OTL logfile created on: 2012-04-01 14:37:17 - Run 3 OTL by OldTimer - Version 3.2.39.2 Folder = C:\Documents and Settings\Administrator\Pulpit Windows XP Home Edition Dodatek Service Pack. 1 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2800.1106) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 510,98 Mb Total Physical Memory | 421,94 Mb Available Physical Memory | 82,57% Memory free 1,22 Gb Paging File | 1,18 Gb Available in Paging File | 96,62% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 19,58 Gb Total Space | 0,86 Gb Free Space | 4,39% Space Free | Partition Type: NTFS Drive D: | 54,92 Gb Total Space | 7,33 Gb Free Space | 13,34% Space Free | Partition Type: NTFS Drive F: | 3,77 Gb Total Space | 0,94 Gb Free Space | 25,06% Space Free | Partition Type: FAT32 Computer Name: KASIA | User Name: Administrator | Logged in as Administrator. Boot Mode: SafeMode | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days [color=#E56717]========== Processes (SafeList) ==========[/color] PRC - [2012-04-01 09:40:06 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Pulpit\OTL.exe PRC - [2002-10-11 17:50:37 | 001,005,568 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe [color=#E56717]========== Modules (No Company Name) ==========[/color] MOD - [2009-02-27 20:04:20 | 000,311,296 | ---- | M] () -- C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\pdfshell.POL MOD - [2009-01-11 00:15:44 | 000,159,744 | ---- | M] () -- C:\Program Files\K-Lite Codec Pack\Filters\Haali\mmfinfo.dll MOD - [2009-01-11 00:14:06 | 000,023,552 | ---- | M] () -- C:\Program Files\K-Lite Codec Pack\Filters\Haali\mkunicode.dll [color=#E56717]========== Win32 Services (SafeList) ==========[/color] SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\xmlprov.dll -- (xmlprov) SRV - File not found [Auto | Stopped] -- %SYSTEMROOT%\system32\wscsvc.dll -- (wscsvc) SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt) SRV - [2012-02-28 18:38:52 | 001,373,576 | ---- | M] (LogMeIn Inc.) [Auto | Stopped] -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc) SRV - [2011-01-12 16:44:02 | 000,033,584 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv) SRV - [2011-01-12 16:41:42 | 000,810,144 | ---- | M] (ESET) [Auto | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn) SRV - [2002-10-11 17:54:10 | 000,047,104 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\WINDOWS\system32\mspmspsv.dll -- (WmdmPmSp) [color=#E56717]========== Driver Services (SafeList) ==========[/color] DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP) DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump) DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc) DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt) DRV - File not found [Kernel | System | Stopped] -- -- (Changer) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\ComboFix\catchme.sys -- (catchme) DRV - [2010-12-21 15:04:06 | 000,141,264 | ---- | M] (ESET) [File_System | Auto | Stopped] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon) DRV - [2010-12-21 15:04:06 | 000,115,008 | ---- | M] (ESET) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv) DRV - [2010-12-21 13:47:38 | 000,094,872 | ---- | M] (ESET) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\epfwtdir.sys -- (epfwtdir) DRV - [2009-11-04 17:53:40 | 000,034,248 | ---- | M] (McAfee, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\mferkdk.sys -- (mferkdk) DRV - [2009-04-30 22:55:58 | 002,687,512 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\LV302V32.SYS -- (PID_PEPI) Logitech QuickCam IM(PID_PEPI) DRV - [2009-03-18 17:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\hamachi.sys -- (hamachi) DRV - [2002-10-11 17:53:11 | 000,407,552 | ---- | M] () [File_System | System | Stopped] -- C:\WINDOWS\system32\drivers\mrxsmb.sys -- (MRxSmb) DRV - [2001-08-22 09:42:58 | 000,013,632 | ---- | M] (Dell Computer Corporation) [Kernel | System | Stopped] -- C:\WINDOWS\system32\drivers\omci.sys -- (OMCI) [color=#E56717]========== Standard Registry (SafeList) ==========[/color] [color=#E56717]========== Internet Explorer ==========[/color] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {56256A51-B582-467e-B8D4-7786EDA79AE0} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [color=#E56717]========== FireFox ==========[/color] FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\System32\Macromed\Flash\NPSWF32.dll () FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012-03-25 15:20:18 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011-12-06 18:20:50 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2011-07-18 15:56:33 | 000,000,000 | ---D | M] [2012-03-31 21:21:11 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Extensions [2010-09-14 22:04:03 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2012-03-25 15:20:18 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2012-01-21 16:55:45 | 000,002,767 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml [2012-01-21 16:55:45 | 000,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml [2012-01-21 16:55:45 | 000,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml [2012-01-21 16:55:45 | 000,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml [2012-01-21 16:55:45 | 000,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml [2012-01-21 16:55:45 | 000,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2012-03-29 19:20:52 | 000,000,761 | RHS- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (ESCOFLiP Toolbar) - {d47a8d7d-f7b2-48a9-b8d6-b44484d51b89} - C:\Program Files\ESCOFLiP\prxtbESC2.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (&Radio) - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\system32\msdxm.ocx (Microsoft Corporation) O3 - HKLM\..\Toolbar: (ESCOFLiP Toolbar) - {d47a8d7d-f7b2-48a9-b8d6-b44484d51b89} - C:\Program Files\ESCOFLiP\prxtbESC2.dll (Conduit Ltd.) O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET) O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\WINDOWS\System32\nwiz.exe (NVIDIA Corporation) O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O7 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0 O9 - Extra Button: @shdoclc.dll,-866 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\Web\related.htm () O9 - Extra 'Tools' menuitem : @shdoclc.dll,-864 - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\Web\related.htm () O16 - DPF: {31435657-9980-0010-8000-00AA00389B71} http://download.microsoft.com/download/e/2/f/e2fcec4b-6c8b-48b7-adab-ab9c403a978f/wvc1dmo.cab (Reg Error: Key error.) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: DirectAnimation Java Classes file://C:\WINDOWS\Java\classes\dajava.cab (Reg Error: Key error.) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E8E6A63F-F592-4797-B625-8A66C131611A}: DhcpNameServer = 192.168.1.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\vnd.ms.radio {3DA2AA3B-3D96-11D2-9BD2-204C4F4F5020} - C:\WINDOWS\system32\msdxm.ocx (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009-12-29 20:46:36 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2010-10-19 16:04:02 | 000,000,986 | ---- | M] () - C:\AutoMapaSetupLog.txt -- [ NTFS ] O32 - AutoRun File - [2011-12-14 20:21:26 | 000,000,000 | ---- | M] () - F:\autorun.bat -- [ FAT32 ] O32 - AutoRun File - [2011-12-14 20:20:38 | 000,000,096 | ---- | M] () - F:\autorun.html -- [ FAT32 ] O32 - AutoRun File - [2011-12-14 20:21:10 | 000,000,000 | ---- | M] () - F:\autorubn.txt -- [ FAT32 ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = ComFile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* [color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color] [2012-04-01 13:58:55 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\WinRAR [2012-04-01 09:42:09 | 000,593,920 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Pulpit\OTL.exe [2012-03-31 21:20:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Mozilla [2012-03-31 21:20:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla [2012-03-31 21:18:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Opera [2012-03-31 21:18:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\Opera [2012-03-31 21:17:37 | 000,000,000 | -HSD | C] -- C:\RECYCLER [2012-03-31 21:16:40 | 000,000,000 | ---D | C] -- C:\WINDOWS\temp [2012-03-31 20:40:23 | 000,518,144 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWREG.exe [2012-03-31 20:40:23 | 000,406,528 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWSC.exe [2012-03-31 20:40:23 | 000,212,480 | ---- | C] (SteelWerX) -- C:\WINDOWS\SWXCACLS.exe [2012-03-31 20:40:23 | 000,060,416 | ---- | C] (NirSoft) -- C:\WINDOWS\NIRCMD.exe [2012-03-31 20:40:19 | 000,000,000 | ---D | C] -- C:\WINDOWS\ERDNT [2012-03-31 20:40:14 | 000,000,000 | ---D | C] -- C:\Qoobox [2012-03-31 20:40:08 | 000,000,000 | R--D | C] -- C:\Documents and Settings\All Users\Dokumenty\Moje wideo [2012-03-31 20:40:08 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Moje dokumenty\Moje wideo [2012-03-31 20:40:08 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Moje dokumenty\Moje obrazy [2012-03-31 20:40:07 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Moje dokumenty\Moja muzyka [2012-03-31 20:40:06 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Menu Start\Programy\Narzędzia administracyjne [2012-03-31 20:37:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\Microsoft [2012-03-31 20:37:02 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\Microsoft [2012-03-31 20:37:02 | 000,000,000 | --SD | C] -- C:\Documents and Settings\Administrator\Cookies [2012-03-31 20:37:02 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji [2012-03-31 20:37:01 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\SendTo [2012-03-31 20:37:01 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Menu Start [2012-03-31 20:37:01 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart [2012-03-31 20:37:01 | 000,000,000 | R--D | C] -- C:\Documents and Settings\Administrator\Menu Start\Programy\Akcesoria [2012-03-31 20:37:01 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\Ustawienia lokalne [2012-03-31 20:37:01 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\Szablony [2012-03-31 20:37:01 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\Recent [2012-03-31 20:37:01 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\PrintHood [2012-03-31 20:37:01 | 000,000,000 | -H-D | C] -- C:\Documents and Settings\Administrator\NetHood [2012-03-31 20:37:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Ulubione [2012-03-31 20:37:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Pulpit [2012-03-31 20:37:01 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Moje dokumenty [2012-03-31 20:36:49 | 000,000,000 | ---D | C] -- C:\WINDOWS\Minidump [2012-03-27 21:13:42 | 000,000,000 | ---D | C] -- C:\Program Files\Opera [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files - Modified Within 30 Days ==========[/color] [2012-04-01 14:35:31 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2012-04-01 09:40:06 | 000,593,920 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Administrator\Pulpit\OTL.exe [2012-03-31 20:33:26 | 001,402,880 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\HijackThis.msi [2012-03-30 21:19:16 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2012-03-29 19:20:52 | 000,000,761 | RHS- | M] () -- C:\WINDOWS\System32\drivers\etc\hosts [2012-03-27 21:13:50 | 000,001,492 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Opera 11.62 1347.lnk [2012-03-25 15:14:13 | 000,355,486 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2012-03-25 15:14:13 | 000,049,492 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2012-03-25 15:14:12 | 000,311,604 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2012-03-25 15:14:12 | 000,039,992 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [2 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [color=#E56717]========== Files Created - No Company Name ==========[/color] [2012-03-31 21:17:08 | 001,402,880 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\HijackThis.msi [2012-03-31 20:40:23 | 000,256,000 | ---- | C] () -- C:\WINDOWS\PEV.exe [2012-03-31 20:40:23 | 000,208,896 | ---- | C] () -- C:\WINDOWS\MBR.exe [2012-03-31 20:40:23 | 000,098,816 | ---- | C] () -- C:\WINDOWS\sed.exe [2012-03-31 20:40:23 | 000,080,412 | ---- | C] () -- C:\WINDOWS\grep.exe [2012-03-31 20:40:23 | 000,068,096 | ---- | C] () -- C:\WINDOWS\zip.exe [2012-03-31 20:37:02 | 000,001,599 | ---- | C] () -- C:\Documents and Settings\Administrator\Menu Start\Programy\Pomoc zdalna.lnk [2012-03-31 20:37:02 | 000,000,792 | ---- | C] () -- C:\Documents and Settings\Administrator\Menu Start\Programy\Windows Media Player.lnk [2012-03-27 21:13:50 | 000,001,498 | ---- | C] () -- C:\Documents and Settings\All Users\Menu Start\Programy\Opera 11.62 1347.lnk [2012-03-27 21:13:50 | 000,001,492 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Opera 11.62 1347.lnk [2011-09-10 08:56:13 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI [color=#E56717]========== LOP Check ==========[/color] [2012-03-31 21:18:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Opera [2011-07-18 15:56:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ESET [2010-04-27 14:28:57 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\NCH Swift Sound [color=#E56717]========== Purity Check ==========[/color] < End of report >