03 Mar 2010, 17:30
03 Mar 2010, 20:19
03 Mar 2010, 20:58
:Processes
killallprocesses
:OTL
:Files
C:\Users\Spalek\AppData\Local\Temp
:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"TCP Query User{1F4337C3-8C2F-4A97-8A69-2588C4B70E32}C:\users\spalek\appdata\local\temp\winjhmds.exe"=-
"TCP Query User{35012282-6BE6-4F36-9876-2BB85F65048D}C:\users\spalek\appdata\local\temp\winwkdaso.exe"=-
"TCP Query User{35FF0A47-583A-4D76-AB42-8F912312F08A}C:\users\spalek\appdata\local\temp\winccagf.exe"=-
"TCP Query User{4286CC76-C4EA-4371-AB41-3E28BBCE9720}C:\users\spalek\appdata\local\temp\winbrxort.exe"=-
"TCP Query User{4B2A0F45-AB7F-476A-B3B9-B1713642E44A}C:\users\spalek\appdata\local\temp\wincsfnjj.exe"=-
"TCP Query User{C7EE8ED4-627B-454E-95CD-667B944EC6E8}C:\users\spalek\appdata\local\temp\winrscys.exe"=-
"TCP Query User{CEEF86A4-C244-49BD-ABDD-67421420BE2C}C:\users\spalek\appdata\local\temp\winogrhi.exe"=-
"TCP Query User{E944F071-DA9B-417A-97D3-776AD60FCC01}C:\users\spalek\appdata\local\temp\winvxkgg.exe"=-
"TCP Query User{EE76282F-E576-4711-AD32-2585A79163A5}C:\users\spalek\appdata\local\temp\winbwcqjx.exe"=-
"UDP Query User{0572FEB8-8D50-41DD-8F65-4548DED7C498}C:\users\spalek\appdata\local\temp\winrscys.exe"=-
"UDP Query User{07BF4888-C7A5-4B54-A452-3B6D031140F6}C:\users\spalek\appdata\local\temp\wincsfnjj.exe"=-
"UDP Query User{400ADDD4-39CF-4762-B3F1-6B1C8F256988}C:\users\spalek\appdata\local\temp\winbwcqjx.exe"=-
"UDP Query User{4AFAD1ED-147A-4E39-8B60-FD0924302AC6}C:\users\spalek\appdata\local\temp\winccagf.exe"=-
"UDP Query User{59B26BDC-95B4-494E-8273-A7B5F1D3D7E7}C:\users\spalek\appdata\local\temp\winjhmds.exe"=-
"UDP Query User{644EB55A-415A-4C08-896F-413DE17C1A92}C:\users\spalek\appdata\local\temp\winogrhi.exe"=-
"UDP Query User{8DDA9768-961F-46DB-A372-2BB0F9CF79A8}C:\users\spalek\appdata\local\temp\winwkdaso.exe"=-
"UDP Query User{A1600902-A7D6-4E2F-83F3-0C6354143251}C:\users\spalek\appdata\local\temp\winvxkgg.exe"=-
"UDP Query User{B3C637C0-60AD-45FA-94E8-0CB9B6243CED}C:\users\spalek\appdata\local\temp\winbrxort.exe"=-
:Commands
[emptytemp]
03 Mar 2010, 21:45
03 Mar 2010, 22:02
:OTL
O32 - AutoRun File - [2010-03-02 20:03:50 | 000,000,105 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010-03-02 19:44:12 | 000,000,105 | RHS- | M] () - F:\autorun.inf -- [ FAT ]
03 Mar 2010, 23:48