. AVG wywala komunikaty o trojanach- Kod: Zaznacz wszystko
OTL Extras logfile created on: 2010-08-06 23:56:06 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Kajtek\Pulpit\Nowy folder
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 71,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 86,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19,53 Gb Total Space | 2,56 Gb Free Space | 13,13% Space Free | Partition Type: NTFS
Drive D: | 19,52 Gb Total Space | 1,13 Gb Free Space | 5,79% Space Free | Partition Type: FAT32
Drive E: | 16,82 Gb Total Space | 6,80 Gb Free Space | 40,43% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 60,54 Gb Total Space | 7,53 Gb Free Space | 12,44% Space Free | Partition Type: NTFS
Drive I: | 255,33 Gb Total Space | 48,30 Gb Free Space | 18,92% Space Free | Partition Type: NTFS
Drive J: | 124,00 Gb Total Space | 35,79 Gb Free Space | 28,86% Space Free | Partition Type: NTFS
Drive K: | 25,89 Gb Total Space | 8,85 Gb Free Space | 34,17% Space Free | Partition Type: NTFS
Computer Name: XXX-E3781CF9A82
Current User Name: Kajtek
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
[color=#E56717]========== Extra Registry (SafeList) ==========[/color]
[color=#E56717]========== File Associations ==========[/color]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)
[color=#E56717]========== Shell Spawning ==========[/color]
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Opera\opera.exe" (Opera Software)
https [open] -- "C:\Program Files\Opera\opera.exe" (Opera Software)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l (Microsoft Corporation)
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[color=#E56717]========== Security Center Settings ==========[/color]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"7407:TCP" = 7407:TCP:*:Enabled:BitComet 7407 TCP
"7407:UDP" = 7407:UDP:*:Enabled:BitComet 7407 UDP
[color=#E56717]========== Authorized Applications List ==========[/color]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\AVG\AVG8\avgemc.exe" = C:\Program Files\AVG\AVG8\avgemc.exe:*:Enabled:avgemc.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\AVG\AVG8\avgupd.exe" = C:\Program Files\AVG\AVG8\avgupd.exe:*:Enabled:avgupd.exe -- (AVG Technologies CZ, s.r.o.)
"C:\Program Files\Nowe Gadu-Gadu\gg.exe" = C:\Program Files\Nowe Gadu-Gadu\gg.exe:*:Enabled:Nowe Gadu-Gadu -- (GG Network S.A.)
"C:\Program Files\Xfire\Xfire.exe" = C:\Program Files\Xfire\Xfire.exe:*:Enabled:Xfire -- (Xfire Inc.)
"C:\Call of Duty 2\CoD2MP_s.exe" = C:\Call of Duty 2\CoD2MP_s.exe:*:Enabled:CoD2MP_s -- ()
"C:\Program Files\BitComet\BitComet.exe" = C:\Program Files\BitComet\BitComet.exe:*:Enabled:BitComet.exe -- File not found
"C:\Program Files\Mozilla Firefox\firefox.exe" = C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)
"E:\Battlefield 1942\BF1942.exe" = E:\Battlefield 1942\BF1942.exe:*:Enabled:BF1942 -- ()
"J:\Call of Duty - World at War\CoDWaW.exe" = J:\Call of Duty - World at War\CoDWaW.exe:*:Enabled:Call of Duty(R): World at War Campaign/Coop -- (Activision Blizzard, Inc.)
"K:\GTA 4\Rockstar Games Social Club\RGSCLauncher.exe" = K:\GTA 4\Rockstar Games Social Club\RGSCLauncher.exe:*:Enabled:Rockstar Games Social Club -- File not found
"K:\GTA 4\Grand Theft Auto IV\LaunchGTAIV.exe" = K:\GTA 4\Grand Theft Auto IV\LaunchGTAIV.exe:*:Enabled:Grand Theft Auto IV -- (Sony DADC Austria AG)
"K:\GTA 4\Grand Theft Auto IV\GTAIV.exe" = K:\GTA 4\Grand Theft Auto IV\GTAIV.exe:*:Enabled:Grand Theft Auto IV -- (Take-Two Interactive Software, Inc.)
"J:\Far Cry 2\bin\FarCry2.exe" = J:\Far Cry 2\bin\FarCry2.exe:*:Enabled:Far Cry 2 -- (Ubisoft Entertainment)
"J:\Far Cry 2\bin\FC2Launcher.exe" = J:\Far Cry 2\bin\FC2Launcher.exe:*:Enabled:Far Cry 2 Updater -- (Ubisoft)
"J:\Far Cry 2\bin\FC2Editor.exe" = J:\Far Cry 2\bin\FC2Editor.exe:*:Enabled:Editor -- (Ubisoft Entertainment)
"J:\steamapps\common\left 4 dead\left4dead.exe" = J:\steamapps\common\left 4 dead\left4dead.exe:*:Enabled:Left 4 Dead -- ()
"H:\Star Wars Battlefront II\GameData\BattlefrontII.exe" = H:\Star Wars Battlefront II\GameData\BattlefrontII.exe:*:Disabled:BattlefrontII -- File not found
"C:\Program Files\gta2gh\gta2gh.exe" = C:\Program Files\gta2gh\gta2gh.exe:*:Enabled:gta2gh -- File not found
"C:\Documents and Settings\Kajtek\Pulpit\Gta2\GTA2\gta2.exe" = C:\Documents and Settings\Kajtek\Pulpit\Gta2\GTA2\gta2.exe:*:Enabled:GTA2 main executable -- File not found
"C:\WINDOWS\system32\dplaysvr.exe" = C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper -- (Microsoft Corporation)
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Program Files\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe" = C:\Program Files\Ubisoft\Ubisoft Game Launcher\UbisoftGameLauncher.exe:*:Enabled:Ubisoft Game Launcher -- File not found
"C:\Documents and Settings\Kajtek\Dane aplikacji\winsvrcn.exe" = C:\Documents and Settings\Kajtek\Dane aplikacji\winsvrcn.exe:*:Enabled:WindowsSysControl -- ()
"C:\Program Files\Java\jre6\bin\java.exe" = C:\Program Files\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)
"C:\Documents and Settings\Kajtek\Dane aplikacji\winbcsrn.exe" = C:\Documents and Settings\Kajtek\Dane aplikacji\winbcsrn.exe:*:Enabled:Winsmgr -- ()
"C:\Documents and Settings\Kajtek\Dane aplikacji\winsvrn.exe" = C:\Documents and Settings\Kajtek\Dane aplikacji\winsvrn.exe:*:Enabled:WinSysMngrs -- File not found
"C:\Documents and Settings\Kajtek\Dane aplikacji\S-4535-3921-5839\wincdsv32.exe" = C:\Documents and Settings\Kajtek\Dane aplikacji\S-4535-3921-5839\wincdsv32.exe:*:Enabled:WinDrvMngrsss -- File not found
"C:\Documents and Settings\Kajtek\Dane aplikacji\S-4535-6842-9325\winsvn.exe" = C:\Documents and Settings\Kajtek\Dane aplikacji\S-4535-6842-9325\winsvn.exe:*:Enabled:Windows Update Services -- File not found
[color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{00C5F4F4-62F9-40D7-8000-AD8A9CD0C669}" = Microsoft Games for Windows - LIVE Redistributable
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{127B684B-A002-44C8-99A7-6CF8F1E26873}" = PunkBuster for Battlefield 1942
"{1D2C96C3-A3F3-49E7-B839-95279DED837F}" = Opera 10.60
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{44E42AAA-432F-4E03-8D7D-C8DB4FEE526A}" = Microsoft Works
"{45A66726-69BC-466B-A7A4-12FCBA4883D7}" = HiJackThis
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5454083B-1308-4485-BF17-1110000B8301}" = Grand Theft Auto IV
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{579BA58C-F33D-4970-9953-B94B43768AC3}" = Grand Theft Auto IV
"{698D7E61-E4BF-4CA6-8A09-CF6BDBFDEF65}" = Battlefield 1942
"{6ECB39BD-73C2-44DD-B1A0-898207C58D8B}" = Nawigator obrazów i fotografii HP 2.0 - All-in-One Sterowniki
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7B4A5C13-069F-4AFE-AE57-C497B4E33C7E}" = Call of Duty(R) 2 Patch 1.3
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8B743AA0-53B2-11D2-808A-00600895FB43}" = Heroes of Might and Magic III - Złota Edycja
"{90120000-0020-0415-0000-0000000FF1CE}" = Pakiet zgodności dla systemu Office 2007
"{95120000-00AF-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (Polish)
"{9867A917-5D17-40DE-83BA-BEA5293194B1}" = Nawigator obrazów i fotografii HP 2.0 - All-in-One
"{A1C962E2-2426-49C6-A38B-9A07E40D607C}" = Microsoft Games for Windows - LIVE
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{AC1E4C93-C1E7-11D6-9D10-00010240CE95}" = Java 2 Runtime Environment, SE v1.4.0_03
"{AC76BA86-7AD7-1045-7B44-A70000000000}" = Adobe Reader 7.0 - Polish
"{BAF78226-3200-4DB4-BE33-4D922A799840}" = Windows Presentation Foundation
"{BEE64C14-BEF1-4610-8A68-A16EAA47B882}" = Futuremark SystemInfo
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C5A31DDC-157A-4DD7-9B5C-C692A06F61FD}" = Prison Break
"{C900EF06-2E76-49C7-8DB0-41F629B21DC5}" = hp psc 1200 series
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D41FAAA9-8048-4906-86B2-9AADEA1FA0B7}" = SpeedTouch USB Software
"{DEA314C4-0929-4250-BC92-98E4C105F28D}" = NVIDIA PhysX
"{F2835483-37F2-4123-B4FE-0E77D58447F2}" = Far Cry 2
"{FB08F381-6533-4108-B7DD-039E11FBC27E}" = Realtek AC'97 Audio
"{FF35F637-72B9-43BE-A281-06EB2854393A}" = 3DMark03
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"ALLPlayer V3.5.6.3_is1" = ALLPlayer V3.X
"AVG8Uninstall" = AVG Free 8.5
"CCleaner" = CCleaner
"DAEMON Tools Toolbar" = DAEMON Tools Toolbar
"FormatFactory" = FormatFactory 2.30
"Gadu-Gadu" = Gadu-Gadu 7.7
"Game Booster_is1" = Game Booster
"HP PSC 1200 Series" = Nawigator obrazów i fotografii HP 2.0 - hp psc 1200 series
"hp psc 1200 series_Driver" = hp psc 1200 series
"Icy Tower v1.4_is1" = Icy Tower v1.4
"ImgBurn" = ImgBurn
"InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"IrfanView" = IrfanView (remove only)
"KLiteCodecPack_is1" = K-Lite Codec Pack 4.7.5 (Full)
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.8)" = Mozilla Firefox (3.6.8)
"Mumble" = Mumble and Murmur
"NETIANET" = NETIANET
"Nowe Gadu-Gadu" = Nowe Gadu-Gadu
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIA nView Desktop Manager" = NVIDIA nView Desktop Manager
"PhotoScape" = PhotoScape
"Picasa 3" = Picasa 3
"RivaTuner" = RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition
"Steam App 500" = Left 4 Dead
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"USB all-in-one game controller" = USB all-in-one game controller
"Video Card Stability Test" = Video Card Stability Test
"WIC" = Windows Imaging Component
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"WinRAR archiver" = Archiwizator WinRAR
"WMFDist11" = Windows Media Format 11 runtime
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0
"Xfire" = Xfire (remove only)
"XpsEPSC" = XML Paper Specification Shared Components Pack 1.0
[color=#E56717]========== HKEY_USERS Uninstall List ==========[/color]
[HKEY_USERS\S-1-5-21-1454471165-725345543-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"PhotoFiltre" = PhotoFiltre
[color=#E56717]========== Last 10 Event Log Errors ==========[/color]
[ Application Events ]
Error - 2010-08-06 15:00:42 | Computer Name = XXX-E3781CF9A82 | Source = Application Hang | ID = 1002
Description = Aplikacja zawieszająca ALLPlayer.exe, wersja 3.5.6.3, moduł zawieszenia
hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.
Error - 2010-08-06 15:00:45 | Computer Name = XXX-E3781CF9A82 | Source = Application Hang | ID = 1002
Description = Aplikacja zawieszająca ALLPlayer.exe, wersja 3.5.6.3, moduł zawieszenia
hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.
Error - 2010-08-06 17:33:33 | Computer Name = XXX-E3781CF9A82 | Source = Application Hang | ID = 1002
Description = Aplikacja zawieszająca OTL.exe, wersja 3.2.9.1, moduł zawieszenia
hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.
Error - 2010-08-06 17:33:33 | Computer Name = XXX-E3781CF9A82 | Source = Application Hang | ID = 1002
Description = Aplikacja zawieszająca OTL.exe, wersja 3.2.9.1, moduł zawieszenia
hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.
[ System Events ]
Error - 2010-08-05 12:27:45 | Computer Name = XXX-E3781CF9A82 | Source = Service Control Manager | ID = 7023
Description = Usługa SSHNAS zakończyła działanie; wystąpił następujący błąd: %%126
Error - 2010-08-05 16:01:17 | Computer Name = XXX-E3781CF9A82 | Source = Service Control Manager | ID = 7023
Description = Usługa SSHNAS zakończyła działanie; wystąpił następujący błąd: %%126
Error - 2010-08-05 17:41:27 | Computer Name = XXX-E3781CF9A82 | Source = Service Control Manager | ID = 7023
Description = Usługa SSHNAS zakończyła działanie; wystąpił następujący błąd: %%126
Error - 2010-08-06 01:33:22 | Computer Name = XXX-E3781CF9A82 | Source = Service Control Manager | ID = 7023
Description = Usługa SSHNAS zakończyła działanie; wystąpił następujący błąd: %%126
Error - 2010-08-06 04:14:03 | Computer Name = XXX-E3781CF9A82 | Source = Service Control Manager | ID = 7023
Description = Usługa SSHNAS zakończyła działanie; wystąpił następujący błąd: %%126
Error - 2010-08-06 04:25:20 | Computer Name = XXX-E3781CF9A82 | Source = Service Control Manager | ID = 7023
Description = Usługa SSHNAS zakończyła działanie; wystąpił następujący błąd: %%126
Error - 2010-08-06 04:37:10 | Computer Name = XXX-E3781CF9A82 | Source = Service Control Manager | ID = 7023
Description = Usługa SSHNAS zakończyła działanie; wystąpił następujący błąd: %%126
Error - 2010-08-06 08:50:04 | Computer Name = XXX-E3781CF9A82 | Source = Service Control Manager | ID = 7023
Description = Usługa SSHNAS zakończyła działanie; wystąpił następujący błąd: %%126
Error - 2010-08-06 15:19:24 | Computer Name = XXX-E3781CF9A82 | Source = Service Control Manager | ID = 7023
Description = Usługa SSHNAS zakończyła działanie; wystąpił następujący błąd: %%126
Error - 2010-08-06 17:36:07 | Computer Name = XXX-E3781CF9A82 | Source = Service Control Manager | ID = 7023
Description = Usługa SSHNAS zakończyła działanie; wystąpił następujący błąd: %%126
< End of report >
- Kod: Zaznacz wszystko
OTL logfile created on: 2010-08-06 23:56:06 - Run 1
OTL by OldTimer - Version 3.2.9.1 Folder = C:\Documents and Settings\Kajtek\Pulpit\Nowy folder
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 71,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 86,00% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 19,53 Gb Total Space | 2,56 Gb Free Space | 13,13% Space Free | Partition Type: NTFS
Drive D: | 19,52 Gb Total Space | 1,13 Gb Free Space | 5,79% Space Free | Partition Type: FAT32
Drive E: | 16,82 Gb Total Space | 6,80 Gb Free Space | 40,43% Space Free | Partition Type: FAT32
F: Drive not present or media not loaded
G: Drive not present or media not loaded
Drive H: | 60,54 Gb Total Space | 7,53 Gb Free Space | 12,44% Space Free | Partition Type: NTFS
Drive I: | 255,33 Gb Total Space | 48,30 Gb Free Space | 18,92% Space Free | Partition Type: NTFS
Drive J: | 124,00 Gb Total Space | 35,79 Gb Free Space | 28,86% Space Free | Partition Type: NTFS
Drive K: | 25,89 Gb Total Space | 8,85 Gb Free Space | 34,17% Space Free | Partition Type: NTFS
Computer Name: XXX-E3781CF9A82
Current User Name: Kajtek
Logged in as Administrator.
Current Boot Mode: Normal
Scan Mode: All users
Company Name Whitelist: Off
Skip Microsoft Files: Off
File Age = 30 Days
Output = Standard
[color=#E56717]========== Processes (SafeList) ==========[/color]
PRC - [2010-08-06 23:55:25 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kajtek\Pulpit\Nowy folder\OTL.exe
PRC - [2010-08-06 23:38:09 | 000,293,376 | ---- | M] () -- C:\Documents and Settings\Kajtek\Pulpit\Nowy folder\yexh64ce.exe
PRC - [2010-07-15 23:18:36 | 000,100,864 | ---- | M] () -- C:\Documents and Settings\Kajtek\winrsncd.exe
PRC - [2010-07-09 10:25:09 | 002,048,352 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgtray.exe
PRC - [2010-06-30 14:52:22 | 000,836,464 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe
PRC - [2010-03-04 20:09:50 | 000,693,016 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgcsrvx.exe
PRC - [2010-03-04 20:09:40 | 000,297,752 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgwdsvc.exe
PRC - [2010-03-04 19:58:44 | 000,486,680 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgrsx.exe
PRC - [2010-03-04 19:58:43 | 000,595,736 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgnsx.exe
PRC - [2010-03-04 19:58:36 | 000,908,056 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files\AVG\AVG8\avgemc.exe
PRC - [2010-03-04 18:09:38 | 000,493,568 | ---- | M] (NETIA S.A.) -- C:\Program Files\Netia\Net\netianet.exe
PRC - [2005-07-12 09:55:26 | 000,081,920 | R--- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\SOUNDMAN.EXE
PRC - [2004-08-04 00:44:20 | 001,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2004-01-26 12:38:38 | 000,866,816 | ---- | M] (THOMSON Telecom Belgium) -- C:\Program Files\Thomson\SpeedTouch USB\dragdiag.exe
[color=#E56717]========== Modules (SafeList) ==========[/color]
MOD - [2010-08-06 23:55:25 | 000,574,976 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Kajtek\Pulpit\Nowy folder\OTL.exe
MOD - [2004-08-04 00:42:34 | 001,050,624 | R--- | M] (Microsoft Corporation) -- C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2180_x-ww_a84f1ff9\comctl32.dll
MOD - [2004-08-03 23:01:18 | 000,102,400 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\msscript.ocx
[color=#E56717]========== Win32 Services (SafeList) ==========[/color]
SRV - File not found [Auto | Stopped] -- C:\WINDOWS\System32\sshnas21.dll -- (SSHNAS)
SRV - File not found [Disabled | Stopped] -- C:\WINDOWS\System32\hidserv.dll -- (HidServ)
SRV - [2010-03-04 20:09:40 | 000,297,752 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG8\avgwdsvc.exe -- (avg8wd)
SRV - [2010-03-04 19:58:36 | 000,908,056 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files\AVG\AVG8\avgemc.exe -- (avg8emc)
SRV - [2003-03-09 22:31:02 | 000,065,795 | ---- | M] (HP) [On_Demand | Stopped] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\DOCUME~1\Kajtek\USTAWI~1\Temp\cpuz130\cpuz_x32.sys -- (cpuz130)
DRV - [2010-04-11 16:02:22 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt)
DRV - [2010-04-11 16:02:22 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2010-04-04 00:55:31 | 010,232,128 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nv4_mini.sys -- (nv)
DRV - [2010-03-12 15:36:03 | 000,691,696 | ---- | M] (Duplex Secure Ltd.) [Kernel | Disabled | Stopped] -- C:\WINDOWS\system32\drivers\sptd.sys -- (sptd)
DRV - [2010-03-04 19:58:44 | 000,335,240 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgldx86.sys -- (AvgLdx86)
DRV - [2010-03-04 19:58:44 | 000,027,784 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\System32\Drivers\avgmfx86.sys -- (AvgMfx86)
DRV - [2010-03-04 19:58:42 | 000,108,552 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\System32\Drivers\avgtdix.sys -- (AvgTdiX)
DRV - [2009-08-22 20:25:00 | 000,009,088 | ---- | M] () [Kernel | On_Demand | Running] -- E:\Użytkowe\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner32.sys -- (RivaTuner32)
DRV - [2005-08-23 11:54:00 | 000,021,760 | ---- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\GMFilter.sys -- (GMFilter)
DRV - [2005-07-15 11:40:36 | 003,640,000 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ALCXWDM.SYS -- (ALCXWDM) Service for Realtek AC97 Audio (WDM)
DRV - [2004-12-16 12:20:44 | 000,010,880 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\SKBusEnum.sys -- (skbusenum)
DRV - [2004-08-13 04:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)
DRV - [2004-08-04 01:08:22 | 000,010,624 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\gameenum.sys -- (gameenum)
DRV - [2003-12-08 12:53:48 | 000,053,600 | ---- | M] (THOMSON) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\alcan5wn.sys -- (alcan5wn) SpeedTouch USB ADSL PPP Networking Driver (NDISWAN)
DRV - [2003-12-08 12:53:46 | 000,070,688 | ---- | M] (THOMSON) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\alcaudsl.sys -- (alcaudsl)
DRV - [2003-11-27 19:48:50 | 000,003,968 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\VirtualK.sys -- (VirtualK)
DRV - [2001-08-18 00:00:04 | 000,002,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\msmpu401.sys -- (ms_mpu401)
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
[color=#E56717]========== Internet Explorer ==========[/color]
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKU\S-1-5-21-1454471165-725345543-839522115-1003\..\URLSearchHook: {08C06D61-F1F3-4799-86F8-BE1A89362C85} - Reg Error: Key error. File not found
IE - HKU\S-1-5-21-1454471165-725345543-839522115-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
[color=#E56717]========== FireFox ==========[/color]
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010-07-28 22:41:15 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 3.6.8\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010-07-25 11:24:04 | 000,000,000 | ---D | M]
[2010-03-11 22:12:06 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kajtek\Dane aplikacji\Mozilla\Extensions
[2010-08-04 00:21:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kajtek\Dane aplikacji\Mozilla\Firefox\Profiles\v4pao9mb.default\extensions
[2010-03-12 01:47:11 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Kajtek\Dane aplikacji\Mozilla\Firefox\Profiles\v4pao9mb.default\extensions\{B042753D-F57E-4e8e-A01B-7379A6D4CEFB}-trash
[2010-03-12 15:36:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kajtek\Dane aplikacji\Mozilla\Firefox\Profiles\v4pao9mb.default\extensions\DTToolbar@toolbarnet.com
[2010-03-12 15:43:05 | 000,002,055 | ---- | M] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\Mozilla\Firefox\Profiles\v4pao9mb.default\searchplugins\daemon-search.xml
[2010-08-04 00:21:55 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions
[2010-07-10 14:39:13 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010-02-21 12:22:32 | 000,712,704 | ---- | M] (BitComet) -- C:\Program Files\Mozilla Firefox\plugins\npBitCometAgent.dll
[2010-07-10 14:38:47 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010-01-16 03:08:36 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml
[2010-01-16 03:08:36 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml
[2010-01-16 03:08:36 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml
[2010-01-16 03:08:36 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml
[2010-01-16 03:08:36 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml
[2010-01-16 03:08:36 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml
O1 HOSTS File: ([2001-10-26 15:45:16 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.)
O3 - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O3 - HKU\S-1-5-21-1454471165-725345543-839522115-1003\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll ()
O4 - HKLM..\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKLM..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe (Microsoft Corporation)
O4 - HKLM..\Run: [NETIANET] C:\Program Files\Netia\Net\netianet.exe (NETIA S.A.)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.DLL (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] File not found
O4 - HKLM..\Run: [RivaTunerStartupDaemon] E:\Użytkowe\RivaTuner v2.24 MSI Master Overclocking Arena 2009 edition\RivaTuner.exe ()
O4 - HKLM..\Run: [SoundMan] C:\WINDOWS\SOUNDMAN.EXE (Realtek Semiconductor Corp.)
O4 - HKLM..\Run: [SpeedTouch USB Diagnostics] C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe (THOMSON Telecom Belgium)
O4 - HKU\S-1-5-21-1454471165-725345543-839522115-1003..\Run: [WinSysControls] C:\Documents and Settings\All Users\winrsncd.exe ()
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1454471165-725345543-839522115-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95 00 00 00 [binary data]
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-1_4_0_03-win.cab (Java Plug-in 1.4.0_03)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - Winlogon\Notify\avgrsstarter: DllName - avgrsstx.dll - C:\WINDOWS\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.)
O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home
O24 - Desktop WallPaper: C:\Documents and Settings\Kajtek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Kajtek\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010-03-02 00:52:22 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{07555180-27b5-11df-9397-000e50b103f1}\Shell - "" = AutoRun
O33 - MountPoints2\{a7763080-2ddc-11df-acd5-000e50b103f1}\Shell - "" = AutoRun
O33 - MountPoints2\{a7763080-2ddc-11df-acd5-000e50b103f1}\Shell\AutoRun\command - "" = G:\autorun.exe -- File not found
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
[2010-08-06 17:42:50 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Kajtek\Recent
[2010-08-03 16:58:48 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kajtek\Dane aplikacji\Red Alert 3
[2010-07-29 15:25:33 | 000,000,000 | ---D | C] -- C:\Hijack This
[2010-07-27 10:41:35 | 000,000,000 | RHSD | C] -- C:\Documents and Settings\Kajtek\Dane aplikacji\S-4535-6842-9325
[2010-07-26 16:36:02 | 000,000,000 | RHSD | C] -- C:\Documents and Settings\Kajtek\Dane aplikacji\S-4535-3921-5839
[2010-07-10 14:41:08 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun
[2010-07-10 14:39:34 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Sun
[2010-07-10 14:39:31 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Java
[2010-07-10 14:39:08 | 000,411,368 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010-07-10 14:39:08 | 000,153,376 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010-07-10 14:39:08 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010-07-10 14:39:08 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010-07-10 14:39:08 | 000,073,728 | ---- | C] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010-07-10 14:35:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Kajtek\Dane aplikacji\Sun
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
[2010-08-06 23:38:06 | 063,026,266 | ---- | M] () -- C:\WINDOWS\System32\drivers\Avg\incavi.avm
[2010-08-06 23:36:18 | 000,276,868 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml
[2010-08-06 23:36:06 | 000,000,286 | -H-- | M] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010-08-06 23:36:06 | 000,000,248 | -H-- | M] () -- C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010-08-06 23:36:05 | 000,000,286 | -H-- | M] () -- C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010-08-06 23:36:05 | 000,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT
[2010-08-06 23:35:50 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2010-08-06 23:35:47 | 000,173,872 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2010-08-06 21:28:07 | 000,000,532 | ---- | M] () -- C:\WINDOWS\win.ini
[2010-08-06 21:28:07 | 000,000,227 | ---- | M] () -- C:\WINDOWS\system.ini
[2010-08-06 21:28:07 | 000,000,211 | -HS- | M] () -- C:\boot.ini
[2010-08-06 17:45:36 | 003,145,728 | -H-- | M] () -- C:\Documents and Settings\Kajtek\NTUSER.DAT
[2010-08-04 21:41:08 | 000,091,136 | ---- | M] () -- C:\Documents and Settings\Kajtek\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010-08-04 15:52:11 | 000,060,416 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\ALCFDRTM.VER
[2010-08-03 20:45:58 | 000,000,522 | ---- | M] () -- C:\hpfr3420.xml
[2010-08-03 09:30:23 | 002,108,726 | -H-- | M] () -- C:\Documents and Settings\Kajtek\Ustawienia lokalne\Dane aplikacji\IconCache.db
[2010-08-03 00:01:47 | 000,000,639 | ---- | M] () -- C:\Documents and Settings\Kajtek\Pulpit\Icy Tower.lnk
[2010-08-02 08:59:29 | 000,214,520 | ---- | M] () -- C:\WINDOWS\System32\PnkBstrB.xtr
[2010-07-30 19:02:45 | 000,033,080 | ---- | M] () -- C:\Documents and Settings\Kajtek\Moje dokumenty\cc_20100730_190242.reg
[2010-07-28 18:25:09 | 000,138,384 | ---- | M] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2010-07-24 11:24:09 | 000,040,642 | ---- | M] () -- C:\Documents and Settings\Kajtek\Pulpit\statement_100724_112404.pdf
[2010-07-23 01:07:10 | 000,048,640 | ---- | M] () -- C:\Documents and Settings\Kajtek\Pulpit\Ustrój polityczny Słowacji [S. Królewicz, P. Andrzejewski GP Kościan II].doc
[2010-07-22 18:41:54 | 000,010,308 | ---- | M] () -- C:\Documents and Settings\Kajtek\Pulpit\BIBLIOGRAFIA.doc
[2010-07-22 18:41:40 | 000,000,754 | ---- | M] () -- C:\WINDOWS\WORDPAD.INI
[2010-07-22 11:12:28 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2010-07-16 22:35:31 | 000,033,500 | ---- | M] () -- C:\Documents and Settings\Kajtek\PMJPMJPMJG.exe
[2010-07-16 21:51:12 | 000,033,280 | RHS- | M] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\winbcsrn.exe
[2010-07-15 23:18:36 | 000,100,864 | -HS- | M] () -- C:\Documents and Settings\All Users\winrsncd.exe
[2010-07-15 23:18:36 | 000,100,864 | ---- | M] () -- C:\Documents and Settings\Kajtek\winrsncd.exe
[2010-07-12 14:28:04 | 000,072,704 | RHS- | M] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\winsvrcn.exe
[2010-07-10 20:31:54 | 000,004,014 | ---- | M] () -- C:\Documents and Settings\Kajtek\Moje dokumenty\cc_20100710_203152.reg
[2010-07-10 18:10:19 | 001,087,636 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI
[2010-07-10 18:10:19 | 000,490,628 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat
[2010-07-10 18:10:19 | 000,432,492 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2010-07-10 18:10:19 | 000,083,880 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat
[2010-07-10 18:10:19 | 000,067,448 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2010-07-10 14:38:47 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\deployJava1.dll
[2010-07-10 14:38:47 | 000,153,376 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaws.exe
[2010-07-10 14:38:47 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javaw.exe
[2010-07-10 14:38:47 | 000,145,184 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\java.exe
[2010-07-10 14:38:47 | 000,073,728 | ---- | M] (Sun Microsystems, Inc.) -- C:\WINDOWS\System32\javacpl.cpl
[2010-07-08 10:53:13 | 000,000,592 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Opera.lnk
[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[color=#E56717]========== Files Created - No Company Name ==========[/color]
[2010-08-03 00:01:47 | 000,000,639 | ---- | C] () -- C:\Documents and Settings\Kajtek\Pulpit\Icy Tower.lnk
[2010-07-30 19:02:44 | 000,033,080 | ---- | C] () -- C:\Documents and Settings\Kajtek\Moje dokumenty\cc_20100730_190242.reg
[2010-07-29 14:06:16 | 000,000,000 | R--- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\hgLKd.txt
[2010-07-28 14:27:02 | 000,000,000 | R--- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\ei66G.txt
[2010-07-27 22:05:53 | 000,000,000 | R--- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\BgmeL.txt
[2010-07-27 13:16:13 | 000,000,000 | R--- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\j618A.txt
[2010-07-27 12:44:28 | 000,000,000 | R--- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\JiC7N.txt
[2010-07-27 11:11:22 | 000,000,286 | -H-- | C] () -- C:\WINDOWS\tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010-07-27 10:41:35 | 000,000,000 | R--- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\MKcC7.txt
[2010-07-26 21:57:00 | 000,000,000 | R--- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\BeKDi.txt
[2010-07-26 16:36:01 | 000,000,000 | R--- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\C8GlF.txt
[2010-07-25 21:02:21 | 000,000,000 | R--- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\BekD6.txt
[2010-07-24 11:24:09 | 000,040,642 | ---- | C] () -- C:\Documents and Settings\Kajtek\Pulpit\statement_100724_112404.pdf
[2010-07-24 11:10:13 | 000,000,000 | R--- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\lL166.txt
[2010-07-23 18:10:08 | 000,000,000 | R--- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\IHAfM.txt
[2010-07-23 09:01:54 | 000,048,640 | ---- | C] () -- C:\Documents and Settings\Kajtek\Pulpit\Ustrój polityczny Słowacji [S. Królewicz, P. Andrzejewski GP Kościan II].doc
[2010-07-23 08:31:15 | 000,000,000 | R--- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\KJcHb.txt
[2010-07-22 18:41:32 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI
[2010-07-22 11:13:28 | 000,000,000 | R--- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\Bb7M1.txt
[2010-07-17 08:22:50 | 000,000,000 | R--- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\mfJHE.txt
[2010-07-16 22:34:50 | 000,033,500 | ---- | C] () -- C:\Documents and Settings\Kajtek\PMJPMJPMJG.exe
[2010-07-16 21:51:13 | 000,033,280 | RHS- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\winbcsrn.exe
[2010-07-16 21:51:13 | 000,000,000 | R--- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\BkCmi.txt
[2010-07-16 10:50:13 | 000,100,864 | -HS- | C] () -- C:\Documents and Settings\All Users\winrsncd.exe
[2010-07-15 23:18:37 | 000,100,864 | ---- | C] () -- C:\Documents and Settings\Kajtek\winrsncd.exe
[2010-07-15 23:18:37 | 000,000,000 | R--- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\BF7cA.txt
[2010-07-15 21:54:33 | 000,000,000 | R--- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\B87ki.txt
[2010-07-13 00:55:02 | 000,000,286 | -H-- | C] () -- C:\WINDOWS\tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[2010-07-13 00:54:18 | 000,000,248 | -H-- | C] () -- C:\WINDOWS\tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010-07-12 20:33:57 | 000,000,000 | R--- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\gf71j.txt
[2010-07-12 14:28:05 | 000,072,704 | RHS- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\winsvrcn.exe
[2010-07-12 14:28:05 | 000,000,000 | R--- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\Bkdi1.txt
[2010-07-12 14:28:03 | 000,000,000 | R--- | C] () -- C:\Documents and Settings\Kajtek\Dane aplikacji\Bd6CH.txt
[2010-07-10 20:31:54 | 000,004,014 | ---- | C] () -- C:\Documents and Settings\Kajtek\Moje dokumenty\cc_20100710_203152.reg
[2010-05-28 02:09:00 | 000,041,872 | ---- | C] () -- C:\WINDOWS\System32\xfcodec.dll
[2010-04-11 16:02:22 | 000,281,760 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys
[2010-04-11 16:02:22 | 000,025,888 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys
[2010-04-09 21:50:58 | 000,315,463 | ---- | C] () -- C:\WINDOWS\System32\GM2500F.dll
[2010-04-09 21:50:57 | 000,110,592 | ---- | C] () -- C:\WINDOWS\System32\GM2500.dll
[2010-04-09 21:50:51 | 000,021,760 | ---- | C] () -- C:\WINDOWS\System32\drivers\GMFilter.sys
[2010-03-04 22:41:22 | 000,138,384 | ---- | C] () -- C:\WINDOWS\System32\drivers\PnkBstrK.sys
[2010-03-03 22:58:46 | 000,000,255 | ---- | C] () -- C:\WINDOWS\game.ini
[2010-03-02 12:11:48 | 000,168,448 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2010-03-02 12:11:45 | 000,795,648 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2010-03-02 12:11:45 | 000,130,048 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll
[2010-03-02 12:11:44 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll
[2010-03-02 12:11:43 | 000,067,584 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll
[2010-03-02 12:11:43 | 000,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest
[2010-03-02 02:01:45 | 000,156,672 | R--- | C] () -- C:\WINDOWS\System32\RTLCPAPI.dll
[2010-03-02 02:00:48 | 000,017,571 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini
[2010-03-02 01:58:38 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys
[2010-03-02 01:58:22 | 000,005,824 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS
[2010-03-02 01:27:50 | 000,005,606 | ---- | C] () -- C:\WINDOWS\System32\stci.dll
[2010-03-02 01:27:06 | 000,041,068 | ---- | C] () -- C:\WINDOWS\System32\ActPanel.dll
[2009-11-06 10:58:04 | 000,178,975 | ---- | C] () -- C:\WINDOWS\System32\xlive.dll.cat
[2004-08-04 00:44:00 | 000,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll
[2003-03-09 22:31:04 | 000,561,152 | ---- | C] () -- C:\WINDOWS\System32\hpotscl.dll
[color=#E56717]========== LOP Check ==========[/color]
[2010-03-12 15:35:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite
[2010-06-30 14:26:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Ubisoft
[2010-03-12 01:20:07 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kajtek\Dane aplikacji\BitComet
[2010-03-12 15:44:10 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kajtek\Dane aplikacji\DAEMON Tools Lite
[2010-04-21 18:59:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kajtek\Dane aplikacji\Disney Interactive Studios
[2010-06-29 16:43:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kajtek\Dane aplikacji\EurekaLog
[2010-04-07 20:32:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kajtek\Dane aplikacji\FreeStone Group
[2010-03-12 20:25:29 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kajtek\Dane aplikacji\Gadu-Gadu
[2010-05-06 21:47:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kajtek\Dane aplikacji\ImgBurn
[2010-06-29 21:28:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kajtek\Dane aplikacji\Mumble
[2010-06-04 10:28:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kajtek\Dane aplikacji\Nowe Gadu-Gadu
[2010-03-02 01:14:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kajtek\Dane aplikacji\Opera
[2010-04-03 23:57:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kajtek\Dane aplikacji\PhotoFiltre
[2010-04-11 16:05:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kajtek\Dane aplikacji\Prison Break
[2010-08-03 16:58:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kajtek\Dane aplikacji\Red Alert 3
[2010-08-06 22:13:02 | 000,000,000 | RHSD | M] -- C:\Documents and Settings\Kajtek\Dane aplikacji\S-4535-3921-5839
[2010-08-06 22:13:02 | 000,000,000 | RHSD | M] -- C:\Documents and Settings\Kajtek\Dane aplikacji\S-4535-6842-9325
[2010-04-04 09:50:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kajtek\Dane aplikacji\Template
[2010-06-30 14:26:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Kajtek\Dane aplikacji\Ubisoft
[2010-06-26 22:02:28 | 000,000,344 | ---- | M] () -- C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1269111306.job
[2010-08-06 23:36:06 | 000,000,286 | -H-- | M] () -- C:\WINDOWS\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job
[2010-08-06 23:36:06 | 000,000,248 | -H-- | M] () -- C:\WINDOWS\Tasks\{35DC3473-A719-4d14-B7C1-FD326CA84A0C}.job
[2010-08-06 23:36:05 | 000,000,286 | -H-- | M] () -- C:\WINDOWS\Tasks\{8C3FDD81-7AE0-4605-A46A-2488B179F2A3}.job
[color=#E56717]========== Purity Check ==========[/color]
< End of report >
- Kod: Zaznacz wszystko
GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-08-07 00:09:33
Windows 5.1.2600 Dodatek Service Pack 3
Running: yexh64ce.exe; Driver: C:\DOCUME~1\Kajtek\USTAWI~1\Temp\ffedrfog.sys
---- Kernel code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xB6FC1380, 0x566445, 0xE8000020]
.text C:\WINDOWS\system32\DRIVERS\atksgt.sys section is writeable [0xB438D300, 0x3B6D8, 0xE8000020]
.text C:\WINDOWS\system32\DRIVERS\lirsgt.sys section is writeable [0xB8398300, 0x1BEE, 0xE8000020]
pnidata C:\WINDOWS\system32\DRIVERS\secdrv.sys unknown last section [0xB41EBF00, 0x24000, 0x48000000]
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x8A 0x2D 0x38 0xA7 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0xD4 0xC3 0x97 0x02 ...
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x8A 0x2D 0x38 0xA7 ...
---- Files - GMER 1.0.15 ----
File C:\WINDOWS\system32\mqoa.dll (size mismatch) 89088/225280 bytes executable
---- EOF - GMER 1.0.15 ----
