documents and settings\tonyww44\Dane aplikacji\U3 2009-09-03 13:51 . 2009-04-06 21:13 -------- d-----w- c:\program files\Opera 2009-08-11 19:34 . 2009-08-11 19:34 23172 ---ha-w- c:\windows\system32\mlfcache.dat 2009-08-05 13:39 . 2009-08-05 13:39 -------- d-----w- c:\program files\Common Files\INCA Shared 2009-07-09 10:24 . 2001-10-26 16:15 77830 ----a-w- c:\windows\system32\perfc015.dat 2009-07-09 10:24 . 2001-10-26 16:15 455052 ----a-w- c:\windows\system32\perfh015.dat 2009-07-06 15:56 . 2009-07-06 20:17 16608 ----a-w- c:\windows\gdrv.sys 2009-07-06 15:33 . 2009-04-06 20:30 27488 ----a-w- c:\documents and settings\tonyww44\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT 2009-07-06 15:08 . 2009-07-06 15:08 0 ----a-w- c:\windows\ativpsrm.bin . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-12-29 687560] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "WooCnxMon"="c:\progra~1\NEOSTR~1\CnxMon.exe" [2003-10-16 24576] "SpeedTouch USB Diagnostics"="c:\program files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816] "WOOWATCH"="c:\progra~1\NEOSTR~1\Watch.exe" [2003-10-16 20480] "WOOTASKBARICON"="c:\progra~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 53248] "avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153] "EasyTuneV"="c:\program files\Gigabyte\ET5\ETcall.exe" [2007-04-26 24576] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-02-25 61440] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\All Users\Application Data\Microsoft\Shortcuts\ icwsetup.exe [2009-8-27 33792] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Application Data^Microsoft^Shortcuts^icwsetup.exe] path=c:\documents and settings\All Users\Application Data\Microsoft\Shortcuts\icwsetup.exe backup=c:\windows\pss\icwsetup.exeCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=c:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^tonyww44^Menu Start^Programy^Autostart^ikowin32.exe] path=c:\documents and settings\tonyww44\Menu Start\Programy\Autostart\ikowin32.exe backup=c:\windows\pss\ikowin32.exeStartup [HKLM\~\startupfolder\C:^Documents and Settings^tonyww44^Menu Start^Programy^Autostart^rncsys32.exe] path=c:\documents and settings\tonyww44\Menu Start\Programy\Autostart\rncsys32.exe backup=c:\windows\pss\rncsys32.exeStartup [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe"= "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "d:\\Gry\\Counter Strike\\hl.exe"= "c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "d:\\różne\\instalki\\mIRC\\mirc.exe"= R0 xfilt;VIA SATA IDE Hot-plug Driver;c:\windows\system32\drivers\xfilt.sys [2009-04-06 11264] R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-06-20 108289] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc . . ------- Skan uzupełniający ------- . uStart Page = hxxp://users.iptelecom.net.ua/~codecs/ IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000 IE: Pobierz wszystkie VIdeo za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddVideo.htm IE: Pobierz wszystko za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddAllLink.htm IE: Pobierz za pomocą BitComet - c:\program files\BitComet\BitComet.exe/AddLink.htm IE: { - c:\program files\Messenger\msmsgs.exe . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-Internet Connection Wizard Setup Tool - c:\program files\Internet Explorer\Connection Wizard\icwsetup.exe ************************************************************************** catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-09-29 23:32 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MarkFun_NT] "ImagePath"="\??\c:\program files\Gigabyte\ET5\markfun.w32" [HKEY_LOCAL_MACHINE\System\ControlSet001\Services\MarkFun_NT] "ImagePath"="\??\c:\program files\Gigabyte\ET5\markfun.w32" . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(736) c:\windows\system32\Ati2evxx.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\ati2evxx.exe c:\program files\Avira\AntiVir Desktop\avguard.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\wdfmgr.exe c:\program files\Neostrada TP\CnxMon.exe c:\program files\Neostrada TP\TaskBarIcon.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe c:\program files\GIGABYTE\ET5\GUI.exe c:\program files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe c:\program files\Internet Explorer\IEXPLORE.EXE c:\program files\HP\Digital Imaging\Smart Web Printing\hpswp_clipbook.exe c:\windows\system32\imapi.exe c:\windows\system32\wbem\wmiapsrv.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2009-09-29 23:34 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-09-29 21:34 Przed: 1 754 640 384 bajtów wolnych Po: 1 665 888 256 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect /usepmtimer 172

**Posty:** 18165 · przez **wojtas** 30 Wrz 2009, 12:54

1.Uruchom OTL z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware (usuń co znajdzie )

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

**Posty:** 33 · przez **tegie04** 30 Wrz 2009, 14:59

zrobiłem wszystko jak w opisie, tylko nie mogę przeskanować kasperskim, bo mi się wiesza IE jak odpalam ale widać już diametralną różnicę po zabiegach z logami...

**Posty:** 18165 · przez **wojtas** 30 Wrz 2009, 19:46

juz powinno byc ok

Autor postu otrzymał pochwałę

**Posty:** 33 · przez **tegie04** 30 Wrz 2009, 20:05

nom i jest, dzięki wielkie już się bałem że tylko format mnie uratuje

Kto jest na forum