Efilon Opublikowano 11 Maja 2013 Zgłoś Udostępnij Opublikowano 11 Maja 2013 Na laptoka dziewczyny prawdopodobie wkradła się jakaś podła kreatura. Dostała powiadomienie od TwarzoKsiążki, że ktoś z Kalifornia in JuEsEj próbował się logować na jej akaunt i bla, bla, bla... Z tegoż powodu zrobiłem rekonesans i z wywiadu okazało się, że wspomniany laptok od jakiegoś czasu sporadycznie odmawiał współpracy podczas wyłączania (nie chciał dopóki miał ładowanie i baterię). Wrzucam logi z OTL, jeśli potrzxeba czegoś więcej to podrzucę jak wrócę z (obozu) pracy. OTL logfile created on: 2013-05-11 10:09:13 - Run 1OTL by OldTimer - Version 3.2.69.0 Folder = D:\PobraneWindows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 8.0.6001.18702)Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 2,87 Gb Total Physical Memory | 2,23 Gb Available Physical Memory | 77,41% Memory free5,72 Gb Paging File | 5,23 Gb Available in Paging File | 91,51% Paging File freePaging file location(s): C:\pagefile.sys 3072 6144 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 56,64 Gb Total Space | 2,24 Gb Free Space | 3,95% Space Free | Partition Type: NTFSDrive D: | 176,23 Gb Total Space | 1,63 Gb Free Space | 0,92% Space Free | Partition Type: NTFS Computer Name: ASUSNEWLAP | User Name: Asus | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All usersCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013-05-11 10:07:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- D:\Pobrane\OTL.exePRC - [2013-04-12 18:57:31 | 000,920,472 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exePRC - [2013-03-07 00:32:44 | 004,767,304 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastUI.exePRC - [2013-03-07 00:32:44 | 000,045,248 | ---- | M] (AVAST Software) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exePRC - [2012-01-18 14:02:04 | 000,508,136 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Common Files\Java\Java Update\jucheck.exePRC - [2011-03-14 17:27:28 | 000,271,712 | ---- | M] () -- C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exePRC - [2010-06-10 09:57:18 | 000,548,744 | R--- | M] (ELAN Microelectronic Corp.) -- C:\Program Files\Elantech\ETDCtrl.exePRC - [2010-05-03 07:56:32 | 000,237,568 | ---- | M] (Alcor Micro Corp.) -- C:\Program Files\AmIcoSingLun\AmIcoSinglun.exePRC - [2010-04-07 07:16:52 | 001,599,880 | R--- | M] (ELAN Microelectronic Corp.) -- C:\Program Files\Elantech\ETDCtrlHelper.exePRC - [2009-04-23 22:24:44 | 000,178,744 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\HControl.exePRC - [2009-04-20 12:09:30 | 000,159,744 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Media\DMedia.exePRC - [2009-04-01 22:05:34 | 000,098,304 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\HControlUser.exePRC - [2009-03-03 16:32:16 | 000,092,728 | ---- | M] (ASUSTeK Computer Inc.) -- C:\Program Files\ASUS\Power4 Gear\BatteryLife.exePRC - [2008-12-22 18:15:34 | 000,174,648 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\WDC.exePRC - [2008-08-13 22:00:08 | 000,113,208 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\KBFiltr.exePRC - [2008-08-13 17:21:56 | 002,482,176 | ---- | M] (ASUS) -- C:\Program Files\ASUS\ATK Hotkey\ATKOSD.exePRC - [2008-04-14 23:51:18 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exePRC - [2007-08-08 01:08:40 | 000,094,208 | ---- | M] () -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe ========== Modules (No Company Name) ========== MOD - [2013-05-11 00:00:16 | 002,084,352 | ---- | M] () -- C:\Program Files\AVAST Software\Avast\defs\13051001\algo.dllMOD - [2013-04-12 18:57:31 | 003,133,336 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dllMOD - [2011-03-14 17:27:28 | 000,271,712 | ---- | M] () -- C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exeMOD - [2009-02-19 07:44:26 | 000,026,624 | ---- | M] () -- C:\WINDOWS\system32\sso1ml3.dllMOD - [2008-04-14 23:50:38 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dllMOD - [2007-08-08 01:08:40 | 000,094,208 | ---- | M] () -- C:\Program Files\ATKGFNEX\GFNEXSrv.exeMOD - [2006-08-24 00:32:26 | 000,163,840 | ---- | M] () -- C:\Program Files\ASUS\ATK Hotkey\ASUSNet.dll ========== Services (SafeList) ========== SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)SRV - [2013-04-12 18:57:31 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)SRV - [2013-03-13 21:26:32 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)SRV - [2013-03-07 00:32:44 | 000,045,248 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)SRV - [2012-06-26 18:46:28 | 000,246,112 | ---- | M] () [Disabled | Stopped] -- C:\Program Files\PLAY ONLINE\UpdateDog\ouc.exe -- (PLAY ONLINE. RunOuc)SRV - [2011-03-14 17:27:28 | 000,271,712 | ---- | M] () [Auto | Running] -- C:\Documents and Settings\All Users\Dane aplikacji\DatacardService\HWDeviceService.exe -- (HWDeviceService.exe)SRV - [2007-08-08 01:08:40 | 000,094,208 | ---- | M] () [Auto | Running] -- C:\Program Files\ATKGFNEX\GFNEXSrv.exe -- (ATKGFNEXSrv) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\SSPORT.sys -- (SSPORT)DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\DgiVecp.sys -- (DgiVecp)DRV - File not found [Kernel | System | Stopped] -- -- (Changer)DRV - [2013-03-07 00:33:24 | 000,765,736 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx)DRV - [2013-03-07 00:33:24 | 000,368,176 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP)DRV - [2013-03-07 00:33:24 | 000,164,736 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\System32\drivers\aswVmm.sys -- (aswVmm)DRV - [2013-03-07 00:33:24 | 000,062,376 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi)DRV - [2013-03-07 00:33:24 | 000,049,760 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (AswRdr)DRV - [2013-03-07 00:33:24 | 000,049,248 | ---- | M] () [Kernel | Boot | Running] -- C:\WINDOWS\System32\drivers\aswRvrt.sys -- (aswRvrt)DRV - [2013-03-07 00:33:23 | 000,066,336 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\aswMonFlt.sys -- (aswMonFlt)DRV - [2013-03-07 00:33:22 | 000,029,816 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk)DRV - [2012-06-26 18:46:38 | 000,073,216 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ew_jubusenum.sys -- (huawei_enumerator)DRV - [2012-06-26 18:46:37 | 000,235,392 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbnet.sys -- (ewusbnet)DRV - [2012-06-26 18:46:37 | 000,194,816 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ewusbmdm.sys -- (hwdatacard)DRV - [2012-06-26 18:46:37 | 000,102,784 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\ew_hwusbdev.sys -- (ew_hwusbdev)DRV - [2012-01-21 23:59:09 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\dtsoftbus01.sys -- (dtsoftbus01)DRV - [2010-05-03 05:46:04 | 000,027,136 | ---- | M] (Alcor Micro, Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\AmUStor.sys -- (AmUStor)DRV - [2009-08-20 04:39:58 | 001,760,384 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\snp2uvc.sys -- (SNP2UVC)DRV - [2009-08-11 10:04:30 | 001,582,624 | R--- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\athw.sys -- (AR5416)DRV - [2009-04-01 05:55:20 | 000,019,200 | R--- | M] (Silicon Integrated Systems Corporation) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\srvkp.sys -- (SiSkp)DRV - [2009-04-01 05:33:56 | 000,324,608 | R--- | M] (Silicon Integrated Systems Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\sisgrp.sys -- (SiS315)DRV - [2009-03-30 11:13:30 | 005,063,168 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService)DRV - [2009-01-22 10:25:26 | 000,120,064 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)DRV - [2008-11-03 09:03:28 | 000,013,880 | R--- | M] ( ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\kbfiltr.sys -- (kbfiltr)DRV - [2008-08-05 14:10:12 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)DRV - [2007-07-24 12:09:04 | 000,013,880 | ---- | M] () [Kernel | Auto | Running] -- C:\Program Files\ATKGFNEX\ASMMAP.sys -- (ASMMAP)DRV - [2006-12-17 17:11:58 | 000,007,680 | R--- | M] (ATK0100) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ATKACPI.sys -- (MTsensor)DRV - [2006-01-04 09:41:48 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)DRV - [2004-05-27 19:13:04 | 000,016,269 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Running] -- C:\Program Files\ASUS\ATK Hotkey\ASNDIS5.SYS -- (ASNDIS5) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-73586283-1965331169-1801674531-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/IE - HKU\S-1-5-21-73586283-1965331169-1801674531-1003\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}IE - HKU\S-1-5-21-73586283-1965331169-1801674531-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRCIE - HKU\S-1-5-21-73586283-1965331169-1801674531-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.selectedEngine: "Diki.pl - SĹ‚ownik angielskiego"FF - prefs.js..browser.search.useDBForOrder: trueFF - prefs.js..browser.startup.homepage: "https://www.google.pl/|http://www.miesniebrzucha.pl/miesnie-brzucha-cwiczenia/abs-2-dla-zaawansowanych|http://www.miesnienog.pl/program-300-przysiadow/41-60-przysiadow"FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.5FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_6_602_180.dll ()FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\WINDOWS\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MI7967~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MI7967~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not foundFF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-04-15 21:08:43 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013-04-12 18:57:31 | 000,000,000 | ---D | M]FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013-04-12 18:57:24 | 000,000,000 | ---D | M] [2011-02-03 06:19:36 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Asus\Dane aplikacji\Mozilla\Extensions[2013-05-08 20:12:49 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Asus\Dane aplikacji\Mozilla\Firefox\Profiles\qhfumenf.default\extensions[2013-03-25 07:28:54 | 000,000,000 | ---D | M] (United States English Spellchecker) -- C:\Documents and Settings\Asus\Dane aplikacji\Mozilla\Firefox\Profiles\qhfumenf.default\extensions\en-US@dictionaries.addons.mozilla.org[2013-05-08 20:12:49 | 000,870,680 | ---- | M] () (No name found) -- C:\Documents and Settings\Asus\Dane aplikacji\Mozilla\Firefox\Profiles\qhfumenf.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi[2011-03-15 12:49:20 | 000,006,300 | ---- | M] () -- C:\Documents and Settings\Asus\Dane aplikacji\Mozilla\Firefox\Profiles\qhfumenf.default\searchplugins\dikipl---sownik-angielskiego.xml[2013-04-12 18:57:22 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions[2013-04-12 18:57:31 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll[2012-04-04 19:10:00 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll[2013-02-19 18:52:41 | 000,002,980 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml[2013-02-19 18:52:41 | 000,001,619 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml[2013-02-19 18:52:41 | 000,001,130 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml[2013-02-19 18:52:41 | 000,001,071 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml[2013-02-19 18:52:41 | 000,001,396 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml[2013-02-19 18:52:41 | 000,001,896 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml O1 HOSTS File: ([2002-09-29 00:00:00 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hostsO1 - Hosts: 127.0.0.1 localhostO2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Program Files\Microsoft Office 2010\Office14\URLREDIR.DLL (Microsoft Corporation)O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)O4 - HKLM..\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe (Alcor Micro Corp.)O4 - HKLM..\Run: [ATKHOTKEY] C:\Program Files\ASUS\ATK Hotkey\HControl.exe (ASUS)O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMedia.exe (ASUS)O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)O4 - HKLM..\Run: [ETDWare] C:\Program Files\Elantech\ETDCtrl.exe (ELAN Microelectronic Corp.)O4 - HKLM..\Run: [HControlUser] C:\Program Files\ASUS\ATK Hotkey\HControlUser.exe (ASUS)O4 - HKLM..\Run: [Power4Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe (ASUSTeK Computer Inc.)O4 - HKLM..\Run: [siSPower] C:\WINDOWS\System32\SiSPower.dll (Silicon Integrated Systems Corporation)O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O7 - HKU\S-1-5-21-73586283-1965331169-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - C:\Program Files\Microsoft Office 2010\Office14\EXCEL.EXE (Microsoft Corporation)O16 - DPF: {05317530-B882-449D-9421-18D94FA3ED34} http://www.sis.com/ocis/OSInfo.cab (OSInfo Control)O16 - DPF: {16095503-786F-4097-AED6-5D567A26D760} http://www.sis.com/ocis/SiSAutodetectNT.cab (SiS_OCX Control)O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} https://juniper.net/dana-cached/sc/JuniperSetupClient.cab (JuniperSetupClientControl Class)O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 62.179.1.63 62.179.1.62O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D7D5BC18-AE0F-4BD6-815F-0DE32E5EF79A}: DhcpNameServer = 62.179.1.63 62.179.1.62O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:HomeO24 - Desktop WallPaper: C:\Documents and Settings\Asus\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmpO24 - Desktop BackupWallPaper: C:\Documents and Settings\Asus\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmpO32 - HKLM CDRom: AutoRun - 1O32 - AutoRun File - [2011-02-02 23:49:23 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]O33 - MountPoints2\{5fa6e194-bfae-11e1-988c-485d60384666}\Shell - "" = AutoRunO33 - MountPoints2\{5fa6e194-bfae-11e1-988c-485d60384666}\Shell\AutoRun\command - "" = F:\AutoRun.exeO33 - MountPoints2\{5fa6e197-bfae-11e1-988c-485d60384666}\Shell - "" = AutoRunO33 - MountPoints2\{5fa6e197-bfae-11e1-988c-485d60384666}\Shell\AutoRun\command - "" = F:\AutoRun.exeO34 - HKLM BootExecute: (autocheck autochk *)O35 - HKLM\..comfile [open] -- "%1" %*O35 - HKLM\..exefile [open] -- "%1" %*O37 - HKLM\...com [@ = comfile] -- "%1" %*O37 - HKLM\...exe [@ = exefile] -- "%1" %*O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013-05-06 20:37:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\K-Lite Codec Pack[2013-04-15 21:09:03 | 000,029,816 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys[2013-04-15 21:09:03 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\avast! Free Antivirus[2013-04-15 21:09:02 | 000,368,176 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys[2013-04-15 21:09:01 | 000,049,760 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys[2013-04-15 21:09:00 | 000,765,736 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys[2013-04-15 21:09:00 | 000,062,376 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys[2013-04-15 21:08:59 | 000,066,336 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswMonFlt.sys[2013-04-15 21:08:58 | 000,228,600 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe[2013-04-15 21:08:14 | 000,041,664 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr[2013-04-15 21:07:43 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software[2013-04-12 18:57:21 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ][1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013-05-11 09:26:00 | 000,000,930 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job[2013-05-11 09:08:05 | 000,000,312 | -H-- | M] () -- C:\WINDOWS\tasks\avast! Emergency Update.job[2013-05-11 07:21:30 | 000,565,374 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat[2013-05-11 07:21:30 | 000,502,156 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat[2013-05-11 07:21:30 | 000,109,650 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat[2013-05-11 07:21:30 | 000,087,680 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat[2013-05-11 07:17:07 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl[2013-05-11 07:17:03 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat[2013-05-11 07:16:59 | 3086,307,328 | -HS- | M] () -- C:\hiberfil.sys[2013-05-03 14:44:34 | 000,101,376 | ---- | M] () -- C:\Documents and Settings\Asus\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini[2013-04-15 23:34:31 | 000,000,211 | -HS- | M] () -- C:\boot.ini[2013-04-15 21:09:03 | 000,001,689 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\avast! Free Antivirus.lnk[2013-04-15 21:08:58 | 000,002,596 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT[4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ][1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2013-04-15 21:09:03 | 000,001,689 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\avast! Free Antivirus.lnk[2013-04-15 21:08:59 | 000,164,736 | ---- | C] () -- C:\WINDOWS\System32\drivers\aswVmm.sys[2013-04-15 21:08:59 | 000,049,248 | ---- | C] () -- C:\WINDOWS\System32\drivers\aswRvrt.sys[2013-04-15 21:08:59 | 000,000,312 | -H-- | C] () -- C:\WINDOWS\tasks\avast! Emergency Update.job[2013-02-08 07:52:09 | 000,026,624 | ---- | C] () -- C:\WINDOWS\System32\sso1ml3.dll[2012-04-04 11:58:46 | 000,008,902 | ---- | C] () -- C:\WINDOWS\eBazyl.ini[2012-04-04 11:58:43 | 000,201,216 | ---- | C] () -- C:\WINDOWS\System32\WCPDPA26.dll[2012-04-04 11:58:43 | 000,138,752 | ---- | C] () -- C:\WINDOWS\System32\WCEDPA26.dll[2012-04-04 11:58:41 | 000,253,265 | ---- | C] () -- C:\WINDOWS\System32\instPSDWE.exe[2012-04-04 11:58:36 | 000,034,872 | ---- | C] () -- C:\WINDOWS\ea.ini[2011-11-06 17:06:29 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat[2011-06-24 20:27:13 | 000,000,785 | ---- | C] () -- C:\Documents and Settings\Asus\quosaddm.properties[2011-05-16 23:22:00 | 000,101,376 | ---- | C] () -- C:\Documents and Settings\Asus\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini[2011-02-03 00:58:25 | 000,064,200 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat ========== ZeroAccess Check ========== [2011-02-03 00:48:07 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]"" = %SystemRoot%\system32\shdocvw.dll -- [2008-04-14 23:50:48 | 001,499,136 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2008-04-14 23:50:32 | 000,472,064 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008-04-14 23:50:58 | 000,273,920 | ---- | M] (Microsoft Corporation)"ThreadingModel" = Both ========== LOP Check ========== [2013-04-15 21:07:43 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Alwil Software[2011-02-03 01:25:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\AmUStor[2012-01-21 23:57:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite[2012-06-26 18:48:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\DatacardService[2012-01-29 00:09:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10[2011-08-29 08:54:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Juniper Networks[2012-06-26 18:47:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\PLAY ONLINE[2013-03-29 20:23:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Dane aplikacji\AIMP[2012-01-22 00:01:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Dane aplikacji\DAEMON Tools Lite[2013-04-01 18:42:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Dane aplikacji\e-Deklaracje.A1909296681C7ACEFE45687D3A64758C8659BF46.1[2011-02-03 06:17:24 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Dane aplikacji\Gadu-Gadu[2011-02-03 06:19:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Dane aplikacji\Gadu-Gadu 10[2011-02-03 02:13:56 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Dane aplikacji\GHISLER[2012-02-26 23:13:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Dane aplikacji\InfraRecorder[2011-08-29 08:54:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Dane aplikacji\Juniper Networks[2011-02-03 06:19:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Dane aplikacji\Nowe Gadu-Gadu[2011-02-07 22:27:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Dane aplikacji\OpenOffice.org[2012-01-21 23:52:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Dane aplikacji\TuxPaint[2013-05-03 13:10:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Asus\Dane aplikacji\uTorrent ========== Purity Check ========== < End of report > OTL Extras logfile created on: 2013-05-11 10:09:13 - Run 1OTL by OldTimer - Version 3.2.69.0 Folder = D:\PobraneWindows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstationInternet Explorer (Version = 8.0.6001.18702)Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 2,87 Gb Total Physical Memory | 2,23 Gb Available Physical Memory | 77,41% Memory free5,72 Gb Paging File | 5,23 Gb Available in Paging File | 91,51% Paging File freePaging file location(s): C:\pagefile.sys 3072 6144 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program FilesDrive C: | 56,64 Gb Total Space | 2,24 Gb Free Space | 3,95% Space Free | Partition Type: NTFSDrive D: | 176,23 Gb Total Space | 1,63 Gb Free Space | 0,92% Space Free | Partition Type: NTFS Computer Name: ASUSNEWLAP | User Name: Asus | Logged in as Administrator.Boot Mode: Normal | Scan Mode: All usersCompany Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>].cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* [HKEY_USERS\S-1-5-21-73586283-1965331169-1801674531-1003\SOFTWARE\Classes\<extension>].html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]batfile [open] -- "%1" %*cmdfile [open] -- "%1" %*comfile [open] -- "%1" %*cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*exefile [open] -- "%1" %*htmlfile [edit] -- "C:\Program Files\Microsoft Office 2010\Office14\msohtmed.exe" %1 (Microsoft Corporation)htmlfile [print] -- "C:\Program Files\Microsoft Office 2010\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)piffile [open] -- "%1" %*regfile [merge] -- Reg Error: Key error.scrfile [config] -- "%1"scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %lscrfile [open] -- "%1" /Stxtfile [edit] -- Reg Error: Key error.Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]"FirstRunDisabled" = 1"AntiVirusDisableNotify" = 0"FirewallDisableNotify" = 0"UpdatesDisableNotify" = 0"AntiVirusOverride" = 0"FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall] ========== System Restore Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]"DisableSR" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]"Start" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]"Start" = 2 ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] ========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation) ========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = LifeFrame2"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148"{1F7424F8-F992-48BC-90EF-7C4DB0405E3F}" = Alcor Micro USB Card Reader"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java 6 Update 31"{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile"{4462AD13-F2AA-4CBD-9F95-293C38EED870}" = ASUS Power4Gear"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater"{5AF4B3C4-C393-48D7-AC7E-8E7615579548}" = Adobe AIR"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update"{7C05592D-424B-46CB-B505-E0013E8E75C9}" = ATK Hotkey"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight"{8F21291E-0444-4B1D-B9F9-4370A73E346D}" = WinFlash"{90110415-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003"{90140000-0010-0415-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (Polish) 14"{90140000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2010"{90140000-0015-0415-0000-0000000FF1CE}" = Microsoft Office Access MUI (Polish) 2010"{90140000-0016-0415-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Polish) 2010"{90140000-0018-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Polish) 2010"{90140000-0019-0415-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Polish) 2010"{90140000-001A-0415-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Polish) 2010"{90140000-001B-0415-0000-0000000FF1CE}" = Microsoft Office Word MUI (Polish) 2010"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010"{90140000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2010"{90140000-002C-0415-0000-0000000FF1CE}" = Microsoft Office Proofing (Polish) 2010"{90140000-0044-0415-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Polish) 2010"{90140000-006E-0415-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Polish) 2010"{90140000-00A1-0415-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Polish) 2010"{90140000-00BA-0415-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Polish) 2010"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2"{A8D93648-9F7F-407D-915C-62044644C3DA}" = MSI to redistribute MS VS2005 CRT libraries"{AC76BA86-7AD7-1045-7B44-AA1000000001}" = Adobe Reader X (10.1.5) - Polish"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2"{C573C350-C666-586C-B309-7C9BD4A44BBF}" = e-Deklaracje Desktop"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1"{D1E5870E-E3E5-4475-98A6-ADD614524ADF}" = ATK Media"{D3D54F3E-C5C3-443D-978F-87A72E5616E8}" = ATK Generic Function Service"{DC226AC9-0314-496C-BE6A-B6A132628466}" = SiSAGP driver"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support"{EC8BD21F-0CA0-4BBF-97D9-4A52B30041A1}" = ASUS Virtual Camera"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver"7-Zip" = 7-Zip 9.20"Adobe AIR" = Adobe AIR"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin"Adobe Shockwave Player" = Adobe Shockwave Player 11.5"AIMP2" = AIMP2"AIMP2at" = AIMP2: Audio Tools"avast" = avast! Free Antivirus"DAEMON Tools Lite" = DAEMON Tools Lite"e-Deklaracje.A1909296681C7ACEFE45687D3A64758C8659BF46.1" = e-Deklaracje Desktop"Elantech" = ETDWare PS/2-x86 7.0.5.12_WHQL"Euro26Search" = Euro 26 - Wyszukiwarka Zniżek"EuroSoft Apteka_is1" = EuroSoft Apteka"Gadu-Gadu 10" = Gadu-Gadu 10"ie8" = Windows Internet Explorer 8"InfraRecorder" = InfraRecorder"InstallShield_{1F7424F8-F992-48BC-90EF-7C4DB0405E3F}" = Alcor Micro USB Card Reader"IrfanView" = IrfanView (remove only)"Juniper_Setup_Client Activex Control" = Juniper Networks Setup Client Activex Control"KLiteCodecPack_is1" = K-Lite Codec Pack 9.9.0 (Full)"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended"Mozilla Firefox 20.0.1 (x86 pl)" = Mozilla Firefox 20.0.1 (x86 pl)"MozillaMaintenanceService" = Mozilla Maintenance Service"NapiProjekt_is1" = NapiProjekt 1.0.6.9"Office14.PROPLUS" = Microsoft Office Professional Plus 2010"PLAY ONLINE" = PLAY ONLINE"QuicktimeAlt_is1" = QuickTime Alternative 3.2.2"RealAlt_is1" = Real Alternative 2.0.2"Samsung SCX-4600 Series" = Konserwacja programu Samsung SCX-4600 Series"SiS VGA Driver" = SiS VGA Utilities"SubEdit-Player_is1" = SubEdit-Player"The KMPlayer" = The KMPlayer (remove only)"Totalcmd" = Total Commander (Remove or Repair)"Tux Paint Stamps_is1" = Tux Paint Stamps 2009-06-28"Tux Paint_is1" = Tux Paint 0.9.21"USB2.0 UVC VGA WebCam" = USB2.0 UVC VGA WebCam"uTorrent" = µTorrent"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7"Windows Media Format Runtime" = Windows Media Format 11 runtime"Windows XP Service Pack" = Windows XP Service Pack 3"WMFDist11" = Windows Media Format 11 runtime ========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-21-73586283-1965331169-1801674531-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]"Juniper_Setup_Client" = Juniper Networks Setup Client ========== Last 20 Event Log Errors ========== [ Application Events ]Error - 2012-12-28 03:59:47 | Computer Name = ASUSNEWLAP | Source = Application Hang | ID = 1002Description = Aplikacja zawieszająca notepad.exe, wersja 5.1.2600.5512, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. [ System Events ]Error - 2013-05-08 17:31:28 | Computer Name = ASUSNEWLAP | Source = Service Control Manager | ID = 7031Description = Usługa Rejestr zdalny niespodziewanie zakończyła pracę. Wystąpiłoto razy: 1. W przeciągu 1000 milisekund zostanie podjęta następująca czynność korekcyjna: Uruchom usługę ponownie. Error - 2013-05-08 17:31:28 | Computer Name = ASUSNEWLAP | Source = Service Control Manager | ID = 7034Description = Usługa Usługa odnajdywania SSDP niespodziewanie zakończyła pracę.Wystąpiło to razy: 1. Error - 2013-05-08 17:31:28 | Computer Name = ASUSNEWLAP | Source = Service Control Manager | ID = 7034Description = Usługa WebClient niespodziewanie zakończyła pracę. Wystąpiło to razy: 1. Error - 2013-05-09 10:18:37 | Computer Name = ASUSNEWLAP | Source = Service Control Manager | ID = 7000Description = Nie można uruchomić usługi DgiVecp z powodu następującego błędu: %%2 Error - 2013-05-09 10:18:37 | Computer Name = ASUSNEWLAP | Source = Service Control Manager | ID = 7000Description = Nie można uruchomić usługi SSPORT z powodu następującego błędu: %%2 Error - 2013-05-09 14:20:44 | Computer Name = ASUSNEWLAP | Source = DCOM | ID = 10005Description = Model DCOM odebrał błąd „%1058” podczas próby uruchomienia usługiwuauserv z argumentami „” w celu uruchomienia serwera: {E60687F7-01A1-40AA-86AC-DB1CBF673334} Error - 2013-05-09 14:21:12 | Computer Name = ASUSNEWLAP | Source = DCOM | ID = 10005Description = Model DCOM odebrał błąd „%1058” podczas próby uruchomienia usługiwuauserv z argumentami „” w celu uruchomienia serwera: {E60687F7-01A1-40AA-86AC-DB1CBF673334} Error - 2013-05-09 15:44:59 | Computer Name = ASUSNEWLAP | Source = PSched | ID = 14103Description = QoS [Karta {29262C23-2859-4C10-8DBC-C0E7DB3D9EDA}]: Sterownik karty sieciowej nie mógł wykonać kwerendy w poszukiwaniu OID_GEN_LINK_SPEED. Error - 2013-05-11 01:18:48 | Computer Name = ASUSNEWLAP | Source = Service Control Manager | ID = 7000Description = Nie można uruchomić usługi DgiVecp z powodu następującego błędu: %%2 Error - 2013-05-11 01:18:48 | Computer Name = ASUSNEWLAP | Source = Service Control Manager | ID = 7000Description = Nie można uruchomić usługi SSPORT z powodu następującego błędu: %%2 < End of report > Odnośnik do komentarza
picasso Opublikowano 11 Maja 2013 Zgłoś Udostępnij Opublikowano 11 Maja 2013 Logi proszę wstawiam metodą załączników, nie wklejaj w poście (długie i parsowane są URL). Brakuje obowiązkowego raportu z GMER. W OTL nie widać żadnych oznak infekcji. . Odnośnik do komentarza
Efilon Opublikowano 11 Maja 2013 Autor Zgłoś Udostępnij Opublikowano 11 Maja 2013 myślałem, że tak będzie przejrzyściej gmer nic nie znalazł (avast wyłączony na 1 godzine) gmerlog.txt Odnośnik do komentarza
picasso Opublikowano 13 Maja 2013 Zgłoś Udostępnij Opublikowano 13 Maja 2013 W raporcie GMER nie widać nic niepokojącego. W podsumowaniu: żaden z dostarczonym logów nie wykazuje obecności infekcji. Odnośnik do komentarza
Efilon Opublikowano 16 Maja 2013 Autor Zgłoś Udostępnij Opublikowano 16 Maja 2013 Widać był jakiś inny powód Dziękuję za analizę logów Odnośnik do komentarza
Rekomendowane odpowiedzi