27 Kwi 2009, 18:57
ComboFix 09-04-25.A3 - ja 2009-04-27 17:50.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.1.1250.48.1045.18.1014.466 [GMT 2:00]
Uruchomiony z: F:\ComboFix.exe
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\documents and settings\LocalService\Dane aplikacji\wsnpoem
c:\documents and settings\LocalService\Dane aplikacji\wsnpoem\audio.dll
c:\program files\myglobalsearch
c:\program files\myglobalsearch\bar\1.bin\M9FFXTBR.JAR
c:\program files\myglobalsearch\bar\1.bin\M9FFXTBR.MANIFEST
c:\program files\myglobalsearch\bar\1.bin\M9NTSTBR.JAR
c:\program files\myglobalsearch\bar\1.bin\M9NTSTBR.MANIFEST
c:\program files\myglobalsearch\bar\1.bin\NPMYGLSH.DLL
c:\program files\myglobalsearch\bar\Cache\[u]0[/u]0028F07
c:\program files\myglobalsearch\bar\Cache\[u]0[/u]002C191
c:\program files\myglobalsearch\bar\Cache\[u]0[/u]0036737.bin
c:\program files\myglobalsearch\bar\Cache\[u]0[/u]0350D9A.bin
c:\program files\myglobalsearch\bar\Cache\[u]0[/u]0350FEC.bin
c:\program files\myglobalsearch\bar\Cache\[u]0[/u]03B2AAA
c:\program files\myglobalsearch\bar\Cache\files.ini
c:\program files\myglobalsearch\bar\History\search
c:\program files\myglobalsearch\bar\Settings\prevcfg.htm
c:\windows\autorun.inf
c:\windows\IE4 Error Log.txt
c:\windows\system32\a
c:\windows\system32\akl.exe
c:\windows\system32\akw.exe
c:\windows\system32\alog.txt
c:\windows\system32\aqt.exe
c:\windows\system32\AutoRun.inf
c:\windows\system32\baf.exe
c:\windows\system32\bcf.exe
c:\windows\system32\bfv.exe
c:\windows\system32\bva.exe
c:\windows\system32\cnu.exe
c:\windows\system32\cvc.exe
c:\windows\system32\czw.exe
c:\windows\system32\dav.exe
c:\windows\system32\dbd.exe
c:\windows\system32\ddy.exe
c:\windows\system32\div.exe
c:\windows\system32\dkk.exe
c:\windows\system32\dli.exe
c:\windows\system32\dllview.exe
c:\windows\system32\dpk.exe
c:\windows\system32\DrsCh.exe
c:\windows\system32\ds.dat
c:\windows\system32\dzf.exe
c:\windows\system32\ebq.exe
c:\windows\system32\eeh.exe
c:\windows\system32\ejt.exe
c:\windows\system32\eju.exe
c:\windows\system32\faj.exe
c:\windows\system32\feu.exe
c:\windows\system32\fjo.exe
c:\windows\system32\fnw.exe
c:\windows\system32\fsw.exe
c:\windows\system32\fuf.exe
c:\windows\system32\gey.exe
c:\windows\system32\grz.exe
c:\windows\system32\gxl.exe
c:\windows\system32\gzv.exe
c:\windows\system32\hgo.exe
c:\windows\system32\hhn.exe
c:\windows\system32\hik.exe
c:\windows\system32\hod.exe
c:\windows\system32\hvb.exe
c:\windows\system32\hzx.exe
c:\windows\system32\i
c:\windows\system32\ica.exe
c:\windows\system32\imo.exe
c:\windows\system32\inl.exe
c:\windows\system32\isj.exe
c:\windows\system32\isu.exe
c:\windows\system32\ixw.exe
c:\windows\system32\iyj.exe
c:\windows\system32\iys.exe
c:\windows\system32\jey.exe
c:\windows\system32\jgy.exe
c:\windows\system32\jhz.exe
c:\windows\system32\jyg.exe
c:\windows\system32\kal.exe
c:\windows\system32\kox.exe
c:\windows\system32\ksx.exe
c:\windows\system32\kuf.exe
c:\windows\system32\lfo.exe
c:\windows\system32\ljx.exe
c:\windows\system32\mod.exe
c:\windows\system32\mvx.dat
c:\windows\system32\mvy.exe
c:\windows\system32\mzg.exe
c:\windows\system32\mzt.exe
c:\windows\system32\nhf.exe
c:\windows\system32\nhl.exe
c:\windows\system32\nlm.exe
c:\windows\system32\nrx.exe
c:\windows\system32\nus.exe
c:\windows\system32\ohi.exe
c:\windows\system32\ooi.exe
c:\windows\system32\ozd.exe
c:\windows\system32\pip.exe
c:\windows\system32\pix.exe
c:\windows\system32\pmf.exe
c:\windows\system32\ppf.exe
c:\windows\system32\ps1.dat
c:\windows\system32\pwn.exe
c:\windows\system32\pyv.exe
c:\windows\system32\pyx.exe
c:\windows\system32\qcg.exe
c:\windows\system32\qjz.exe
c:\windows\system32\qpg.exe
c:\windows\system32\qza.exe
c:\windows\system32\rc.dat
c:\windows\system32\rdi.exe
c:\windows\system32\Regview.exe
c:\windows\system32\rfp.exe
c:\windows\system32\rgw.exe
c:\windows\system32\SCtri.exe
c:\windows\system32\sfw.exe
c:\windows\system32\smg.exe
c:\windows\system32\sqn.exe
c:\windows\system32\srd.exe
c:\windows\system32\sry.exe
c:\windows\system32\tar.exe
c:\windows\system32\tet.exe
c:\windows\system32\Ton.exe
c:\windows\system32\tpe.exe
c:\windows\system32\tqf.exe
c:\windows\system32\tqp.exe
c:\windows\system32\tsw.exe
c:\windows\system32\ttt.exe
c:\windows\system32\tvp.exe
c:\windows\system32\tzg.exe
c:\windows\system32\uea.exe
c:\windows\system32\ufq.exe
c:\windows\system32\uly.exe
c:\windows\system32\uqz.exe
c:\windows\system32\urh.exe
c:\windows\system32\vvo.exe
c:\windows\system32\vyn.exe
c:\windows\system32\wgy.exe
c:\windows\system32\wqf.exe
c:\windows\system32\wsk.exe
c:\windows\system32\wsnpoem
c:\windows\system32\wsnpoem\audio.dll
c:\windows\system32\wsnpoem\video.dll
c:\windows\system32\xcn.exe
c:\windows\system32\xha.exe
c:\windows\system32\xqt.exe
c:\windows\system32\xss.exe
c:\windows\system32\xwp.exe
c:\windows\system32\ydl.exe
c:\windows\system32\yma.exe
c:\windows\system32\yvf.exe
c:\windows\system32\yvm.exe
c:\windows\system32\zsc.exe
c:\windows\system32\zvw.exe
.
((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\Legacy_ZZZSVC_LICH
-------\Service_ZZZdrv_lich
-------\Service_ZZZsvc_lich
((((((((((((((((((((((((( Pliki utworzone od 2009-05-27 do 2009-4-27 )))))))))))))))))))))))))))))))
.
2009-04-25 20:30 . 2008-03-17 09:56 103168 ----a-w c:\windows\system32\drivers\ewusbfake.sys
2009-04-25 20:30 . 2008-03-17 09:03 101376 ----a-r c:\windows\system32\drivers\ewusbmdm.sys
2009-04-25 20:30 . 2008-03-16 12:47 872192 ----a-w c:\windows\system32\drivers\mod7700.sys
2009-04-25 20:30 . 2008-01-22 13:09 100992 ----a-w c:\windows\system32\drivers\ewusbnet.sys
2009-04-25 20:30 . 2007-08-09 02:13 24448 ----a-r c:\windows\system32\drivers\ewdcsc.sys
2009-04-22 14:38 . 2009-04-22 14:38 729088 ----a-w c:\windows\system32\ywj.exe
2009-04-22 14:30 . 2009-04-22 14:30 724992 ----a-w c:\windows\system32\tzj.exe
2009-04-22 14:30 . 2009-04-22 14:30 729088 ----a-w c:\windows\system32\edt.exe
2009-04-22 11:49 . 2009-04-22 11:49 729088 ----a-w c:\windows\system32\rzh.exe
2009-04-22 11:01 . 2009-04-22 11:01 729088 ----a-w c:\windows\system32\job.exe
2009-04-22 10:56 . 2009-04-22 10:56 729088 ----a-w c:\windows\system32\udm.exe
2009-04-22 08:54 . 2009-04-22 08:54 729088 ----a-w c:\windows\system32\bmc.exe
2009-04-22 07:37 . 2009-04-22 07:37 729088 ----a-w c:\windows\system32\mwh.exe
2009-04-22 07:33 . 2009-04-22 07:33 729088 ----a-w c:\windows\system32\pfx.exe
2009-04-22 07:28 . 2009-04-22 07:28 729088 ----a-w c:\windows\system32\jed.exe
2009-04-21 20:46 . 2009-04-21 20:46 729088 ----a-w c:\windows\system32\enj.exe
2009-04-21 19:44 . 2009-04-21 19:44 729088 ----a-w c:\windows\system32\pms.exe
2009-04-21 19:32 . 2009-04-21 19:33 724992 ----a-w c:\windows\system32\zar.exe
2009-04-21 19:32 . 2009-04-21 19:32 729088 ----a-w c:\windows\system32\lwg.exe
2009-04-21 19:27 . 2009-04-21 19:27 729088 ----a-w c:\windows\system32\yes.exe
2009-04-21 18:15 . 2009-04-21 18:15 729088 ----a-w c:\windows\system32\wvm.exe
2009-04-21 17:56 . 2009-04-21 17:59 724992 ----a-w c:\windows\system32\vbi.exe
2009-04-21 17:56 . 2009-04-21 17:56 729088 ----a-w c:\windows\system32\zys.exe
2009-04-21 17:51 . 2009-04-21 17:51 729088 ----a-w c:\windows\system32\nag.exe
2009-04-21 17:46 . 2009-04-21 17:47 729088 ----a-w c:\windows\system32\qcc.exe
2009-04-21 17:36 . 2009-04-21 17:36 729088 ----a-w c:\windows\system32\pkf.exe
2009-04-21 17:32 . 2009-04-21 17:32 729088 ----a-w c:\windows\system32\aeg.exe
2009-04-21 17:23 . 2009-04-21 17:23 729088 ----a-w c:\windows\system32\whp.exe
2009-04-21 17:19 . 2009-04-21 17:19 729088 ----a-w c:\windows\system32\tqx.exe
2009-04-21 17:00 . 2009-04-21 17:00 729088 ----a-w c:\windows\system32\ztb.exe
2009-04-21 16:54 . 2009-04-21 16:54 729088 ----a-w c:\windows\system32\juc.exe
2009-04-21 16:50 . 2009-04-21 16:50 729088 ----a-w c:\windows\system32\ouw.exe
2009-04-21 16:47 . 2009-04-21 16:47 729088 ----a-w c:\windows\system32\xwu.exe
2009-04-21 16:36 . 2009-04-21 16:36 729088 ----a-w c:\windows\system32\fyd.exe
2009-04-21 16:04 . 2009-04-21 16:03 729088 --sh--r c:\windows\system32\drivers\Regview.exe
2009-03-30 16:58 . 2009-03-30 16:58 733184 ----a-w c:\windows\system32\vcd.exe
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-25 20:30 . 2009-01-02 14:39 -------- d-----w c:\program files\PLAY ONLINE
2009-04-24 17:16 . 2008-10-18 18:40 -------- d-----w c:\documents and settings\ja\Dane aplikacji\TransRu2
2009-04-05 21:23 . 2008-10-18 18:44 -------- d-----w c:\documents and settings\ja\Dane aplikacji\TransEngPol41
2009-04-01 20:49 . 2002-09-28 22:00 68532 ----a-w c:\windows\system32\perfc015.dat
2009-04-01 20:49 . 2002-09-28 22:00 439432 ----a-w c:\windows\system32\perfh015.dat
2009-04-01 15:00 . 2007-06-30 10:47 -------- d--h--w c:\program files\InstallShield Installation Information
2009-03-26 20:30 . 2009-03-26 20:30 -------- d-----w c:\program files\Vplayer
2009-03-25 12:57 . 2009-03-25 12:39 13030 ----a-w C:\PDOXUSRS.NET
2009-03-24 19:58 . 2009-03-24 19:58 69632 ----a-w c:\windows\system32\gdp.exe
2009-03-20 09:56 . 2002-09-28 22:00 133632 ----a-w c:\windows\system32\sfc_os.dll
2009-03-20 09:12 . 2009-03-20 09:12 274432 ----a-w c:\windows\system32\scn.exe
2009-02-10 21:03 . 2007-10-17 19:12 2560 -c--a-w c:\windows\_MSRSTRT.EXE
2009-02-04 11:43 . 2009-02-04 11:02 290816 ----a-w c:\windows\system32\nef.exe
2009-02-03 16:05 . 2009-02-03 16:05 172032 ----a-w c:\windows\system32\rby.exe
2009-02-02 17:28 . 2009-02-02 17:27 274432 ----a-w c:\windows\system32\aun.exe
2009-01-31 17:27 . 2009-01-31 17:27 552960 ----a-w c:\windows\system32\iec.exe
2008-10-19 17:23 . 2007-07-08 10:59 63976 -c--a-w c:\documents and settings\ja\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2007-07-08 10:59 . 2007-07-08 10:59 127 ----a-w c:\documents and settings\ja\Ustawienia lokalne\Dane aplikacji\fusioncache.dat
2008-08-29 17:2008-08-29 17:08 08:52 . c:\program files\mozilla firefox\components\GoogleDesktopMozilla.dll
2009-02-23 22:2008-05-10 16:00 13:17 . c:\program files\mozilla firefox\components\jar50.dll
2009-02-23 22:2008-05-10 16:00 13:17 . c:\program files\mozilla firefox\components\jsd3250.dll
2009-02-23 22:2008-05-10 16:00 13:17 . c:\program files\mozilla firefox\components\myspell.dll
2009-02-23 22:2008-05-10 16:00 13:21 . c:\program files\mozilla firefox\components\spellchk.dll
2009-02-23 22:2008-05-10 16:00 13:21 . c:\program files\mozilla firefox\components\xpinstal.dll
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\ctfmon.exe" [2002-09-28 13312]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2002-08-20 1511453]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-12-23 143360]
"Gadu-Gadu"="e:\gadu-gadu\gg.exe" [2007-11-14 2131392]
"Picasa Media Detector"="c:\program files\Picasa2\PicasaMediaDetector.exe" [2008-08-21 443968]
"swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-10-08 68856]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2007-09-04 95536]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\System32\igfxtray.exe" [2006-03-23 94208]
"igfxhkcmd"="c:\windows\System32\hkcmd.exe" [2006-03-23 77824]
"igfxpers"="c:\windows\System32\igfxpers.exe" [2006-03-23 118784]
"WinampAgent"="c:\program files\Winamp\winampa.exe" [2007-05-14 35328]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2004-05-12 241664]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 155648]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-10-19 286720]
"Google Desktop Search"="c:\program files\Google\Google Desktop Search\GoogleDesktop.exe" [2008-08-29 29744]
"OM2_Monitor"="c:\program files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" [2007-09-04 54576]
"HP Software Update"="c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152]
"egui"="c:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2008-08-18 1447168]
"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-09-06 16262656]
"SkyTel"="SkyTel.EXE" - c:\windows\SkyTel.exe [2006-05-16 2879488]
"SMSERIAL"="sm56hlpr.exe" - c:\windows\sm56hlpr.exe [2006-01-20 544768]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\System32\CTFMON.EXE" [2002-09-28 13312]
c:\documents and settings\All Users\Menu Start\Programy\Autostart\
BTTray.lnk - c:\program files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\BTTray.exe [2006-5-12 581693]
HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-5-28 241664]
HP Image Zone - szybkie uruchamianie.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-5-29 53248]
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify"=dword:00000001
"AntiVirusDisableNotify"=dword:00000001
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001
R2 DelSrv Service Controler;DelSrv Service Controler; [x]
R3 GoogleDesktopManager-061008-081103;Google Desktop Manager 5.7.806.10245;c:\program files\Google\Google Desktop Search\GoogleDesktop.exe [2008-08-29 29744]
R3 ZDCndis5;ZDCndis5 Protocol Driver; [x]
S0 O2MDRDR;O2MDRDR;c:\windows\System32\DRIVERS\o2media.sys [2006-02-27 34880]
S0 O2SDRDR;O2SDRDR;c:\windows\System32\DRIVERS\o2sd.sys [2006-02-20 29056]
S1 epfwtdir;epfwtdir;c:\windows\system32\DRIVERS\epfwtdir.sys [2008-08-18 34312]
S2 ekrn;Eset Service;c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2008-08-18 468224]
S2 Regview Controler;Regview Controler;c:\windows\system32\drivers\Regview.exe [2009-04-21 729088]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08
.
Zawartość folderu 'Zaplanowane zadania'
2009-04-02 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 13:57]
.
- - - - USUNIĘTO PUSTE WPISY - - - -
HKCU-Run-SService - c:\documents and settings\ja\57119.exe
HKLM-Run-BearShare - c:\program files\BearShare\BearShare.exe
.
------- Skan uzupełniający -------
.
uStart Page = hxxp://www.wp.pl/
uSearch Page = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com/ie
uSearch Bar = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
IE: Wyślij do interfejsu &Bluetooth - c:\program files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\btsendto_ie_ctx.htm
IE: {{C5138A0F-7D8E-4A3B-8BCC-654E0E2ED10F} - c:\program files\TransRu2\trru2ie_opcje.htm
IE: {{C51A533B-0756-4A8E-8C72-77B61773803D} - c:\program files\TransRu2\trru2ie_tlumacz2.htm
IE: {{C521B432-9701-4281-8E4E-54C6217C3D49} - c:\program files\TransRu2\trru2ie_tlumacz.htm
IE: {{c95fe080-8f5d-11d2-a20b-00aa003c157a} - %SystemRoot%\web\related.htm
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: ING Bank Online - hxxps://ssl.bsk.com.pl/bskonlreg/component/INGOnl.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\ja\Dane aplikacji\Mozilla\Firefox\Profiles\6fti4zwn.default\
FF - prefs.js: network.proxy.type - 1
FF - component: c:\program files\Mozilla Firefox\components\GoogleDesktopMozilla.dll
FF - component: c:\program files\Mozilla Firefox\components\xpinstal.dll
.
.
------- Skojarzenia plików -------
.
txtfile=notepad.exe "%1"
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-27 18:41
Windows 5.1.2600 Dodatek Service Pack. 1 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'winlogon.exe'(696)
c:\windows\System32\ODBC32.dll
- - - - - - - > 'lsass.exe'(752)
c:\windows\System32\dssenh.dll
- - - - - - - > 'explorer.exe'(3984)
c:\windows\System32\msi.dll
c:\progra~1\MICROS~2\OFFICE11\MCPS.DLL
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\bin\btwdins.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
c:\windows\system32\o2flash.exe
c:\windows\system32\wdfmgr.exe
c:\program files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
c:\program files\Common Files\Ahead\Lib\NMIndexingService.exe
c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
c:\program files\PLAY ONLINE\PLAY ONLINE.exe
c:\program files\Opera\Opera.exe
.
**************************************************************************
.
Czas ukończenia: 2009-04-27 18:44 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2009-04-27 16:44
Przed: 2 102 091 776 bajtów wolnych
Po: 8 538 173 440 bajtów wolnych
355
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:51:45, on 2009-04-27
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\bin\btwdins.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\o2flash.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\drivers\Regview.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\System32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Picasa2\PicasaMediaDetector.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\BTTray.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\WINDOWS\System32\taskmgr.exe
C:\Program Files\PLAY ONLINE\PLAY ONLINE.exe
C:\Program Files\Opera\Opera.exe
F:\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
F2 - REG:system.ini: Shell=Explorer.exe %windir%\system32\drivers\Regview.exe
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,userinit.exe,C:\WINDOWS\System32\ntos.exe,
O2 - BHO: Rmn plugin - {00EBB3B3-DEAD-4440-B1F8-B09DDDB89EF3} - lbbd32.dll (file missing)
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files\HP\Smart Web Printing\hpswp_framework.dll
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_219B3E1547538286.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\FirstStart.exe" /OM
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [SService] C:\Documents and Settings\ja\57119.exe
O4 - HKCU\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone - szybkie uruchamianie.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Wyślij do interfejsu &Bluetooth - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\btsendto_ie_ctx.htm
O9 - Extra button: Kolekcja wycinków HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Zaznaczanie HP Smart - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Opcje tłumaczenia (rosyjsko-polski) - {C5138A0F-7D8E-4A3B-8BCC-654E0E2ED10F} - C:\Program Files\TransRu2\trru2ie_opcje.htm
O9 - Extra 'Tools' menuitem: Opcje tłumaczenia (rosyjsko-polski) - {C5138A0F-7D8E-4A3B-8BCC-654E0E2ED10F} - C:\Program Files\TransRu2\trru2ie_opcje.htm
O9 - Extra button: Tłumacz polski->rosyjski - {C51A533B-0756-4A8E-8C72-77B61773803D} - C:\Program Files\TransRu2\trru2ie_tlumacz2.htm
O9 - Extra 'Tools' menuitem: Tłumacz z polskiego na rosyjski - {C51A533B-0756-4A8E-8C72-77B61773803D} - C:\Program Files\TransRu2\trru2ie_tlumacz2.htm
O9 - Extra button: Tłumacz rosyjski->polski - {C521B432-9701-4281-8E4E-54C6217C3D49} - C:\Program Files\TransRu2\trru2ie_tlumacz.htm
O9 - Extra 'Tools' menuitem: Tłumacz z rosyjskiego na polski - {C521B432-9701-4281-8E4E-54C6217C3D49} - C:\Program Files\TransRu2\trru2ie_tlumacz.htm
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\btsendto_ie.htm
O9 - Extra button: Opcje tłumaczenia angielsko-polskie (Kompas wersja 4) - {4F1DF60B-1BFF-4566-924B-9F24A974C910} - C:\Program Files\TransEnPl41\trenpl4ie_opcje.htm (HKCU)
O9 - Extra 'Tools' menuitem: Opcje tłumaczenia angielsko-polskie (Kompas wersja 4) - {4F1DF60B-1BFF-4566-924B-9F24A974C910} - C:\Program Files\TransEnPl41\trenpl4ie_opcje.htm (HKCU)
O9 - Extra button: Tłumacz angielski->polski (Kompas wersja 4) - {50C285B9-12A7-427B-B1B4-3BD810513848} - C:\Program Files\TransEnPl41\trenpl4ie_tlumaczenpl.htm (HKCU)
O9 - Extra 'Tools' menuitem: Tłumacz angielski->polski (Kompas wersja 4) - {50C285B9-12A7-427B-B1B4-3BD810513848} - C:\Program Files\TransEnPl41\trenpl4ie_tlumaczenpl.htm (HKCU)
O9 - Extra button: Tłumacz polski->angielski (Kompas wersja 4) - {860D2F9E-9D14-4D7C-A3C9-1B1B40C758F6} - C:\Program Files\TransEnPl41\trenpl4ie_tlumaczplen.htm (HKCU)
O9 - Extra 'Tools' menuitem: Tłumacz polski->angielski (Kompas wersja 4) - {860D2F9E-9D14-4D7C-A3C9-1B1B40C758F6} - C:\Program Files\TransEnPl41\trenpl4ie_tlumaczplen.htm (HKCU)
O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonlreg/component/INGOnl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{23EF87FC-53BA-4E1F-B58B-2EB2364EB3CB}: NameServer = 89.108.195.20 89.108.195.21
O17 - HKLM\System\CS1\Services\Tcpip\..\{23EF87FC-53BA-4E1F-B58B-2EB2364EB3CB}: NameServer = 89.108.195.20 89.108.195.21
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Oprogramowanie interfejsu Bluetooth\bin\btwdins.exe
O23 - Service: DelSrv Service Controler - Unknown owner - C:\WINDOWS\system32\drivers\DelSrv.exe (file missing)
O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - C:\WINDOWS\System32\o2flash.exe
O23 - Service: Regview Controler - Unknown owner - C:\WINDOWS\system32\drivers\Regview.exe
O23 - Service: ZZZsvc_lich - Unknown owner - C:\lich.exe (file missing)
--
End of file - 11511 bytes
29 Kwi 2009, 20:29