Komputer został zablokowany z powodu naruszenia prawa polskiego

Natasia24 · 7 Lipca 2012

Wczoraj w godzinach wieczornych gdzy wyłaczylem przegladarke internetowa na pulpicie wyskoczyło mi okno, ktorego niemoge zamknąć. Wynika z niego ze musze zapłacic 300 zł aby mój komputer został odblokowany.

Jestem kompletnym lalikiem w dziedzinie komputerów .

Błagam o pomoc. Mój komputer został zablokowany nie wiem dlaczego.

Udało mi się utworzyć potrzebne pliki przy pomocy instrukcji , ale nie wiem co dalej

Liczę na szybką pomoc.

Pozdrawiam

Natalia

OTL.Txt

Extras.Txt

Landuss · 7 Lipca 2012

Zastanów sie co ty robisz. Zakładasz dwa razy ten sam temat. Nie poganiaj, my tutaj mamy dziesiątki takich tematów jak twój. Duplikat tematu usuwam.

1. Wejdź w panel usuwania programów i odinstaluj: Babylon toolbar on IE

2. Uruchom AdwCleaner z opcji Delete

3. Uruchom OTL i w oknie Własne opcje skanowania/Skrypt wklej następujący tekst:

:OTL
IE - HKU\S-1-5-21-241298349-3269669532-2685158662-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http: //search.babylon.com/?AF=109217&babsrc=HP_ss&mntrId=18b6e7960000000000006c626de6911f
IE - HKU\S-1-5-21-241298349-3269669532-2685158662-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http: //search.babylon.com/?q={searchTerms}&AF=109217&babsrc=SP_ss&mntrId=18b6e7960000000000006c626de6911f
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..keyword.URL: "http://search.babylon.com/?AF=109217&babsrc=adbartrp&mntrId=18b6e7960000000000006c626de6911f&q="
O3 - HKU\S-1-5-21-241298349-3269669532-2685158662-1000\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
O4:64bit: - HKLM..\Run: [sppuinotify] C:\Users\Wojtek\AppData\Local\Microsoft\Windows\3376\sppuinotify.exe ()
O4:64bit: - HKLM..\Run: [sxstrace] C:\Users\MAMA\AppData\Local\Microsoft\Windows\4672\sxstrace.exe File not found
 
:Files
C:\Users\Wojtek\AppData\Roaming\hellomoto
C:\Users\Wojtek\AppData\Local\Microsoft\Windows\3376
 
:Reg
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"UDP Query User{FB275C94-C6CC-4E6C-86BF-2718A4B89E56}D:\sopcast\adv\sopadver.exe"=-
 
:Commands
[emptytemp]

Kliknij w Wykonaj skrypt. Zatwierdź restart komputera.

4. Uruchamiasz OTL ponownie, tym razem wywołujesz opcję Skanuj. Pokazujesz nowe logi z OTL

Natasia24 · 7 Lipca 2012

Oto logi po wykonaniu powyższych czynności.

OTL logfile created on: 2012-07-07 20:56:03 - Run 2

OTL by OldTimer - Version 3.2.53.1 Folder = C:\Users\Wojtek\Desktop

64bit- Professional (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

3,98 Gb Total Physical Memory | 3,43 Gb Available Physical Memory | 86,18% Memory free

7,96 Gb Paging File | 7,43 Gb Available in Paging File | 93,28% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 49,90 Gb Total Space | 4,25 Gb Free Space | 8,51% Space Free | Partition Type: NTFS

Drive D: | 207,88 Gb Total Space | 20,99 Gb Free Space | 10,10% Space Free | Partition Type: NTFS

Drive E: | 207,88 Gb Total Space | 4,73 Gb Free Space | 2,27% Space Free | Partition Type: NTFS

Drive G: | 3,72 Gb Total Space | 3,44 Gb Free Space | 92,46% Space Free | Partition Type: FAT32

Computer Name: WOJTEK-KOMPUTER | User Name: Wojtek | Logged in as Administrator.

Boot Mode: SafeMode with Networking | Scan Mode: All users | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012-07-07 16:48:53 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Wojtek\Desktop\OTL.exe

========== Modules (No Company Name) ==========

========== Win32 Services (SafeList) ==========

SRV:64bit: - [2009-07-14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV:64bit: - [2009-07-14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)

SRV - [2012-07-03 00:18:17 | 000,076,888 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)

SRV - [2012-06-27 12:29:24 | 002,369,960 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- D:\Hamachi\hamachi-2.exe -- (Hamachi2Svc)

SRV - [2012-06-24 20:42:01 | 000,008,704 | ---- | M] (Hi-Rez Studios) [Auto | Stopped] -- D:\Hi-Rez Studios\HiPatchService.exe -- (HiPatchService)

SRV - [2012-06-23 22:46:12 | 000,250,056 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012-06-20 18:50:26 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2012-06-16 13:02:16 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012-06-11 12:59:06 | 000,018,360 | ---- | M] () [On_Demand | Stopped] -- D:\Overwolf\\OverwolfUpdater.exe -- (OverwolfUpdaterService)

SRV - [2012-05-03 08:31:10 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2012-03-07 02:15:14 | 000,044,768 | ---- | M] (AVAST Software) [Auto | Stopped] -- D:\AVAST Software\Avast\AvastSvc.exe -- (avast! Antivirus)

SRV - [2012-03-01 02:02:00 | 002,348,352 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)

SRV - [2012-02-29 13:26:46 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2011-03-04 11:39:14 | 000,584,488 | ---- | M] (Nero AG) [Auto | Stopped] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate) @C:\Program Files (x86)

SRV - [2011-03-01 19:29:58 | 000,130,976 | ---- | M] (Futuremark Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe -- (Futuremark SystemInfo Service)

SRV - [2010-12-20 12:30:38 | 002,656,280 | R--- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\UNS\UNS.exe -- (UNS) Intel®

SRV - [2010-12-20 12:30:36 | 000,325,656 | R--- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel® Management Engine Components\LMS\LMS.exe -- (LMS) Intel®

SRV - [2010-03-18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009-06-10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

========== Driver Services (SafeList) ==========

DRV:64bit: - [2012-03-07 02:04:06 | 000,819,032 | ---- | M] (AVAST Software) [File_System | System | Stopped] -- C:\Windows\SysNative\drivers\aswSnx.sys -- (aswSnx)

DRV:64bit: - [2012-03-07 02:04:04 | 000,337,240 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\aswSP.sys -- (aswSP)

DRV:64bit: - [2012-03-07 02:02:20 | 000,053,080 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\aswRdr2.sys -- (aswRdr)

DRV:64bit: - [2012-03-07 02:01:57 | 000,059,224 | ---- | M] (AVAST Software) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\aswTdi.sys -- (aswTdi)

DRV:64bit: - [2012-03-07 02:01:52 | 000,069,976 | ---- | M] (AVAST Software) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\aswMonFlt.sys -- (aswMonFlt)

DRV:64bit: - [2012-03-07 02:01:32 | 000,024,408 | ---- | M] (AVAST Software) [File_System | Auto | Stopped] -- C:\Windows\SysNative\drivers\aswFsBlk.sys -- (aswFsBlk)

DRV:64bit: - [2012-01-17 14:45:56 | 000,188,224 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)

DRV:64bit: - [2011-08-17 10:58:26 | 000,009,216 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser_lowerfltjx64.sys -- (UsbserFilt)

DRV:64bit: - [2011-08-17 10:58:20 | 000,027,136 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbox64.sys -- (nmwcdc)

DRV:64bit: - [2011-08-17 10:58:16 | 000,019,968 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ccdcmbx64.sys -- (nmwcd)

DRV:64bit: - [2011-07-02 13:19:17 | 000,314,016 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)

DRV:64bit: - [2011-07-02 13:19:16 | 000,043,680 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)

DRV:64bit: - [2011-06-15 10:30:46 | 000,093,240 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\scdemu.sys -- (SCDEmu)

DRV:64bit: - [2010-12-28 21:45:54 | 000,412,776 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)

DRV:64bit: - [2010-12-10 13:50:36 | 000,181,248 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)

DRV:64bit: - [2010-12-10 13:50:36 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)

DRV:64bit: - [2010-10-19 10:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel®

DRV:64bit: - [2009-11-18 01:12:00 | 000,032,344 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\MBfilt64.sys -- (MBfilt)

DRV:64bit: - [2009-07-14 03:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2009-07-14 03:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2009-07-14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009-07-14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009-07-14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2009-07-14 03:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2009-07-14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009-07-14 02:06:32 | 000,032,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usbser.sys -- (usbser)

DRV:64bit: - [2009-06-10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009-06-10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009-06-10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009-06-10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2008-02-13 17:20:16 | 000,017,920 | ---- | M] (A4Tech Co.,Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Amusbx64.sys -- (Amusbprt)

DRV:64bit: - [2007-10-15 12:37:22 | 000,012,288 | ---- | M] ((Standard mouse types)) [Kernel | System | Stopped] -- C:\Windows\SysNative\drivers\Amfltx64.sys -- (Amfilter)

DRV - [2010-05-27 02:43:00 | 000,014,648 | ---- | M] () [Kernel | On_Demand | Stopped] -- D:\MSI Afterburner\RTCore64.sys -- (RTCore64)

DRV - [2009-07-14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

DRV - [2007-03-16 10:11:20 | 000,015,648 | ---- | M] (Windows ® Server 2003 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\TBPanelx64.sys -- (Cardex)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-241298349-3269669532-2685158662-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =

IE - HKU\S-1-5-21-241298349-3269669532-2685158662-1000\..\SearchScopes,DefaultScope = {02885A83-CA56-4DB3-B309-3D49B2F400CB}

IE - HKU\S-1-5-21-241298349-3269669532-2685158662-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-241298349-3269669532-2685158662-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.startup.homepage: "http://www.google.pl/"

FF - user.js - File not found

FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_262.dll File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_262.dll ()

FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\SysWOW64\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)

FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.104.0: C:\Program Files (x86)\Battlelog Web Plugins\1.104.0\npesnlaunch.dll File not found

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.116.0: C:\Program Files (x86)\Battlelog Web Plugins\1.116.0\npesnlaunch.dll File not found

FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.122.0: C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll (ESN Social Software AB)

FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: D:\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@onlive.com/OnLiveGameClientDetector,version=1.0.0: C:\Program Files (x86)\OnLive\Plugin\npolgdet.dll (OnLive)

FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Wojtek\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)

FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: D:\AVAST Software\Avast\WebRep\FF [2012-03-23 21:35:09 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\fbphotozoom@installdaddy.com: C:\Program Files (x86)\fbphotozoom\fbphotozoom13.xpi [2012-03-04 22:29:59 | 000,102,233 | ---- | M] ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: D:\Mozilla Firefox\components [2012-06-16 13:02:17 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: D:\Mozilla Firefox\plugins

[2011-08-04 20:50:01 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Wojtek\AppData\Roaming\mozilla\Extensions

[2012-05-19 23:11:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Wojtek\AppData\Roaming\mozilla\Firefox\Profiles\aqyfl2nk.default\extensions

[2012-05-19 23:11:42 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Wojtek\AppData\Roaming\mozilla\Firefox\Profiles\aqyfl2nk.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}

[2011-08-11 17:59:33 | 000,000,000 | ---D | M] (Battlefield Heroes Updater) -- C:\Users\Wojtek\AppData\Roaming\mozilla\Firefox\Profiles\aqyfl2nk.default\extensions\battlefieldheroespatcher@ea.com

[2011-11-01 11:46:11 | 000,000,000 | ---D | M] (Battlefield Play4Free) -- C:\Users\Wojtek\AppData\Roaming\mozilla\Firefox\Profiles\aqyfl2nk.default\extensions\battlefieldplay4free@ea.com

[2011-08-04 20:48:24 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

[2011-06-17 22:40:14 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files (x86)\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}

O1 HOSTS File: ([2012-07-07 14:03:25 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - D:\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)

O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - D:\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)

O4:64bit: - HKLM..\Run: [RTHDVCPL] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)

O4:64bit: - HKLM..\Run: [sppuinotify] C:\Users\Wojtek\AppData\Local\Microsoft\Windows\3376\sppuinotify.exe File not found

O4:64bit: - HKLM..\Run: [sxstrace] C:\Users\MAMA\AppData\Local\Microsoft\Windows\4672\sxstrace.exe File not found

O4:64bit: - HKLM..\Run: [WheelMouse] D:\Mouse\Amoumain.exe ()

O4 - HKLM..\Run: [avast] D:\AVAST Software\Avast\avastUI.exe (AVAST Software)

O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)

O4 - HKU\S-1-5-21-241298349-3269669532-2685158662-1000..\Run: [Overwolf] D:\Overwolf\Overwolf.exe (Overwolf)

O4 - HKU\S-1-5-21-241298349-3269669532-2685158662-1000..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe ()

O4 - HKU\S-1-5-21-241298349-3269669532-2685158662-1000..\Run: [TBPanel] D:\Vtune\TBPanel.exe ()

O4 - HKLM..\RunOnce: [DeleteOnReboot] C:\Windows\DeleteOnReboot.bat ()

O4 - HKU\S-1-5-21-241298349-3269669532-2685158662-1000..\RunOnce: [Report] C:\AdwCleaner[s2].txt ()

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-241298349-3269669532-2685158662-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-241298349-3269669532-2685158662-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O15 - HKU\.DEFAULT\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)

O15 - HKU\.DEFAULT\..Trusted Domains: freerealms.com ([]* in Trusted sites)

O15 - HKU\.DEFAULT\..Trusted Domains: soe.com ([]* in Trusted sites)

O15 - HKU\.DEFAULT\..Trusted Domains: sony.com ([]* in Trusted sites)

O15 - HKU\S-1-5-18\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)

O15 - HKU\S-1-5-18\..Trusted Domains: freerealms.com ([]* in Trusted sites)

O15 - HKU\S-1-5-18\..Trusted Domains: soe.com ([]* in Trusted sites)

O15 - HKU\S-1-5-18\..Trusted Domains: sony.com ([]* in Trusted sites)

O15 - HKU\S-1-5-19\..Trusted Domains: clonewarsadventures.com ([]* in )

O15 - HKU\S-1-5-19\..Trusted Domains: freerealms.com ([]* in )

O15 - HKU\S-1-5-19\..Trusted Domains: soe.com ([]* in )

O15 - HKU\S-1-5-19\..Trusted Domains: sony.com ([]* in )

O15 - HKU\S-1-5-20\..Trusted Domains: clonewarsadventures.com ([]* in )

O15 - HKU\S-1-5-20\..Trusted Domains: freerealms.com ([]* in )

O15 - HKU\S-1-5-20\..Trusted Domains: soe.com ([]* in )

O15 - HKU\S-1-5-20\..Trusted Domains: sony.com ([]* in )

O15 - HKU\S-1-5-21-241298349-3269669532-2685158662-1000\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)

O15 - HKU\S-1-5-21-241298349-3269669532-2685158662-1000\..Trusted Domains: freerealms.com ([]* in Trusted sites)

O15 - HKU\S-1-5-21-241298349-3269669532-2685158662-1000\..Trusted Domains: soe.com ([]* in Trusted sites)

O15 - HKU\S-1-5-21-241298349-3269669532-2685158662-1000\..Trusted Domains: sony.com ([]* in Trusted sites)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{57E26C84-FAD4-466E-AF99-B19D0B33CD36}: DhcpNameServer = 91.189.16.2 195.225.248.48

O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

========== Files/Folders - Created Within 30 Days ==========

[2012-07-07 20:52:40 | 000,000,000 | ---D | C] -- C:\_OTL

[2012-07-07 16:48:53 | 000,595,968 | ---- | C] (OldTimer Tools) -- C:\Users\Wojtek\Desktop\OTL.exe

[2012-07-07 14:04:55 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2012-07-07 14:03:27 | 000,000,000 | ---D | C] -- C:\$RECYCLE.BIN

[2012-07-07 13:58:28 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2012-07-07 13:58:28 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2012-07-07 13:58:28 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2012-07-07 13:58:24 | 000,000,000 | ---D | C] -- C:\Qoobox

[2012-07-07 13:57:37 | 000,000,000 | ---D | C] -- C:\Users\Wojtek\Desktop\combofix

[2012-07-07 13:00:18 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0

[2012-07-06 21:04:55 | 000,000,000 | ---D | C] -- C:\Windows\erdnt

[2012-07-03 13:49:28 | 000,000,000 | ---D | C] -- C:\Users\Wojtek\Desktop\ANIAAA

[2012-07-03 13:44:10 | 000,000,000 | ---D | C] -- C:\Users\Wojtek\Desktop\ANIA ZDJĘCIA

[2012-06-28 12:13:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\LogMeIn Hamachi

[2012-06-27 21:58:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Hi-Rez Studios

[2012-06-26 17:20:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Bethesda Softworks

[2012-06-26 15:47:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SEGA

[2012-06-23 10:30:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Overwolf

[2012-06-16 15:12:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Butterfly Escape

[2012-06-16 14:25:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe AIR

[2012-06-16 14:25:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe

[2012-06-10 13:00:15 | 000,000,000 | ---D | C] -- C:\ProgramData\Genimo

[2012-06-10 12:55:35 | 000,000,000 | ---D | C] -- C:\Users\Wojtek\AppData\Roaming\Genimo

[2012-06-10 11:21:26 | 000,000,000 | ---D | C] -- C:\Users\Wojtek\AppData\Local\Macromedia

========== Files - Modified Within 30 Days ==========

[2012-07-07 20:53:47 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012-07-07 20:53:41 | 3207,577,600 | -HS- | M] () -- C:\hiberfil.sys

[2012-07-07 20:46:15 | 000,000,261 | ---- | M] () -- C:\Windows\DeleteOnReboot.bat

[2012-07-07 18:58:00 | 000,001,044 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

[2012-07-07 16:48:53 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Wojtek\Desktop\OTL.exe

[2012-07-07 14:03:25 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts

[2012-07-06 20:31:00 | 000,001,048 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

[2012-07-06 19:46:00 | 000,000,930 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2012-07-06 10:33:06 | 000,009,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012-07-06 10:33:06 | 000,009,792 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012-07-05 20:57:36 | 000,000,010 | ---- | M] () -- C:\Windows\popcinfo.dat

[2012-07-03 13:50:34 | 001,663,412 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2012-07-03 13:50:34 | 000,737,942 | ---- | M] () -- C:\Windows\SysNative\perfh015.dat

[2012-07-03 13:50:34 | 000,652,150 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2012-07-03 13:50:34 | 000,154,630 | ---- | M] () -- C:\Windows\SysNative\perfc015.dat

[2012-07-03 13:50:34 | 000,121,082 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2012-07-03 00:18:17 | 000,076,888 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrA.exe

[2012-07-03 00:17:44 | 000,298,016 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr

[2012-07-03 00:17:44 | 000,298,016 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe

[2012-07-03 00:13:59 | 000,189,248 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0

[2012-07-03 00:07:21 | 003,130,440 | ---- | M] () -- C:\Windows\SysWow64\pbsvc_blr.exe

[2012-06-27 21:58:18 | 000,000,707 | ---- | M] () -- C:\Users\Public\Desktop\Smite Closed Beta.lnk

[2012-06-27 21:58:18 | 000,000,698 | ---- | M] () -- C:\Users\Public\Desktop\Hi-Rez Diagnostics and Support.lnk

[2012-06-26 17:20:32 | 000,000,702 | ---- | M] () -- C:\Users\Public\Desktop\Fallout New Vegas.lnk

[2012-06-26 15:47:12 | 000,000,649 | ---- | M] () -- C:\Users\Public\Desktop\Football Manager 2012.lnk

[2012-06-23 22:46:12 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe

[2012-06-23 22:46:12 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl

[2012-06-16 15:12:23 | 000,000,565 | ---- | M] () -- C:\Users\Wojtek\Desktop\Butterfly Escape.lnk

[2012-06-09 18:39:24 | 000,000,177 | ---- | M] () -- C:\Users\Public\Desktop\Vindictus EU.url

========== Files Created - No Company Name ==========

[2012-07-07 20:46:13 | 000,000,261 | ---- | C] () -- C:\Windows\DeleteOnReboot.bat

[2012-07-07 13:58:28 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2012-07-07 13:58:28 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2012-07-07 13:58:28 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2012-07-07 13:58:28 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2012-07-07 13:58:28 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2012-07-03 00:13:45 | 003,130,440 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_blr.exe

[2012-06-27 21:58:18 | 000,000,707 | ---- | C] () -- C:\Users\Public\Desktop\Smite Closed Beta.lnk

[2012-06-27 21:58:18 | 000,000,698 | ---- | C] () -- C:\Users\Public\Desktop\Hi-Rez Diagnostics and Support.lnk

[2012-06-26 17:20:32 | 000,000,702 | ---- | C] () -- C:\Users\Public\Desktop\Fallout New Vegas.lnk

[2012-06-26 15:47:12 | 000,000,649 | ---- | C] () -- C:\Users\Public\Desktop\Football Manager 2012.lnk

[2012-06-16 15:12:23 | 000,000,565 | ---- | C] () -- C:\Users\Wojtek\Desktop\Butterfly Escape.lnk

[2012-06-09 18:39:24 | 000,000,177 | ---- | C] () -- C:\Users\Public\Desktop\Vindictus EU.url

[2012-02-29 13:26:56 | 000,416,064 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe

[2012-02-22 20:25:30 | 000,032,768 | ---- | C] () -- C:\Windows\SysWow64\Amhooker.dll

[2011-08-26 11:50:18 | 000,101,096 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat

[2011-08-05 15:15:24 | 001,638,614 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI

[2011-08-04 20:49:58 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat

[2011-07-23 14:11:02 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe

[2011-07-19 13:20:31 | 000,000,047 | ---- | C] () -- C:\Windows\NeroDigital.ini

[2011-07-15 11:34:05 | 000,002,048 | ---- | C] () -- C:\Windows\SysWow64\winver.exe

[2011-07-04 11:53:57 | 000,000,032 | R--- | C] () -- C:\ProgramData\hash.dat

[2011-06-28 17:08:24 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat

[2011-06-20 11:32:35 | 000,000,017 | ---- | C] () -- C:\Users\Wojtek\AppData\Local\resmon.resmoncfg

[2011-06-18 15:16:58 | 000,000,010 | ---- | C] () -- C:\Windows\popcinfo.dat

[2011-06-18 11:05:15 | 000,298,016 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe

[2011-06-18 11:05:13 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe

[2011-05-31 08:39:50 | 000,058,368 | ---- | C] () -- C:\Windows\SysWow64\bdmpegv.dll

[2011-05-31 08:38:18 | 000,015,360 | ---- | C] () -- C:\Windows\SysWow64\bdmjpeg.dll

[2011-04-09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat

========== LOP Check ==========

[2012-07-07 09:28:48 | 000,000,000 | ---D | M] -- C:\Users\MAMA\AppData\Roaming\hellomoto

[2012-06-23 17:58:27 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\.minecraft

[2012-04-15 13:37:27 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\.spoutcraft

[2011-11-22 18:05:17 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\2K Sports

[2011-10-16 19:58:55 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\Avnex

[2012-03-04 22:30:01 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\Babylon

[2011-08-23 14:07:28 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\Beat Hazard

[2012-04-05 19:27:52 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\Bioshock2

[2012-04-10 14:14:18 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\Firefly Studios

[2011-07-05 13:48:06 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\FOG Downloader

[2012-05-02 14:09:12 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\Friday's games

[2011-11-21 22:27:04 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\Gadu-Gadu 10

[2012-05-03 12:36:51 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\GameHouse

[2011-06-21 20:03:26 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\GameRanger

[2012-06-10 12:55:35 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\Genimo

[2012-01-15 12:12:05 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\ipla

[2011-06-21 15:35:57 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\Leadertech

[2011-08-25 18:50:40 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\LolClient

[2012-05-18 22:21:51 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\LolClient2

[2011-08-12 10:58:21 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\Need for Speed World

[2011-11-26 13:47:02 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\OnLive App

[2011-09-22 21:12:56 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\OpenFM

[2011-06-26 11:59:33 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\OpenOffice.org

[2011-11-12 23:37:26 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\Origin

[2011-06-18 11:05:12 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\PunkBuster

[2012-02-23 13:13:41 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\RotMG.Production

[2011-10-24 18:32:44 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\Sports Interactive

[2011-08-03 19:58:44 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\The Creative Assembly

[2012-04-16 21:10:11 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\Tibia

[2012-04-10 23:01:48 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\TS3Client

[2012-01-30 20:28:24 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\Unity

[2012-06-26 17:12:34 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\uTorrent

[2011-06-20 11:04:23 | 000,000,000 | ---D | M] -- C:\Users\Wojtek\AppData\Roaming\wargaming.net

[2012-07-01 10:57:26 | 000,032,604 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 100 bytes -> C:\ProgramData\TEMP:ADF211B1

< End of report >

Natasia24 · 7 Lipca 2012

Bardzo dziękuje za pomoc

Buziaki

Landuss · 7 Lipca 2012

Czemu log nie jest wklejony opcją załączniki? Możesz przejść do finalizacji tematu.

1. Do OTL wklej kosmetyczny skrypt o tej zawartości:

:OTL
O4:64bit: - HKLM..\Run: [sppuinotify] C:\Users\Wojtek\AppData\Local\Microsoft\Windows\3376\sppuinotify.exe File not found
O4:64bit: - HKLM..\Run: [sxstrace] C:\Users\MAMA\AppData\Local\Microsoft\Windows\4672\sxstrace.exe File not found

Klikasz w Wykonaj skrypt. Logów nie pokazujesz żadnych. Użyj opcji Sprzątanie z OTL.

2. Opróżnij folder przywracania systemu: KLIK

3. Zaktualizuj system instalując Service Pack 1 oraz wymienione programy do najnowszych wersji:

Internet Explorer (Version = 8.0.7600.16385)

"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java 6 Update 31

"{AC76BA86-7AD7-1045-7B44-A95000000001}" = Adobe Reader 9.5.1 - Polish

Szczegóły aktualizacyjne: KLIK

4. Dla bezpieczeństw a zmień hasła logowania do serwisów w sieci.

picasso · 8 Lipca 2012

Jestem kompletnym lalikiem w dziedzinie komputerów

Toteż nie powinieneś uruchamiać ComboFix na własną rękę: KLIK. A zasady działu (KLIK) mówią, by się przyznać do jego uruchomienia i pokazać log z wynikami usuwania ...

1. Uruchom OTL i w sekcji Własne opcje skanowania / skrypt wklej:

:OTL
O4:64bit: - HKLM..\Run: [sppuinotify] C:\Users\Wojtek\AppData\Local\Microsoft\Windows\3376\sppuinotify.exe ()
O4:64bit: - HKLM..\Run: [sxstrace] C:\Users\MAMA\AppData\Local\Microsoft\Windows\4672\sxstrace.exe File not found
O3 - HKU\S-1-5-21-241298349-3269669532-2685158662-1000\..\Toolbar\WebBrowser: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - No CLSID value found.
 
:Files
C:\Users\Wojtek\AppData\Local\Microsoft\Windows\3376
C:\Users\MAMA\AppData\Local\Microsoft\Windows\4672
C:\Users\Wojtek\AppData\Roaming\hellomoto
C:\Users\MAMA\AppData\Roaming\hellomoto
rd /s /q "C:\Kaspersky Rescue Disk 10.0" /C
 
:Reg
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="about:blank"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
"DefaultScope"="{0633EE93-D776-472f-A0FF-E1416B8B2E3A}"
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}]
 
:Commands
[emptytemp]

Klik w Wykonaj skrypt. System zostanie zrestartowany (i odblokowany). W katalogu C:\_OTL powstanie log z usuwania.

2. Przez Panel sterowania odinstaluj adware Babylon toolbar on IE. Popraw w AdwCleaner opcją Delete, z czego też powstanie log na dysku C:.

3. Wygeneruj nowy log OTL z opcji Skanuj (już bez Extras). Dołącz log z usuwania OTL z punktu 1 oraz AdwCleaner z punktu 2.

.

Zaloguj się

Komputer został zablokowany z powodu naruszenia prawa polskiego

Rekomendowane odpowiedzi

Natasia24

Odnośnik do komentarza

Landuss

Odnośnik do komentarza

Natasia24

Odnośnik do komentarza

Natasia24

Odnośnik do komentarza

Landuss

Odnośnik do komentarza

picasso

Odnośnik do komentarza

Ostatnio przeglądający 0 użytkowników

Przeglądaj

Cała aktywność