Tutaj kod z Sillent Runners http://www.wklej.eu/index.php?id=60e3977e24
- Kod: Zaznacz wszystko
ComboFix 09-05-23.04 - MMA 2009-11-25 7:40.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1250.48.1045.18.2046.1429 [GMT 1:00]
Uruchomiony z: e:\instalki\ComboFix.exe
AV: ESET NOD32 Antivirus 4.0 *On-access scanning disabled* (Updated) {E5E70D32-0101-4F12-8FB0-D96ACA4F34C0}
* Utworzono nowy punkt przywracania
UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!
.
- TRYB ZREDUKOWANEJ FUNKCJONALNOŚCI -
.
((((((((((((((((((((((((( Pliki utworzone od 2009-10-25 do 2009-11-25 )))))))))))))))))))))))))))))))
.
2009-11-22 17:40 . 2009-11-22 17:40 -------- dc-h--w c:\documents and settings\All Users\Dane aplikacji\{C79A30AF-08C1-49CF-8F27-526F179A478D}
2009-11-22 17:40 . 2009-02-17 14:54 2942456 -c--a-w c:\documents and settings\All Users\Dane aplikacji\{C79A30AF-08C1-49CF-8F27-526F179A478D}\Traktor Setup.exe
2009-11-22 17:40 . 2009-11-22 17:40 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Native Instruments
2009-11-22 17:39 . 2009-11-22 17:39 -------- dc-h--w c:\documents and settings\All Users\Dane aplikacji\{902029B2-957E-4066-85FA-30DA31731718}
2009-11-22 17:39 . 2009-01-15 11:39 2932576 -c--a-w c:\documents and settings\All Users\Dane aplikacji\{902029B2-957E-4066-85FA-30DA31731718}\Service Center Setup.exe
2009-11-22 17:39 . 2009-11-22 17:39 -------- d-----w c:\program files\Native Instruments
2009-11-22 17:39 . 2009-11-22 17:39 -------- d-----w c:\program files\Common Files\Native Instruments
2009-11-22 14:19 . 2009-11-22 14:19 -------- d-----w c:\documents and settings\MMA\Ustawienia lokalne\Dane aplikacji\Identities
2009-11-22 12:41 . 2009-11-22 12:41 -------- d-----w c:\documents and settings\MMA\Ustawienia lokalne\Dane aplikacji\PCHealth
2009-11-21 18:36 . 2009-11-21 18:36 -------- d-----w C:\98b5790a5f2890fbde
2009-11-21 14:12 . 2009-11-21 14:12 -------- d-----w C:\27e9603354aad6601323db804ac85020
2009-11-21 14:11 . 2009-11-21 14:11 -------- d-----w c:\windows\system32\XPSViewer
2009-11-21 14:11 . 2009-11-21 14:11 -------- d-----w c:\program files\Reference Assemblies
2009-11-21 14:10 . 2009-11-21 14:11 -------- d-----w C:\69a703c39f75da113fa5
2009-11-21 14:10 . 2008-07-06 12:06 89088 -c----w c:\windows\system32\dllcache\filterpipelineprintproc.dll
2009-11-21 14:10 . 2008-07-06 12:06 575488 -c----w c:\windows\system32\dllcache\xpsshhdr.dll
2009-11-21 14:10 . 2008-07-06 12:06 575488 ------w c:\windows\system32\xpsshhdr.dll
2009-11-21 14:10 . 2008-07-06 12:06 1676288 -c----w c:\windows\system32\dllcache\xpssvcs.dll
2009-11-21 14:10 . 2008-07-06 12:06 1676288 ------w c:\windows\system32\xpssvcs.dll
2009-11-21 14:10 . 2008-07-06 12:06 117760 ------w c:\windows\system32\prntvpt.dll
2009-11-21 14:10 . 2008-07-06 10:50 597504 -c----w c:\windows\system32\dllcache\printfilterpipelinesvc.exe
2009-11-21 14:08 . 2009-11-21 14:08 -------- d-sh--w c:\documents and settings\NetworkService\IETldCache
2009-11-20 21:12 . 2009-11-22 12:54 -------- d-----w c:\program files\Cracked Steam
2009-11-20 17:55 . 2009-11-20 17:55 -------- d-----w c:\documents and settings\MMA\Dane aplikacji\GHISLER
2009-11-20 17:55 . 2009-09-24 06:50 545 ----a-w c:\windows\UC.PIF
2009-11-20 17:55 . 2009-09-24 06:50 545 ----a-w c:\windows\RAR.PIF
2009-11-20 17:55 . 2009-09-24 06:50 545 ----a-w c:\windows\PKZIP.PIF
2009-11-20 17:55 . 2009-09-24 06:50 545 ----a-w c:\windows\PKUNZIP.PIF
2009-11-20 17:55 . 2009-09-24 06:50 545 ----a-w c:\windows\NOCLOSE.PIF
2009-11-20 17:55 . 2009-09-24 06:50 545 ----a-w c:\windows\LHA.PIF
2009-11-20 17:55 . 2009-09-24 06:50 545 ----a-w c:\windows\ARJ.PIF
2009-11-18 08:40 . 2004-08-18 08:34 442368 ----a-r c:\windows\system32\vp6vfw.dll
2009-11-18 07:18 . 2009-11-20 17:42 -------- d-----w C:\Downloads
2009-11-16 18:40 . 2009-11-16 18:40 -------- d-----w c:\documents and settings\MMA\Dane aplikacji\Gadu-Gadu
2009-11-16 18:40 . 2009-11-16 18:41 -------- d-----w c:\documents and settings\MMA\Gadu-Gadu
2009-11-13 08:09 . 2009-11-13 08:09 -------- d-----w c:\documents and settings\MMA\Ustawienia lokalne\Dane aplikacji\ESET
2009-11-13 07:26 . 2009-11-13 07:26 -------- d-----w c:\documents and settings\MMA\Ustawienia lokalne\Dane aplikacji\cache
2009-11-13 07:00 . 2009-11-13 15:43 -------- d-----w c:\windows\SxsCaPendDel
2009-11-12 12:57 . 2009-11-12 12:57 -------- d-----w c:\program files\OO Software
2009-11-10 13:19 . 2009-11-10 13:20 -------- d-----w c:\program files\Image-Line
2009-11-10 13:19 . 2009-11-10 13:19 -------- d-----w c:\program files\Outsim
2009-11-10 13:15 . 2009-11-10 13:16 -------- d-----w c:\documents and settings\MMA\Dane aplikacji\Ableton
2009-11-10 13:15 . 2009-11-10 13:15 -------- d-----w c:\program files\Ableton
2009-11-10 12:34 . 2009-11-10 12:34 368640 ----a-w c:\windows\system32\ReWire.dll
2009-11-10 12:34 . 2009-11-10 12:34 233472 ----a-w c:\windows\system32\REX Shared Library.dll
2009-11-10 12:30 . 2009-11-10 12:30 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Propellerhead Software
2009-11-10 12:30 . 2009-11-10 12:34 -------- d-----w c:\documents and settings\MMA\Dane aplikacji\Propellerhead Software
2009-11-09 20:01 . 2009-11-09 20:01 -------- d-----w c:\documents and settings\MMA\Dane aplikacji\Resolume Avenue 3
2009-11-09 20:01 . 2009-11-09 20:01 -------- d-----w c:\documents and settings\MMA\Dane aplikacji\Resolume
2009-11-09 20:01 . 2009-11-09 20:01 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Resolume Avenue 3
2009-11-09 20:00 . 2009-11-09 20:00 -------- d-----w c:\program files\QuickTime
2009-11-05 18:02 . 2009-11-19 10:46 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Test Drive Unlimited
2009-11-04 18:47 . 2008-04-13 23:15 10368 -c--a-w c:\windows\system32\dllcache\hidusb.sys
2009-11-04 18:47 . 2008-04-13 23:15 10368 ----a-w c:\windows\system32\drivers\hidusb.sys
2009-11-03 09:18 . 2009-11-03 09:18 -------- d-sh--w c:\documents and settings\MMA\PrivacIE
2009-11-03 08:03 . 2009-11-03 09:24 -------- d-----w c:\documents and settings\MMA\Dane aplikacji\Winamp
2009-11-02 05:40 . 2009-11-02 05:40 -------- d-----w c:\documents and settings\NetworkService\Ustawienia lokalne\Dane aplikacji\Google
2009-11-01 17:46 . 2009-11-14 09:58 -------- d-----w c:\documents and settings\MMA\Ustawienia lokalne\Dane aplikacji\Temp
2009-11-01 17:46 . 2009-11-01 17:46 -------- d-----w c:\documents and settings\LocalService\Ustawienia lokalne\Dane aplikacji\Google
2009-11-01 16:29 . 2009-11-01 16:29 -------- d-----w c:\documents and settings\MMA\Dane aplikacji\CyberLink
2009-11-01 16:29 . 2009-11-01 16:29 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\CyberLink
2009-10-31 11:54 . 2009-10-31 11:54 -------- d-----w c:\program files\SystemRequirementsLab
2009-10-30 10:33 . 2006-06-30 14:00 28160 ----a-w c:\windows\system32\PostProc.dll
2009-10-30 10:33 . 2006-03-17 16:18 392960 ----a-w c:\windows\system32\drivers\senfilt.sys
2009-10-30 10:33 . 2001-09-19 11:47 765952 ----a-w c:\windows\system\crlds3d.dll
2009-10-30 10:33 . 2007-01-16 08:09 293888 ----a-w c:\windows\system32\drivers\ADIHdAud.sys
2009-10-30 10:33 . 2006-08-07 05:57 93952 ----a-w c:\windows\system32\drivers\aeaudio.sys
2009-10-30 10:30 . 2009-10-30 10:32 -------- d-----w c:\documents and settings\MMA\Dane aplikacji\Download Manager
2009-10-29 11:16 . 2009-10-30 09:09 -------- d-----w c:\documents and settings\MMA\Dane aplikacji\Skype
2009-10-29 11:16 . 2009-10-29 11:16 -------- d-----w c:\program files\Skype
2009-10-27 10:51 . 2009-10-27 10:51 -------- d-----w c:\documents and settings\MMA\Dane aplikacji\Nero
2009-10-26 10:45 . 2009-11-03 15:39 -------- d-----w c:\documents and settings\MMA\Ustawienia lokalne\Dane aplikacji\Google
2009-10-26 10:45 . 2009-11-10 09:08 -------- d-----w c:\program files\Google
2009-10-26 10:45 . 2009-10-26 10:45 -------- d-----w c:\windows\system32\IOSUBSYS
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-11-25 05:50 . 2006-03-02 12:00 84916 ----a-w c:\windows\system32\perfc015.dat
2009-11-25 05:50 . 2006-03-02 12:00 493632 ----a-w c:\windows\system32\perfh015.dat
2009-11-25 05:47 . 2009-10-19 18:22 -------- d-----w c:\documents and settings\MMA\Dane aplikacji\uTorrent
2009-11-24 07:29 . 2009-10-14 13:34 -------- d-----w c:\documents and settings\MMA\Dane aplikacji\ipla
2009-11-23 13:51 . 2009-10-14 05:55 -------- d-----w c:\program files\KEMailKb
2009-11-22 16:28 . 2009-10-14 13:35 70408 ----a-w c:\documents and settings\MMA\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-11-13 07:00 . 2009-10-14 05:56 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Microsoft Help
2009-11-03 15:37 . 2009-10-14 05:48 -------- d--h--w c:\program files\InstallShield Installation Information
2009-11-03 08:47 . 2009-10-14 06:15 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\CanonIJPLM
2009-10-25 16:17 . 2009-10-25 16:17 9662 ----a-r c:\documents and settings\MMA\Dane aplikacji\Microsoft\Installer\{794C9D0B-C79C-4872-B8F3-BA228339BA8B}\_4C9DC67663960A31AB03C3.exe
2009-10-25 16:17 . 2009-10-25 16:17 87182 ----a-r c:\documents and settings\MMA\Dane aplikacji\Microsoft\Installer\{794C9D0B-C79C-4872-B8F3-BA228339BA8B}\_DD9485BAFDA7CACDB62672.exe
2009-10-25 16:17 . 2009-10-25 16:17 87182 ----a-r c:\documents and settings\MMA\Dane aplikacji\Microsoft\Installer\{794C9D0B-C79C-4872-B8F3-BA228339BA8B}\_39305E2A4B2ABE6218D0FE.exe
2009-10-25 16:17 . 2009-10-25 16:17 87182 ----a-r c:\documents and settings\MMA\Dane aplikacji\Microsoft\Installer\{794C9D0B-C79C-4872-B8F3-BA228339BA8B}\_6FEFF9B68218417F98F549.exe
2009-10-25 08:15 . 2009-10-14 05:35 76487 ----a-w c:\windows\pchealth\helpctr\OfflineCache\index.dat
2009-10-24 11:16 . 2009-10-24 11:16 -------- d-----w c:\documents and settings\MMA\Dane aplikacji\LightZone
2009-10-24 11:16 . 2009-10-24 11:16 -------- d-----w c:\program files\Common Files\eSellerate
2009-10-20 06:51 . 2009-10-20 06:51 2976 ----a-w c:\windows\system32\SpoonUninstall-dBpoweramp WavPack Codec.dat
2009-10-20 06:51 . 2009-10-20 06:51 2999 ----a-w c:\windows\system32\SpoonUninstall-dBpoweramp Ogg Vorbis Codec.dat
2009-10-20 06:51 . 2009-10-20 06:51 426872 ----a-w c:\windows\system32\SpoonUninstall.exe
2009-10-20 06:51 . 2009-10-20 06:51 3087 ----a-w c:\windows\system32\SpoonUninstall-dBpoweramp mp3 (Fraunhofer IIS) Codec.dat
2009-10-20 06:51 . 2009-10-20 06:51 3076 ----a-w c:\windows\system32\SpoonUninstall-dBpoweramp Monkeys Audio Codec.dat
2009-10-20 06:51 . 2009-10-20 06:51 2920 ----a-w c:\windows\system32\SpoonUninstall-dBpoweramp FLAC Codec.dat
2009-10-20 06:51 . 2009-10-20 06:51 3494 ----a-w c:\windows\system32\SpoonUninstall-dBpoweramp Mp2 and BwfMp2 codec.dat
2009-10-20 06:51 . 2009-10-20 06:51 2814 ----a-w c:\windows\system32\SpoonUninstall-dBpoweramp [Calculate Audio CRC] Codec.dat
2009-10-20 06:51 . 2009-10-20 06:51 14189 ----a-w c:\windows\system32\SpoonUninstall-dBpoweramp Music Converter.dat
2009-10-18 18:21 . 2009-10-18 18:20 -------- d-----w c:\program files\Common Files\DVDVideoSoft
2009-10-18 18:21 . 2009-10-18 18:21 -------- d-----w c:\program files\DVDVideoSoft
2009-10-18 17:32 . 2009-10-18 17:32 61440 ----a-w c:\documents and settings\MMA\Dane aplikacji\Sun\Java\Deployment\cache\6.0\21\14e5d595-441d8b59-n\decora-sse.dll
2009-10-18 17:32 . 2009-10-18 17:32 503808 ----a-w c:\documents and settings\MMA\Dane aplikacji\Sun\Java\Deployment\cache\6.0\21\14e5d595-441d8b59-n\msvcp71.dll
2009-10-18 17:32 . 2009-10-18 17:32 499712 ----a-w c:\documents and settings\MMA\Dane aplikacji\Sun\Java\Deployment\cache\6.0\21\14e5d595-441d8b59-n\jmc.dll
2009-10-18 17:32 . 2009-10-18 17:32 348160 ----a-w c:\documents and settings\MMA\Dane aplikacji\Sun\Java\Deployment\cache\6.0\21\14e5d595-441d8b59-n\msvcr71.dll
2009-10-18 17:32 . 2009-10-18 17:32 12800 ----a-w c:\documents and settings\MMA\Dane aplikacji\Sun\Java\Deployment\cache\6.0\21\14e5d595-441d8b59-n\decora-d3d.dll
2009-10-18 17:32 . 2009-10-18 17:32 348160 ----a-w c:\documents and settings\MMA\Dane aplikacji\Sun\Java\Deployment\cache\6.0\15\58fb3e0f-4915c84b-n\msvcr71.dll
2009-10-18 17:32 . 2009-10-18 17:32 503808 ----a-w c:\documents and settings\MMA\Dane aplikacji\Sun\Java\Deployment\cache\6.0\15\58fb3e0f-4915c84b-n\msvcp71.dll
2009-10-18 17:32 . 2009-10-18 17:32 61440 ----a-w c:\documents and settings\MMA\Dane aplikacji\Sun\Java\Deployment\cache\6.0\15\58fb3e0f-4915c84b-n\decora-sse.dll
2009-10-18 17:32 . 2009-10-18 17:32 499712 ----a-w c:\documents and settings\MMA\Dane aplikacji\Sun\Java\Deployment\cache\6.0\15\58fb3e0f-4915c84b-n\jmc.dll
2009-10-18 17:32 . 2009-10-18 17:32 12800 ----a-w c:\documents and settings\MMA\Dane aplikacji\Sun\Java\Deployment\cache\6.0\15\58fb3e0f-4915c84b-n\decora-d3d.dll
2009-10-18 17:31 . 2009-10-18 17:31 315392 ----a-w c:\documents and settings\MMA\Dane aplikacji\Sun\Java\Deployment\cache\6.0\62\6baea4fe-54fd7413-n\jogl.dll
2009-10-18 17:31 . 2009-10-18 17:31 20480 ----a-w c:\documents and settings\MMA\Dane aplikacji\Sun\Java\Deployment\cache\6.0\62\6baea4fe-54fd7413-n\jogl_awt.dll
2009-10-18 17:31 . 2009-10-18 17:31 114688 ----a-w c:\documents and settings\MMA\Dane aplikacji\Sun\Java\Deployment\cache\6.0\62\6baea4fe-54fd7413-n\jogl_cg.dll
2009-10-18 17:31 . 2009-10-18 17:31 20480 ----a-w c:\documents and settings\MMA\Dane aplikacji\Sun\Java\Deployment\cache\6.0\45\4f710eed-2f6ba33b-n\gluegen-rt.dll
2009-10-18 17:31 . 2009-10-18 17:31 411368 ----a-w c:\windows\system32\deploytk.dll
2009-10-18 17:31 . 2009-10-18 17:31 -------- d-----w c:\program files\Java
2009-10-18 17:31 . 2009-10-18 17:31 152576 ----a-w c:\documents and settings\MMA\Dane aplikacji\Sun\Java\jre1.6.0_16\lzma.dll
2009-10-18 13:55 . 2009-10-18 13:53 -------- d-----w c:\documents and settings\MMA\Dane aplikacji\Auslogics
2009-10-17 17:03 . 2009-10-14 05:43 -------- d-----w c:\program files\AGEIA Technologies
2009-10-17 17:03 . 2009-10-14 05:43 -------- d-----w c:\program files\Common Files\Wise Installation Wizard
2009-10-17 16:58 . 2009-10-17 16:58 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\NVIDIA Corporation
2009-10-17 16:57 . 2009-10-17 16:57 -------- d-----w c:\program files\NVIDIA Corporation
2009-10-17 16:01 . 2009-10-14 05:47 -------- d-----w c:\program files\Common Files\InstallShield
2009-10-16 04:52 . 2009-10-16 04:52 1924440 ----a-w c:\documents and settings\MMA\Dane aplikacji\Macromedia\Flash Player\www.macromedia.com\bin\fpupdatepl\fpupdatepl.exe
2009-10-16 04:47 . 2009-10-16 04:45 -------- d-----w c:\documents and settings\MMA\Dane aplikacji\RaimaRadioPro
2009-10-15 17:47 . 2009-10-15 17:47 -------- d-----w c:\documents and settings\MMA\Dane aplikacji\Media Player Classic
2009-10-15 16:39 . 2009-10-15 16:39 -------- d-----w c:\documents and settings\MMA\Dane aplikacji\Nokia
2009-10-15 16:39 . 2009-10-15 16:39 -------- d-----w c:\documents and settings\MMA\Dane aplikacji\PC Suite
2009-10-15 16:39 . 2009-10-15 16:39 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\PC Suite
2009-10-15 16:38 . 2009-10-15 16:38 -------- d-----w c:\program files\Common Files\Nokia
2009-10-15 16:38 . 2009-10-15 16:38 -------- d-----w c:\program files\Common Files\PCSuite
2009-10-15 16:38 . 2009-10-15 16:38 -------- d-----w c:\program files\DIFX
2009-10-15 16:38 . 2009-10-15 16:38 -------- d-----w c:\program files\PC Connectivity Solution
2009-10-15 16:38 . 2009-10-15 16:38 61440 ----a-w c:\documents and settings\All Users\Dane aplikacji\Installations\{9C05FA75-0337-4523-AA57-9D3511018887}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-10-15 16:38 . 2009-10-15 16:38 10240 ----a-w c:\documents and settings\All Users\Dane aplikacji\Installations\{9C05FA75-0337-4523-AA57-9D3511018887}\Installer\CommonCustomActions\UninstPCS.exe
2009-10-15 16:37 . 2009-10-15 16:37 8192 ----a-w c:\documents and settings\All Users\Dane aplikacji\Installations\{9C05FA75-0337-4523-AA57-9D3511018887}\Installer\CommonCustomActions\UninstCCD.exe
2009-10-15 16:37 . 2009-10-15 16:37 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\Installations
2009-10-14 13:41 . 2009-10-14 13:41 716272 ----a-w c:\windows\system32\drivers\sptd.sys
2009-10-14 13:34 . 2009-10-14 13:34 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\ipla
2009-10-14 13:20 . 2009-10-14 13:20 -------- d-----w c:\program files\ipla
2009-10-14 13:20 . 2009-10-14 13:20 1060864 ----a-w c:\windows\system32\mfc71.dll
2009-10-14 11:28 . 2009-10-14 11:28 -------- d-----w c:\program files\Windows Media Connect 2
2009-10-14 06:27 . 2009-10-14 06:25 -------- d-----w c:\documents and settings\MMA\Dane aplikacji\Nowe Gadu-Gadu
2009-10-14 06:17 . 2009-10-14 06:17 -------- d-----w c:\program files\Thomson
2009-10-14 06:17 . 2009-10-14 06:16 -------- d-----w c:\program files\Neostrada TP
2009-10-14 06:15 . 2009-10-14 06:15 -------- d--h--w c:\documents and settings\All Users\Dane aplikacji\CanonIJMyPrinter
2009-10-14 06:15 . 2009-10-14 06:12 -------- d-----w c:\program files\Canon
2009-10-14 06:15 . 2009-10-14 06:15 0 ----a-w c:\windows\nsreg.dat
2009-10-14 06:13 . 2009-10-14 06:13 -------- d--h--w c:\documents and settings\All Users\Dane aplikacji\CanonBJ
2009-10-14 06:13 . 2009-10-14 06:13 -------- d--h--w c:\program files\CanonBJ
2009-10-14 06:05 . 2009-10-14 06:05 -------- d-----w c:\documents and settings\MMA\Dane aplikacji\Ahead
2009-10-14 06:04 . 2009-10-14 06:04 -------- d-----w c:\program files\Common Files\Ahead
2009-10-14 06:02 . 2009-10-14 06:02 -------- d-----w c:\program files\Microsoft Works
2009-10-14 06:02 . 2009-10-14 06:02 -------- d-----w c:\program files\MSBuild
2009-10-14 05:50 . 2009-10-14 05:50 -------- d-----w c:\documents and settings\All Users\Dane aplikacji\ESET
2009-10-14 05:49 . 2009-10-14 05:49 -------- d-----w c:\program files\Analog Devices
2009-10-14 05:36 . 2009-10-14 05:36 -------- d-----w c:\program files\microsoft frontpage
2009-10-14 05:34 . 2009-10-14 05:34 -------- d-----w c:\program files\Usługi online
2009-10-14 05:32 . 2009-10-14 05:32 21856 ----a-w c:\windows\system32\emptyregdb.dat
2009-09-27 16:19 . 2009-09-27 16:19 3674112 ----a-w c:\windows\system32\nvwssr.dll
2009-09-27 14:12 . 2009-10-14 05:41 490088 ----a-w c:\windows\system32\nvudisp.exe
2009-09-27 14:12 . 2009-09-27 14:12 2194024 ----a-w c:\windows\system32\nvcuvid.dll
2009-09-27 14:12 . 2009-09-27 14:12 1714792 ----a-w c:\windows\system32\nvcuvenc.dll
2009-09-27 14:12 . 2009-09-27 14:12 1604482 ----a-w c:\windows\system32\nvdata.bin
2009-09-27 14:12 . 2008-08-24 04:11 888832 ----a-w c:\windows\system32\nvapi.dll
2009-09-27 14:12 . 2008-08-24 04:11 7655872 ----a-w c:\windows\system32\drivers\nv4_mini.sys
2009-09-27 14:12 . 2008-08-24 04:11 5900416 ----a-w c:\windows\system32\nv4_disp.dll
2009-09-27 14:12 . 2008-08-24 04:11 2007040 ----a-w c:\windows\system32\nvcuda.dll
2009-09-27 14:12 . 2008-08-24 04:11 170600 ----a-w c:\windows\system32\nvcodins.dll
2009-09-27 14:12 . 2008-08-24 04:11 170600 ----a-w c:\windows\system32\nvcod.dll
2009-09-27 14:12 . 2008-08-24 04:11 10756096 ----a-w c:\windows\system32\nvoglnt.dll
2009-09-24 07:24 . 2009-10-14 05:41 490088 ----a-w c:\windows\system32\NVUNINST.EXE
2009-09-11 14:19 . 2006-03-02 12:00 136192 ----a-w c:\windows\system32\msv1_0.dll
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D}]
2009-07-27 15:42 42088 ----a-w c:\documents and settings\MMA\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]
"AutoConnect"="e:\program files\AutoConnect\AutoConnect.exe" [2006-12-02 310784]
"Auslogics BoostSpeed 4"="e:\program files\Auslogics\Auslogics BoostSpeed\boostspeed.exe" [2009-01-24 361584]
"uTorrent"="e:\program files\uTorrent\uTorrent.exe" [2009-10-19 289072]
"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"egui"="e:\program files\ESET\ESET NOD32 Antivirus\egui.exe" [2009-04-09 2029640]
"KEMailKb"="c:\progra~1\KEMailKb\KEMailKb.EXE" [2003-10-21 401408]
"SpeedTouch USB Diagnostics"="c:\program files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 866816]
"nwiz"="c:\program files\NVIDIA Corporation\nView\nwiz.exe" [2009-09-23 1657448]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-09-27 13918208]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2009-09-27 86016]
"OODefragTray"="c:\windows\system32\oodtray.exe" [2008-11-03 2540800]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-10-18 149280]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
"WinampAgent"="e:\program files\Winamp\winampa.exe" [2008-08-03 36352]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\[u]0[/u]OODBS
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"e:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"e:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=
"e:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"e:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"e:\\Program Files\\uTorrent\\uTorrent.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"e:\\Nagrac\\TDU\\TDU\\TestDriveUnlimited.exe"=
"c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"=
"e:\\Program Files\\Gadu-Gadu\\gg.exe"=
R1 ehdrv;ehdrv;c:\windows\system32\drivers\ehdrv.sys [2009-04-09 107256]
R1 epfwtdir;epfwtdir;c:\windows\system32\drivers\epfwtdir.sys [2009-04-09 94360]
R2 ekrn;ESET Service;e:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe [2009-04-09 731840]
S2 gupdate;Usługa Google Update (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [2009-11-01 133104]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\system32\rundll32.exe" "c:\windows\system32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
.
Zawartość folderu 'Zaplanowane zadania'
2009-11-25 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-01 17:45]
2009-11-25 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2009-11-01 17:45]
.
- - - - USUNIĘTO PUSTE WPISY - - - -
SafeBoot-procexp90.Sys
.
------- Skan uzupełniający -------
.
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: E&ksportuj do programu Microsoft Excel - e:\progra~1\MICROS~1\Office12\EXCEL.EXE/3000
FF - ProfilePath - c:\documents and settings\MMA\Dane aplikacji\Mozilla\Firefox\Profiles\yfwqpu5h.default\
FF - prefs.js: browser.startup.homepage - google.pl
FF - plugin: c:\documents and settings\MMA\Dane aplikacji\Nowe Gadu-Gadu\_userdata\npgg.1.dll
FF - plugin: c:\documents and settings\MMA\Dane aplikacji\Nowe Gadu-Gadu\_userdata\nppl3260.dll
FF - plugin: c:\documents and settings\MMA\Dane aplikacji\Nowe Gadu-Gadu\_userdata\nprpjplug.dll
FF - plugin: c:\program files\Google\Update\1.2.183.13\npGoogleOneClick8.dll
FF - plugin: e:\program files\Google\Picasa3\npPicasa3.dll
FF - plugin: e:\program files\Opera\program\plugins\npdsplay.dll
FF - plugin: e:\program files\Opera\program\plugins\NPSWF32.dll
FF - plugin: e:\program files\Opera\program\plugins\npwmsdrm.dll
FF - plugin: e:\program files\Real Alternative\browser\plugins\nppl3260.dll
FF - plugin: e:\program files\Real Alternative\browser\plugins\nprpjplug.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-11-25 07:40
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG11.00.00.01WORKSTATION"="827DDB89BD594A26DF70D2D7D062CA3C99962D15221BFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933C038D530D6EB34528EDD5E5BE2F6E667A6171C11EC38DE3DD2B3EEB0213FAE7C95EDB288B796017D180FA6BC41058D69D905355C23B06095EF4B38FC3A2667037F7FB2057D74156F0608DD0BEEDE58786FC805B95995DE4E03EAB54DE209A9F517B636A06E47701B1EF3D643C96BDBF47B648DA5B19581362DC960D69B853E10457A23C7DE2DDAC6B08B852C1F67FB4E52836E630D30EA07E6A2A4727BF9A7754539540D3A86D09BDC0ED0B14B5653589754BAD5DF29F05C7A35651D2A0C18AA26E117A4FE7803A917BA1461C3FCAECAC40A7B04320620388646F577E5A37797CB6AAD6BBD6B56E2A8D99CEE8E6790BFA9DB2D1A9F13357CFD9D21467FEB610C6FCACD5D9E8D629DAEB22FB248E1AD3767823F685ADE2372A6052173DBD524389B00A21DDAD0F392991583A49E006F15F1BE16E2A43D91481C4EA98A7495C531B08AC8F041688CE2AED1C2E45597F49F955109A0D7C5590C4D4B5F3D58A27AF062EE534134CE5F10053E0CB7C4C10E046E82645EDFD10AB3FCD459E0A6BA31D43737479CA9C0D67F0C34F281575E40CF6F9BE7FC3C02661642C6A6EC955C861E8CED9FB42B3F8DFD0211FECF8C0EC6F7DC6C48FD83B8E37186004800EC4B50F19125CA615990D4B67C37A95077B78DD25146AD0ADB1DAD650B64B15A8C9194DA4AF0A899633CB0BD650B64543F05361B3C82B2EE029BA276DF5B4D60E37A0FC48D6A117D128F5A89787710551FE49772DC78691BC6E1548BECD0779AF8953081892DCE4D3E1D3EF4466A056D6789B8DA498854218E630AF26C34023764389A47BADA1DF05639FBBC34540D5BF9E75A3CEC15EB3B50D7BDDCEEF9B086D4F9262E779830F0DD7CE985FAAB6981CF3B6BE004059C44193A1F5D55183D7D09B6DE35668DAEF969450FD3A7E8CA67F101927921C2C53B0A490F6DD78CD4B4D80E833D82E6AFE024342813998BD8B7017C2999AA3D3B46568726E780D598E92D65870A1ED644994C2EA6128793AE413032BD3758E6C5AB47BE2C0EACF61DFC02E493C6DA0F6CBEB35B2E01F8875CF6C66D0FAEB935A1D738F7238412786CF3E8F7020131CB9F0EC1AA1778CA7163F0A03C15BEAFA4FD5A19023A54B465017608CE6229ECC646E86F4DED722EDD3C682B70F98CF0B300676F715A68F1CDCFD1185DF715AC41C0D5CB37744D27DECF3C6C20181D86E3BED6529B9C12F6C43A7866DC3CFDE6015E7E79221ECA900A7FF0F8A583DD4E3DC5256F9D4F0545631B7C5448D881E0CD67B1AD0B1412947A9DABFD9F021C79C816F00656F65BB6433F1957E0AE21377494DFB233B22D354B6F39B86F0B8D8F16"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
- - - - - - - > 'explorer.exe'(3232)
c:\windows\system32\WININET.dll
e:\program files\Gadu-Gadu\ggwhook.dll
c:\windows\system32\webcheck.dll
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
e:\program files\Microsoft Office\Office12\1045\GrooveIntlResource.dll
c:\program files\Common Files\Ahead\lib\NeroDigitalExt.dll
e:\program files\Illustrate\dBpoweramp\dBShell.dll
.
Czas ukończenia: 2009-11-25 7:41
ComboFix-quarantined-files.txt 2009-11-25 06:41
Przed: 12 304 338 944 bajtów wolnych
Po: 13 019 361 280 bajtów wolnych
293 --- E O F --- 2009-11-22 11:28
- Kod: Zaznacz wszystko
Logfile of HijackThis v1.99.1
Scan saved at 07:38:05, on 2009-11-25
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
E:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\oodag.exe
C:\Program Files\Analog Devices\SoundMAX\SMax4.exe
E:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe
C:\PROGRA~1\KEMailKb\KEMailKb.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
E:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Program Files\AutoConnect\AutoConnect.exe
E:\Program Files\Auslogics\Auslogics BoostSpeed\boostspeed.exe
E:\Program Files\Gadu-Gadu\gg.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Java\jre6\bin\jucheck.exe
E:\Program Files\Winamp\winamp.exe
E:\Program Files\Mozilla Firefox\firefox.exe
E:\Program Files\ToniArts\EasyCleaner\EasyClea.exe
E:\Instalki\hijackthis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - E:\PROGRA~1\MICROS~1\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: IEPluginBHO - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Documents and Settings\MMA\Dane aplikacji\Nowe Gadu-Gadu\_userdata\ggbho.1.dll
O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\SMax4.exe" /tray
O4 - HKLM\..\Run: [egui] "E:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice
O4 - HKLM\..\Run: [KEMailKb] C:\PROGRA~1\KEMailKb\KEMailKb.EXE
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe /install
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [OODefragTray] C:\WINDOWS\system32\oodtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [WinampAgent] "e:\Program Files\Winamp\winampa.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [AutoConnect] e:\Program Files\AutoConnect\AutoConnect.exe
O4 - HKCU\..\Run: [Auslogics BoostSpeed 4] e:\Program Files\Auslogics\Auslogics BoostSpeed\boostspeed.exe
O4 - HKCU\..\Run: [uTorrent] "e:\Program Files\uTorrent\uTorrent.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://E:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - E:\PROGRA~1\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International
O17 - HKLM\System\CCS\Services\Tcpip\..\{D8CA8117-D632-4011-950B-85FAEA65BD4F}: NameServer = 194.204.152.34 194.204.159.1
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - E:\PROGRA~1\MICROS~1\Office12\GR99D3~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: ESET HTTP Server (EhttpSrv) - ESET - E:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe
O23 - Service: ESET Service (ekrn) - ESET - E:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe
O23 - Service: Usługa Google Update (gupdate) (gupdate) - Unknown owner - C:\Program Files\Google\Update\GoogleUpdate.exe" /svc (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: Inkjet Printer/Scanner Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program Files\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Unknown owner - C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Unknown owner - e:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe (file missing)
Do a system scan only 
