ComboFix 07-10-06.5 - Jakub 2007-10-06 20:50:26.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.128 [GMT 2:00] Running from: D:\Documents and Settings\Jakub\Pulpit\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-09-06 to 2007-10-06 ))))))))))))))))))))))))))))))) . 2007-10-06 19:01 368,912 --a------ D:\WINDOWS\system32\vbar332.dll 2007-10-06 17:50 d-------- D:\Program Files\KLC 2007-10-05 19:56 d-------- D:\Program Files\Trend Micro 2007-10-05 19:37 348,160 --a------ D:\WINDOWS\system32\msvcr71.dll 2007-10-03 08:36 512,096 --a------ D:\WINDOWS\system32\drivers\amon.sys 2007-10-03 08:36 298,104 --a------ D:\WINDOWS\system32\imon.dll 2007-10-03 08:36 15,424 --a------ D:\WINDOWS\system32\drivers\nod32drv.sys 2007-10-01 21:58 d-------- D:\Program Files\Autoplay Repair 2007-10-01 18:16 d-------- D:\Program Files\CodeStuff 2007-09-29 10:02 d-------- D:\Program Files\Ie7 2007-09-29 09:54 d-------- D:\Program Files\MSXML 6.0 2007-09-29 09:41 d-------- D:\Program Files\MSXML 4.0 2007-09-29 09:27 d--h----- D:\WINDOWS\$hf_mig$ 2007-09-27 20:07 d-------- D:\Documents and Settings\Jakub\Dane aplikacji\OTVREG 2007-09-27 18:29 d-------- D:\Program Files\NeroInstall.bak 2007-09-27 17:32 d-------- D:\Documents and Settings\All Users\Dane aplikacji\Eset 2007-09-27 16:33 d-------- D:\Documents and Settings\Jakub\Dane aplikacji\Nero 2007-09-27 16:25 d-------- D:\Program Files\Nero 2007-09-27 16:25 d-------- D:\Program Files\Common Files\Nero 2007-09-27 16:25 d-------- D:\Documents and Settings\All Users\Dane aplikacji\Nero 2007-09-26 22:26 45,056 --a------ D:\WINDOWS\system32\WNASPI32.DLL 2007-09-26 22:26 16,877 --a------ D:\WINDOWS\system32\drivers\ASPI32.SYS 2007-09-26 17:32 427,864 --a------ D:\WINDOWS\system32\XceedZip.dll 2007-09-26 17:32 d-------- D:\Program Files\Driver-Soft 2007-09-26 16:53 d-------- D:\Documents and Settings\All Users\Dane aplikacji\Hagel Technologies 2007-09-26 10:35 d-------- D:\Documents and Settings\Jakub\Dane aplikacji\DivX 2007-09-25 13:29 d-------- D:\Documents and Settings\Jakub\Dane aplikacji\Ashampoo 2007-09-25 12:41 996,648 --a------ D:\WINDOWS\system32\ShellManager10E2D762.dll 2007-09-25 09:55 d-------- D:\Program Files\Mozilla Thunderbird 2007-09-25 08:26 d-------- D:\Documents and Settings\Jakub\Dane aplikacji\MozillaControl 2007-09-25 08:26 d-------- D:\Documents and Settings\Jakub\Dane aplikacji\AutoUpdate 2007-09-23 21:43 d-------- D:\Documents and Settings\Jakub\Dane aplikacji\Apple Computer 2007-09-23 21:32 82,248 --a------ D:\WINDOWS\system32\drivers\iksyssec.sys 2007-09-23 21:32 57,672 --a------ D:\WINDOWS\system32\drivers\iksysflt.sys 2007-09-23 21:32 40,264 --a------ D:\WINDOWS\system32\drivers\ikfilesec.sys 2007-09-23 21:32 29,000 --a------ D:\WINDOWS\system32\drivers\kcom.sys 2007-09-23 21:32 d-------- D:\Program Files\Spyware Doctor 2007-09-23 21:32 d-------- D:\Documents and Settings\Jakub\Dane aplikacji\PC Tools 2007-09-23 21:31 626,688 --a------ D:\WINDOWS\system32\msvcr80.dll 2007-09-23 19:01 d-------- D:\Documents and Settings\Jakub\Dane aplikacji\iolo 2007-09-23 19:01 d-------- D:\Documents and Settings\All Users\Dane aplikacji\iolo 2007-09-23 15:39 d-------- D:\Program Files\SkanerOnline 2007-09-22 14:50 95,608 --a------ D:\WINDOWS\system32\AVASTSS.scr 2007-09-22 14:50 94,416 --a------ D:\WINDOWS\system32\drivers\aswmon2.sys 2007-09-22 14:50 92,848 --a------ D:\WINDOWS\system32\drivers\aswmon.sys 2007-09-22 14:50 801,144 --a------ D:\WINDOWS\system32\aswBoot.exe 2007-09-22 14:50 42,912 --a------ D:\WINDOWS\system32\drivers\aswTdi.sys 2007-09-22 14:50 26,624 --a------ D:\WINDOWS\system32\drivers\aavmker4.sys 2007-09-22 14:50 23,152 --a------ D:\WINDOWS\system32\drivers\aswRdr.sys 2007-09-22 14:50 d-------- D:\Program Files\Alwil Software 2007-09-22 14:44 d-------- D:\Program Files\SpeedFan 2007-09-20 23:46 d-------- D:\Moje dokumenty 2007-09-20 23:42 d-------- D:\Program Files\Lekarz domowy 2007-09-20 23:41 d-------- D:\Program Files\CDex_150 2007-09-20 18:57 d-------- D:\Program Files\xp-AntiSpy 2007-09-20 18:42 14,336 --a------ D:\WINDOWS\system32\drivers\amdacpi.sys 2007-09-20 18:42 d-------- D:\Program Files\AMD 2007-09-20 18:01 d-------- D:\Documents and Settings\Jakub\Dane aplikacji\atitray 2007-09-20 18:00 d-a------ D:\Documents and Settings\All Users\Dane aplikacji\TEMP 2007-09-20 17:45 516,096 --------- D:\WINDOWS\system32\ati2sgag.exe 2007-09-19 12:51 d-------- D:\Program Files\WinAVIVideoConverter 2007-09-19 12:31 d-------- D:\Program Files\RM Converter 2007-09-19 12:20 d-------- D:\Program Files\AC3Filter 2007-09-19 10:16 d-------- D:\WINDOWS\A5W_DATA 2007-09-17 20:23 823,296 --a------ D:\WINDOWS\system32\divx_xx0c.dll 2007-09-17 20:23 823,296 --a------ D:\WINDOWS\system32\divx_xx07.dll 2007-09-17 20:22 802,816 --a------ D:\WINDOWS\system32\divx_xx11.dll 2007-09-17 20:22 739,840 --a------ D:\WINDOWS\system32\DivX.dll 2007-09-16 22:32 d-------- D:\Program Files\OrtografiaDlaDzieci 2007-09-15 12:31 d-------- D:\Documents and Settings\Jakub\Dane aplikacji\vlc 2007-09-14 14:43 d-------- D:\Program Files\DAEMON Tools 2007-09-12 01:14 156,992 --a------ D:\WINDOWS\system32\DivXCodecVersionChecker.exe 2007-09-09 15:21 90,624 --a------ D:\WINDOWS\system32\nmwcdcls.dll 2007-09-09 15:20 d-------- D:\Documents and Settings\All Users\Dane aplikacji\Installations 2007-09-08 16:35 66,872 --a------ D:\WINDOWS\system32\PnkBstrA.exe 2007-09-08 16:35 22,328 --a------ D:\WINDOWS\system32\drivers\PnkBstrK.sys 2007-09-08 16:35 103,736 --a------ D:\WINDOWS\system32\PnkBstrB.exe 2007-09-06 13:53 d-------- D:\Program Files\Juz w szkole klasa 1 2007-09-06 13:44 d-------- D:\Program Files\Common Files\YDP . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-10-06 20:49 --------- d-------- D:\Documents and Settings\Jakub\Dane aplikacji\Skype 2007-10-06 19:26 --------- d-------- D:\Documents and Settings\Jakub\Dane aplikacji\uTorrent 2007-10-04 19:42 --------- d-------- D:\Program Files\Dzielenie i laczenie plikow 2007-10-01 23:06 --------- d-------- D:\Program Files\DivX 2007-10-01 22:41 --------- d-------- D:\Program Files\totalcmd 2007-10-01 19:59 --------- d--h----- D:\Program Files\InstallShield Installation Information 2007-09-27 16:25 --------- d-------- D:\Program Files\Common Files\Ahead 2007-09-26 13:35 --------- d-------- D:\Program Files\bitRipper 2007-09-23 23:52 --------- d-------- D:\Program Files\Ashampoo 2007-09-20 23:08 --------- d-------- D:\Program Files\ffdshow 2007-09-20 18:47 --------- d-------- D:\Program Files\Common Files\Wise Installation Wizard 2007-09-20 17:41 451072 --a------ D:\WINDOWS\Radeon Omega Drivers v3.8.360 Uninstall.exe 2007-09-19 13:21 --------- d-------- D:\Program Files\Spik 2007-09-19 12:21 --------- d-------- D:\Program Files\AviSynth 2.5 2007-09-16 23:26 --------- d-------- D:\Program Files\Odkurzacz 2007-09-16 17:14 --------- d-------- D:\Program Files\Smarty Uninstaller Pro 2007-09-16 14:40 --------- d-------- D:\Documents and Settings\Jakub\Dane aplikacji\OpenOffice.org2 2007-09-08 16:19 --------- d-------- D:\Program Files\Wolfenstein - Enemy Territory 2007-09-01 21:39 --------- d-------- D:\Program Files\Microsoft Bootvis 2007-08-31 13:58 --------- d-------- D:\Program Files\XviD 2007-08-31 13:58 --------- d-------- D:\Program Files\QuickTime 2007-08-28 22:30 --------- d-------- D:\Documents and Settings\Jakub\Dane aplikacji\gtopala 2007-08-27 22:38 --------- d-------- D:\Documents and Settings\Jakub\Dane aplikacji\Ringjacker 2007-08-23 23:09 --------- d-------- D:\Program Files\Common Files\BinarySense 2007-08-23 23:09 --------- d-------- D:\Program Files\BinarySense 2007-08-23 23:09 --------- d-------- D:\Documents and Settings\Jakub\Dane aplikacji\BinarySense 2007-08-23 20:11 --------- d-------- D:\Program Files\Winamp 2007-08-23 12:10 28168 --a------ D:\WINDOWS\system32\drivers\epfwtdir.sys 2007-08-23 12:08 33288 --a------ D:\WINDOWS\system32\drivers\eamon.sys 2007-08-23 12:08 25096 --a------ D:\WINDOWS\system32\drivers\easdrv.sys 2007-08-22 13:56 --------- d-------- D:\Documents and Settings\All Users\Dane aplikacji\Apple Computer 2007-08-21 02:26 81920 --a------ D:\WINDOWS\system32\dpl100.dll 2007-08-21 02:26 196608 --a--c--- D:\WINDOWS\system32\dtu100.dll 2007-08-20 09:58 --------- d-------- D:\Program Files\DVDDecrypter 2007-08-18 17:35 --------- d-------- D:\Program Files\Webteh 2007-08-18 17:34 --------- d-------- D:\Documents and Settings\Jakub\Dane aplikacji\BSplayer PRO 2007-08-18 07:17 --------- d-------- D:\Program Files\CCleaner 2007-08-16 20:20 --------- d-------- D:\Program Files\Realtek AC97 2007-08-16 00:33 524288 --a------ D:\WINDOWS\system32\DivXsm.exe 2007-08-16 00:33 3596288 --a------ D:\WINDOWS\system32\qt-dx331.dll 2007-08-16 00:33 200704 --a------ D:\WINDOWS\system32\ssldivx.dll 2007-08-16 00:33 1044480 --a------ D:\WINDOWS\system32\libdivx.dll 2007-08-16 00:31 593920 --a------ D:\WINDOWS\system32\dpuGUI11.dll 2007-08-16 00:31 57344 --a------ D:\WINDOWS\system32\dpv11.dll 2007-08-16 00:31 53248 --a--c--- D:\WINDOWS\system32\dpuGUI10.dll 2007-08-16 00:31 344064 --a--c--- D:\WINDOWS\system32\dpus11.dll 2007-08-16 00:31 294912 --a--c--- D:\WINDOWS\system32\dpu10.dll 2007-08-16 00:31 294912 --a------ D:\WINDOWS\system32\dpu11.dll 2007-08-16 00:30 12288 --a------ D:\WINDOWS\system32\DivXWMPExtType.dll 2007-08-15 17:39 --------- d-------- D:\Program Files\AidemMedia 2007-08-13 17:30 --------- d-------- D:\Program Files\Przygoda Boba w Zamku 2007-08-12 10:23 --------- d-------- D:\Documents and Settings\Jakub\Dane aplikacji\Ahead 2007-08-10 01:31 50688 --a------ D:\WINDOWS\system32\wbhelp2.dll 2007-07-30 19:19 92504 --a------ D:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 549720 --a------ D:\WINDOWS\system32\wuapi.dll 2007-07-30 19:19 53080 --a------ D:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 43352 --a--c--- D:\WINDOWS\system32\wups2.dll 2007-07-30 19:19 325976 --a------ D:\WINDOWS\system32\wucltui.dll 2007-07-30 19:19 203096 --a------ D:\WINDOWS\system32\wuweb.dll 2007-07-30 19:19 1712984 --a------ D:\WINDOWS\system32\wuaueng.dll 2007-07-30 19:18 33624 --a--c--- D:\WINDOWS\system32\wups.dll 2007-07-30 19:18 207736 --a------ D:\WINDOWS\system32\muweb.dll 2007-07-29 17:51 7680 --a------ D:\WINDOWS\system32\ff_vfw.dll 2007-07-29 17:34 60416 --a------ D:\WINDOWS\ALCFDRTM.EXE 2007-07-27 01:06 129784 -----c--- D:\WINDOWS\system32\pxafs.dll 2007-07-27 01:06 120056 -----c--- D:\WINDOWS\system32\pxcpyi64.exe 2007-07-27 01:06 118520 -----c--- D:\WINDOWS\system32\pxinsi64.exe 2007-07-22 11:32 60273 --a------ D:\WINDOWS\system32\pthreadGC2.dll 2007-05-08 22:24 81920 --a--c--- D:\Documents and Settings\Jakub\Dane aplikacji\ezpinst.exe 2007-05-08 22:24 47360 --a--c--- D:\Documents and Settings\Jakub\Dane aplikacji\pcouffin.sys 2004-09-28 04:00 26240 --a--c--- D:\WINDOWS\inf\RAMDSK.SYS 2007-02-16 18:36:50 88 -csh--r D:\WINDOWS\system32\153235FFBD.sys 2007-02-23 09:30:17 56 -csh--r D:\WINDOWS\system32\BDFF353215.sys 2007-02-23 09:30:44 5,852 -csha-w D:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "nod32kui"="D:\Program Files\Eset\nod32kui.exe" [2007-10-03 08:36] "SpeedFan"="D:\Program Files\SpeedFan\speedfan.exe" [2007-09-17 19:04] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Spik"="D:\Program Files\Spik\Spik.exe" [2007-09-12 14:22] "Skype"="D:\Program Files\Skype\Phone\Skype.exe" [2007-09-13 13:31] "AtiTrayTools"="D:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe" [2007-05-22 11:04] "ctfmon.exe"="D:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] "DAEMON Tools"="D:\Program Files\DAEMON Tools\daemon.exe" [2007-08-16 13:24] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "NoDispBackgroundPage"=0 (0x0) "SynchronousUserGroupPolicy"=0 (0x0) "SynchronousMachineGroupPolicy"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "NoDispBackgroundPage"=0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"=0 (0x0) "NoPropertiesMyComputer"=0 (0x0) "NoFileAssociate"=0 (0x0) "NoSMHelp"=0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer] "NoRecentDocsHistory"=0 (0x0) "NoTrayItemsDisplay"=0 (0x0) "NoWelcomeScreen"=0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "TapiSrv"=3 (0x3) "Silent Runners.vbs", revision 52, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "Spik" = "D:\Program Files\Spik\Spik.exe -autostart" [null data] "Skype" = ""D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized" ["Skype Technologies S.A."] "AtiTrayTools" = ""D:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe"" ["Ray Adams"] "ctfmon.exe" = "D:\WINDOWS\system32\ctfmon.exe" [MS] "DAEMON Tools" = ""D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033" ["DT Soft Ltd."] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "nod32kui" = ""D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE" ["Eset "] "SpeedFan" = "D:\Program Files\SpeedFan\speedfan.exe" ["Almico Software (www.almico.com)"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "Adobe PDF Reader Link Helper" \InProcServer32\(Default) = "D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "SSVHelper Class" \InProcServer32\(Default) = "D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "D:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data] "{e57ce731-33e8-4c51-8354-bb4de9d215d1}" = "Uniwersalne urządzenia Plug and Play" -> {HKLM...CLSID} = "Uniwersalne urządzenia Plug and Play" \InProcServer32\(Default) = "D:\WINDOWS\system32\upnpui.dll" [MS] "{CCA60260-A2C9-11D2-BA62-0020188191B2}" = "Resplendent Registrar Shell Extension" -> {HKLM...CLSID} = "Resplendent Registrar Shell Extension" \InProcServer32\(Default) = "rrShellX.dll" [null data] "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" = "UnlockerShellExtension" -> {HKLM...CLSID} = "UnlockerShellExtension" \InProcServer32\(Default) = "D:\Program Files\Unlocker\UnlockerCOM.dll" [null data] "{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}" = "OpenOffice.org Column Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""D:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{087B3AE3-E237-4467-B8DB-5A38AB959AC9}" = "OpenOffice.org Infotip Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""D:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{63542C48-9552-494A-84F7-73AA6A7C99C1}" = "OpenOffice.org Property Sheet Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""D:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{3B092F0C-7696-40E3-A80F-68D74DA84210}" = "OpenOffice.org Thumbnail Viewer" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""D:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] "{B4B924A2-EBDA-11DA-95DA-00E08161165F}" = "Dodatki Spika" -> {HKLM...CLSID} = "SpikShellExt Class" \InProcServer32\(Default) = "D:\Program Files\Spik\shellext_wpmsg.dll" ["Wirtualna Polska"] "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "D:\Program Files\Eset\nodshex.dll" [null data] HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad"WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "D:\WINDOWS\system32\WPDShServiceObj.dll" [MS] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify<> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] <> wzcnotif\DLLName = "wzcdlg.dll" [MS] HKLM\Software\Classes\Folder\shellex\ColumnHandlers{C52AF81D-F7A0-4AAB-8E87-F80A60CCD396}\(Default) = "OpenOffice.org Column Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = ""D:\Program Files\OpenOffice.org 2.2\program\shlxthdl.dll"" ["Sun Microsystems, Inc."] {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlersMkS_Vir\(Default) = "{E64226E0-9DA1-479E-8265-8D65BA327BD4}" -> {HKLM...CLSID} = "MkS_Vir Shell Extension" \InProcServer32\(Default) = "/u\mksshell.dll" [file not found] NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "D:\Program Files\Eset\nodshex.dll" [null data] Spik\(Default) = "{B4B924A2-EBDA-11DA-95DA-00E08161165F}" -> {HKLM...CLSID} = "SpikShellExt Class" \InProcServer32\(Default) = "D:\Program Files\Spik\shellext_wpmsg.dll" ["Wirtualna Polska"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlersWinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlersMkS_Vir\(Default) = "{E64226E0-9DA1-479E-8265-8D65BA327BD4}" -> {HKLM...CLSID} = "MkS_Vir Shell Extension" \InProcServer32\(Default) = "/u\mksshell.dll" [file not found] NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}" -> {HKLM...CLSID} = "NOD32 Context Menu Shell Extension" \InProcServer32\(Default) = "D:\Program Files\Eset\nodshex.dll" [null data] Spik\(Default) = "{B4B924A2-EBDA-11DA-95DA-00E08161165F}" -> {HKLM...CLSID} = "SpikShellExt Class" \InProcServer32\(Default) = "D:\Program Files\Spik\shellext_wpmsg.dll" ["Wirtualna Polska"] UnlockerShellExtension\(Default) = "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" -> {HKLM...CLSID} = "UnlockerShellExtension" \InProcServer32\(Default) = "D:\Program Files\Unlocker\UnlockerCOM.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "D:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\AllFilesystemObjects\shellex\ContextMenuHandlersUnlockerShellExtension\(Default) = "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" -> {HKLM...CLSID} = "UnlockerShellExtension" \InProcServer32\(Default) = "D:\Program Files\Unlocker\UnlockerCOM.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoCDBurning" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoRecentDocsHistory" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "ClearRecentDocsOnExit" = (REG_DWORD) hex:0x00000001 {unrecognized setting} "NoTrayItemsDisplay" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Hide the notification area} "NoWelcomeScreen" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer "NoResolveTrack" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoPropertiesMyComputer" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoFileAssociate" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoSMHelp" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System "NoDispBackgroundPage" = (REG_DWORD) hex:0x00000000 {User Configuration|Administrative Templates|Control Panel|Display| Hide Desktop tab} HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel "SecurityTab" = (REG_DWORD) hex:0x00000000 {Computer Configuration|Administrative Templates|Windows Components|Internet Explorer|Internet Control Panel| Disable the Security page} "ConnectionsTab" = (REG_DWORD) hex:0x00000000 {Computer Configuration|Administrative Templates|Windows Components|Internet Explorer|Internet Control Panel| Disable the Connections page} "SecChangeSettings" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions "NoBrowserOptions" = (REG_DWORD) hex:0x00000000 {Computer Configuration|Administrative Templates|Windows Components|Internet Explorer|Browser Menus| Tools menu: Disable Internet Options... menu option} "NoBrowserSaveAs" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoFavorites" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoFileNew" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoFileOpen" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "NoTheaterMode" = (REG_DWORD) hex:0x00000000 {unrecognized setting} HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} "ShutdownWithoutLogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "NoDispBackgroundPage" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "SynchronousUserGroupPolicy" = (REG_DWORD) hex:0x00000000 {unrecognized setting} "SynchronousMachineGroupPolicy" = (REG_DWORD) hex:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General"Wallpaper" = "D:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop"Wallpaper" = "D:\Documents and Settings\Jakub\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: D:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 19 %SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 18 %SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10 Toolbars, Explorer Bars, Extensions: ------------------------------------ Extensions (Tools menu items, main toolbar menu buttons) HKLM\Software\Microsoft\Internet Explorer\Extensions{08B0E5C0-4FCB-11CF-AAA5-00401C608501}"MenuText" = "Sun Java Console" "CLSIDExtension" = "{CAFEEFAC-0016-0000-0002-ABCDEFFEDCBC}" -> {HKCU...CLSID} = "Java Plug-in 1.6.0_02" \InProcServer32\(Default) = "D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll" ["Sun Microsystems, Inc."] -> {HKLM...CLSID} = "Java Plug-in 1.6.0_02" \InProcServer32\(Default) = "D:\Program Files\Java\jre1.6.0_02\bin\npjpi160_02.dll" ["Sun Microsystems, Inc."] {E2E2DD38-D088-4134-82B7-F2BA38496583}"MenuText" = "@xpsp3res.dll,-20001" "Exec" = "%windir%\Network Diagnostic\xpnetdiag.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, "D:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."] HDDlife HDD Access service, HDDlife HDD Access service, ""D:\Program Files\Common Files\BinarySense\hldasvc.exe"" ["BinarySense, Inc."] NOD32 Kernel Service, NOD32krn, ""D:\Program Files\Eset\nod32krn.exe"" ["Eset "] PnkBstrA, PnkBstrA, "D:\WINDOWS\system32\PnkBstrA.exe" [null data] ---------- (launch time: 2007-10-06 20:45:18) <>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 63 seconds, including 5 seconds for message boxes)

Wrzuć tak dla pewności logi Silent Runners i ComboFix.

Tak po podmianie plików z płytki działa OK.Ale co do restrykcji to nie zakładałem.

Zostały Ci jakies śmieci po Awaście. [quote]O23 - Service: aswUpdSv - Unknown owner - (no file)[/quote] Klepni w wierszu polecenia [quote]sc delete aswUpdSv[/quote] Jakies restrykcje są wprowadzone - sam zakładałeś ?? [quote]O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present[/quote] Skoro napisałeś, że jest OK to rozumiem, że wszystko działa już jak nalezy ??

Pliki przywróciłem z płytki i jest OK.Antywirus twierdzi że jest czysto.Ale log dołączam. Logfile of HijackThis v1.99.1 Scan saved at 14:09:33, on 2007-10-04 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0011) Running processes: D:\WINDOWS\System32\smss.exe D:\WINDOWS\system32\winlogon.exe D:\WINDOWS\system32\services.exe D:\WINDOWS\system32\lsass.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\system32\svchost.exe D:\WINDOWS\System32\svchost.exe D:\WINDOWS\system32\Ati2evxx.exe D:\WINDOWS\Explorer.EXE D:\WINDOWS\system32\spoolsv.exe D:\Program Files\Eset\nod32kui.exe D:\Program Files\SpeedFan\speedfan.exe D:\Program Files\Spik\Spik.exe D:\Program Files\Skype\Phone\Skype.exe D:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe D:\Program Files\DAEMON Tools\daemon.exe D:\WINDOWS\system32\ctfmon.exe D:\WINDOWS\system32\cisvc.exe D:\Program Files\Common Files\BinarySense\hldasvc.exe D:\Program Files\Common Files\BinarySense\hldasvc.exe D:\Program Files\Eset\nod32krn.exe D:\WINDOWS\system32\PnkBstrA.exe E:\Programy\Narzędzia\hijackthis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O4 - HKLM\..\Run: [nod32kui] "D:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [SpeedFan] D:\Program Files\SpeedFan\speedfan.exe O4 - HKCU\..\Run: [Spik] D:\Program Files\Spik\Spik.exe -autostart O4 - HKCU\..\Run: [Skype] "D:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [AtiTrayTools] "D:\Program Files\Ray Adams\ATI Tray Tools\atitray.exe" O4 - HKCU\..\Run: [DAEMON Tools] "D:\Program Files\DAEMON Tools\daemon.exe" -lang 1033 O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_02\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1190932099718 O18 - Protocol: hddlife - {BD758015-47D9-477A-8873-4B688A2BC0E2} - "D:\Program Files\BinarySense\HDDlife 3\hlAPP.dll" (file missing) O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - D:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Protocol: wpmsg - {2E0AC5A0-3597-11D6-B3ED-0001021DC1C3} - D:\Program Files\Spik\url_wpmsg.dll O20 - Winlogon Notify: WgaLogon - D:\WINDOWSO21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - D:\WINDOWS\system32\WPDShServiceObj.dll O23 - Service: Adobe LM Service - Adobe Systems - D:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: aswUpdSv - Unknown owner - (no file) O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - D:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - D:\WINDOWS\system32\ati2sgag.exe O23 - Service: Eset HTTP server (EhttpSrv) - Unknown owner - D:\Program Files\Eset\ESET NOD32 Antivirus\EHttpSrv.exe (file missing) O23 - Service: Eset Service (ekrn) - Unknown owner - D:\Program Files\Eset\ESET NOD32 Antivirus\ekrn.exe (file missing) O23 - Service: HDDlife HDD Access service - BinarySense, Inc. - D:\Program Files\Common Files\BinarySense\hldasvc.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - D:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - D:\Program Files\Eset\nod32krn.exe O23 - Service: PnkBstrA - Unknown owner - D:\WINDOWS\system32\PnkBstrA.exe O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\swdsvc.exe

Przywrócić spróbuj z płyty instalacyjnej pliki command.com, autoexec.nt i config.ny - dodatkowo - skan programem antywirusowym. Pokaż też loga Hijacka.

Gra dla dzieci,która jakiś czas temu chodziła normalnie(jak kilka innych zresztą).

Co to za obraz ??

Następny komunikat się pojawia NTVDM CPU:napotkano niedozwoloną instrukcję.CS:8dff IP:28e0 OP:ff ff 01 00 ff

Zerknij -> [url]http://support.microsoft.com/kb/314452/pl[/url]