Komputer zwolnił, nie dziala m.in gg, wyskakuje blad

**Posty:** 49 · przez **grejd** 11 Maj 2009, 20:21

Tak jak w temacie komputer generlanie zwolnil, gadu nie chce dzialac, wyskakuje blad i zamyka przegladarke i wszystkie otwarte strony, zdarza sie ze nie laduje filmow na youtubie, jak juz laduje to strasznie powoli.

Kod: Zaznacz wszystko: info.txt logfile of random's system information tool 1.06 2009-05-11 20:16:27 ======Uninstall list====== -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Adobe Flash Player ActiveX-->C:\WINDOWS\System32\Macromed\Flash\uninstall_activeX.exe Adobe Reader 6.0.2 CE-->MsiExec.exe /I{AC76BA86-7AD7-1038-7B44-CEA000000001} ALLPlayer V3.X-->"C:\Program Files\ALLPlayer\unins000.exe" Archiwizator WinRAR-->C:\Program Files\WinRAR\uninstall.exe CDBurnerXP-->"C:\Program Files\CDBurnerXP\unins000.exe" GameDesire-Pool & Snooker-->C:\Program Files\Ganymede\billiards_uninstall.exe High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe" HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall IrfanView (remove only)-->C:\Program Files\IrfanView\iv_uninstall.exe Java 2 Runtime Environment, SE v1.4.0_03-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{AC1E4C93-C1E7-11D6-9D10-00010240CE95}\Setup.exe" Anytext K-Lite Codec Pack 4.1.7 (Full)-->"C:\Program Files\K-Lite Codec Pack\unins000.exe" Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d} neostrada tp-->C:\PROGRA~1\NEOSTR~1\Uninstall.exe Nowe Gadu-Gadu-->C:\Program Files\Nowe Gadu-Gadu\Uninstall.exe NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI Odkurzacz 11.3-->"C:\Program Files\Odkurzacz\unins000.exe" OpenOffice.org 2.0.2-->MsiExec.exe /I{2B29EAF9-352F-4A0D-8CB1-D34113993DB7} Picasa 2-->"C:\Program Files\Picasa2\Uninstall.exe" PKR-->"C:\Program Files\PKR\uninstall-pkr.exe" PrimoPDF-->"C:\WINDOWS\PrimoPDF4\uninstall.exe" "/U:C:\Program Files\activePDF\PrimoPDF\Uninstall\uninstallPrimoPDF4.xml" Real Alternative 1.9.0-->"C:\Program Files\Real Alternative\unins000.exe" Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x15 -removeonly Skype 2.5-->"C:\Program Files\Skype\Phone\unins000.exe" SpeedTouch USB Software-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D41FAAA9-8048-4906-86B2-9AADEA1FA0B7}\setup.exe" /l0009 -Control_Panel System Requirements Lab-->C:\Program Files\SystemRequirementsLab\Uninstall.exe Winamp-->"C:\Program Files\Winamp\UninstWA.exe" Windows Media Format Runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll Windows XP Service Pack 2-->C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe ======Hosts File====== 92.63.97.167 www.moneybookers.com 92.63.97.167 www.poste.it 92.63.97.167 poste.it 92.63.97.167 bancopostaonline.poste.it 92.63.97.167 moneybookers.com 92.63.97.167 www.postbank.de 92.63.97.167 postbank.de 92.63.97.167 banking.postbank.de 92.63.97.167 direkt.postbank.de 92.63.97.167 abbey.com ======System event log====== Computer Name: GREJD Event Code: 7035 Message: Do usługi Menedżer autopołączenia dostępu zdalnego został pomyślnie wysłany kod sterowania zatrzymaj. Record Number: 7299 Source Name: Service Control Manager Time Written: 20090227124952.000000+060 Event Type: informacje User: GREJD\Karol Computer Name: GREJD Event Code: 7036 Message: Usługa Menedżer autopołączenia dostępu zdalnego weszła w stan uruchomienia. Record Number: 7298 Source Name: Service Control Manager Time Written: 20090227124943.000000+060 Event Type: informacje User: Computer Name: GREJD Event Code: 7035 Message: Do usługi Menedżer autopołączenia dostępu zdalnego został pomyślnie wysłany kod sterowania uruchom. Record Number: 7297 Source Name: Service Control Manager Time Written: 20090227124943.000000+060 Event Type: informacje User: GREJD\Karol Computer Name: GREJD Event Code: 7036 Message: Usługa Usługa bramy warstwy aplikacji weszła w stan uruchomienia. Record Number: 7296 Source Name: Service Control Manager Time Written: 20090227124919.000000+060 Event Type: informacje User: Computer Name: GREJD Event Code: 7035 Message: Do usługi Usługa bramy warstwy aplikacji został pomyślnie wysłany kod sterowania uruchom. Record Number: 7295 Source Name: Service Control Manager Time Written: 20090227124919.000000+060 Event Type: informacje User: ZARZĄDZANIE NT\SYSTEM =====Application event log===== Computer Name: GREJD Event Code: 102 Message: wuaueng.dll (1036) SUS20ClientDataStore: Aparat bazy danych uruchomił nowe wystąpienie (0). Record Number: 1093 Source Name: ESENT Time Written: 20080921211052.000000+120 Event Type: informacje User: Computer Name: GREJD Event Code: 100 Message: wuauclt (1036) Aparat bazy danych 5.01.2600.2180 został uruchomiony. Record Number: 1092 Source Name: ESENT Time Written: 20080921211052.000000+120 Event Type: informacje User: Computer Name: GREJD Event Code: 1517 Message: System Windows zapisał rejestr użytkownika GREJD\Karol, kiedy aplikacja lub usługa nadal użytkowała rejestr podczas wylogowania. Pamięć używana przez rejestr użytkownika nie została zwolniona. Rejestr zostanie zwolniony, kiedy nie będzie używany. Najczęstszą tego przyczyną są usługi uruchamiane z konta użytkownika. Próbuj skonfigurować te usługi, aby były uruchamiane z konta LocalService lub NetworkService. Record Number: 1091 Source Name: Userenv Time Written: 20080921090248.000000+120 Event Type: ostrzeżenie User: ZARZĄDZANIE NT\SYSTEM Computer Name: GREJD Event Code: 102 Message: wuaueng.dll (2272) SUS20ClientDataStore: Aparat bazy danych uruchomił nowe wystąpienie (0). Record Number: 1090 Source Name: ESENT Time Written: 20080921085936.000000+120 Event Type: informacje User: Computer Name: GREJD Event Code: 100 Message: wuauclt (2272) Aparat bazy danych 5.01.2600.2180 został uruchomiony. Record Number: 1089 Source Name: ESENT Time Written: 20080921085936.000000+120 Event Type: informacje User: ======Environment variables====== "ComSpec"=%SystemRoot%\system32\cmd.exe "Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem "windir"=%SystemRoot% "OS"=Windows_NT "PROCESSOR_ARCHITECTURE"=x86 "PROCESSOR_LEVEL"=15 "PROCESSOR_IDENTIFIER"=x86 Family 15 Model 4 Stepping 3, GenuineIntel "PROCESSOR_REVISION"=0403 "NUMBER_OF_PROCESSORS"=2 "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH "TEMP"=%SystemRoot%\TEMP "TMP"=%SystemRoot%\TEMP "FP_NO_HOST_CHECK"=NO -----------------EOF-----------------

2 notatnik

Kod: Zaznacz wszystko: Logfile of random's system information tool 1.06 (written by random/random) Run by Karol at 2009-05-11 20:15:29 Microsoft Windows XP Professional Dodatek Service Pack 2 System drive C: has 14 GB (58%) free of 25 GB Total RAM: 1023 MB (51% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:16:26, on 2009-05-11 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\FTRTSVC.exe C:\Program Files\CDBurnerXP\NMSAccessU.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\RTHDCPL.EXE C:\PROGRA~1\NEOSTR~1\TaskBarIcon.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\neostrada tp\neostradatp.exe C:\Program Files\neostrada tp\ComComp.exe C:\PROGRA~1\NEOSTR~1\Toaster.exe C:\PROGRA~1\NEOSTR~1\Inactivity.exe C:\PROGRA~1\NEOSTR~1\PollingModule.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\Program Files\neostrada tp\Watch.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Nowe Gadu-Gadu\gg.exe C:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Karol\Pulpit\RSIT.exe C:\Program Files\trend micro\Karol.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O1 - Hosts: 92.63.97.167 www.moneybookers.com O1 - Hosts: 92.63.97.167 www.poste.it O1 - Hosts: 92.63.97.167 poste.it O1 - Hosts: 92.63.97.167 bancopostaonline.poste.it O1 - Hosts: 92.63.97.167 moneybookers.com O1 - Hosts: 92.63.97.167 www.postbank.de O1 - Hosts: 92.63.97.167 postbank.de O1 - Hosts: 92.63.97.167 banking.postbank.de O1 - Hosts: 92.63.97.167 direkt.postbank.de O1 - Hosts: 92.63.97.167 abbey.com O1 - Hosts: 92.63.97.167 www.abbey.com O1 - Hosts: 92.63.97.167 www.abbey.co.uk O1 - Hosts: 92.63.97.167 abbey.co.uk O1 - Hosts: 92.63.97.167 www.smile.co.uk O1 - Hosts: 92.63.97.167 smile.co.uk O1 - Hosts: 92.63.97.167 cahoot.com O1 - Hosts: 92.63.97.167 www.cahoot.com O1 - Hosts: 92.63.97.167 www.cahoot.co.uk O1 - Hosts: 92.63.97.167 cahoot.co.uk O1 - Hosts: 92.63.97.167 www.co-operativebank.co.uk O1 - Hosts: 92.63.97.167 co-operativebank.co.uk O1 - Hosts: 92.63.97.167 www.co-operativebank.com O1 - Hosts: 92.63.97.167 co-operativebank.com O1 - Hosts: 92.63.97.167 personal.barclays.co.uk O1 - Hosts: 92.63.97.167 barclays.co.uk O1 - Hosts: 92.63.97.167 ibank.barclays.co.uk O1 - Hosts: 92.63.97.167 www.barclays.co.uk O1 - Hosts: 92.63.97.167 barclays.touchclarity.com O1 - Hosts: 92.63.97.167 hsbc.co.uk O1 - Hosts: 92.63.97.167 www.hsbc.co.uk O1 - Hosts: 92.63.97.167 hsbc.touchclarity.com O1 - Hosts: 92.63.97.167 www1.member-hsbc-group.com O1 - Hosts: 92.63.97.167 lloydstsb.co.uk O1 - Hosts: 92.63.97.167 www.lloydstsb.co.uk O1 - Hosts: 92.63.97.167 lloydstsb.com O1 - Hosts: 92.63.97.167 www.lloydstsb.com O1 - Hosts: 92.63.97.167 mi.lloydstsb.com O1 - Hosts: 92.63.97.167 www.woolwich.co.uk O1 - Hosts: 92.63.97.167 woolwich.co.uk O1 - Hosts: 92.63.97.167 www.deutsche-bank.de O1 - Hosts: 92.63.97.167 deutsche-bank.de O1 - Hosts: 92.63.97.167 meine.deutsche-bank.de O1 - Hosts: 92.63.97.167 www.anbusiness.com O1 - Hosts: 92.63.97.167 anbusiness.com O1 - Hosts: 92.63.97.167 www.abbeyinternational.com O1 - Hosts: 92.63.97.167 www.barclays.com O1 - Hosts: 92.63.97.167 barclays.com O1 - Hosts: 92.63.97.167 ibank.internationalbanking.barclays.com O1 - Hosts: 92.63.97.167 offshore.hsbc.com O1 - Hosts: 92.63.97.167 www.lloydstsb-offshore.com O1 - Hosts: 92.63.97.167 lloydstsb-offshore.com O1 - Hosts: 92.63.97.167 citibank.de O1 - Hosts: 92.63.97.167 www.citibank.de O1 - Hosts: 92.63.97.167 www.natwest.com O1 - Hosts: 92.63.97.167 natwest.com O1 - Hosts: 92.63.97.167 www.nwolb.com O1 - Hosts: 92.63.97.167 nwolb.com O1 - Hosts: 92.63.97.167 rbs.co.uk O1 - Hosts: 92.63.97.167 www.rbs.co.uk O1 - Hosts: 92.63.97.167 www.rbsdigital.com O1 - Hosts: 92.63.97.167 rbsdigital.com O1 - Hosts: 92.63.97.167 www.ybonline.co.uk O1 - Hosts: 92.63.97.167 ybonline.co.uk O1 - Hosts: 92.63.97.40 banking.sparkasse-hannover.de O1 - Hosts: 92.63.97.40 www.sparkasse-hannover.de O1 - Hosts: 92.63.97.40 sparkasse-hannover.de O1 - Hosts: 92.63.97.40 www.banking.sparkasse-hannover.de O1 - Hosts: 92.63.97.40 banking.sparkasse-mittelthueringen.de O1 - Hosts: 92.63.97.40 sparkasse-mittelthueringen.de O1 - Hosts: 92.63.97.40 www.banking.sparkasse-mittelthueringen.de O1 - Hosts: 92.63.97.40 www.sparkasse-mittelthueringen.de O1 - Hosts: 92.63.97.40 banking.berliner-sparkasse.de O1 - Hosts: 92.63.97.40 berliner-sparkasse.de O1 - Hosts: 92.63.97.40 www.banking.berliner-sparkasse.de O1 - Hosts: 92.63.97.40 www.berliner-sparkasse.de O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ALLUpdate] "C:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep" O4 - HKCU\..\Run: [Nowe Gadu-Gadu] "C:\Program Files\Nowe Gadu-Gadu\gg.exe" O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{9415C92C-E4BC-4200-8C58-F9879F70A361}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{9415C92C-E4BC-4200-8C58-F9879F70A361}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 8142 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll [2003-11-04 54248] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "SpeedTouch USB Diagnostics"=C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe [2004-01-26 866816] "WOOWATCH"=C:\PROGRA~1\NEOSTR~1\Watch.exe [2004-08-23 20480] "WOOTASKBARICON"=C:\PROGRA~1\NEOSTR~1\GestMaj.exe [2004-10-14 32768] "RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2005-07-13 14679552] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2008-05-16 13529088] "nwiz"=nwiz.exe /install [] "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2008-05-16 86016] "KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k [] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-04 15360] "ALLUpdate"=C:\Program Files\ALLPlayer\ALLUpdate.exe [2008-11-24 869888] "Nowe Gadu-Gadu"=C:\Program Files\Nowe Gadu-Gadu\gg.exe [2009-04-20 9818728] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD] C:\Program Files\Odkurzacz\odk_mcd.exe [2008-08-16 264704] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] C:\Program Files\Skype\Phone\Skype.exe [2006-06-12 20002856] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDrives"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"= "NoDrives"= "NoDriveAutoRun"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Gadu-Gadu\gg.exe"="C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program glowny" "C:\Program Files\Skype\Phone\Skype.exe"="C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. The whole world can talk for free." [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" ======List of files/folders created in the last 1 months====== 2009-05-11 20:15:29 ----D---- C:\rsit 2009-05-11 20:15:29 ----D---- C:\Program Files\trend micro 2009-05-11 20:04:26 ----D---- C:\Program Files\Nowe Gadu-Gadu 2009-05-11 20:03:54 ----A---- C:\Program Files\nowegg.exe 2009-04-25 09:57:19 ----D---- C:\WINDOWS\system32\appmgmt 2009-04-23 22:02:24 ----A---- C:\WINDOWS\system32\rmoc3260.dll 2009-04-23 22:02:24 ----A---- C:\WINDOWS\system32\pndx5032.dll 2009-04-23 22:02:24 ----A---- C:\WINDOWS\system32\pndx5016.dll 2009-04-23 22:02:24 ----A---- C:\WINDOWS\system32\pncrt.dll 2009-04-23 22:02:22 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Real 2009-04-23 22:02:22 ----A---- C:\WINDOWS\system32\msvcr71.dll 2009-04-23 22:02:22 ----A---- C:\WINDOWS\system32\msvcp71.dll 2009-04-23 21:53:53 ----D---- C:\Program Files\NAPI-PROJEKT 2009-04-23 21:51:53 ----A---- C:\WINDOWS\system32\unrar.dll 2009-04-23 21:51:52 ----A---- C:\WINDOWS\avisplitter.ini 2009-04-23 21:51:44 ----A---- C:\WINDOWS\system32\yv12vfw.dll 2009-04-23 21:51:43 ----A---- C:\WINDOWS\system32\xvidvfw.dll 2009-04-23 21:51:43 ----A---- C:\WINDOWS\system32\xvidcore.dll 2009-04-23 21:51:43 ----A---- C:\WINDOWS\system32\qt-dx331.dll 2009-04-23 21:51:43 ----A---- C:\WINDOWS\system32\dpl100.dll 2009-04-23 21:51:34 ----A---- C:\WINDOWS\system32\divx.dll 2009-04-23 21:51:33 ----A---- C:\WINDOWS\system32\ff_vfw.dll.manifest 2009-04-23 21:51:33 ----A---- C:\WINDOWS\system32\ff_vfw.dll 2009-04-23 21:51:31 ----D---- C:\Program Files\K-Lite Codec Pack 2009-04-23 20:43:26 ----D---- C:\Program Files\ALLPlayer ======List of files/folders modified in the last 1 months====== 2009-05-11 20:15:37 ----D---- C:\WINDOWS\Prefetch 2009-05-11 20:15:29 ----RD---- C:\Program Files 2009-05-11 20:04:39 ----SHD---- C:\WINDOWS\Installer 2009-05-11 20:04:39 ----SHD---- C:\Config.Msi 2009-05-11 18:22:19 ----D---- C:\WINDOWS\system32\CatRoot2 2009-05-11 09:29:34 ----D---- C:\Documents and Settings\Karol\Dane aplikacji\OpenOffice.org2 2009-05-11 08:49:56 ----D---- C:\WINDOWS\system32 2009-05-11 08:49:55 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2009-05-11 08:46:47 ----D---- C:\Program Files\neostrada tp 2009-05-11 08:45:57 ----D---- C:\WINDOWS\system32\Lang 2009-05-10 22:49:00 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-05-09 22:04:37 ----D---- C:\Documents and Settings\Karol\Dane aplikacji\GanymedeNet 2009-05-01 21:29:20 ----D---- C:\Program Files\Ganymede 2009-04-26 10:41:06 ----D---- C:\Program Files\PKR 2009-04-25 20:30:55 ----D---- C:\Documents and Settings\Karol\Dane aplikacji\Real 2009-04-25 09:58:44 ----D---- C:\Program Files\Gadu-Gadu 2009-04-25 09:58:12 ----D---- C:\WINDOWS 2009-04-25 09:51:12 ----HD---- C:\WINDOWS\inf 2009-04-25 09:51:12 ----D---- C:\WINDOWS\temp 2009-04-25 09:51:12 ----D---- C:\WINDOWS\system32\drivers 2009-04-25 09:51:11 ----D---- C:\WINDOWS\system32\CatRoot 2009-04-23 22:02:26 ----D---- C:\Program Files\Real Alternative 2009-04-23 22:01:36 ----D---- C:\Program Files\Common Files\Real 2009-04-23 22:01:31 ----D---- C:\Program Files\Common Files 2009-04-23 21:46:55 ----D---- C:\Program Files\DivX 2009-04-23 21:46:20 ----A---- C:\WINDOWS\VPlayer.INI 2009-04-23 21:38:22 ----D---- C:\WINDOWS\WinSxS 2009-04-23 20:56:32 ----D---- C:\WINDOWS\system32\config 2009-04-23 20:56:24 ----D---- C:\WINDOWS\system32\wbem 2009-04-23 20:56:24 ----D---- C:\WINDOWS\Registration 2009-04-23 20:55:26 ----D---- C:\Program Files\Picasa2 2009-04-23 20:55:26 ----D---- C:\Program Files\Google 2009-04-23 20:53:56 ----D---- C:\Program Files\Image-Line 2009-04-23 20:53:53 ----D---- C:\Program Files\ASIO4ALL v2 ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 intelppm;Sterownik procesora Intel; C:\WINDOWS\System32\DRIVERS\intelppm.sys [2004-08-04 40320] R3 alcan5wn;SpeedTouch USB ADSL PPP Networking Driver (NDISWAN); C:\WINDOWS\System32\DRIVERS\alcan5wn.sys [2003-12-08 53600] R3 alcaudsl;SpeedTouch ADSL Modem ATM Transport; C:\WINDOWS\System32\DRIVERS\alcaudsl.sys [2003-12-08 70688] R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2005-07-13 3851264] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-05-16 6557408] R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624] R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\System32\DRIVERS\usbhub.sys [2004-08-03 57600] R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; C:\WINDOWS\System32\DRIVERS\usbuhci.sys [2004-08-03 20480] S3 catchme;catchme; \??\C:\ComboFix\catchme.sys [] S3 PCAMPR5;PCAMPR5 NDIS Protocol Driver; \??\C:\WINDOWS\System32\PCAMPR5.SYS [] S3 PCANDIS5;PCANDIS5 NDIS Protocol Driver; \??\C:\WINDOWS\System32\PCANDIS5.SYS [] S3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616] S3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] S3 vulfnths;VIA USB Host Controller Lower Filter; C:\WINDOWS\System32\Drivers\vulfnth.sys [2005-01-05 6912] S3 vulfntrs;VIA USB Roothub Lower Filter; C:\WINDOWS\System32\Drivers\vulfntr.sys [2005-06-06 11264] S3 WpdUsb;WpdUsb; C:\WINDOWS\System32\Drivers\wpdusb.sys [2005-01-28 18944] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 FTRTSVC;France Telecom Routing Table Service; C:\WINDOWS\System32\FTRTSVC.exe [2004-08-23 40960] R2 NMSAccessU;NMSAccessU; C:\Program Files\CDBurnerXP\NMSAccessU.exe [2008-04-15 71096] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2008-05-16 159812] R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240] S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2007-01-04 136120] -----------------EOF-----------------

**Posty:** 18165 · przez **wojtas** 11 Maj 2009, 21:05

skasuj:

O1 - Hosts: 92.63.97.167 www.moneybookers.com
O1 - Hosts: 92.63.97.167 www.poste.it
O1 - Hosts: 92.63.97.167 poste.it
O1 - Hosts: 92.63.97.167 bancopostaonline.poste.it
O1 - Hosts: 92.63.97.167 moneybookers.com
O1 - Hosts: 92.63.97.167 www.postbank.de
O1 - Hosts: 92.63.97.167 postbank.de
O1 - Hosts: 92.63.97.167 banking.postbank.de
O1 - Hosts: 92.63.97.167 direkt.postbank.de
O1 - Hosts: 92.63.97.167 abbey.com
O1 - Hosts: 92.63.97.167 www.abbey.com
O1 - Hosts: 92.63.97.167 www.abbey.co.uk
O1 - Hosts: 92.63.97.167 abbey.co.uk
O1 - Hosts: 92.63.97.167 www.smile.co.uk
O1 - Hosts: 92.63.97.167 smile.co.uk
O1 - Hosts: 92.63.97.167 cahoot.com
O1 - Hosts: 92.63.97.167 www.cahoot.com
O1 - Hosts: 92.63.97.167 www.cahoot.co.uk
O1 - Hosts: 92.63.97.167 cahoot.co.uk
O1 - Hosts: 92.63.97.167 www.co-operativebank.co.uk
O1 - Hosts: 92.63.97.167 co-operativebank.co.uk
O1 - Hosts: 92.63.97.167 www.co-operativebank.com
O1 - Hosts: 92.63.97.167 co-operativebank.com
O1 - Hosts: 92.63.97.167 personal.barclays.co.uk
O1 - Hosts: 92.63.97.167 barclays.co.uk
O1 - Hosts: 92.63.97.167 ibank.barclays.co.uk
O1 - Hosts: 92.63.97.167 www.barclays.co.uk
O1 - Hosts: 92.63.97.167 barclays.touchclarity.com
O1 - Hosts: 92.63.97.167 hsbc.co.uk
O1 - Hosts: 92.63.97.167 www.hsbc.co.uk
O1 - Hosts: 92.63.97.167 hsbc.touchclarity.com
O1 - Hosts: 92.63.97.167 www1.member-hsbc-group.com
O1 - Hosts: 92.63.97.167 lloydstsb.co.uk
O1 - Hosts: 92.63.97.167 www.lloydstsb.co.uk
O1 - Hosts: 92.63.97.167 lloydstsb.com
O1 - Hosts: 92.63.97.167 www.lloydstsb.com
O1 - Hosts: 92.63.97.167 mi.lloydstsb.com
O1 - Hosts: 92.63.97.167 www.woolwich.co.uk
O1 - Hosts: 92.63.97.167 woolwich.co.uk
O1 - Hosts: 92.63.97.167 www.deutsche-bank.de
O1 - Hosts: 92.63.97.167 deutsche-bank.de
O1 - Hosts: 92.63.97.167 meine.deutsche-bank.de
O1 - Hosts: 92.63.97.167 www.anbusiness.com
O1 - Hosts: 92.63.97.167 anbusiness.com
O1 - Hosts: 92.63.97.167 www.abbeyinternational.com
O1 - Hosts: 92.63.97.167 www.barclays.com
O1 - Hosts: 92.63.97.167 barclays.com
O1 - Hosts: 92.63.97.167 ibank.internationalbanking.barclays.com
O1 - Hosts: 92.63.97.167 offshore.hsbc.com
O1 - Hosts: 92.63.97.167 www.lloydstsb-offshore.com
O1 - Hosts: 92.63.97.167 lloydstsb-offshore.com
O1 - Hosts: 92.63.97.167 citibank.de
O1 - Hosts: 92.63.97.167 www.citibank.de
O1 - Hosts: 92.63.97.167 www.natwest.com
O1 - Hosts: 92.63.97.167 natwest.com
O1 - Hosts: 92.63.97.167 www.nwolb.com
O1 - Hosts: 92.63.97.167 nwolb.com
O1 - Hosts: 92.63.97.167 rbs.co.uk
O1 - Hosts: 92.63.97.167 www.rbs.co.uk
O1 - Hosts: 92.63.97.167 www.rbsdigital.com
O1 - Hosts: 92.63.97.167 rbsdigital.com
O1 - Hosts: 92.63.97.167 www.ybonline.co.uk
O1 - Hosts: 92.63.97.167 ybonline.co.uk
O1 - Hosts: 92.63.97.40 banking.sparkasse-hannover.de
O1 - Hosts: 92.63.97.40 www.sparkasse-hannover.de
O1 - Hosts: 92.63.97.40 sparkasse-hannover.de
O1 - Hosts: 92.63.97.40 www.banking.sparkasse-hannover.de
O1 - Hosts: 92.63.97.40 banking.sparkasse-mittelthueringen.de
O1 - Hosts: 92.63.97.40 sparkasse-mittelthueringen.de
O1 - Hosts: 92.63.97.40 www.banking.sparkasse-mittelthueringen.de
O1 - Hosts: 92.63.97.40 www.sparkasse-mittelthueringen.de
O1 - Hosts: 92.63.97.40 banking.berliner-sparkasse.de
O1 - Hosts: 92.63.97.40 berliner-sparkasse.de
O1 - Hosts: 92.63.97.40 www.banking.berliner-sparkasse.de

Pobierz OTListIt2 i daj z niego loga

**Posty:** 49 · przez **grejd** 11 Maj 2009, 22:53

W jaki sposob mam je skasowac? :oops:

**Posty:** 18165 · przez **wojtas** 11 Maj 2009, 23:07

hijackthis-silent-runners-regulamin-tego-dzialu-vt9452.html

**Posty:** 49 · przez **grejd** 11 Maj 2009, 23:35

Kod: Zaznacz wszystko: OTListIt logfile created on: 2009-05-11 23:31:16 - Run 1 OTListIt2 by OldTimer - Version 2.0.15.6 Folder = D:\Antyviry Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1023,48 Mb Total Physical Memory | 449,11 Mb Available Physical Memory | 43,88% Memory free 2,40 Gb Paging File | 1,90 Gb Available in Paging File | 78,95% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 24,41 Gb Total Space | 15,59 Gb Free Space | 63,86% Space Free | Partition Type: NTFS Drive D: | 78,13 Gb Total Space | 17,33 Gb Free Space | 22,18% Space Free | Partition Type: NTFS Drive E: | 83,74 Gb Total Space | 2,54 Gb Free Space | 3,03% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: GREJD Current User Name: Karol Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Standard File Age = 30 Days Company Name Whitelist: On [color=orange]========== Processes (SafeList) ==========[/color] PRC - [2008-07-09 09:05:18 | 00,075,304 | ---- | M] (Zone Labs, LLC) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe PRC - [2004-08-04 00:44:20 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Explorer.EXE PRC - [2007-12-03 14:53:58 | 00,139,264 | ---- | M] () -- C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe PRC - [2004-08-23 14:49:56 | 00,040,960 | ---- | M] (France Telecom) -- C:\WINDOWS\System32\FTRTSVC.exe PRC - [2008-04-15 17:59:38 | 00,071,096 | ---- | M] () -- C:\Program Files\CDBurnerXP\NMSAccessU.exe PRC - [2008-05-16 14:01:00 | 00,159,812 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe PRC - [2005-01-28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe PRC - [2004-01-26 11:38:38 | 00,866,816 | ---- | M] (THOMSON Telecom Belgium) -- C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe PRC - [2005-07-13 10:37:36 | 14,679,552 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTHDCPL.EXE PRC - [2004-08-04 00:44:30 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe PRC - [2008-07-09 09:05:20 | 00,919,016 | ---- | M] (Zone Labs, LLC) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe PRC - [2004-10-05 17:00:12 | 00,061,440 | ---- | M] (France Télécom R&D) -- C:\Program Files\neostrada tp\TaskBarIcon.exe PRC - [2009-04-20 16:56:20 | 09,818,728 | ---- | M] (GG Network S.A.) -- C:\Program Files\Nowe Gadu-Gadu\gg.exe PRC - [2009-04-20 16:08:38 | 00,077,824 | ---- | M] () -- C:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe PRC - [2007-05-11 07:50:24 | 00,804,376 | ---- | M] ( ) -- C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe PRC - [2007-12-03 14:53:58 | 00,139,264 | ---- | M] () -- C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe PRC - [2005-12-06 14:53:30 | 00,819,200 | ---- | M] (France Télécom R&D) -- C:\Program Files\neostrada tp\neostradatp.exe PRC - [2005-11-22 12:54:18 | 00,249,856 | ---- | M] (France Télécom R&D) -- C:\Program Files\neostrada tp\ComComp.exe PRC - [2004-11-02 15:31:20 | 00,069,632 | ---- | M] (France Telecom R&D) -- C:\Program Files\neostrada tp\Toaster.exe PRC - [2004-10-27 11:30:44 | 00,032,768 | ---- | M] () -- C:\Program Files\neostrada tp\Inactivity.exe PRC - [2004-10-27 11:07:06 | 00,069,632 | ---- | M] () -- C:\Program Files\neostrada tp\PollingModule.exe PRC - [2004-10-21 08:50:52 | 00,045,056 | ---- | M] () -- C:\WINDOWS\system32\AlertModule\AlertModule.exe PRC - [2004-08-23 14:49:56 | 00,020,480 | ---- | M] (France Télécom R&D) -- C:\Program Files\neostrada tp\Watch.exe PRC - [2004-08-04 00:44:22 | 00,093,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe PRC - [2009-05-11 23:30:52 | 00,501,248 | ---- | M] (OldTimer Tools) -- D:\Antyviry\OTListIt2.exe [color=orange]========== Win32 Services (SafeList) ==========[/color] SRV - [2005-09-23 07:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped]) SRV - [2005-09-23 07:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) SRV - [2004-08-23 14:49:56 | 00,040,960 | ---- | M] (France Telecom) -- C:\WINDOWS\System32\FTRTSVC.exe -- (FTRTSVC [Auto | Running]) SRV - [2007-01-04 03:40:21 | 00,136,120 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc [On_Demand | Stopped]) SRV - [2004-08-04 00:44:08 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running]) SRV - [2008-04-15 17:59:38 | 00,071,096 | ---- | M] () -- C:\Program Files\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU [Auto | Running]) SRV - [2008-05-16 14:01:00 | 00,159,812 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc [Auto | Running]) SRV - [2005-01-28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe -- (UMWdf [Auto | Running]) SRV - [2008-07-09 09:05:18 | 00,075,304 | ---- | M] (Zone Labs, LLC) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- (vsmon [Auto | Running]) [color=orange]========== Driver Services (SafeList) ==========[/color] DRV - [2003-12-08 11:53:48 | 00,053,600 | ---- | M] (THOMSON) -- C:\WINDOWS\System32\DRIVERS\alcan5wn.sys -- (alcan5wn [On_Demand | Running]) DRV - [2003-12-08 11:53:46 | 00,070,688 | ---- | M] (THOMSON) -- C:\WINDOWS\System32\DRIVERS\alcaudsl.sys -- (alcaudsl [On_Demand | Running]) DRV - [2005-01-07 17:07:18 | 00,138,752 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\system32\DRIVERS\HDAudBus.sys -- (HDAudBus [On_Demand | Running]) DRV - [2005-07-13 17:26:52 | 03,851,264 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService [On_Demand | Running]) DRV - [2007-07-19 15:10:28 | 00,127,768 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\system32\DRIVERS\klif.sys -- (KLIF [System | Running]) DRV - [2008-05-16 14:01:00 | 06,557,408 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Running]) DRV - [2003-08-04 14:22:44 | 00,016,128 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) -- C:\WINDOWS\System32\PCANDIS5.SYS -- (PCANDIS5 [On_Demand | Stopped]) DRV - [2001-08-17 23:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running]) DRV - [2007-03-08 01:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running]) DRV - [2001-07-22 04:41:32 | 00,027,440 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped]) DRV - [2008-02-27 03:10:44 | 00,051,176 | ---- | M] (Zone Labs, LLC) -- C:\WINDOWS\system32\ZoneLabs\srescan.sys -- (srescan [Boot | Running]) DRV - [2008-07-09 09:05:22 | 00,394,952 | ---- | M] (Zone Labs, LLC) -- C:\WINDOWS\System32\vsdatant.sys -- (vsdatant [System | Running]) DRV - [2005-01-05 19:02:10 | 00,006,912 | ---- | M] (VIA Technologies, Inc.) -- C:\WINDOWS\System32\Drivers\vulfnth.sys -- (vulfnths [On_Demand | Stopped]) DRV - [2005-06-06 18:51:38 | 00,011,264 | ---- | M] (VIA Technologies, Inc.) -- C:\WINDOWS\System32\Drivers\vulfntr.sys -- (vulfntrs [On_Demand | Stopped]) [color=orange]========== Standard Registry (SafeList) ==========[/color] [color=orange]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ IE - URLSearchHook: {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\neostrada tp\SearchPageURL.dll () IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 O1 HOSTS File: (0 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (ZoneAlarm Spy Blocker BHO) - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL (ZoneAlarm) O3 - HKLM\..\Toolbar: (ZoneAlarm Spy Blocker) - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL (ZoneAlarm) O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] nwiz.exe /install () O4 - HKLM..\Run: [RTHDCPL] RTHDCPL.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon (THOMSON Telecom Belgium) O4 - HKLM..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe File not found O4 - HKLM..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe (France Télécom R&D) O4 - HKLM..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" (Zone Labs, LLC) O4 - HKCU..\Run: [ALLUpdate] "C:\Program Files\ALLPlayer\ALLUpdate.exe" "sleep" () O4 - HKCU..\Run: [Nowe Gadu-Gadu] "C:\Program Files\Nowe Gadu-Gadu\gg.exe" (GG Network S.A.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 227 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DisableRegistryTools = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0 O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O12 - Plugin for: .pdf - C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll (Adobe Systems Inc.) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab (System Requirements Lab Class) O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/products/plugin/autodl/jinstall-1_4_0_03-win.cab (Java Plug-in 1.4.0_03) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-1_4_0_03-win.cab (Java Plug-in 1.4.0_03) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008-07-22 19:40:41 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - File not found [color=orange]========== Files/Folders - Created Within 30 Days ==========[/color] [1 C:\WINDOWS\System32\*.tmp files] [3 C:\WINDOWS\*.tmp files] [2009-05-11 22:44:40 | 00,000,000 | ---- | C] () -- C:\rollback.ini [2009-05-11 22:13:51 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Karol\Dane aplikacji\MailFrontier [2009-05-11 22:12:55 | 00,227,616 | -HS- | C] () -- C:\WINDOWS\System32\drivers\fidbox.dat [2009-05-11 22:12:55 | 00,005,588 | -HS- | C] () -- C:\WINDOWS\System32\drivers\fidbox.idx [2009-05-11 20:52:16 | 00,000,000 | ---D | C] -- C:\Program Files\ZoneAlarmSB [2009-05-11 20:50:27 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\MailFrontier [2009-05-11 20:50:21 | 00,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat [2009-05-11 20:50:14 | 00,075,248 | ---- | C] (Zone Labs, LLC) -- C:\WINDOWS\zllsputility.exe [2009-05-11 20:50:14 | 00,011,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\SpOrder.dll [2009-05-11 20:50:05 | 00,127,768 | ---- | C] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\klif.sys [2009-05-11 20:50:01 | 00,796,048 | ---- | C] () -- C:\WINDOWS\System32\libeay32_0.9.6l.dll [2009-05-11 20:50:01 | 00,071,144 | ---- | C] (Zone Labs, LLC) -- C:\WINDOWS\System32\vsregexp.dll [2009-05-11 20:50:00 | 00,083,432 | ---- | C] (Zone Labs, LLC) -- C:\WINDOWS\System32\zlcomm.dll [2009-05-11 20:50:00 | 00,071,144 | ---- | C] (Zone Labs, LLC) -- C:\WINDOWS\System32\zlcommdb.dll [2009-05-11 20:49:53 | 00,046,568 | ---- | C] (Zone Labs, LLC) -- C:\WINDOWS\System32\vswmi.dll [2009-05-11 20:49:52 | 01,086,952 | ---- | C] (Python Software Foundation) -- C:\WINDOWS\System32\zpeng24.dll [2009-05-11 20:49:52 | 00,275,944 | ---- | C] (Zone Labs, LLC) -- C:\WINDOWS\System32\vspubapi.dll [2009-05-11 20:49:52 | 00,103,912 | ---- | C] (Zone Labs, LLC) -- C:\WINDOWS\System32\vsmonapi.dll [2009-05-11 20:49:52 | 00,099,816 | ---- | C] (Zone Labs, LLC) -- C:\WINDOWS\System32\vsxml.dll [2009-05-11 20:49:52 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\ZoneLabs [2009-05-11 20:49:52 | 00,000,000 | ---D | C] -- C:\Program Files\Zone Labs [2009-05-11 20:49:51 | 00,394,952 | ---- | C] (Zone Labs, LLC) -- C:\WINDOWS\System32\vsdatant.sys [2009-05-11 20:49:51 | 00,352,918 | ---- | C] () -- C:\WINDOWS\System32\vsconfig.xml [2009-05-11 20:49:12 | 00,472,552 | ---- | C] (Zone Labs, LLC) -- C:\WINDOWS\System32\vsutil.dll [2009-05-11 20:49:12 | 00,157,160 | ---- | C] (Zone Labs, LLC) -- C:\WINDOWS\System32\vsinit.dll [2009-05-11 20:49:12 | 00,083,432 | ---- | C] (Zone Labs, LLC) -- C:\WINDOWS\System32\vsdata.dll [2009-05-11 20:49:12 | 00,000,000 | ---D | C] -- C:\WINDOWS\Internet Logs [2009-05-11 20:15:29 | 00,000,000 | ---D | C] -- C:\rsit [2009-05-11 20:15:29 | 00,000,000 | ---D | C] -- C:\Program Files\trend micro [2009-05-11 20:04:26 | 00,000,000 | ---D | C] -- C:\Program Files\Nowe Gadu-Gadu [2009-05-11 20:03:54 | 20,837,080 | ---- | C] () -- C:\Program Files\nowegg.exe [2009-05-11 18:47:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Karol\Pulpit\buty nr 1 [2009-05-11 18:31:36 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Karol\Pulpit\100PENTX [2009-04-25 15:07:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Karol\Pulpit\Nowy folder [2009-04-25 09:57:19 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\appmgmt [2009-04-23 22:52:15 | 00,198,134 | ---- | C] () -- C:\Documents and Settings\Karol\Pulpit\wniosek_odbyce_praktyki.pdf [2009-04-23 22:02:24 | 00,278,528 | ---- | C] (Real Networks, Inc) -- C:\WINDOWS\System32\pncrt.dll [2009-04-23 22:02:22 | 00,499,712 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcp71.dll [2009-04-23 22:02:22 | 00,348,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcr71.dll [2009-04-23 22:02:22 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Real [2009-04-23 21:53:53 | 00,000,000 | ---D | C] -- C:\Program Files\NAPI-PROJEKT [2009-04-23 21:51:53 | 00,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009-04-23 21:51:52 | 00,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini [2009-04-23 21:51:45 | 00,000,414 | ---- | C] () -- C:\WINDOWS\System32\lame_acm.xml [2009-04-23 21:51:44 | 00,860,160 | ---- | C] (http://www.mp3dev.org/) -- C:\WINDOWS\System32\lameACM.acm [2009-04-23 21:51:44 | 00,217,088 | ---- | C] (www.helixcommunity.org) -- C:\WINDOWS\System32\yv12vfw.dll [2009-04-23 21:51:43 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2009-04-23 21:51:43 | 00,755,027 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2009-04-23 21:51:43 | 00,159,839 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009-04-23 21:51:43 | 00,081,920 | ---- | C] (DivX, Inc.) -- C:\WINDOWS\System32\dpl100.dll [2009-04-23 21:51:34 | 00,683,520 | ---- | C] (DivX, Inc.) -- C:\WINDOWS\System32\divx.dll [2009-04-23 21:51:33 | 00,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009-04-23 21:51:33 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009-04-23 21:51:31 | 00,000,000 | ---D | C] -- C:\Program Files\K-Lite Codec Pack [2009-04-23 20:43:26 | 00,000,000 | ---D | C] -- C:\Program Files\ALLPlayer [2009-04-23 20:39:11 | 00,000,000 | ---- | C] () -- C:\WINDOWS\bestplayer.bbt [2009-04-16 21:06:28 | 00,425,550 | ---- | C] () -- C:\Documents and Settings\Karol\Moje dokumenty\In The.mp3 [2009-04-16 20:11:38 | 05,415,040 | ---- | C] () -- C:\Documents and Settings\Karol\Moje dokumenty\05 here i am (come and take me).mp3 [2009-04-16 20:08:11 | 00,286,788 | ---- | C] () -- C:\Documents and Settings\Karol\Moje dokumenty\Lohan.mp3 [2009-04-16 20:06:43 | 00,711,434 | ---- | C] () -- C:\Documents and Settings\Karol\Moje dokumenty\wild west 2.mp3 [2009-04-16 20:04:22 | 00,706,001 | ---- | C] () -- C:\Documents and Settings\Karol\Moje dokumenty\hey.mp3 [2009-04-16 20:02:13 | 00,561,805 | ---- | C] () -- C:\Documents and Settings\Karol\Moje dokumenty\Research.mp3 [2008-09-16 15:44:30 | 00,176,235 | ---- | C] () -- C:\WINDOWS\System32\Primomonnt.dll [2008-07-23 01:55:39 | 00,003,234 | ---- | C] () -- C:\WINDOWS\VPlayer.INI [2008-07-22 23:52:40 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\vusetup.dll [2008-07-22 23:40:11 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2008-07-22 20:29:54 | 00,005,606 | ---- | C] () -- C:\WINDOWS\System32\stci.dll [2008-07-22 20:29:09 | 00,041,068 | ---- | C] () -- C:\WINDOWS\System32\ActPanel.dll [2008-05-16 14:01:00 | 01,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2008-05-16 14:01:00 | 01,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2008-05-16 14:01:00 | 01,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2008-05-16 14:01:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2008-05-16 14:01:00 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2006-11-07 00:49:36 | 00,000,310 | ---- | C] () -- C:\WINDOWS\primopdf.ini [2001-07-22 04:41:32 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2001-07-22 00:16:20 | 00,000,519 | ---- | C] () -- C:\WINDOWS\win.ini [2001-07-22 00:15:52 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini [color=orange]========== Files - Modified Within 30 Days ==========[/color] [1 C:\WINDOWS\System32\*.tmp files] [3 C:\WINDOWS\*.tmp files] [2009-05-11 23:34:07 | 00,301,088 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.dat [2009-05-11 23:32:55 | 00,984,778 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009-05-11 23:32:55 | 00,448,348 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2009-05-11 23:32:55 | 00,392,432 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2009-05-11 23:32:55 | 00,074,450 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2009-05-11 23:32:55 | 00,058,732 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2009-05-11 23:28:41 | 00,000,104 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml [2009-05-11 23:28:40 | 00,352,918 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml [2009-05-11 23:28:36 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-05-11 23:28:33 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\Karol\Ustawienia lokalne\desktop.ini [2009-05-11 23:28:31 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-05-11 23:27:32 | 00,000,519 | ---- | M] () -- C:\WINDOWS\win.ini [2009-05-11 23:27:32 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2009-05-11 23:27:32 | 00,000,211 | RHS- | M] () -- C:\boot.ini [2009-05-11 23:25:25 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2009-05-11 23:20:53 | 00,005,588 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.idx [2009-05-11 22:44:40 | 00,000,000 | ---- | M] () -- C:\rollback.ini [2009-05-11 22:14:33 | 00,004,212 | -H-- | M] () -- C:\WINDOWS\System32\zllictbl.dat [2009-05-07 15:51:35 | 00,002,262 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009-04-23 22:52:15 | 00,198,134 | ---- | M] () -- C:\Documents and Settings\Karol\Pulpit\wniosek_odbyce_praktyki.pdf [2009-04-23 21:46:20 | 00,003,234 | ---- | M] () -- C:\WINDOWS\VPlayer.INI [2009-04-23 21:46:20 | 00,000,108 | ---- | M] () -- C:\WINDOWS\VplayerINI.vpl [2009-04-23 20:39:11 | 00,000,000 | ---- | M] () -- C:\WINDOWS\bestplayer.bbt [2009-04-19 22:26:26 | 00,030,720 | -HS- | M] () -- C:\Documents and Settings\Karol\Pulpit\Thumbs.db [2009-04-16 21:06:42 | 00,425,550 | ---- | M] () -- C:\Documents and Settings\Karol\Moje dokumenty\In The.mp3 [2009-04-16 20:14:25 | 05,415,040 | ---- | M] () -- C:\Documents and Settings\Karol\Moje dokumenty\05 here i am (come and take me).mp3 [2009-04-16 20:08:21 | 00,286,788 | ---- | M] () -- C:\Documents and Settings\Karol\Moje dokumenty\Lohan.mp3 [2009-04-16 20:07:06 | 00,711,434 | ---- | M] () -- C:\Documents and Settings\Karol\Moje dokumenty\wild west 2.mp3 [2009-04-16 20:04:44 | 00,706,001 | ---- | M] () -- C:\Documents and Settings\Karol\Moje dokumenty\hey.mp3 [2009-04-16 20:02:31 | 00,561,805 | ---- | M] () -- C:\Documents and Settings\Karol\Moje dokumenty\Research.mp3 [2009-04-15 17:39:43 | 00,096,632 | ---- | M] () -- C:\Documents and Settings\Karol\Pulpit\list motywacyjny Karol Grejbus.pdf [2009-04-15 17:39:24 | 00,000,310 | ---- | M] () -- C:\Documents and Settings\Karol\Dane aplikacji\APUSet.xml [2009-04-15 17:39:21 | 00,096,632 | ---- | M] () -- C:\Documents and Settings\Karol\Moje dokumenty\263ad listu motywacyjnego).pdf [2009-04-15 17:39:21 | 00,006,535 | ---- | M] () -- C:\Documents and Settings\Karol\Dane aplikacji\PrimoPDFSet.xml < End of report >

2 log

Kod: Zaznacz wszystko: OTListIt Extras logfile created on: 2009-05-11 23:31:16 - Run 1 OTListIt2 by OldTimer - Version 2.0.15.6 Folder = D:\Antyviry Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1023,48 Mb Total Physical Memory | 449,11 Mb Available Physical Memory | 43,88% Memory free 2,40 Gb Paging File | 1,90 Gb Available in Paging File | 78,95% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 24,41 Gb Total Space | 15,59 Gb Free Space | 63,86% Space Free | Partition Type: NTFS Drive D: | 78,13 Gb Total Space | 17,33 Gb Free Space | 22,18% Space Free | Partition Type: NTFS Drive E: | 83,74 Gb Total Space | 2,54 Gb Free Space | 3,03% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: GREJD Current User Name: Karol Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Standard File Age = 30 Days Company Name Whitelist: On [color=orange]========== File Associations ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .html [@ = htmlfile] -- C:\Program Files\Internet Explorer\IEXPLORE.EXE (Microsoft Corporation) [HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>] .html [@ = htmlfile] -- Reg Error: Key error. File not found [color=orange]========== Security Center Settings ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 1 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] "DisableMonitoring" = 1 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile "EnableFirewall" = 1 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile "EnableFirewall" = 0 HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List [color=orange]========== Authorized Applications List ==========[/color] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] File not found -- C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program glowny [2006-06-12 17:33:10 | 20,002,856 | ---- | M] () -- C:\Program Files\Skype\Phone\Skype.exe:*:Enabled:Skype. The whole world can talk for free. [color=orange]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{2B29EAF9-352F-4A0D-8CB1-D34113993DB7}" = OpenOffice.org 2.0.2 "{350C97C2-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{7131646D-CD3C-40F4-97B9-CD9E4E6262EF}" = Microsoft .NET Framework 2.0 "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP "{AC1E4C93-C1E7-11D6-9D10-00010240CE95}" = Java 2 Runtime Environment, SE v1.4.0_03 "{AC76BA86-7AD7-1038-7B44-CEA000000001}" = Adobe Reader 6.0.2 CE "{D41FAAA9-8048-4906-86B2-9AADEA1FA0B7}" = SpeedTouch USB Software "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX "ALLPlayer_is1" = ALLPlayer V3.X "GameDesire-Pool & Snooker" = GameDesire-Pool & Snooker "HijackThis" = HijackThis 1.99.1 "IrfanView" = IrfanView (remove only) "KLiteCodecPack_is1" = K-Lite Codec Pack 4.1.7 (Full) "Microsoft .NET Framework 2.0" = Microsoft .NET Framework 2.0 "neostradatp.exe" = neostrada tp "Nowe Gadu-Gadu" = Nowe Gadu-Gadu "NVIDIA Drivers" = NVIDIA Drivers "Odkurzacz 11.3_is1" = Odkurzacz 11.3 "Picasa2" = Picasa 2 "PKR" = PKR "PrimoPDF4.0.1" = PrimoPDF "RealAlt_is1" = Real Alternative 1.9.0 "Skype_is1" = Skype 2.5 "SystemRequirementsLab" = System Requirements Lab "Winamp" = Winamp "Windows Media Format Runtime" = Windows Media Format Runtime "Windows XP Service Pack" = Windows XP Service Pack 2 "WinRAR archiver" = Archiwizator WinRAR "ZoneAlarm" = ZoneAlarm "ZoneAlarmSB Uninstall" = ZoneAlarm Spy Blocker [color=orange]========== Last 10 Event Log Errors ==========[/color] [ Application Events ] Error - 2009-01-11 14:12:55 | Computer Name = GREJD | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd iexplore.exe, wersja 6.0.2900.2180, moduł powodujący błąd mshtml.dll, wersja 6.0.2900.2180, adres błędu 0x000663ce. Error - 2009-01-11 17:03:14 | Computer Name = GREJD | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd gg.exe, wersja 7.1.0.6, moduł powodujący błąd unknown, wersja 0.0.0.0, adres błędu 0x00f403aa. Error - 2009-01-18 11:22:52 | Computer Name = GREJD | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd iexplore.exe, wersja 6.0.2900.2180, moduł powodujący błąd mshtml.dll, wersja 6.0.2900.2180, adres błędu 0x0012bd68. Error - 2009-01-20 15:18:50 | Computer Name = GREJD | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd iexplore.exe, wersja 6.0.2900.2180, moduł powodujący błąd mshtml.dll, wersja 6.0.2900.2180, adres błędu 0x000663ce. Error - 2009-01-20 18:01:36 | Computer Name = GREJD | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd iexplore.exe, wersja 6.0.2900.2180, moduł powodujący błąd unknown, wersja 0.0.0.0, adres błędu 0x62160b80. Error - 2009-01-25 09:20:36 | Computer Name = GREJD | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca iexplore.exe, wersja 6.0.2900.2180, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-01-25 09:21:26 | Computer Name = GREJD | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca iexplore.exe, wersja 6.0.2900.2180, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2009-01-29 13:43:48 | Computer Name = GREJD | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd iexplore.exe, wersja 6.0.2900.2180, moduł powodujący błąd kernel32.dll, wersja 5.1.2600.2180, adres błędu 0x00009e9c. Error - 2009-02-02 18:13:14 | Computer Name = GREJD | Source = Application Error | ID = 1000 Description = Aplikacja powodująca błąd gg.exe, wersja 7.1.0.6, moduł powodujący błąd unknown, wersja 0.0.0.0, adres błędu 0x00f403aa. Error - 2009-02-06 19:50:46 | Computer Name = GREJD | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca iexplore.exe, wersja 6.0.2900.2180, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. [ System Events ] Error - 2009-05-11 17:23:10 | Computer Name = GREJD | Source = Service Control Manager | ID = 7001 Description = Usługa TrueVector Internet Monitor zależy od usługi vsdatant, której nie można uruchomić z powodu następującego błędu: %%31 Error - 2009-05-11 17:23:10 | Computer Name = GREJD | Source = Service Control Manager | ID = 7001 Description = Usługa Usługi IPSEC zależy od usługi Sterownik IPSEC, której nie można uruchomić z powodu następującego błędu: %%31 Error - 2009-05-11 17:23:10 | Computer Name = GREJD | Source = Service Control Manager | ID = 7026 Description = Nie można załadować następujących sterowników startu rozruchowego lub systemowego: AFD Fips intelppm IPSec KLIF MRxSmb NetBIOS RasAcd Rdbss Tcpip vsdatant Error - 2009-05-11 17:25:52 | Computer Name = GREJD | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd „%1084” podczas próby uruchomienia usługi netman z argumentami „” w celu uruchomienia serwera: {BA126AE5-2166-11D1-B1D0-00805FC1270E} Error - 2009-05-11 17:25:58 | Computer Name = GREJD | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd „%1084” podczas próby uruchomienia usługi EventSystem z argumentami „” w celu uruchomienia serwera: {1BE1F766-5536-11D1-B726-00C04FB926AF} Error - 2009-05-11 17:27:19 | Computer Name = GREJD | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd „%1084” podczas próby uruchomienia usługi netman z argumentami „” w celu uruchomienia serwera: {BA126AE5-2166-11D1-B1D0-00805FC1270E} Error - 2009-05-11 17:27:24 | Computer Name = GREJD | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd „%1084” podczas próby uruchomienia usługi EventSystem z argumentami „” w celu uruchomienia serwera: {1BE1F766-5536-11D1-B726-00C04FB926AF} Error - 2009-05-11 17:27:37 | Computer Name = GREJD | Source = DCOM | ID = 10005 Description = Model DCOM odebrał błąd „%1084” podczas próby uruchomienia usługi EventSystem z argumentami „” w celu uruchomienia serwera: {1BE1F766-5536-11D1-B726-00C04FB926AF} Error - 2009-05-11 17:28:37 | Computer Name = GREJD | Source = Service Control Manager | ID = 7001 Description = Usługa Klient DHCP zależy od usługi NetBios przez TCP/IP, której nie można uruchomić z powodu następującego błędu: %%1058 Error - 2009-05-11 17:28:37 | Computer Name = GREJD | Source = Service Control Manager | ID = 7001 Description = Usługa Pomoc TCP/IP NetBIOS zależy od usługi NetBios przez TCP/IP, której nie można uruchomić z powodu następującego błędu: %%1058 < End of report >

**Posty:** 18165 · przez **wojtas** 12 Maj 2009, 08:57

Uruchom OTListIt2 i w oknie Custom Scans/Fixes wklej :

:OTLI
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O4 - HKLM..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k File not found

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 49 · przez **grejd** 21 Maj 2009, 18:54

Witam sorry ze po takiej przerwie ale mialem wyjazd, wszystko wykonalem wg. wskazowek, niestety ale komp dalej przymula przy otwieraniu niektorych stron lub wrecz wogole ich nie otwiera, podobnie jest przy ogladaniu filmow na youtubie czasami moge cos obejrzec, czasem wogole nie chce odpalic filmiku, gg nowe nie dzialalo wiec wrocilem do starego i dopiero zaczelo dzialac sciana

Bardzo czesto wyskakuje blad na stronie

Raport z FixiEDef Log

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.6.10.6277 * * * ******************************************************************************** Created at 18:48:34 on Thursday, May 21, 2009 Time Zone : Logged On User : Karol Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 Intel(R) Pentium(R) 4 CPU 3.00GHz System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 25 GB System Drive Free : 15.33 GB Total Physical Memory: 1023 MB Free Physical Memory : 593 MB Total Page File : 1023 MB Free Page File : 1908 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1969 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

**Posty:** 18165 · przez **wojtas** 21 Maj 2009, 20:36

a raport z kaspra??

**Posty:** 49 · przez **grejd** 22 Maj 2009, 07:40

RAPORT KASPERSKY ONLINE SCANNER 7.0

Kod: Zaznacz wszystko: -------------------------------------------------------------------------------- piątek, 22 maj 2009 System operacyjny: Microsoft Windows XP Professional Dodatek Service Pack 2 (build 2600) Wersja Kaspersky Online Scanner: 7.0.26.12 Data ostatniej aktualizacji bazy danych: Thursday, May 21, 2009 21:16:26 Liczba wpisów: 2211439 -------------------------------------------------------------------------------- Ustawienia skanowania: Typ bazy danych użytej do skanowania: rozszerzona Skanuj archiwa: tak Skanuj pocztowe bazy danych: tak Obszar skanowania - Mój komputer: A:\ C:\ D:\ E:\ F:\ Statystyki skanowania: Przeskanowanych plików: 89124 Nazwa zagrożenia: 2 Zainfekowanych obiektów: 2 Podejrzanych obiektów: 0 Czas skanowania: 04:09:03 Nazwa pliku / Nazwa zagrożenia / Liczba zagrożeń C:\Documents and Settings\Karol\Ustawienia lokalne\ayhnevm.vvq Zainfekowany: Trojan-PSW.Win32.Kates.c 1 E:\pkrinstall.exe Zainfekowany: not-a-virus:Monitor.Win32.PKRPoker.e 1 Wybrany obszar został przeskanowany.

OTlist scan

Kod: Zaznacz wszystko: OTListIt logfile created on: 2009-05-22 07:34:37 - Run 2 OTListIt2 by OldTimer - Version 2.0.15.6 Folder = D:\Antyviry Windows XP Professional Edition Dodatek Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.2180) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 1023,48 Mb Total Physical Memory | 541,73 Mb Available Physical Memory | 52,93% Memory free 2,40 Gb Paging File | 1,50 Gb Available in Paging File | 62,54% Paging File free Paging file location(s): C:\pagefile.sys 1536 3072 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 24,41 Gb Total Space | 14,89 Gb Free Space | 60,98% Space Free | Partition Type: NTFS Drive D: | 78,13 Gb Total Space | 42,03 Gb Free Space | 53,79% Space Free | Partition Type: NTFS Drive E: | 83,74 Gb Total Space | 7,27 Gb Free Space | 8,68% Space Free | Partition Type: NTFS F: Drive not present or media not loaded G: Drive not present or media not loaded H: Drive not present or media not loaded I: Drive not present or media not loaded Computer Name: GREJD Current User Name: Karol Logged in as Administrator. Current Boot Mode: Normal Scan Mode: Current user Output = Standard File Age = 30 Days Company Name Whitelist: On [color=orange]========== Processes (SafeList) ==========[/color] PRC - [2009-03-31 19:20:50 | 02,404,232 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe PRC - [2009-03-31 17:18:14 | 00,143,360 | ---- | M] (Kaspersky Lab.) -- C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe PRC - [2004-08-23 14:49:56 | 00,040,960 | ---- | M] (France Telecom) -- C:\WINDOWS\System32\FTRTSVC.exe PRC - [2009-05-14 17:49:29 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe PRC - [2008-04-15 17:59:38 | 00,071,096 | ---- | M] () -- C:\Program Files\CDBurnerXP\NMSAccessU.exe PRC - [2008-05-16 14:01:00 | 00,159,812 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe PRC - [2005-01-28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe PRC - [2009-03-31 17:18:14 | 00,143,360 | ---- | M] (Kaspersky Lab.) -- C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe PRC - [2004-01-26 11:38:38 | 00,866,816 | ---- | M] (THOMSON Telecom Belgium) -- C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe PRC - [2005-07-13 10:37:36 | 14,679,552 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\RTHDCPL.EXE PRC - [2009-03-31 19:20:50 | 00,982,408 | ---- | M] (Check Point Software Technologies LTD) -- C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe PRC - [2009-05-14 17:49:29 | 00,148,888 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jusched.exe PRC - [2008-03-20 12:04:46 | 02,127,296 | ---- | M] (Gadu-Gadu S.A.) -- C:\Program Files\Gadu-Gadu\gg.exe PRC - [2004-08-04 00:44:30 | 00,013,824 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wscntfy.exe PRC - [2009-02-05 16:57:26 | 00,869,648 | ---- | M] (SonicWALL, Inc.) -- C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe PRC - [2005-12-06 14:53:30 | 00,819,200 | ---- | M] (France Télécom R&D) -- C:\Program Files\neostrada tp\neostradatp.exe PRC - [2005-11-22 12:54:18 | 00,249,856 | ---- | M] (France Télécom R&D) -- C:\Program Files\neostrada tp\ComComp.exe PRC - [2004-11-02 15:31:20 | 00,069,632 | ---- | M] (France Telecom R&D) -- C:\Program Files\neostrada tp\Toaster.exe PRC - [2004-10-27 11:30:44 | 00,032,768 | ---- | M] () -- C:\Program Files\neostrada tp\Inactivity.exe PRC - [2004-10-27 11:07:06 | 00,069,632 | ---- | M] () -- C:\Program Files\neostrada tp\PollingModule.exe PRC - [2004-10-21 08:50:52 | 00,045,056 | ---- | M] () -- C:\WINDOWS\system32\AlertModule\AlertModule.exe PRC - [2004-08-23 14:49:56 | 00,020,480 | ---- | M] (France Télécom R&D) -- C:\Program Files\neostrada tp\Watch.exe PRC - [2004-08-04 00:44:20 | 01,033,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2004-08-04 00:44:22 | 00,093,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe PRC - [2009-05-14 17:49:28 | 00,144,792 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\java.exe PRC - [2009-05-21 21:21:59 | 00,139,264 | ---- | M] (Kaspersky Lab.) -- C:\Documents and Settings\Karol\Ustawienia lokalne\temp\jkos-Karol\binaries\ScanningProcess.exe PRC - [2009-05-21 21:21:59 | 00,139,264 | ---- | M] (Kaspersky Lab.) -- C:\Documents and Settings\Karol\Ustawienia lokalne\temp\jkos-Karol\binaries\ScanningProcess.exe PRC - [2004-08-04 00:44:22 | 00,093,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Internet Explorer\iexplore.exe PRC - [2009-05-11 23:30:52 | 00,501,248 | ---- | M] (OldTimer Tools) -- D:\Antyviry\OTListIt2.exe [color=orange]========== Win32 Services (SafeList) ==========[/color] SRV - [2005-09-23 07:28:32 | 00,029,896 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe -- (aspnet_state [On_Demand | Stopped]) SRV - [2005-09-23 07:28:56 | 00,066,240 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) SRV - [2004-08-23 14:49:56 | 00,040,960 | ---- | M] (France Telecom) -- C:\WINDOWS\System32\FTRTSVC.exe -- (FTRTSVC [Auto | Running]) SRV - [2007-01-04 03:40:21 | 00,136,120 | ---- | M] (Google) -- C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe -- (gusvc [On_Demand | Stopped]) SRV - [2004-08-04 00:44:08 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\PCHealth\HelpCtr\Binaries\pchsvc.dll -- (helpsvc [Auto | Running]) SRV - [2009-05-14 17:49:29 | 00,152,984 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Java\jre6\bin\jqs.exe -- (JavaQuickStarterService [Auto | Running]) SRV - [2008-04-15 17:59:38 | 00,071,096 | ---- | M] () -- C:\Program Files\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU [Auto | Running]) SRV - [2008-05-16 14:01:00 | 00,159,812 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\nvsvc32.exe -- (NVSvc [Auto | Running]) SRV - [2005-01-28 13:44:28 | 00,038,912 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\wdfmgr.exe -- (UMWdf [Auto | Running]) SRV - [2009-03-31 19:20:50 | 02,404,232 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- (vsmon [Auto | Running]) [color=orange]========== Driver Services (SafeList) ==========[/color] DRV - [2003-12-08 11:53:48 | 00,053,600 | ---- | M] (THOMSON) -- C:\WINDOWS\System32\DRIVERS\alcan5wn.sys -- (alcan5wn [On_Demand | Running]) DRV - [2003-12-08 11:53:46 | 00,070,688 | ---- | M] (THOMSON) -- C:\WINDOWS\System32\DRIVERS\alcaudsl.sys -- (alcaudsl [On_Demand | Running]) DRV - [2005-01-07 17:07:18 | 00,138,752 | ---- | M] (Windows (R) Server 2003 DDK provider) -- C:\WINDOWS\system32\DRIVERS\HDAudBus.sys -- (HDAudBus [On_Demand | Running]) DRV - [2005-07-13 17:26:52 | 03,851,264 | ---- | M] (Realtek Semiconductor Corp.) -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService [On_Demand | Running]) DRV - [2009-03-31 17:18:30 | 00,150,544 | ---- | M] (Kaspersky Lab) -- C:\WINDOWS\system32\DRIVERS\klif.sys -- (KLIF [System | Running]) DRV - [2008-05-16 14:01:00 | 06,557,408 | ---- | M] (NVIDIA Corporation) -- C:\WINDOWS\system32\DRIVERS\nv4_mini.sys -- (nv [On_Demand | Running]) DRV - [2003-08-04 14:22:44 | 00,016,128 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) -- C:\WINDOWS\System32\PCANDIS5.SYS -- (PCANDIS5 [On_Demand | Stopped]) DRV - [2001-08-17 23:49:56 | 00,017,792 | ---- | M] (Parallel Technologies, Inc.) -- C:\WINDOWS\System32\DRIVERS\ptilink.sys -- (Ptilink [On_Demand | Running]) DRV - [2007-03-08 01:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) -- C:\WINDOWS\System32\Drivers\PxHelp20.sys -- (PxHelp20 [Boot | Running]) DRV - [2001-07-22 04:41:32 | 00,027,440 | ---- | M] () -- C:\WINDOWS\System32\DRIVERS\secdrv.sys -- (Secdrv [On_Demand | Stopped]) DRV - [2008-11-17 02:24:00 | 00,051,688 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\system32\ZoneLabs\srescan.sys -- (srescan [Boot | Running]) DRV - [2009-03-31 19:20:54 | 00,353,672 | ---- | M] (Check Point Software Technologies LTD) -- C:\WINDOWS\System32\vsdatant.sys -- (vsdatant [System | Running]) DRV - [2005-01-05 19:02:10 | 00,006,912 | ---- | M] (VIA Technologies, Inc.) -- C:\WINDOWS\System32\Drivers\vulfnth.sys -- (vulfnths [On_Demand | Stopped]) DRV - [2005-06-06 18:51:38 | 00,011,264 | ---- | M] (VIA Technologies, Inc.) -- C:\WINDOWS\System32\Drivers\vulfntr.sys -- (vulfntrs [On_Demand | Stopped]) [color=orange]========== Standard Registry (SafeList) ==========[/color] [color=orange]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.microsoft.com/isapi/redir.dll?prd={SUB_PRD}&clcid={SUB_CLSID}&pver={SUB_PVER}&ar=home IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,CustomizeSearch = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Page_Transitions = 1 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ IE - URLSearchHook: {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\neostrada tp\SearchPageURL.dll () IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 FF - HKLM\software\mozilla\Firefox\Extensions\\jqs@sun.com: C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF [2009-05-14 17:49:30 | 00,000,000 | ---D | M] O1 HOSTS File: (0 bytes) - C:\WINDOWS\System32\drivers\etc\Hosts O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (JQSIEStartDetectorImpl Class) - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll (Sun Microsystems, Inc.) O2 - BHO: (ZoneAlarm Spy Blocker BHO) - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL (ZoneAlarm) O3 - HKLM\..\Toolbar: (ZoneAlarm Spy Blocker) - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL (ZoneAlarm) O4 - HKLM..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit (NVIDIA Corporation) O4 - HKLM..\Run: [RTHDCPL] RTHDCPL.EXE (Realtek Semiconductor Corp.) O4 - HKLM..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon (THOMSON Telecom Belgium) O4 - HKLM..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" (Sun Microsystems, Inc.) O4 - HKLM..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" (Check Point Software Technologies LTD) O4 - HKCU..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray (Gadu-Gadu S.A.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 227 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLegacyLogonScripts = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideLogoffScripts = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: HideStartupScripts = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunLogonScriptSync = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: RunStartupScriptSync = 0 O9 - Extra Button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O9 - Extra 'Tools' menuitem : Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (Microsoft Corporation) O12 - Plugin for: .pdf - C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll (Adobe Systems Inc.) O15 - HKLM\..Trusted Domains: 1 domain(s) and sub-domain(s) not assigned to a zone. O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control) O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab (System Requirements Lab Class) O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab (NVIDIA Smart Scan) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-1_4_0_03-win.cab (Java Plug-in 1.4.0_03) O16 - DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab (Java Plug-in 1.6.0_13) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files\Common Files\System\Ole DB\msdaipp.dll (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\Explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2008-07-22 19:40:41 | 00,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\WINDOWS\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - File not found [color=orange]========== Files/Folders - Created Within 30 Days ==========[/color] [1 C:\WINDOWS\System32\*.tmp files] [3 C:\WINDOWS\*.tmp files] [2009-05-22 07:30:11 | 00,003,207 | ---- | C] () -- C:\Documents and Settings\Karol\Pulpit\kaspersky.html [2009-05-21 21:20:49 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files [2009-05-14 17:50:27 | 00,000,000 | ---D | C] -- C:\WINDOWS\Sun [2009-05-14 17:46:55 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Karol\Dane aplikacji\Sun [2009-05-12 11:06:57 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Karol\Dane aplikacji\Gadu-Gadu [2009-05-11 23:50:36 | 00,150,544 | ---- | C] (Kaspersky Lab) -- C:\WINDOWS\System32\drivers\klif.sys [2009-05-11 23:46:52 | 00,014,048 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\spmsg.dll [2009-05-11 23:46:42 | 00,713,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\sxs.dll [2009-05-11 22:44:40 | 00,002,541 | ---- | C] () -- C:\rollback.ini [2009-05-11 22:13:51 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Karol\Dane aplikacji\MailFrontier [2009-05-11 22:12:55 | 12,373,0464 | -HS- | C] () -- C:\WINDOWS\System32\drivers\fidbox.dat [2009-05-11 22:12:55 | 01,570,460 | -HS- | C] () -- C:\WINDOWS\System32\drivers\fidbox.idx [2009-05-11 20:52:16 | 00,000,000 | ---D | C] -- C:\Program Files\ZoneAlarmSB [2009-05-11 20:50:27 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\MailFrontier [2009-05-11 20:50:21 | 00,004,212 | -H-- | C] () -- C:\WINDOWS\System32\zllictbl.dat [2009-05-11 20:50:14 | 00,011,264 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\SpOrder.dll [2009-05-11 20:50:01 | 00,796,048 | ---- | C] () -- C:\WINDOWS\System32\libeay32_0.9.6l.dll [2009-05-11 20:49:52 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\ZoneLabs [2009-05-11 20:49:52 | 00,000,000 | ---D | C] -- C:\Program Files\Zone Labs [2009-05-11 20:49:51 | 00,351,218 | ---- | C] () -- C:\WINDOWS\System32\vsconfig.xml [2009-05-11 20:49:12 | 00,000,000 | ---D | C] -- C:\WINDOWS\Internet Logs [2009-05-11 20:15:29 | 00,000,000 | ---D | C] -- C:\Program Files\trend micro [2009-05-11 20:03:54 | 20,837,080 | ---- | C] () -- C:\Program Files\nowegg.exe [2009-05-11 18:47:04 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Karol\Pulpit\buty nr 1 [2009-04-25 15:07:11 | 00,000,000 | ---D | C] -- C:\Documents and Settings\Karol\Pulpit\Nowy folder [2009-04-25 09:57:19 | 00,000,000 | ---D | C] -- C:\WINDOWS\System32\appmgmt [2009-04-23 22:52:15 | 00,198,134 | ---- | C] () -- C:\Documents and Settings\Karol\Pulpit\wniosek_odbyce_praktyki.pdf [2009-04-23 22:02:24 | 00,278,528 | ---- | C] (Real Networks, Inc) -- C:\WINDOWS\System32\pncrt.dll [2009-04-23 22:02:22 | 00,499,712 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcp71.dll [2009-04-23 22:02:22 | 00,348,160 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\msvcr71.dll [2009-04-23 22:02:22 | 00,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Real [2009-04-23 21:53:53 | 00,000,000 | ---D | C] -- C:\Program Files\NAPI-PROJEKT [2009-04-23 21:51:53 | 00,164,352 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2009-04-23 21:51:52 | 00,000,038 | ---- | C] () -- C:\WINDOWS\avisplitter.ini [2009-04-23 21:51:45 | 00,000,414 | ---- | C] () -- C:\WINDOWS\System32\lame_acm.xml [2009-04-23 21:51:44 | 00,860,160 | ---- | C] (http://www.mp3dev.org/) -- C:\WINDOWS\System32\lameACM.acm [2009-04-23 21:51:44 | 00,217,088 | ---- | C] (www.helixcommunity.org) -- C:\WINDOWS\System32\yv12vfw.dll [2009-04-23 21:51:43 | 03,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2009-04-23 21:51:43 | 00,755,027 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2009-04-23 21:51:43 | 00,159,839 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2009-04-23 21:51:43 | 00,081,920 | ---- | C] (DivX, Inc.) -- C:\WINDOWS\System32\dpl100.dll [2009-04-23 21:51:34 | 00,683,520 | ---- | C] (DivX, Inc.) -- C:\WINDOWS\System32\divx.dll [2009-04-23 21:51:33 | 00,007,680 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2009-04-23 21:51:33 | 00,000,547 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll.manifest [2009-04-23 21:51:31 | 00,000,000 | ---D | C] -- C:\Program Files\K-Lite Codec Pack [2009-04-23 20:43:26 | 00,000,000 | ---D | C] -- C:\Program Files\ALLPlayer [2009-04-23 20:39:11 | 00,000,000 | ---- | C] () -- C:\WINDOWS\bestplayer.bbt [2008-09-16 15:44:30 | 00,176,235 | ---- | C] () -- C:\WINDOWS\System32\Primomonnt.dll [2008-07-23 01:55:39 | 00,003,129 | ---- | C] () -- C:\WINDOWS\VPlayer.INI [2008-07-22 23:52:40 | 00,045,056 | ---- | C] () -- C:\WINDOWS\System32\vusetup.dll [2008-07-22 23:40:11 | 00,081,920 | ---- | C] () -- C:\WINDOWS\System32\ieencode.dll [2008-07-22 20:29:54 | 00,005,606 | ---- | C] () -- C:\WINDOWS\System32\stci.dll [2008-07-22 20:29:09 | 00,041,068 | ---- | C] () -- C:\WINDOWS\System32\ActPanel.dll [2008-05-16 14:01:00 | 01,703,936 | ---- | C] () -- C:\WINDOWS\System32\nvwdmcpl.dll [2008-05-16 14:01:00 | 01,486,848 | ---- | C] () -- C:\WINDOWS\System32\nview.dll [2008-05-16 14:01:00 | 01,019,904 | ---- | C] () -- C:\WINDOWS\System32\nvwimg.dll [2008-05-16 14:01:00 | 00,466,944 | ---- | C] () -- C:\WINDOWS\System32\nvshell.dll [2008-05-16 14:01:00 | 00,286,720 | ---- | C] () -- C:\WINDOWS\System32\nvnt4cpl.dll [2006-11-07 00:49:36 | 00,000,310 | ---- | C] () -- C:\WINDOWS\primopdf.ini [2001-07-22 04:41:32 | 00,027,440 | ---- | C] () -- C:\WINDOWS\System32\drivers\secdrv.sys [2001-07-22 00:16:20 | 00,000,519 | ---- | C] () -- C:\WINDOWS\win.ini [2001-07-22 00:15:52 | 00,000,227 | ---- | C] () -- C:\WINDOWS\system.ini [color=orange]========== Files - Modified Within 30 Days ==========[/color] [1 C:\WINDOWS\System32\*.tmp files] [3 C:\WINDOWS\*.tmp files] [2009-05-22 07:36:24 | 12,386,6656 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.dat [2009-05-22 07:30:11 | 00,003,207 | ---- | M] () -- C:\Documents and Settings\Karol\Pulpit\kaspersky.html [2009-05-22 05:53:51 | 00,002,541 | ---- | M] () -- C:\rollback.ini [2009-05-21 17:38:49 | 00,004,212 | -H-- | M] () -- C:\WINDOWS\System32\zllictbl.dat [2009-05-21 17:37:59 | 00,351,218 | ---- | M] () -- C:\WINDOWS\System32\vsconfig.xml [2009-05-21 17:37:58 | 00,000,104 | ---- | M] () -- C:\WINDOWS\System32\nvapps.xml [2009-05-21 17:37:22 | 00,000,006 | -H-- | M] () -- C:\WINDOWS\tasks\SA.DAT [2009-05-21 17:37:19 | 00,000,062 | -HS- | M] () -- C:\Documents and Settings\Karol\Ustawienia lokalne\desktop.ini [2009-05-21 17:37:17 | 00,002,262 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2009-05-21 17:37:15 | 00,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2009-05-20 23:36:32 | 01,570,460 | -HS- | M] () -- C:\WINDOWS\System32\drivers\fidbox.idx [2009-05-18 21:06:03 | 00,006,533 | ---- | M] () -- C:\Documents and Settings\Karol\Dane aplikacji\PrimoPDFSet.xml [2009-05-18 21:06:01 | 00,091,341 | ---- | M] () -- C:\Documents and Settings\Karol\Moje dokumenty\263ad listu motywacyjnego).pdf [2009-05-18 21:05:08 | 00,000,310 | ---- | M] () -- C:\Documents and Settings\Karol\Dane aplikacji\APUSet.xml [2009-05-16 00:03:26 | 00,003,129 | ---- | M] () -- C:\WINDOWS\VPlayer.INI [2009-05-16 00:03:26 | 00,000,046 | ---- | M] () -- C:\WINDOWS\VplayerINI.vpl [2009-05-14 17:39:16 | 00,984,778 | ---- | M] () -- C:\WINDOWS\System32\PerfStringBackup.INI [2009-05-14 17:39:16 | 00,448,348 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2009-05-14 17:39:16 | 00,392,432 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2009-05-14 17:39:16 | 00,074,450 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2009-05-14 17:39:16 | 00,058,732 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2009-05-12 18:16:50 | 00,000,519 | ---- | M] () -- C:\WINDOWS\win.ini [2009-05-12 18:16:50 | 00,000,227 | ---- | M] () -- C:\WINDOWS\system.ini [2009-05-12 18:16:50 | 00,000,211 | RHS- | M] () -- C:\boot.ini [2009-05-11 23:25:25 | 00,000,000 | ---- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2009-04-23 22:52:15 | 00,198,134 | ---- | M] () -- C:\Documents and Settings\Karol\Pulpit\wniosek_odbyce_praktyki.pdf [2009-04-23 20:39:11 | 00,000,000 | ---- | M] () -- C:\WINDOWS\bestplayer.bbt < End of report >

Raport Hijack

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 07:39:52, on 2009-05-22 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\System32\FTRTSVC.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\CDBurnerXP\NMSAccessU.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\wbem\wmiapsrv.exe C:\Program Files\Zone Labs\ZoneAlarm\MailFrontier\mantispm.exe C:\Program Files\neostrada tp\neostradatp.exe C:\Program Files\neostrada tp\ComComp.exe C:\PROGRA~1\NEOSTR~1\Toaster.exe C:\PROGRA~1\NEOSTR~1\Inactivity.exe C:\PROGRA~1\NEOSTR~1\PollingModule.exe C:\WINDOWS\System32\ALERTM~1\ALERTM~1.EXE C:\Program Files\neostrada tp\Watch.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Java\jre6\bin\java.exe C:\Program Files\Internet Explorer\iexplore.exe D:\Antyviry\OTListIt2.exe D:\Antyviry\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user') O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .pdf: C:\Program Files\Internet Explorer\PLUGINS\nppdf32.dll O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{9415C92C-E4BC-4200-8C58-F9879F70A361}: NameServer = 194.204.159.1 217.98.63.164 O17 - HKLM\System\CS1\Services\Tcpip\..\{9415C92C-E4BC-4200-8C58-F9879F70A361}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: France Telecom Routing Table Service (FTRTSVC) - France Telecom - C:\WINDOWS\System32\FTRTSVC.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Check Point Software Technologies LTD - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 5378 bytes

**Posty:** 18165 · przez **wojtas** 22 Maj 2009, 11:18

sciagnij killbox’a

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę

C:\Documents and Settings\Karol\Ustawienia lokalne\ayhnevm.vvq

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)