SafeGroup

SafeGroup > Bezpieczeństwo > Pomoc po zainfekowaniu > Podejrzenie infekcji
Pełna wersja: Podejrzenie infekcji
Aktualnie przeglądasz uproszczoną wersję forum. Kliknij tutaj, by zobaczyć wersję z pełnym formatowaniem.

amator72

18.10.2011, 01:25
Laptop: Inspiron N5110
Wersja systemu Windows: Microsoft Windows 7 Home Premium
Nazwa procesora:Intel® Core™ i7-2630QM CPU @ 2.00GHz
Nazwa karty graficznej: NVIDIA GeForce GT 525M
Zainstalowana pamięć: 6,00 GB

Podczas skanowania antywirusem AVG komunikat : C:/Program Files(x86)Intel/BLUTOOTH/OBEXSRV.EXE (nie dałem do kwarantanny)
Zwiększona wydajność: C:\WINDOWS\SYSWOW64\PING.EXE
Podczas próby aktualizacji systemu - wyłącza się!
Bardzo proszę o pomoc i z góry dziękuję!

OTL.Txt

Kod:
OTL logfile created on: 2011-10-17 01:50:20 - Run 3
OTL by OldTimer - Version 3.2.31.0 Folder = D:\Download
64bit- Home Premium Edition(Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

5,91 Gb Total Physical Memory | 4,19 Gb Available Physical Memory | 70,97% Memory free
11,82 Gb Paging File | 9,98 Gb Available in Paging File | 84,48% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 39,07 Gb Total Space | 11,81 Gb Free Space | 30,23% Space Free | Partition Type: NTFS
Drive D: | 542,36 Gb Total Space | 542,12 Gb Free Space | 99,96% Space Free | Partition Type: NTFS

Computer Name: KOMPUTER | User Name: by JS | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2011-10-18 16:02:24 | 000,584,192 | ---- | M] (OldTimer Tools) -- D:\Download\OTL.exe
PRC - [2011-10-12 09:23:01 | 000,924,632 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
PRC - [2011-09-23 06:31:50 | 002,404,704 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
PRC - [2011-09-12 06:23:46 | 005,265,248 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe
PRC - [2011-09-06 19:29:20 | 004,259,648 | ---- | M] (SoftThinks - Dell) -- C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE
PRC - [2011-08-19 06:24:14 | 002,399,560 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgfws.exe
PRC - [2011-08-18 17:05:54 | 002,751,808 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
PRC - [2011-08-18 17:05:46 | 001,692,480 | ---- | M] (SoftThinks SAS) -- C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
PRC - [2011-08-02 06:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
PRC - [2011-08-01 19:56:48 | 000,460,096 | ---- | M] (SoftThinks - Dell) -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
PRC - [2011-05-27 15:58:48 | 000,793,416 | ---- | M] (AVG) -- C:\Program Files (x86)\AVG\AVG PC Tuneup 2011\BoostSpeed.exe
PRC - [2010-11-30 04:04:00 | 001,997,416 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2010-11-29 11:31:42 | 000,378,472 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2010-11-06 06:54:22 | 000,013,336 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
PRC - [2010-11-03 19:01:34 | 000,983,104 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
PRC - [2010-11-03 18:53:28 | 000,897,088 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
PRC - [2010-10-06 04:04:12 | 002,655,768 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
PRC - [2010-10-06 04:04:08 | 000,325,656 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
PRC - [2009-07-14 03:14:47 | 000,254,976 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SysWOW64\wbem\WmiPrvSE.exe
PRC - [2009-07-14 03:14:28 | 000,015,360 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SysWOW64\PING.EXE


[color=#E56717]========== Modules (No Company Name) ==========[/color]

MOD - [2011-10-12 09:23:02 | 001,989,592 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2011-08-18 17:05:54 | 002,751,808 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
MOD - [2011-05-25 10:53:36 | 000,473,960 | ---- | M] () -- C:\Program Files (x86)\AVG\AVG PC Tuneup 2011\sqlite3.dll
MOD - [2011-05-25 10:53:14 | 000,350,024 | ---- | M] () -- C:\Program Files (x86)\AVG\AVG PC Tuneup 2011\madExcept_.bpl
MOD - [2011-05-25 10:53:12 | 000,184,136 | ---- | M] () -- C:\Program Files (x86)\AVG\AVG PC Tuneup 2011\madBasic_.bpl
MOD - [2011-05-25 10:53:12 | 000,050,504 | ---- | M] () -- C:\Program Files (x86)\AVG\AVG PC Tuneup 2011\madDisAsm_.bpl
MOD - [2011-05-17 11:01:34 | 000,311,296 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_pl_b77a5c561934e089\mscorlib.resources.dll
MOD - [2011-05-17 08:52:54 | 002,295,296 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\b1a619266964bede98b18ef83eb1c559\System.Core.ni.dll
MOD - [2011-03-21 05:30:24 | 000,224,768 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\ad29de17e87b1cefbfcf8a3dd41e0b5c\PresentationFramework.Classic.ni.dll
MOD - [2011-03-21 05:29:59 | 014,318,592 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\eb5ff7b60b69cc300751f46c6af316ad\PresentationFramework.ni.dll
MOD - [2011-03-21 05:29:43 | 012,430,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\f92c882fd4e7005c005e208daa04c28d\System.Windows.Forms.ni.dll
MOD - [2011-03-21 05:29:35 | 001,586,688 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\fdeec42fa02f3d789c42be2e33b130eb\System.Drawing.ni.dll
MOD - [2011-03-21 05:29:29 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\3060dfcdecbeb8ee65077fb29b217c3d\System.Xml.ni.dll
MOD - [2011-03-21 05:29:25 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\4be2653d1c9804d2ff6e6b66d22764e1\System.Configuration.ni.dll
MOD - [2011-03-21 05:29:23 | 012,216,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\a937151be4e65fd89c55b4c603f7d902\PresentationCore.ni.dll
MOD - [2011-03-21 05:23:36 | 003,313,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\d80659eacd9554d9606881b0d35835cf\WindowsBase.ni.dll
MOD - [2011-03-21 05:23:34 | 007,949,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\500ddd904b1099f95552a81b54223b7f\System.ni.dll
MOD - [2011-03-21 05:23:28 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f58ab951b57c8526430486dcf7ee38fd\mscorlib.ni.dll
MOD - [2010-11-30 04:04:00 | 000,004,096 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\CoProcManager\detoured.dll
MOD - [2010-11-29 11:31:24 | 000,235,112 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll


[color=#E56717]========== Win32 Services (SafeList) ==========[/color]

SRV:[b]64bit:[/b] - [2011-01-25 11:57:18 | 000,296,448 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Program Files\IDT\WDM\stacsv64.exe -- (STacSV)
SRV:[b]64bit:[/b] - [2010-12-17 21:41:32 | 001,515,792 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV:[b]64bit:[/b] - [2010-12-17 21:28:46 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)
SRV:[b]64bit:[/b] - [2010-12-17 21:26:50 | 000,836,880 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV:[b]64bit:[/b] - [2010-11-29 22:00:56 | 000,149,504 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)
SRV:[b]64bit:[/b] - [2010-09-23 01:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:[b]64bit:[/b] - [2009-07-14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:[b]64bit:[/b] - [2009-03-03 12:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Program Files\IDT\WDM\AESTSr64.exe -- (AESTFilters)
SRV - [2011-09-12 06:23:46 | 005,265,248 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011-08-19 06:24:14 | 002,399,560 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\avgfws.exe -- (avgfws)
SRV - [2011-08-18 17:05:46 | 001,692,480 | ---- | M] (SoftThinks SAS) [Auto | Running] -- C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE -- (SftService)
SRV - [2011-08-02 06:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe -- (avgwd)
SRV - [2010-11-30 04:04:00 | 001,997,416 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2010-11-29 11:31:42 | 000,378,472 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2010-11-25 12:34:18 | 000,219,632 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe -- (RoxWatch12)
SRV - [2010-11-25 12:33:18 | 001,116,656 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe -- (RoxMediaDB12OEM)
SRV - [2010-11-06 06:54:22 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2010-11-03 19:01:34 | 000,983,104 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe -- (Bluetooth OBEX Service)
SRV - [2010-11-03 19:01:20 | 001,298,496 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe -- (Bluetooth Media Service)
SRV - [2010-11-03 18:53:28 | 000,897,088 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe -- (Bluetooth Device Monitor)
SRV - [2010-10-06 04:04:12 | 002,655,768 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2010-10-06 04:04:08 | 000,325,656 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2009-06-10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)


[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV:[b]64bit:[/b] - [2011-09-13 06:30:08 | 000,037,456 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:[b]64bit:[/b] - [2011-08-08 06:08:58 | 000,046,672 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:[b]64bit:[/b] - [2011-07-11 01:14:36 | 000,375,376 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\SysNative\drivers\avgtdia.sys -- (Avgtdia)
DRV:[b]64bit:[/b] - [2011-07-11 01:14:08 | 000,029,776 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV:[b]64bit:[/b] - [2011-07-11 01:14:06 | 000,120,400 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV:[b]64bit:[/b] - [2011-07-11 01:14:06 | 000,026,704 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\WINDOWS\SysNative\drivers\AVGIDSEH.sys -- (AVGIDSEH)
DRV:[b]64bit:[/b] - [2011-07-11 01:13:44 | 000,282,704 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\SysNative\drivers\avgldx64.sys -- (Avgldx64)
DRV:[b]64bit:[/b] - [2011-05-23 01:03:28 | 000,048,992 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\SysNative\drivers\avgfwd6a.sys -- (Avgfwfd)
DRV:[b]64bit:[/b] - [2011-01-25 11:57:18 | 000,520,192 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:[b]64bit:[/b] - [2011-01-08 03:42:34 | 012,262,688 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:[b]64bit:[/b] - [2010-12-21 16:08:48 | 008,505,856 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\NETwNs64.sys -- (NETwNs64) ___ Sterownik karty Intel(R)
DRV:[b]64bit:[/b] - [2010-12-10 23:50:36 | 000,181,248 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:[b]64bit:[/b] - [2010-12-10 23:50:36 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:[b]64bit:[/b] - [2010-12-04 00:32:24 | 000,316,024 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\Apfiltr.sys -- (ApfiltrService)
DRV:[b]64bit:[/b] - [2010-12-01 12:02:22 | 000,042,392 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\WDKMD.sys -- (wdkmd)
DRV:[b]64bit:[/b] - [2010-11-30 04:04:00 | 000,025,576 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\SysNative\drivers\nvpciflt.sys -- (nvpciflt)
DRV:[b]64bit:[/b] - [2010-11-29 22:00:04 | 000,016,120 | ---- | M] (Intel(R) Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\SysNative\drivers\TurboB.sys -- (TurboB)
DRV:[b]64bit:[/b] - [2010-11-12 14:40:50 | 000,155,752 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:[b]64bit:[/b] - [2010-11-07 01:45:48 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:[b]64bit:[/b] - [2010-11-04 12:07:06 | 000,058,128 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\btmaux.sys -- (btmaux)
DRV:[b]64bit:[/b] - [2010-11-04 10:31:44 | 000,059,904 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\iBtFltCoex.sys -- (iBtFltCoex)
DRV:[b]64bit:[/b] - [2010-10-30 02:11:42 | 000,250,984 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:[b]64bit:[/b] - [2010-10-26 21:08:08 | 000,406,632 | ---- | M] (Realtek) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:[b]64bit:[/b] - [2010-10-20 01:12:58 | 000,274,432 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\btmhsf.sys -- (btmhsf)
DRV:[b]64bit:[/b] - [2010-09-21 16:59:38 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel(R)
DRV:[b]64bit:[/b] - [2010-08-12 17:51:30 | 000,175,168 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt)
DRV:[b]64bit:[/b] - [2010-05-12 10:37:32 | 000,107,912 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:[b]64bit:[/b] - [2010-05-12 10:37:32 | 000,027,016 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\WINDOWS\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:[b]64bit:[/b] - [2010-03-19 10:00:00 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:[b]64bit:[/b] - [2009-07-14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:[b]64bit:[/b] - [2009-07-14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:[b]64bit:[/b] - [2009-07-14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:[b]64bit:[/b] - [2009-07-14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:[b]64bit:[/b] - [2009-06-10 22:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\yk62x64.sys -- (yukonw7)
DRV:[b]64bit:[/b] - [2009-06-10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:[b]64bit:[/b] - [2009-06-10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:[b]64bit:[/b] - [2009-06-10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:[b]64bit:[/b] - [2009-06-10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:[b]64bit:[/b] - [2006-11-01 19:51:00 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV - [2009-07-14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\SysWOW64\drivers\wimmount.sys -- (WIMMount)


[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.startup.homepage: "http://www.google.pl/"

FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG2012\Firefox4\ [2011-10-16 22:37:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011-10-16 23:32:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2011-10-16 23:32:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\by JS\AppData\Roaming\mozilla\Extensions
[2011-10-16 23:32:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\by JS\AppData\Roaming\mozilla\Firefox\Profiles\16v685bp.default\extensions
[2011-10-16 23:32:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011-10-16 23:32:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\distribution\extensions
() (No name found) -- C:\USERS\BY JS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\16V685BP.DEFAULT\EXTENSIONS\[email protected]
[2011-10-12 09:23:02 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011-10-12 07:56:37 | 000,002,767 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\allegro-pl.xml
[2011-10-12 07:56:37 | 000,001,406 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fbc-pl.xml
[2011-10-12 07:56:37 | 000,000,917 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\merlin-pl.xml
[2011-10-12 07:56:37 | 000,000,858 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\pwn-pl.xml
[2011-10-12 07:56:37 | 000,001,183 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-pl.xml
[2011-10-12 07:56:37 | 000,001,683 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wp-pl.xml

Hosts file not found
O2:[b]64bit:[/b] - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4 - HKLM..\Run: []File not found
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O8:[b]64bit:[/b] - Extra context menu item: Search the Web - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html File not found
O8 - Extra context menu item: Search the Web - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html File not found
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra ''Tools'' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13[b]64bit:[/b] - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 62.179.1.62 62.179.1.63
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CD88BCA0-31A9-4CEA-A630-ABD46D0CF31A}: DhcpNameServer = 62.179.1.62 62.179.1.63
O18:[b]64bit:[/b] - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:[b]64bit:[/b] - Protocol\Handler\livecall - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\msnim - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\skype4com - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\wlmailhtml - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:[b]64bit:[/b] - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\WINDOWS\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) -C:\WINDOWS\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\WINDOWS\SysNative\userinit.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (/pagefile) -File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:[b]64bit:[/b] - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /sync /restart)
O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2011-10-19 00:05:36 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2011-10-18 23:34:55 | 000,000,000 | ---D | C] -- C:\Windows\SMINST
[2011-10-16 23:32:14 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Mozilla
[2011-10-16 23:32:14 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Local\Mozilla
[2011-10-16 23:32:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2011-10-16 23:21:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2011-10-16 23:21:27 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2011-10-16 23:08:02 | 000,000,000 | ---D | C] -- C:\Users\by JS\Tracing
[2011-10-16 22:59:53 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Macromedia
[2011-10-16 22:59:50 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Adobe
[2011-10-16 22:57:53 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011-10-16 22:47:10 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\AVG
[2011-10-16 22:43:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC Tuneup 2011
[2011-10-16 22:37:38 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\AVG2012
[2011-10-16 22:37:33 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2011-10-16 22:37:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2012
[2011-10-16 22:37:27 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\AVG
[2011-10-16 22:37:17 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2012
[2011-10-16 22:37:17 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\AVG
[2011-10-16 22:37:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVG
[2011-10-16 22:34:23 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2011-10-16 21:41:50 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Intel Corporation
[2011-10-16 21:41:38 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Dell
[2011-10-16 21:41:32 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Roxio
[2011-10-16 21:41:26 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Dell Touch Zone
[2011-10-16 21:41:26 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Creative
[2011-10-16 21:41:24 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Leadertech
[2011-10-16 21:40:54 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Identities
[2011-10-16 21:40:52 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011-10-16 21:40:40 | 000,000,000 | R--D | C] -- C:\Users\by JS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011-10-16 21:40:40 | 000,000,000 | R--D | C] -- C:\Users\by JS\Searches
[2011-10-16 21:40:40 | 000,000,000 | R--D | C] -- C:\Users\by JS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011-10-16 21:40:38 | 000,000,000 | R--D | C] -- C:\Users\by JS\Contacts
[2011-10-16 21:37:42 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Local\SoftThinks
[2011-10-16 21:35:32 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Local\VirtualStore
[2011-10-16 21:35:31 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Intel
[2011-10-16 21:35:29 | 000,000,000 | --SD | C] -- C:\Users\by JS\AppData\Roaming\Microsoft
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\Videos
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\Saved Games
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\Pictures
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\Music
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\Links
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\Favorites
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\Downloads
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\Documents
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\Desktop
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\Ustawienia lokalne
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\AppData\Local\Temporary Internet Files
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\Szablony
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\SendTo
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\Recent
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\PrintHood
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\NetHood
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\Documents\Moje wideo
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\Documents\Moje obrazy
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\Moje dokumenty
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\Documents\Moja muzyka
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\Menu Start
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\AppData\Local\Historia
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\Dane aplikacji
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\AppData\Local\Dane aplikacji
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\Cookies
[2011-10-16 21:35:29 | 000,000,000 | -H-D | C] -- C:\Users\by JS\AppData
[2011-10-16 21:35:29 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Local\Temp
[2011-10-16 21:35:29 | 000,000,000 | ---D | C] -- C:\Users\by JS\Roaming
[2011-10-16 21:35:29 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Local\Microsoft
[2011-10-16 21:35:29 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Media Center Programs
[2011-10-16 21:35:22 | 000,000,000 | -HSD | C] -- C:\ProgramData\Ulubione
[2011-10-16 21:35:22 | 000,000,000 | -HSD | C] -- C:\ProgramData\Szablony
[2011-10-16 21:35:22 | 000,000,000 | -HSD | C] -- C:\ProgramData\Pulpit
[2011-10-16 21:35:22 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Moje wideo
[2011-10-16 21:35:22 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Moje obrazy
[2011-10-16 21:35:22 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Moja muzyka
[2011-10-16 21:35:22 | 000,000,000 | -HSD | C] -- C:\ProgramData\Menu Start
[2011-10-16 21:35:22 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumenty
[2011-10-16 21:35:22 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dane aplikacji

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2011-10-19 04:34:54 | 000,064,519 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2011-10-19 04:34:54 | 000,064,519 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2011-10-17 01:50:02 | 000,786,432 | ---- | M] () -- C:\Users\by JS\NTUSER.DAT
[2011-10-17 01:11:03 | 463,867,903 | -HS- | M] () -- C:\hiberfil.sys
[2011-10-17 00:56:31 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011-10-17 00:56:31 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011-10-17 00:48:33 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2011-10-17 00:48:20 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011-10-17 00:47:17 | 000,984,320 | -H-- | M] () -- C:\Users\by JS\AppData\Local\IconCache.db
[2011-10-17 00:29:49 | 106,781,948 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\incavi.avm
[2011-10-16 23:28:13 | 001,523,412 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011-10-16 23:28:13 | 000,687,828 | ---- | M] () -- C:\Windows\SysNative\perfh015.dat
[2011-10-16 23:28:13 | 000,607,190 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011-10-16 23:28:13 | 000,131,382 | ---- | M] () -- C:\Windows\SysNative\perfc015.dat
[2011-10-16 23:28:13 | 000,103,568 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011-10-16 22:42:15 | 000,662,551 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\iavifw.avm
[2011-10-16 22:37:27 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\drivers\AVG\incavi.avm
[2011-10-16 22:37:27 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\drivers\AVG\iavifw.avm
[2011-10-16 22:37:27 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\drivers\AVG\iavichjw.avm
[2011-10-16 21:37:50 | 000,524,288 | -HS- | M] () -- C:\Users\by JS\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2011-10-16 21:37:50 | 000,524,288 | -HS- | M] () -- C:\Users\by JS\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2011-10-16 21:37:50 | 000,065,536 | -HS- | M] () -- C:\Users\by JS\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2011-10-16 21:35:40 | 000,074,400 | ---- | M] () -- C:\Users\by JS\AppData\Local\GDIPFONTCACHEV1.DAT
[2011-10-16 21:35:29 | 000,000,020 | -HS- | M] () -- C:\Users\by JS\ntuser.ini

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2011-10-19 00:05:26 | 463,867,903 | -HS- | C] () -- C:\hiberfil.sys
[2011-10-17 00:47:17 | 000,984,320 | -H-- | C] () -- C:\Users\by JS\AppData\Local\IconCache.db
[2011-10-17 00:29:49 | 106,781,948 | ---- | C] () -- C:\Windows\SysNative\drivers\AVG\incavi.avm
[2011-10-16 23:32:11 | 000,001,165 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011-10-16 22:42:15 | 000,662,551 | ---- | C] () -- C:\Windows\SysNative\drivers\AVG\iavifw.avm
[2011-10-16 22:37:27 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\drivers\AVG\incavi.avm
[2011-10-16 22:37:27 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\drivers\AVG\iavifw.avm
[2011-10-16 22:37:27 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\drivers\AVG\iavichjw.avm
[2011-10-16 21:41:04 | 000,001,423 | ---- | C] () -- C:\Users\by JS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2011-10-16 21:40:46 | 000,001,457 | ---- | C] () -- C:\Users\by JS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011-10-16 21:36:24 | 000,001,979 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dokumentacja pomocy firmy Dell.lnk
[2011-10-16 21:35:40 | 000,074,400 | ---- | C] () -- C:\Users\by JS\AppData\Local\GDIPFONTCACHEV1.DAT
[2011-10-16 21:35:29 | 000,786,432 | ---- | C] () -- C:\Users\by JS\NTUSER.DAT
[2011-10-16 21:35:29 | 000,524,288 | -HS- | C] () -- C:\Users\by JS\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2011-10-16 21:35:29 | 000,524,288 | -HS- | C] () -- C:\Users\by JS\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2011-10-16 21:35:29 | 000,065,536 | -HS- | C] () -- C:\Users\by JS\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2011-10-16 21:35:29 | 000,000,020 | -HS- | C] () -- C:\Users\by JS\ntuser.ini
[2011-05-17 10:45:23 | 000,017,776 | ---- | C] () -- C:\Windows\EvtMessage.dll
[2011-05-17 10:43:53 | 000,960,940 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011-05-17 10:43:52 | 000,207,376 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011-05-17 10:43:52 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2011-05-17 10:43:14 | 000,000,096 | ---- | C] () -- C:\Windows\LaunApp.ini
[2011-05-17 10:43:10 | 000,000,035 | ---- | C] () -- C:\Windows\DELL_LANGCODE.ini
[2011-05-17 10:43:10 | 000,000,033 | ---- | C] () -- C:\Windows\DELL_OSTYPE.ini
[2011-05-17 10:43:10 | 000,000,032 | ---- | C] () -- C:\Windows\WisHWDest.ini
[2011-05-17 10:43:10 | 000,000,023 | ---- | C] () -- C:\Windows\WisSysInfo.ini
[2011-05-17 10:43:09 | 000,000,271 | ---- | C] () -- C:\Windows\WisPriority.ini
[2011-05-17 10:43:09 | 000,000,028 | ---- | C] () -- C:\Windows\WisLangCode.ini
[2011-05-17 08:25:33 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll
[2011-03-21 04:49:03 | 000,000,324 | ---- | C] () -- C:\Windows\Prelaunch.ini
[2009-07-14 07:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009-07-14 04:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009-07-14 04:35:42 | 000,001,405 | ---- | C] () -- C:\Windows\msdfmap.ini
[2009-07-14 04:34:57 | 000,000,435 | ---- | C] () -- C:\Windows\win.ini
[2009-07-14 04:34:57 | 000,000,219 | ---- | C] () -- C:\Windows\system.ini
[2009-07-14 04:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009-07-14 02:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009-07-14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009-07-13 23:59:36 | 000,982,196 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin
[2009-07-13 23:59:36 | 000,139,824 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin
[2009-07-13 23:59:36 | 000,097,448 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin
[2009-07-13 23:59:35 | 000,417,344 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin
[2009-07-13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009-06-10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

[color=#E56717]========== LOP Check ==========[/color]

[2011-10-17 01:04:17 | 000,000,000 | ---D | M] -- C:\Users\by JS\AppData\Roaming\AVG
[2011-10-16 22:37:38 | 000,000,000 | ---D | M] -- C:\Users\by JS\AppData\Roaming\AVG2012
[2011-10-16 21:41:24 | 000,000,000 | ---D | M] -- C:\Users\by JS\AppData\Roaming\Leadertech
[2009-07-14 07:08:49 | 000,011,440 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[color=#E56717]========== Purity Check ==========[/color]



[color=#E56717]========== Alternate Data Streams ==========[/color]

@Alternate Data Stream - 206 bytes -> C:\ProgramData\Temp:0B4227B4
@Alternate Data Stream - 191 bytes -> C:\ProgramData\Temp:0B4227B4

< End of report >


Extras.Txt

Kod:
OTL Extras logfile created on: 2011-10-17 01:50:20 - Run 3
OTL by OldTimer - Version 3.2.31.0 Folder = D:\Download
64bit- Home Premium Edition(Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

5,91 Gb Total Physical Memory | 4,19 Gb Available Physical Memory | 70,97% Memory free
11,82 Gb Paging File | 9,98 Gb Available in Paging File | 84,48% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 39,07 Gb Total Space | 11,81 Gb Free Space | 30,23% Space Free | Partition Type: NTFS
Drive D: | 542,36 Gb Total Space | 542,12 Gb Free Space | 99,96% Space Free | Partition Type: NTFS

Computer Name: KOMPUTER | User Name: by JS | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

[color=#E56717]========== Extra Registry (SafeList) ==========[/color]


[color=#E56717]========== File Associations ==========[/color]

[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[color=#E56717]========== Shell Spawning ==========[/color]

[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[color=#E56717]========== Security Center Settings ==========[/color]

[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1

[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01[binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[b]64bit:[/b] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]

[color=#E56717]========== Firewall Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0

[color=#E56717]========== Authorized Applications List ==========[/color]


[color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]

64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0090A87C-3E0E-43D4-AA71-A71B06563A4A}" = Dell Support Center
"{1B8ABA62-74F0-47ED-B18C-A43128E591B8}" = Windows Live ID Sign-in Assistant
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{2426E29F-9E8C-4C0B-97FC-0DB690C1ED98}" = Windows Live Remote Client Resources
"{26A24AE4-039D-4CA4-87B4-2F86416024FF}" = Java(TM) 6 Update 24 (64-bit)
"{28EF7372-9087-4AC3-9B9F-D9751FCDF830}" = Intel(R) Wireless Display
"{290D4DB2-F1B4-4B8E-918D-D71EF29A001B}" = Oprogramowanie Intel(R) PROSet/Wireless WiFi
"{480F28F0-8BCE-404A-A52E-0DBB7D1CE2EF}" = Windows Live Remote Service Resources
"{5349A735-7482-406F-9FE4-3BB24608479D}" = AVG 2012
"{60B2315F-680F-4EB3-B8DD-CCDC86A7CCAB}" = Roxio File Backup
"{7CE8BE79-ABC3-4B2C-9543-28ED2B0A9EA8}" = Intel(R) PROSet/Wireless Software for Bluetooth(R) Technology
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{87CF757E-C1F1-4D22-865C-00C6950B5258}" = Quickset64
"{8EBA8727-ADC2-477B-9D9A-1A1836BE4E05}" = Dell Edoc Viewer
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9D6DFAD6-09E5-445E-A4B5-A388FEEBD90D}" = RBVirtualFolder64Inst
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Dell Touchpad
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA Sterownik 3D Vision 265.94
"{B2FE1952-0186-46c3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = Panel sterowania NVIDIA 265.94
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Sterownik graficzny 265.94
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Optimus" = NVIDIA Optimus 1.0.9
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA Sterownik dźwięku HD 1.1.13.1
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B77EFA0B-9BD3-4122-9F9A-15A963B5EA24}" = Intel(R) Turbo Boost Technology Monitor 2.0
"{D07A61E5-A59C-433C-BCBD-22025FA2287B}" = Windows Live Language Selector
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{ED5E169E-490F-4F4C-B2BB-C89D510FA595}" = AVG 2012
"AVG" = AVG 2012
"Dell Support Center" = Dell Support Center
"ProInst" = Intel PROSet Wireless

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052bac4a-6f79-46d4-a024-1ce1b4f73cd4}" = Microsoft Visual C++ 2005 Redistributable
"{0654EA5D-308A-4196-882B-5C09744A5D81}" = Windows Live Photo Common
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0C1931EB-8339-4837-8BEC-75029BF42734}" = Windows Live UX Platform Language Pack
"{0ED7EE95-6A97-47AA-AD73-152C08A15B04}" = Dell DataSafe Local Backup
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010x86 Redistributable - 10.0.30319
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26E3C07C-7FF7-4362-9E99-9E49E383CF16}" = Windows Live Writer Resources
"{2A0F2CC5-3065-492C-8380-B03AA7106B1A}" = Dell Product Registration
"{2C7E8AA1-9C03-4606-BF34-5D99D07964DA}" = Windows Live Messenger
"{3250260C-7A95-4632-893B-89657EB5545B}" = PhotoShowExpress
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology
"{3E8A1ADF-B72C-47FE-85F6-F7A73C487F6C}" = Dell MusicStage
"{3F1B9D10-D0F2-44FC-BC6E-E426CA1D0CD5}" = Dell Stage
"{50316C0A-CC2A-460A-9EA5-F486E54AC17D}_is1" = AVG PC Tuneup 2011
"{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"{5A06423A-210C-49FB-950E-CB0EB8C5CEC7}" = Roxio BackOnTrack
"{64376910-1860-4CEF-8B34-AA5D205FC5F1}" = Poczta usługi Windows Live
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Roxio Express Labeler 3
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6F0BBEFE-BE1C-419B-BA1F-D36C9E7915BC}" = Roxio Creator Starter
"{7746BFAA-2B5D-4FFD-A0E8-4558F4668105}" = Roxio Burn
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{7A9D47BA-6D50-4087-866F-0800D8B89383}" = Podstawowe programy Windows Live
"{7DB9F1E5-9ACB-410D-A7DC-7A3D023CE045}" = Dell Getting Started Guide
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95140000-0070-0000-0000-0000000FF1CE}" = Microsoft Office 2010
"{96AE7E41-E34E-47D0-AC07-1091A8127911}" = Realtek USB 2.0 Card Reader
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A00EC4E-27E1-42C4-98DD-662F32AC8870}" = Sonic CinePlayer Decoder Pack
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A121EEDE-C68F-461D-91AA-D48BA226AF1C}" = Roxio Activation Module
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A9668246-FB70-4103-A1E3-66C9BC2EFB49}" = Dell DataSafe Local Backup - Support Software
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AC76BA86-7AD7-FFFF-7B44-AA0000000001}" = Adobe Reader X MUI
"{AF9E97C1-7431-426D-A8D5-ABE40995C0B1}" = DirectX 9 Runtime
"{B04A0E2F-1E4C-4E61-B18E-3B2BD6779CA7}" = Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsługę połączeń zdalnych
"{BD8DA595-F501-4ABE-85A0-5C23E82472A0}" = Pomocnik Messenger
"{BF35168D-F6F9-4202-BA87-86B5E3C9BF7A}" = Windows Live Mesh
"{CB3F59BB-7858-41A1-A7EA-4B8A6FC7D431}" = Galeria fotografii usługi Windows Live
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}" = Dell VideoStage
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3A5A8AB-58F6-45FF-AFCB-C9AE18C05001}" = IDT Audio
"{E4335E82-17B3-460F-9E70-39D9BC269DB3}" = Dell PhotoStage
"{E55E0C35-AC3C-4683-BA2F-834348577B80}" = Windows Live Writer
"{E5D03B2E-B2D4-477F-A60D-8E1969D821FA}" = Adobe Flash Player 10 ActiveX
"{E6725026-A650-449C-897B-D6B7A5EEA058}" = Adobe Flash Player 10 Plugin
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EF56258E-0326-48C5-A86C-3BAC26FC15DF}" = Roxio Creator Starter
"{F06B5C4C-8D2E-4B24-9D43-7A45EEC6C878}" = Roxio Creator Starter
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics
"{F80E5450-3EF3-4270-B26C-6AC53BEC5E76}" = Windows Live Movie Maker
"{F84906ED-BB54-4889-B131-FED9C9056FC8}" = Intel(R) Wireless Display
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{FCDBEA60-79F0-4FAE-BBA8-55A26C609A49}" = Visual Studio 2008 x64 Redistributables
"Advanced Audio FX Engine" = Advanced Audio FX Engine
"Dell Webcam Central" = Dell Webcam Central
"InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"InstallShield_{DCE0E79A-B9AC-41AC-98C1-7EF0538BCA7F}" = Dell VideoStage
"Mozilla Firefox 8.0 (x86 pl)" = Mozilla Firefox 8.0 (x86 pl)
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"WinLiveSuite" = Podstawowe programy Windows Live

[color=#E56717]========== Last 10 Event Log Errors ==========[/color]

[ Dell Events ]
Error - 2011-10-16 15:57:17 | Computer Name = Komputer | Source = DataSafe | ID = 17
Description = Proces został przerwany przed zakończeniem.

Error - 2011-10-16 16:00:57 | Computer Name = Komputer | Source = DataSafe | ID = 17
Description = Proces został przerwany przed zakończeniem.


< End of report >

preter

18.10.2011, 10:07
Jeżeli proces PING.EXE obciąża komputer to na 99% jest to malware. Przeskanuj kompa Emsisoft Emergency Kit, MBAM i Hitman Pro. Któryś z nich powinien wykryć zagrożenie i je usunąć.

Waves

18.10.2011, 14:42
Plik:
Kod:
C:\WINDOWS\SysWOW64\wbem\WmiPrvSE.exe

Przeskanuj na

[Aby zobaczyć linki, zarejestruj się tutaj]



Do programu OTL w własne pole skanowania skrypt:

Kod:
:Processes
Killallprocesses

:Files
C:\WINDOWS\SysWOW64\PING.EXE

:OTL
O4 - HKLM..\Run: []File not found
O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (/pagefile) -File not found
@Alternate Data Stream - 206 bytes -> C:\ProgramData\Temp:0B4227B4
@Alternate Data Stream - 191 bytes -> C:\ProgramData\Temp:0B4227B4

:Commands
[EMPTYTEMP]
[EMPTYFLASH]


Wykonaj skrypt. Pokaż log z usuwania i nowy po.

amator72

18.10.2011, 18:14
skan za pomocą

[Aby zobaczyć linki, zarejestruj się tutaj]

:

Kod:
File name:
WmiPrvSE.exe
Submission date:
2011-10-18 10:10:59 (UTC)
Current status:
finished
Result:
0 /43 (0.0%)


Antivirus     Version     Last Update     Result
AhnLab-V3     2011.10.17.00     2011.10.17     -
AntiVir     7.11.16.32     2011.10.18     -
Antiy-AVL     2.0.3.7     2011.10.18     -
Avast     6.0.1289.0     2011.10.18     -
AVG     10.0.0.1190     2011.10.18     -
BitDefender     7.2     2011.10.18     -
ByteHero     1.0.0.1     2011.09.23     -
CAT-QuickHeal     11.00     2011.10.18     -
ClamAV     0.97.0.0     2011.10.18     -
Commtouch     5.3.2.6     2011.10.18     -
Comodo     10484     2011.10.18     -
DrWeb     5.0.2.03300     2011.10.18     -
Emsisoft     5.1.0.11     2011.10.18     -
eSafe     7.0.17.0     2011.10.17     -
eTrust-Vet     36.1.8625     2011.10.18     -
F-Prot     4.6.5.141     2011.10.17     -
F-Secure     9.0.16440.0     2011.10.18     -
Fortinet     4.3.370.0     2011.10.18     -
GData     22     2011.10.18     -
Ikarus     T3.1.1.107.0     2011.10.18     -
Jiangmin     13.0.900     2011.10.17     -
K7AntiVirus     9.115.5300     2011.10.17     -
Kaspersky     9.0.0.837     2011.10.18     -
McAfee     5.400.0.1158     2011.10.18     -
McAfee-GW-Edition     2010.1D     2011.10.18     -
Microsoft     1.7702     2011.10.18     -
NOD32     6552     2011.10.18     -
Norman     6.07.11     2011.10.18     -
nProtect     2011-10-18.01     2011.10.18     -
Panda     10.0.3.5     2011.10.17     -
PCTools     8.0.0.5     2011.10.18     -
Prevx     3.0     2011.10.18     -
Rising     23.80.01.02     2011.10.18     -
Sophos     4.70.0     2011.10.18     -
SUPERAntiSpyware     4.40.0.1006     2011.10.18     -
Symantec     20111.2.0.82     2011.10.18     -
TheHacker     6.7.0.1.325     2011.10.17     -
TrendMicro     9.500.0.1008     2011.10.18     -
TrendMicro-HouseCall     9.500.0.1008     2011.10.18     -
VBA32     3.12.16.4     2011.10.17     -
VIPRE     10797     2011.10.18     -
ViRobot     2011.10.18.4725     2011.10.18     -
VirusBuster     14.1.16.0     2011.10.17     -
Additional information
MD5 : 203c3380a744ca5b9b1a9caeb57f7d57
SHA1: cc9550792d5ef0711b92923b762db1ad40ca6065
SHA256: 43907909f307fada0a748ace0363aa82768bad3f9107b0dc524ed2bd4205360a
ssdeep: 6144:7/tpbUgyTWnYyz5+jV0+7Z59tKfAsZnQdog:RBUgyTWnYe+7N5XkF7g
File size : 254976 bytes
First seen: 2009-07-17 17:35:41
Last seen : 2011-10-18 10:10:59
Magic: PE32 executable for MS Windows (GUI) Intel 80386 32-bit
TrID:
Win32 Executable MS Visual C++ (generic) (65.2%)
Win32 Executable Generic (14.7%)
Win32 Dynamic Link Library (generic) (13.1%)
Generic Win/DOS Executable (3.4%)
DOS Executable Generic (3.4%)

sigcheck:
publisher....: Microsoft Corporation
copyright....: (c) Microsoft Corporation. All rights reserved.
product......: Microsoft_ Windows_ Operating System
description..: WMI Provider Host
original name: Wmiprvse.exe
internal name: Wmiprvse.exe
file version.: 6.1.7600.16385 (win7_rtm.090713-1255)
comments.....: n/a
signers......: -
signing date.: -
verified.....: Unsigned

PEiD: -

PEInfo: PE structure information

[[ basic data ]]
entrypointaddress: 0x1166F
timedatestamp....: 0x4A5BC39A (Mon Jul 13 23:30:34 2009)
machinetype......: 0x14C (Intel I386)

[[ 4 section(s) ]]
name, viradd, virsiz, rawdsiz, ntropy, md5
.text, 0x1000, 0x385AD, 0x38600, 6.36, 983193d7f49a68dffeb9276f66eedd84
.data, 0x3A000, 0x1C28, 0x1C00, 4.37, 85a84914d3b30f4ea74e4c84f636e9b5
.rsrc, 0x3C000, 0x6C8, 0x800, 3.99, a4cfcc6185a836bb5a4a17dde637fad0
.reloc, 0x3D000, 0x3570, 0x3600, 6.66, 400c99a4f686658cc7a9c46b97570ea2

[[ 10 import(s) ]]
advapi32.dll: ReportEventW, SetSecurityDescriptorDacl, SetSecurityDescriptorGroup, SetSecurityDescriptorOwner, SetEntriesInAclW, FreeSid, AllocateAndInitializeSid, InitializeSecurityDescriptor, RegDisablePredefinedCache, RegSetValueExW, MakeSelfRelativeSD, GetSecurityDescriptorLength, AddAce, InitializeAcl, GetLengthSid, CopySid, RegCloseKey, RegCreateKeyExW, RegDeleteKeyExW, RegOpenKeyExW, RevertToSelf, SetThreadToken, RegisterEventSourceW, DeregisterEventSource, ImpersonateLoggedOnUser, OpenProcessToken, GetAclInformation, OpenThreadToken, ConvertStringSecurityDescriptorToSecurityDescriptorW, MakeAbsoluteSD, MapGenericMask, AccessCheck, RegQueryValueExW, GetTokenInformation
fastprox.dll: _New@CWbemCallSecurity@@SGPAV1@XZ
kernel32.dll: WaitForMultipleObjects, Sleep, GetCurrentThreadId, TerminateProcess, GetCurrentProcess, GetProcAddress, FreeLibrary, GetModuleHandleExW, WaitForSingleObject, DuplicateHandle, HeapSetInformation, CreateThread, lstrlenW, GetModuleFileNameW, InterlockedDecrement, GetVersionExW, MapViewOfFile, CreateFileMappingW, OpenFileMappingW, EnterCriticalSection, LeaveCriticalSection, TlsAlloc, TlsFree, ChangeTimerQueueTimer, InterlockedExchange, InitializeCriticalSectionAndSpinCount, SwitchToThread, CreateEventW, LCMapStringW, GetTickCount, GetCurrentThread, GetStringTypeExW, HeapFree, HeapAlloc, HeapDestroy, HeapCreate, GetProcessHeap, UnhandledExceptionFilter, GetSystemTimeAsFileTime, QueryPerformanceCounter, GetModuleHandleA, SetUnhandledExceptionFilter, GetStartupInfoA, SetEvent, InterlockedIncrement, CloseHandle, GetCurrentProcessId, GetLastError, GetCommandLineW, CompareStringW, LocalFree, InterlockedCompareExchange, DeleteCriticalSection, UnmapViewOfFile
msvcrt.dll: _ismbblead, _XcptFilter, _exit, _cexit, __getmainargs, memcpy, exit, _purecall, _CxxThrowException, memset, _vsnwprintf, __CxxFrameHandler3, _itow, wcstok, _acmdln, _initterm, _amsg_exit, __setusermatherr, __p__commode, __p__fmode, __set_app_type, __1type_info@@UAE@XZ, _unlock, __dllonexit, _lock, _onexit, _except_handler4_common, _terminate@@YAXXZ, _controlfp
ncobjapi.dll: WmiCreateObjectWithFormat, WmiEventSourceConnect, WmiEventSourceDisconnect, WmiDestroyObject, WmiSetAndCommitObject
ntdll.dll: NtQuerySystemInformation, EtwGetTraceEnableFlags, EtwGetTraceEnableLevel, EtwGetTraceLoggerHandle, EtwRegisterTraceGuidsW, EtwUnregisterTraceGuids, EtwTraceMessage
ole32.dll: CoImpersonateClient, CLSIDFromString, CoGetClassObject, CoCreateGuid, CoMarshalInterThreadInterfaceInStream, CoGetInterfaceAndReleaseStream, CoUninitialize, CoFreeUnusedLibrariesEx, CoRegisterClassObject, CoCreateInstance, CoInitializeSecurity, CoRevertToSelf, CoInitializeEx, StringFromGUID2, CoGetCallContext, CoSwitchCallContext, CoRevokeClassObject
oleaut32.dll: -, -, -, -, -, -, -, -, -
user32.dll: LoadCursorW, DefWindowProcW, DeleteMenu, GetSystemMenu, UpdateWindow, ShowWindow, CreateWindowExW, RegisterClassW, LoadIconW, UnregisterClassW, DestroyWindow, DispatchMessageW, TranslateMessage, GetMessageW, PeekMessageW, MsgWaitForMultipleObjects, MsgWaitForMultipleObjectsEx, PostMessageW
wbemcomn.dll: _BreakOnDbgAndRenterLoop@@YGKXZ, _GetMemLogObject@@YGPAVCMemoryLog@@XZ, _Write@CMemoryLog@@QAEXJ@Z, __ThrowMemoryException_@@YGXXZ, _SetPreferredLanguages@CMUILocale@@SGJKPBGPAK@Z
Androguard:
-
ExifTool:
file metadata
CharacterSet: Unicode
CodeSize: 230912
CompanyName: Microsoft Corporation
EntryPoint: 0x1166f
FileDescription: WMI Provider Host
FileFlagsMask: 0x003f
FileOS: Windows NT 32-bit
FileSize: 249 kB
FileSubtype: 0
FileType: Win32 EXE
FileVersion: 6.1.7600.16385 (win7_rtm.090713-1255)
FileVersionNumber: 6.1.7600.16385
ImageVersion: 6.1
InitializedDataSize: 23552
InternalName: Wmiprvse.exe
LanguageCode: English (U.S.)
LegalCopyright: Microsoft Corporation. All rights reserved.
LinkerVersion: 9.0
MIMEType: application/octet-stream
MachineType: Intel 386 or later, and compatibles
OSVersion: 6.1
ObjectFileType: Dynamic link library
OriginalFilename: Wmiprvse.exe
PEType: PE32
ProductName: Microsoft Windows Operating System
ProductVersion: 6.1.7600.16385
ProductVersionNumber: 6.1.7600.16385
Subsystem: Windows GUI
SubsystemVersion: 6.1
TimeStamp: 2009:07:14 01:30:34+02:00
UninitializedDataSize: 0
Symantec reputation:Suspicious.Insight


po usunięciu przy pomocy skryptu:

Kod:
All processes killed
========== PROCESSES ==========
No active process named :Files was found!
Process PING.EXE killed successfully!
No active process named :OTL was found!
No active process named Run: []File not found was found!
No active process named O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (/pagefile) -File not found was found!
No active process named Temp:0B4227B4 was found!
No active process named Temp:0B4227B4 was found!
No active process named :Commands was found!
No active process named [EMPTYTEMP] was found!
No active process named [EMPTYFLASH] was found!

OTL by OldTimer - Version 3.2.31.0 log created on 10172011_161557

Files\Folders moved on Reboot...

Registry entries deleted on Reboot..


Dodano: 18 paź 2011 17:14

OTL.Txt

Kod:
OTL logfile created on: 2011-10-17 16:29:26 - Run 4
OTL by OldTimer - Version 3.2.31.0 Folder = D:\Download
64bit- Home Premium Edition(Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

5,91 Gb Total Physical Memory | 4,54 Gb Available Physical Memory | 76,90% Memory free
11,82 Gb Paging File | 10,37 Gb Available in Paging File | 87,80% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 39,07 Gb Total Space | 10,93 Gb Free Space | 27,98% Space Free | Partition Type: NTFS
Drive D: | 542,36 Gb Total Space | 541,90 Gb Free Space | 99,92% Space Free | Partition Type: NTFS

Computer Name: KOMPUTER | User Name: by JS | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2011-10-18 16:02:24 | 000,584,192 | ---- | M] (OldTimer Tools) -- D:\Download\OTL.exe
PRC - [2011-09-23 06:31:50 | 002,404,704 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgtray.exe
PRC - [2011-09-12 06:23:46 | 005,265,248 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe
PRC - [2011-09-06 19:29:20 | 004,259,648 | ---- | M] (SoftThinks - Dell) -- C:\Program Files (x86)\Dell DataSafe Local Backup\TOASTER.EXE
PRC - [2011-08-19 06:24:14 | 002,399,560 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgfws.exe
PRC - [2011-08-18 17:05:54 | 002,751,808 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
PRC - [2011-08-18 17:05:46 | 001,692,480 | ---- | M] (SoftThinks SAS) -- C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE
PRC - [2011-08-02 06:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe
PRC - [2011-08-01 19:56:48 | 000,460,096 | ---- | M] (SoftThinks - Dell) -- C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpd.exe
PRC - [2011-05-27 15:58:48 | 000,793,416 | ---- | M] (AVG) -- C:\Program Files (x86)\AVG\AVG PC Tuneup 2011\BoostSpeed.exe
PRC - [2010-11-30 04:04:00 | 001,997,416 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
PRC - [2010-11-29 11:31:42 | 000,378,472 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2010-11-03 19:01:34 | 000,983,104 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
PRC - [2010-11-03 18:53:28 | 000,897,088 | ---- | M] (Intel Corporation) -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
PRC - [2009-07-14 03:14:28 | 000,015,360 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\SysWOW64\PING.EXE


[color=#E56717]========== Modules (No Company Name) ==========[/color]

MOD - [2011-08-18 17:05:54 | 002,751,808 | ---- | M] () -- C:\Program Files (x86)\Dell DataSafe Local Backup\COMPONENTS\SCHEDULER\STSERVICE.EXE
MOD - [2011-05-25 10:53:14 | 000,350,024 | ---- | M] () -- C:\Program Files (x86)\AVG\AVG PC Tuneup 2011\madExcept_.bpl
MOD - [2011-05-25 10:53:12 | 000,184,136 | ---- | M] () -- C:\Program Files (x86)\AVG\AVG PC Tuneup 2011\madBasic_.bpl
MOD - [2011-05-25 10:53:12 | 000,050,504 | ---- | M] () -- C:\Program Files (x86)\AVG\AVG PC Tuneup 2011\madDisAsm_.bpl
MOD - [2011-05-17 11:01:34 | 000,311,296 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_pl_b77a5c561934e089\mscorlib.resources.dll
MOD - [2011-05-17 08:52:54 | 002,295,296 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\b1a619266964bede98b18ef83eb1c559\System.Core.ni.dll
MOD - [2011-03-21 05:30:24 | 000,224,768 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\ad29de17e87b1cefbfcf8a3dd41e0b5c\PresentationFramework.Classic.ni.dll
MOD - [2011-03-21 05:29:59 | 014,318,592 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\eb5ff7b60b69cc300751f46c6af316ad\PresentationFramework.ni.dll
MOD - [2011-03-21 05:29:43 | 012,430,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\f92c882fd4e7005c005e208daa04c28d\System.Windows.Forms.ni.dll
MOD - [2011-03-21 05:29:35 | 001,586,688 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\fdeec42fa02f3d789c42be2e33b130eb\System.Drawing.ni.dll
MOD - [2011-03-21 05:29:29 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\3060dfcdecbeb8ee65077fb29b217c3d\System.Xml.ni.dll
MOD - [2011-03-21 05:29:25 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\4be2653d1c9804d2ff6e6b66d22764e1\System.Configuration.ni.dll
MOD - [2011-03-21 05:29:23 | 012,216,320 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\a937151be4e65fd89c55b4c603f7d902\PresentationCore.ni.dll
MOD - [2011-03-21 05:23:36 | 003,313,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\d80659eacd9554d9606881b0d35835cf\WindowsBase.ni.dll
MOD - [2011-03-21 05:23:34 | 007,949,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\500ddd904b1099f95552a81b54223b7f\System.ni.dll
MOD - [2011-03-21 05:23:28 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\f58ab951b57c8526430486dcf7ee38fd\mscorlib.ni.dll


[color=#E56717]========== Win32 Services (SafeList) ==========[/color]

SRV:[b]64bit:[/b] - [2011-01-25 11:57:18 | 000,296,448 | ---- | M] (IDT, Inc.) [Auto | Running] -- C:\Program Files\IDT\WDM\stacsv64.exe -- (STacSV)
SRV:[b]64bit:[/b] - [2010-12-17 21:41:32 | 001,515,792 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Intel\WiFi\bin\EvtEng.exe -- (EvtEng)
SRV:[b]64bit:[/b] - [2010-12-17 21:28:46 | 000,340,240 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe -- (MyWiFiDHCPDNS)
SRV:[b]64bit:[/b] - [2010-12-17 21:26:50 | 000,836,880 | ---- | M] (Intel(R) Corporation) [Auto | Running] -- C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe -- (RegSrvc)
SRV:[b]64bit:[/b] - [2010-11-29 22:00:56 | 000,149,504 | ---- | M] (Intel(R) Corporation) [On_Demand | Stopped] -- C:\Program Files\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost)
SRV:[b]64bit:[/b] - [2010-09-23 01:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:[b]64bit:[/b] - [2009-07-14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV:[b]64bit:[/b] - [2009-03-03 12:42:58 | 000,089,600 | ---- | M] (Andrea Electronics Corporation) [Auto | Running] -- C:\Program Files\IDT\WDM\AESTSr64.exe -- (AESTFilters)
SRV - [2011-09-12 06:23:46 | 005,265,248 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\AVGIDSAgent.exe -- (AVGIDSAgent)
SRV - [2011-08-19 06:24:14 | 002,399,560 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\avgfws.exe -- (avgfws)
SRV - [2011-08-18 17:05:46 | 001,692,480 | ---- | M] (SoftThinks SAS) [Auto | Running] -- C:\Program Files (x86)\Dell DataSafe Local Backup\sftservice.EXE -- (SftService)
SRV - [2011-08-02 06:09:08 | 000,192,776 | ---- | M] (AVG Technologies CZ, s.r.o.) [Auto | Running] -- C:\Program Files (x86)\AVG\AVG2012\avgwdsvc.exe -- (avgwd)
SRV - [2010-11-30 04:04:00 | 001,997,416 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2010-11-29 11:31:42 | 000,378,472 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2010-11-25 12:34:18 | 000,219,632 | ---- | M] (Sonic Solutions) [Auto | Stopped] -- c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatch12OEM.exe -- (RoxWatch12)
SRV - [2010-11-25 12:33:18 | 001,116,656 | ---- | M] (Sonic Solutions) [On_Demand | Stopped] -- c:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxMediaDB12OEM.exe -- (RoxMediaDB12OEM)
SRV - [2010-11-06 06:54:22 | 000,013,336 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2010-11-03 19:01:34 | 000,983,104 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe -- (Bluetooth OBEX Service)
SRV - [2010-11-03 19:01:20 | 001,298,496 | ---- | M] (Intel Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe -- (Bluetooth Media Service)
SRV - [2010-11-03 18:53:28 | 000,897,088 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe -- (Bluetooth Device Monitor)
SRV - [2010-10-06 04:04:12 | 002,655,768 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2010-10-06 04:04:08 | 000,325,656 | ---- | M] (Intel Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2009-06-10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)


[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV:[b]64bit:[/b] - [2011-09-13 06:30:08 | 000,037,456 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | Boot | Running] -- C:\WINDOWS\SysNative\drivers\avgrkx64.sys -- (Avgrkx64)
DRV:[b]64bit:[/b] - [2011-08-08 06:08:58 | 000,046,672 | ---- | M] (AVG Technologies CZ, s.r.o.) [File_System | System | Running] -- C:\WINDOWS\SysNative\drivers\avgmfx64.sys -- (Avgmfx64)
DRV:[b]64bit:[/b] - [2011-07-11 01:14:36 | 000,375,376 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\SysNative\drivers\avgtdia.sys -- (Avgtdia)
DRV:[b]64bit:[/b] - [2011-07-11 01:14:08 | 000,029,776 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\AVGIDSFilter.sys -- (AVGIDSFilter)
DRV:[b]64bit:[/b] - [2011-07-11 01:14:06 | 000,120,400 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\AVGIDSDriver.sys -- (AVGIDSDriver)
DRV:[b]64bit:[/b] - [2011-07-11 01:14:06 | 000,026,704 | ---- | M] (AVG Technologies CZ, s.r.o. ) [Kernel | Boot | Running] -- C:\WINDOWS\SysNative\drivers\AVGIDSEH.sys -- (AVGIDSEH)
DRV:[b]64bit:[/b] - [2011-07-11 01:13:44 | 000,282,704 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\SysNative\drivers\avgldx64.sys -- (Avgldx64)
DRV:[b]64bit:[/b] - [2011-05-23 01:03:28 | 000,048,992 | ---- | M] (AVG Technologies CZ, s.r.o.) [Kernel | System | Running] -- C:\WINDOWS\SysNative\drivers\avgfwd6a.sys -- (Avgfwfd)
DRV:[b]64bit:[/b] - [2011-01-25 11:57:18 | 000,520,192 | ---- | M] (IDT, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\stwrt64.sys -- (STHDA)
DRV:[b]64bit:[/b] - [2011-01-08 03:42:34 | 012,262,688 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:[b]64bit:[/b] - [2010-12-21 16:08:48 | 008,505,856 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\NETwNs64.sys -- (NETwNs64) ___ Sterownik karty Intel(R)
DRV:[b]64bit:[/b] - [2010-12-10 23:50:36 | 000,181,248 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:[b]64bit:[/b] - [2010-12-10 23:50:36 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:[b]64bit:[/b] - [2010-12-04 00:32:24 | 000,316,024 | ---- | M] (Alps Electric Co., Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\Apfiltr.sys -- (ApfiltrService)
DRV:[b]64bit:[/b] - [2010-12-01 12:02:22 | 000,042,392 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\WDKMD.sys -- (wdkmd)
DRV:[b]64bit:[/b] - [2010-11-30 04:04:00 | 000,025,576 | ---- | M] (NVIDIA Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\SysNative\drivers\nvpciflt.sys -- (nvpciflt)
DRV:[b]64bit:[/b] - [2010-11-29 22:00:04 | 000,016,120 | ---- | M] (Intel(R) Corporation) [Kernel | Auto | Running] -- C:\WINDOWS\SysNative\drivers\TurboB.sys -- (TurboB)
DRV:[b]64bit:[/b] - [2010-11-12 14:40:50 | 000,155,752 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:[b]64bit:[/b] - [2010-11-07 01:45:48 | 000,438,808 | ---- | M] (Intel Corporation) [Kernel | Boot | Running] -- C:\WINDOWS\SysNative\drivers\iaStor.sys -- (iaStor)
DRV:[b]64bit:[/b] - [2010-11-04 12:07:06 | 000,058,128 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\btmaux.sys -- (btmaux)
DRV:[b]64bit:[/b] - [2010-11-04 10:31:44 | 000,059,904 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\iBtFltCoex.sys -- (iBtFltCoex)
DRV:[b]64bit:[/b] - [2010-10-30 02:11:42 | 000,250,984 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\RtsUStor.sys -- (RSUSBSTOR)
DRV:[b]64bit:[/b] - [2010-10-26 21:08:08 | 000,406,632 | ---- | M] (Realtek) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:[b]64bit:[/b] - [2010-10-20 01:12:58 | 000,274,432 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\btmhsf.sys -- (btmhsf)
DRV:[b]64bit:[/b] - [2010-09-21 16:59:38 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\HECIx64.sys -- (MEIx64) Intel(R)
DRV:[b]64bit:[/b] - [2010-08-12 17:51:30 | 000,175,168 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Running] -- C:\WINDOWS\SysNative\drivers\CtClsFlt.sys -- (CtClsFlt)
DRV:[b]64bit:[/b] - [2010-05-12 10:37:32 | 000,107,912 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:[b]64bit:[/b] - [2010-05-12 10:37:32 | 000,027,016 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\WINDOWS\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:[b]64bit:[/b] - [2010-03-19 10:00:00 | 000,055,856 | ---- | M] (Sonic Solutions) [Kernel | Boot | Running] -- C:\WINDOWS\SysNative\drivers\PxHlpa64.sys -- (PxHlpa64)
DRV:[b]64bit:[/b] - [2009-07-14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:[b]64bit:[/b] - [2009-07-14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:[b]64bit:[/b] - [2009-07-14 03:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:[b]64bit:[/b] - [2009-07-14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:[b]64bit:[/b] - [2009-06-10 22:35:33 | 000,389,120 | ---- | M] (Marvell) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\yk62x64.sys -- (yukonw7)
DRV:[b]64bit:[/b] - [2009-06-10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:[b]64bit:[/b] - [2009-06-10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:[b]64bit:[/b] - [2009-06-10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:[b]64bit:[/b] - [2009-06-10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:[b]64bit:[/b] - [2006-11-01 19:51:00 | 000,151,656 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\SysNative\drivers\WimFltr.sys -- (WimFltr)
DRV - [2009-07-14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\WINDOWS\SysWOW64\drivers\wimmount.sys -- (WIMMount)


[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-2175222819-2116247590-1290357179-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2175222819-2116247590-1290357179-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/
IE - HKU\S-1-5-21-2175222819-2116247590-1290357179-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..browser.startup.homepage: "http://www.google.pl/"

FF:[b]64bit:[/b] - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{1E73965B-8B48-48be-9C8D-68B920ABC1C4}: C:\Program Files (x86)\AVG\AVG2012\Firefox4\ [2011-10-16 22:37:28 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2011-10-16 23:32:09 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins

[2011-10-16 23:32:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\by JS\AppData\Roaming\mozilla\Extensions
[2011-10-16 23:32:24 | 000,000,000 | ---D | M] (No name found) -- C:\Users\by JS\AppData\Roaming\mozilla\Firefox\Profiles\16v685bp.default\extensions
[2011-10-16 23:32:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2011-10-16 23:32:09 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\distribution\extensions
() (No name found) -- C:\USERS\BY JS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\16V685BP.DEFAULT\EXTENSIONS\[email protected]
[2011-10-12 09:23:02 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011-10-12 07:56:37 | 000,002,767 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\allegro-pl.xml
[2011-10-12 07:56:37 | 000,001,406 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\fbc-pl.xml
[2011-10-12 07:56:37 | 000,000,917 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\merlin-pl.xml
[2011-10-12 07:56:37 | 000,000,858 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\pwn-pl.xml
[2011-10-12 07:56:37 | 000,001,183 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-pl.xml
[2011-10-12 07:56:37 | 000,001,683 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wp-pl.xml

Hosts file not found
O2:[b]64bit:[/b] - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssiea.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files (x86)\AVG\AVG2012\avgssie.dll (AVG Technologies CZ, s.r.o.)
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O4 - HKLM..\Run: []File not found
O4 - HKLM..\Run: [AVG_TRAY] C:\Program Files (x86)\AVG\AVG2012\avgtray.exe (AVG Technologies CZ, s.r.o.)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2175222819-2116247590-1290357179-1000..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-2175222819-2116247590-1290357179-1000..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-2175222819-2116247590-1290357179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2175222819-2116247590-1290357179-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255
O8:[b]64bit:[/b] - Extra context menu item: Search the Web - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html File not found
O8 - Extra context menu item: Search the Web - C:\Program Files (x86)\SweetIM\Toolbars\Internet Explorer\resources\menuext.html File not found
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra ''Tools'' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O13[b]64bit:[/b] - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 62.179.1.62 62.179.1.63
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CD88BCA0-31A9-4CEA-A630-ABD46D0CF31A}: DhcpNameServer = 62.179.1.62 62.179.1.63
O18:[b]64bit:[/b] - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgppa.dll (AVG Technologies CZ, s.r.o.)
O18:[b]64bit:[/b] - Protocol\Handler\livecall - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\msnim - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\skype4com - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\wlmailhtml - No CLSID value found
O18:[b]64bit:[/b] - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files (x86)\AVG\AVG2012\avgpp.dll (AVG Technologies CZ, s.r.o.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:[b]64bit:[/b] - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\WINDOWS\SysNative\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) -C:\WINDOWS\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\WINDOWS\SysNative\userinit.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:[b]64bit:[/b] - HKLM Winlogon: VMApplet - (/pagefile) -File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) -C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20:[b]64bit:[/b] - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)
O21:[b]64bit:[/b] - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (C:\PROGRA~2\AVG\AVG2012\avgrsa.exe /sync /restart)
O35:[b]64bit:[/b] - HKLM\..comfile [open] -- "%1" %*
O35:[b]64bit:[/b] - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...com [@ = comfile] -- "%1" %*
O37:[b]64bit:[/b] - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2011-10-19 00:05:36 | 000,000,000 | -HSD | C] -- C:\System Volume Information
[2011-10-18 23:34:55 | 000,000,000 | ---D | C] -- C:\Windows\SMINST
[2011-10-17 08:15:08 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Local\FlickrNet
[2011-10-17 08:14:37 | 000,000,000 | ---D | C] -- C:\ProgramData\ArcSoft
[2011-10-17 08:14:29 | 000,841,280 | ---- | C] (ArcSoft, Inc.) -- C:\Windows\SysNative\PhotoStageScrSaver.scr
[2011-10-17 08:01:28 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Local\Downloaded Installations
[2011-10-17 07:56:25 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Local\ArcSoft
[2011-10-17 07:50:06 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Fingertapps
[2011-10-17 07:50:06 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Fingertapps
[2011-10-17 02:57:32 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Local\Powercinema
[2011-10-17 02:57:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cyberlink
[2011-10-17 02:56:39 | 000,000,000 | ---D | C] -- C:\ProgramData\install_clap
[2011-10-17 02:53:05 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\CyberLink
[2011-10-17 02:53:05 | 000,000,000 | ---D | C] -- C:\ProgramData\CyberLink
[2011-10-17 02:42:41 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Local\Dell
[2011-10-17 02:41:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Dell Touch Software Suite
[2011-10-16 23:32:14 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Mozilla
[2011-10-16 23:32:14 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Local\Mozilla
[2011-10-16 23:32:09 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2011-10-16 23:21:27 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
[2011-10-16 23:21:27 | 000,000,000 | ---D | C] -- C:\Program Files\7-Zip
[2011-10-16 23:08:02 | 000,000,000 | ---D | C] -- C:\Users\by JS\Tracing
[2011-10-16 22:59:53 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Macromedia
[2011-10-16 22:59:50 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Adobe
[2011-10-16 22:57:53 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2011-10-16 22:47:10 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\AVG
[2011-10-16 22:43:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG PC Tuneup 2011
[2011-10-16 22:37:38 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\AVG2012
[2011-10-16 22:37:33 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files
[2011-10-16 22:37:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG 2012
[2011-10-16 22:37:27 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\drivers\AVG
[2011-10-16 22:37:17 | 000,000,000 | ---D | C] -- C:\ProgramData\AVG2012
[2011-10-16 22:37:17 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\drivers\AVG
[2011-10-16 22:37:10 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AVG
[2011-10-16 22:34:23 | 000,000,000 | ---D | C] -- C:\ProgramData\MFAData
[2011-10-16 21:41:50 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Intel Corporation
[2011-10-16 21:41:38 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Dell
[2011-10-16 21:41:32 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Roxio
[2011-10-16 21:41:26 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Dell Touch Zone
[2011-10-16 21:41:26 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Creative
[2011-10-16 21:41:24 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Leadertech
[2011-10-16 21:40:54 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Identities
[2011-10-16 21:40:52 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2011-10-16 21:40:40 | 000,000,000 | R--D | C] -- C:\Users\by JS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup
[2011-10-16 21:40:40 | 000,000,000 | R--D | C] -- C:\Users\by JS\Searches
[2011-10-16 21:40:40 | 000,000,000 | R--D | C] -- C:\Users\by JS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools
[2011-10-16 21:40:38 | 000,000,000 | R--D | C] -- C:\Users\by JS\Contacts
[2011-10-16 21:37:42 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Local\SoftThinks
[2011-10-16 21:35:32 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Local\VirtualStore
[2011-10-16 21:35:31 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Intel
[2011-10-16 21:35:29 | 000,000,000 | --SD | C] -- C:\Users\by JS\AppData\Roaming\Microsoft
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\Videos
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\Saved Games
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\Pictures
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\Music
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\Links
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\Favorites
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\Downloads
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\Documents
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\Desktop
[2011-10-16 21:35:29 | 000,000,000 | R--D | C] -- C:\Users\by JS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\Ustawienia lokalne
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\AppData\Local\Temporary Internet Files
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\Szablony
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\SendTo
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\Recent
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\PrintHood
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\NetHood
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\Documents\Moje wideo
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\Documents\Moje obrazy
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\Moje dokumenty
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\Documents\Moja muzyka
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\Menu Start
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\AppData\Local\Historia
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\Dane aplikacji
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\AppData\Local\Dane aplikacji
[2011-10-16 21:35:29 | 000,000,000 | -HSD | C] -- C:\Users\by JS\Cookies
[2011-10-16 21:35:29 | 000,000,000 | -H-D | C] -- C:\Users\by JS\AppData
[2011-10-16 21:35:29 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Local\Temp
[2011-10-16 21:35:29 | 000,000,000 | ---D | C] -- C:\Users\by JS\Roaming
[2011-10-16 21:35:29 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Local\Microsoft
[2011-10-16 21:35:29 | 000,000,000 | ---D | C] -- C:\Users\by JS\AppData\Roaming\Media Center Programs
[2011-10-16 21:35:22 | 000,000,000 | -HSD | C] -- C:\ProgramData\Ulubione
[2011-10-16 21:35:22 | 000,000,000 | -HSD | C] -- C:\ProgramData\Szablony
[2011-10-16 21:35:22 | 000,000,000 | -HSD | C] -- C:\ProgramData\Pulpit
[2011-10-16 21:35:22 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Moje wideo
[2011-10-16 21:35:22 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Moje obrazy
[2011-10-16 21:35:22 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Moja muzyka
[2011-10-16 21:35:22 | 000,000,000 | -HSD | C] -- C:\ProgramData\Menu Start
[2011-10-16 21:35:22 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumenty
[2011-10-16 21:35:22 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dane aplikacji

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2011-10-19 04:34:54 | 000,064,519 | ---- | M] () -- C:\Windows\SysWow64\license.rtf
[2011-10-19 04:34:54 | 000,064,519 | ---- | M] () -- C:\Windows\SysNative\license.rtf
[2011-10-17 16:28:26 | 001,048,576 | ---- | M] () -- C:\Users\by JS\NTUSER.DAT
[2011-10-17 16:27:51 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT
[2011-10-17 16:27:35 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011-10-17 16:27:29 | 463,867,903 | -HS- | M] () -- C:\hiberfil.sys
[2011-10-17 16:24:17 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2011-10-17 16:24:17 | 000,013,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2011-10-17 16:24:14 | 001,523,412 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2011-10-17 16:24:14 | 000,687,828 | ---- | M] () -- C:\Windows\SysNative\perfh015.dat
[2011-10-17 16:24:14 | 000,607,190 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2011-10-17 16:24:14 | 000,131,382 | ---- | M] () -- C:\Windows\SysNative\perfc015.dat
[2011-10-17 16:24:14 | 000,103,568 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2011-10-17 13:25:28 | 106,811,154 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\incavi.avm
[2011-10-16 22:42:15 | 000,662,551 | ---- | M] () -- C:\Windows\SysNative\drivers\AVG\iavifw.avm
[2011-10-16 22:37:27 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\drivers\AVG\incavi.avm
[2011-10-16 22:37:27 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\drivers\AVG\iavifw.avm
[2011-10-16 22:37:27 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\drivers\AVG\iavichjw.avm
[2011-10-16 21:37:50 | 000,524,288 | -HS- | M] () -- C:\Users\by JS\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2011-10-16 21:37:50 | 000,524,288 | -HS- | M] () -- C:\Users\by JS\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2011-10-16 21:37:50 | 000,065,536 | -HS- | M] () -- C:\Users\by JS\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2011-10-16 21:35:40 | 000,074,400 | ---- | M] () -- C:\Users\by JS\AppData\Local\GDIPFONTCACHEV1.DAT
[2011-10-16 21:35:29 | 000,000,020 | -HS- | M] () -- C:\Users\by JS\ntuser.ini

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2011-10-19 00:05:26 | 463,867,903 | -HS- | C] () -- C:\hiberfil.sys
[2011-10-17 13:25:28 | 106,811,154 | ---- | C] () -- C:\Windows\SysNative\drivers\AVG\incavi.avm
[2011-10-16 23:32:11 | 000,001,165 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011-10-16 22:42:15 | 000,662,551 | ---- | C] () -- C:\Windows\SysNative\drivers\AVG\iavifw.avm
[2011-10-16 22:37:27 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\drivers\AVG\incavi.avm
[2011-10-16 22:37:27 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\drivers\AVG\iavifw.avm
[2011-10-16 22:37:27 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\drivers\AVG\iavichjw.avm
[2011-10-16 21:41:04 | 000,001,423 | ---- | C] () -- C:\Users\by JS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer (64-bit).lnk
[2011-10-16 21:40:46 | 000,001,457 | ---- | C] () -- C:\Users\by JS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
[2011-10-16 21:36:24 | 000,001,979 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Dokumentacja pomocy firmy Dell.lnk
[2011-10-16 21:35:40 | 000,074,400 | ---- | C] () -- C:\Users\by JS\AppData\Local\GDIPFONTCACHEV1.DAT
[2011-10-16 21:35:29 | 001,048,576 | ---- | C] () -- C:\Users\by JS\NTUSER.DAT
[2011-10-16 21:35:29 | 000,524,288 | -HS- | C] () -- C:\Users\by JS\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000002.regtrans-ms
[2011-10-16 21:35:29 | 000,524,288 | -HS- | C] () -- C:\Users\by JS\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TMContainer00000000000000000001.regtrans-ms
[2011-10-16 21:35:29 | 000,065,536 | -HS- | C] () -- C:\Users\by JS\NTUSER.DAT{016888bd-6c6f-11de-8d1d-001e0bcde3ec}.TM.blf
[2011-10-16 21:35:29 | 000,000,020 | -HS- | C] () -- C:\Users\by JS\ntuser.ini
[2011-05-17 10:45:23 | 000,017,776 | ---- | C] () -- C:\Windows\EvtMessage.dll
[2011-05-17 10:43:53 | 000,960,940 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin
[2011-05-17 10:43:52 | 000,207,376 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin
[2011-05-17 10:43:52 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin
[2011-05-17 10:43:14 | 000,000,096 | ---- | C] () -- C:\Windows\LaunApp.ini
[2011-05-17 10:43:10 | 000,000,035 | ---- | C] () -- C:\Windows\DELL_LANGCODE.ini
[2011-05-17 10:43:10 | 000,000,033 | ---- | C] () -- C:\Windows\DELL_OSTYPE.ini
[2011-05-17 10:43:10 | 000,000,032 | ---- | C] () -- C:\Windows\WisHWDest.ini
[2011-05-17 10:43:10 | 000,000,023 | ---- | C] () -- C:\Windows\WisSysInfo.ini
[2011-05-17 10:43:09 | 000,000,271 | ---- | C] () -- C:\Windows\WisPriority.ini
[2011-05-17 10:43:09 | 000,000,028 | ---- | C] () -- C:\Windows\WisLangCode.ini
[2011-05-17 08:25:33 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll
[2011-03-21 04:49:03 | 000,000,324 | ---- | C] () -- C:\Windows\Prelaunch.ini
[2009-07-14 07:38:36 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009-07-14 04:35:51 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT
[2009-07-14 04:35:42 | 000,001,405 | ---- | C] () -- C:\Windows\msdfmap.ini
[2009-07-14 04:34:57 | 000,000,435 | ---- | C] () -- C:\Windows\win.ini
[2009-07-14 04:34:57 | 000,000,219 | ---- | C] () -- C:\Windows\system.ini
[2009-07-14 04:34:42 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat
[2009-07-14 02:10:29 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009-07-14 01:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\BWContextHandler.dll
[2009-07-13 23:59:36 | 000,982,196 | ---- | C] () -- C:\Windows\SysWow64\igkrng500.bin
[2009-07-13 23:59:36 | 000,139,824 | ---- | C] () -- C:\Windows\SysWow64\igfcg500.bin
[2009-07-13 23:59:36 | 000,097,448 | ---- | C] () -- C:\Windows\SysWow64\igfcg500m.bin
[2009-07-13 23:59:35 | 000,417,344 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng500.bin
[2009-07-13 23:03:59 | 000,364,544 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2009-06-10 23:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat

[color=#E56717]========== LOP Check ==========[/color]

[2011-10-17 01:04:17 | 000,000,000 | ---D | M] -- C:\Users\by JS\AppData\Roaming\AVG
[2011-10-16 22:37:38 | 000,000,000 | ---D | M] -- C:\Users\by JS\AppData\Roaming\AVG2012
[2011-10-17 07:50:06 | 000,000,000 | ---D | M] -- C:\Users\by JS\AppData\Roaming\Fingertapps
[2011-10-16 21:41:24 | 000,000,000 | ---D | M] -- C:\Users\by JS\AppData\Roaming\Leadertech
[2009-07-14 07:08:49 | 000,013,024 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT

[color=#E56717]========== Purity Check ==========[/color]



[color=#E56717]========== Alternate Data Streams ==========[/color]

@Alternate Data Stream - 206 bytes -> C:\ProgramData\Temp:0B4227B4

< End of report >


Dodano: 18 paź 2011 19:14

preter_m napisał(a):Jeżeli proces PING.EXE obciąża komputer to na 99% jest to malware. Przeskanuj kompa Emsisoft Emergency Kit, MBAM i Hitman Pro. Któryś z nich powinien wykryć zagrożenie i je usunąć.


Hitman Pro wykrył
Komunikat:
Wykryto możliwy wariant Rootkita TDL3 (aka Alureon)
Device stack dysku twardego odnosi się do ukrytego sterownika. Może to wpłynąć na wykrywanie szkodliwych plików.

Master Boot Record (Sector 0) Bootkitc:$MBR

Zawiera cechy jako zagrożenie bezpieczeństwa Win32/Bootkit

shinjiru

18.10.2011, 18:24
ej, a ten cały PING.exe jest ogólnie bezpieczny?

amator72

18.10.2011, 18:34
ustawiony priorytet na : bezpieczny

Flash999

18.10.2011, 18:39
Od czego Wy zaczynacie? Przecież tu jest Alureon! Użyj

[Aby zobaczyć linki, zarejestruj się tutaj]

. Przy wykryciu Rootkita TDL wybierz Cure. To go usunie. Po tym czas na kolejne działania.

amator72

18.10.2011, 19:49
Flash999 napisał(a):Od czego Wy zaczynacie? Przecież tu jest Alureon! Użyj

[Aby zobaczyć linki, zarejestruj się tutaj]

. Przy wykryciu Rootkita TDL wybierz Cure. To go usunie. Po tym czas na kolejne działania.



Właśnie tak zrobiłem i go usunął po naciśnięciu Cure.
Nie wiem gdzie zapisał się ten raport - bo nastąpił restart systemu.
zrobiłem 2 skan aby sprawdzić i oto wynik jest ok.
Proszę o dalsze info....dzięki!

Dodano: 18 paź 2011 20:49

odnalazłem te raporty ( ale byłem ślepy!)
Kod:
19:40:56.0591 1376    TDSS rootkit removing tool 2.6.10.0 Oct 17 2011 15:43:23
19:40:57.0545 1376    ============================================================
19:40:57.0545 1376    Current date / time: 2011/10/17 19:40:57.0545
19:40:57.0545 1376    SystemInfo:
19:40:57.0545 1376    
19:40:57.0545 1376    OS Version: 6.1.7600 ServicePack: 0.0
19:40:57.0545 1376    Product type: Workstation
19:40:57.0545 1376    ComputerName: KOMPUTER
19:40:57.0545 1376    UserName: by JS
19:40:57.0545 1376    Windows directory: C:\Windows
19:40:57.0545 1376    System windows directory: C:\Windows
19:40:57.0545 1376    Running under WOW64
19:40:57.0545 1376    Processor architecture: Intel x64
19:40:57.0545 1376    Number of processors: 8
19:40:57.0545 1376    Page size: 0x1000
19:40:57.0546 1376    Boot type: Normal boot
19:40:57.0546 1376    ============================================================
19:40:57.0937 1376    Initialize success
19:41:02.0890 0404    ============================================================
19:41:02.0890 0404    Scan started
19:41:02.0890 0404    Mode: Manual;
19:41:02.0891 0404    ============================================================
19:41:03.0751 0404    1394ohci(969c91060cbb5d17cb8440b5f78b4c51) C:\Windows\system32\DRIVERS\1394ohci.sys
19:41:03.0753 0404    1394ohci - ok
19:41:04.0319 0404    ACPI(794ff35015209b9d44f1360c42c9776d) C:\Windows\system32\DRIVERS\ACPI.sys
19:41:04.0325 0404    ACPI - ok
19:41:04.0804 0404    AcpiPmi (63b05a0420ce4bf0e4af6dcc7cada254) C:\Windows\system32\DRIVERS\acpipmi.sys
19:41:04.0805 0404    AcpiPmi - ok
19:41:05.0402 0404    adp94xx (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
19:41:05.0411 0404    adp94xx - ok
19:41:05.0976 0404    adpahci (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
19:41:05.0983 0404    adpahci - ok
19:41:06.0546 0404    adpu320 (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
19:41:06.0550 0404    adpu320 - ok
19:41:07.0152 0404    AFD (b9384e03479d2506bc924c16a3db87bc) C:\Windows\system32\drivers\afd.sys
19:41:07.0160 0404    AFD - ok
19:41:07.0605 0404    agp440(608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\DRIVERS\agp440.sys
19:41:07.0608 0404    agp440 - ok
19:41:08.0083 0404    aliide(5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\DRIVERS\aliide.sys
19:41:08.0085 0404    aliide - ok
19:41:08.0584 0404    amdide(1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\DRIVERS\amdide.sys
19:41:08.0585 0404    amdide - ok
19:41:09.0285 0404    AmdK8 (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
19:41:09.0289 0404    AmdK8 - ok
19:41:10.0054 0404    AmdPPM(1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
19:41:10.0057 0404    AmdPPM - ok
19:41:10.0135 0404    amdsata (ab3166c09438a161fbde13099a72e0af) C:\Windows\system32\DRIVERS\amdsata.sys
19:41:10.0137 0404    amdsata - ok
19:41:10.0208 0404    amdsbs(f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
19:41:10.0212 0404    amdsbs - ok
19:41:10.0248 0404    amdxata (5118dcd2065d8c8d752ad5ec0b2d6aa6) C:\Windows\system32\DRIVERS\amdxata.sys
19:41:10.0250 0404    amdxata - ok
19:41:10.0751 0404    ApfiltrService(7380b9072ebc65a54da3074e14bf34b9) C:\Windows\system32\DRIVERS\Apfiltr.sys
19:41:10.0757 0404    ApfiltrService - ok
19:41:11.0251 0404    AppID (42fd751b27fa0e9c69bb39f39e409594) C:\Windows\system32\drivers\appid.sys
19:41:11.0254 0404    AppID - ok
19:41:11.0753 0404    arc (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
19:41:11.0756 0404    arc - ok
19:41:12.0000 0404    arcsas(019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
19:41:12.0003 0404    arcsas - ok
19:41:12.0467 0404    AsyncMac(769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
19:41:12.0470 0404    AsyncMac - ok
19:41:12.0700 0404    atapi (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\DRIVERS\atapi.sys
19:41:12.0702 0404    atapi - ok
19:41:13.0189 0404    Avgfwfd (96b4456f1dca4eda506ed31c7d2d6b05) C:\Windows\system32\DRIVERS\avgfwd6a.sys
19:41:13.0191 0404    Avgfwfd - ok
19:41:13.0363 0404    AVGIDSDriver(e29ea1a0ec7ab9fa2dc7e75a03f12a4f) C:\Windows\system32\DRIVERS\AVGIDSDriver.Sys
19:41:13.0366 0404    AVGIDSDriver - ok
19:41:13.0834 0404    AVGIDSEH(f823d184b8e8ffb8da3ead45dbf5bd6a) C:\Windows\system32\DRIVERS\AVGIDSEH.Sys
19:41:13.0835 0404    AVGIDSEH - ok
19:41:14.0291 0404    AVGIDSFilter(ed2b25bd7fe35d1944211968842d30da) C:\Windows\system32\DRIVERS\AVGIDSFilter.Sys
19:41:14.0293 0404    AVGIDSFilter - ok
19:41:14.0803 0404    Avgldx64(dadfccfb036da99fa83e7e1d29290a6c) C:\Windows\system32\DRIVERS\avgldx64.sys
19:41:14.0809 0404    Avgldx64 - ok
19:41:15.0256 0404    Avgmfx64(36b1a5843695766eac714daffc5b84d1) C:\Windows\system32\DRIVERS\avgmfx64.sys
19:41:15.0258 0404    Avgmfx64 - ok
19:41:15.0342 0404    Avgrkx64(1102239fb724527f1febbbbccf6bf313) C:\Windows\system32\DRIVERS\avgrkx64.sys
19:41:15.0344 0404    Avgrkx64 - ok
19:41:15.0396 0404    Avgtdia (11f36d3ea82d9db9aa05a476a210551b) C:\Windows\system32\DRIVERS\avgtdia.sys
19:41:15.0403 0404    Avgtdia - ok
19:41:15.0945 0404    b06bdrv (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
19:41:15.0948 0404    b06bdrv - ok
19:41:16.0060 0404    b57nd60a(b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
19:41:16.0069 0404    b57nd60a - ok
19:41:16.0118 0404    Beep(16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
19:41:16.0122 0404    Beep - ok
19:41:16.0592 0404    blbdrive(61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
19:41:16.0595 0404    blbdrive - ok
19:41:17.0127 0404    bowser(91ce0d3dc57dd377e690a2d324022b08) C:\Windows\system32\DRIVERS\bowser.sys
19:41:17.0131 0404    bowser - ok
19:41:17.0321 0404    BrFiltLo(f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
19:41:17.0323 0404    BrFiltLo - ok
19:41:17.0343 0404    BrFiltUp(b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
19:41:17.0344 0404    BrFiltUp - ok
19:41:17.0574 0404    Brserid (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
19:41:17.0580 0404    Brserid - ok
19:41:17.0602 0404    BrSerWdm(a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
19:41:17.0605 0404    BrSerWdm - ok
19:41:17.0627 0404    BrUsbMdm(b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
19:41:17.0629 0404    BrUsbMdm - ok
19:41:17.0648 0404    BrUsbSer(a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
19:41:17.0650 0404    BrUsbSer - ok
19:41:18.0152 0404    BthEnum (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\DRIVERS\BthEnum.sys
19:41:18.0155 0404    BthEnum - ok
19:41:18.0633 0404    BTHMODEM(9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
19:41:18.0636 0404    BTHMODEM - ok
19:41:18.0826 0404    BthPan(02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys
19:41:18.0829 0404    BthPan - ok
19:41:19.0313 0404    BTHPORT (a51fa9d0e85d5adabef72e67f386309c) C:\Windows\system32\Drivers\BTHport.sys
19:41:19.0331 0404    BTHPORT - ok
19:41:19.0842 0404    BTHUSB(f740b9a16b2c06700f2130e19986bf3b) C:\Windows\system32\Drivers\BTHUSB.sys
19:41:19.0846 0404    BTHUSB - ok
19:41:20.0332 0404    btmaux(16c1bac9760c9fa85a30f3fa0fbb1b7a) C:\Windows\system32\DRIVERS\btmaux.sys
19:41:20.0334 0404    btmaux - ok
19:41:20.0805 0404    btmhsf(0c468d8da95be16bfdd380bb9de88259) C:\Windows\system32\DRIVERS\btmhsf.sys
19:41:20.0810 0404    btmhsf - ok
19:41:21.0279 0404    cdfs(b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
19:41:21.0283 0404    cdfs - ok
19:41:21.0529 0404    cdrom (83d2d75e1efb81b3450c18131443f7db) C:\Windows\system32\DRIVERS\cdrom.sys
19:41:21.0534 0404    cdrom - ok
19:41:21.0995 0404    circlass(d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
19:41:21.0997 0404    circlass - ok
19:41:22.0340 0404    CLFS(fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
19:41:22.0346 0404    CLFS - ok
19:41:22.0553 0404    CmBatt(0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
19:41:22.0556 0404    CmBatt - ok
19:41:23.0055 0404    cmdide(e19d3f095812725d88f9001985b94edd) C:\Windows\system32\DRIVERS\cmdide.sys
19:41:23.0057 0404    cmdide - ok
19:41:23.0228 0404    CNG (f95fd4cb7da00ba2a63ce9f6b5c053e1) C:\Windows\system32\Drivers\cng.sys
19:41:23.0236 0404    CNG - ok
19:41:23.0712 0404    Compbatt(102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
19:41:23.0714 0404    Compbatt - ok
19:41:24.0225 0404    CompositeBus(f26b3a86f6fa87ca360b879581ab4123) C:\Windows\system32\DRIVERS\CompositeBus.sys
19:41:24.0229 0404    CompositeBus - ok
19:41:24.0703 0404    crcdisk (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
19:41:24.0705 0404    crcdisk - ok
19:41:25.0272 0404    CtClsFlt(fbe228abeab2be13b9c3a3a112d4d8dc) C:\Windows\system32\DRIVERS\CtClsFlt.sys
19:41:25.0275 0404    CtClsFlt - ok
19:41:25.0395 0404    DfsC(3f1dc527070acb87e40afe46ef6da749) C:\Windows\system32\Drivers\dfsc.sys
19:41:25.0400 0404    DfsC - ok
19:41:25.0964 0404    discache(13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
19:41:25.0966 0404    discache - ok
19:41:26.0444 0404    Disk(9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
19:41:26.0446 0404    Disk - ok
19:41:26.0984 0404    drmkaud (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
19:41:26.0987 0404    drmkaud - ok
19:41:27.0521 0404    DXGKrnl (1633b9abf52784a1331476397a48cbef) C:\Windows\System32\drivers\dxgkrnl.sys
19:41:27.0538 0404    DXGKrnl - ok
19:41:28.0081 0404    ebdrv (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
19:41:28.0106 0404    ebdrv - ok
19:41:28.0677 0404    elxstor (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
19:41:28.0687 0404    elxstor - ok
19:41:29.0138 0404    ErrDev(34a3c54752046e79a126e15c51db409b) C:\Windows\system32\DRIVERS\errdev.sys
19:41:29.0138 0404    ErrDev - ok
19:41:29.0342 0404    exfat (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
19:41:29.0345 0404    exfat - ok
19:41:29.0782 0404    fastfat (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
19:41:29.0788 0404    fastfat - ok
19:41:30.0014 0404    fdc (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
19:41:30.0017 0404    fdc - ok
19:41:30.0427 0404    FileInfo(655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
19:41:30.0430 0404    FileInfo - ok
19:41:30.0883 0404    Filetrace (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
19:41:30.0886 0404    Filetrace - ok
19:41:31.0451 0404    flpydisk(c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
19:41:31.0453 0404    flpydisk - ok
19:41:32.0059 0404    FltMgr(f7866af72abbaf84b1fa5aa195378c59) C:\Windows\system32\drivers\fltmgr.sys
19:41:32.0065 0404    FltMgr - ok
19:41:32.0313 0404    FsDepends (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
19:41:32.0316 0404    FsDepends - ok
19:41:32.0796 0404    Fs_Rec(e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
19:41:32.0798 0404    Fs_Rec - ok
19:41:33.0009 0404    fvevol(b8b2a6e1558f8f5de5ce431c5b2c7b09) C:\Windows\system32\DRIVERS\fvevol.sys
19:41:33.0013 0404    fvevol - ok
19:41:33.0390 0404    gagp30kx(8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
19:41:33.0393 0404    gagp30kx - ok
19:41:33.0875 0404    hcw85cir(f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
19:41:33.0878 0404    hcw85cir - ok
19:41:33.0978 0404    HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys
19:41:33.0988 0404    HdAudAddService - ok
19:41:34.0434 0404    HDAudBus(0a49913402747a0b67de940fb42cbdbb) C:\Windows\system32\DRIVERS\HDAudBus.sys
19:41:34.0437 0404    HDAudBus - ok
19:41:34.0531 0404    HidBatt (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
19:41:34.0533 0404    HidBatt - ok
19:41:34.0555 0404    HidBth(7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
19:41:34.0558 0404    HidBth - ok
19:41:34.0604 0404    HidIr (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
19:41:34.0606 0404    HidIr - ok
19:41:35.0060 0404    HidUsb(b3bf6b5b50006def50b66306d99fcf6f) C:\Windows\system32\DRIVERS\hidusb.sys
19:41:35.0063 0404    HidUsb - ok
19:41:35.0206 0404    HpSAMD(0886d440058f203eba0e1825e4355914) C:\Windows\system32\DRIVERS\HpSAMD.sys
19:41:35.0207 0404    HpSAMD - ok
19:41:35.0645 0404    HTTP(cee049cac4efa7f4e1e4ad014414a5d4) C:\Windows\system32\drivers\HTTP.sys
19:41:35.0661 0404    HTTP - ok
19:41:36.0080 0404    hwpolicy(f17766a19145f111856378df337a5d79) C:\Windows\system32\drivers\hwpolicy.sys
19:41:36.0082 0404    hwpolicy - ok
19:41:36.0140 0404    i8042prt(fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\DRIVERS\i8042prt.sys
19:41:36.0144 0404    i8042prt - ok
19:41:36.0210 0404    iaStor(d7921d5a870b11cc1adab198a519d50a) C:\Windows\system32\DRIVERS\iaStor.sys
19:41:36.0212 0404    iaStor - ok
19:41:36.0710 0404    iaStorV (513dc087cfed7d2bb82f005385d3531f) C:\Windows\system32\DRIVERS\iaStorV.sys
19:41:36.0717 0404    iaStorV - ok
19:41:36.0805 0404    iBtFltCoex(fc85972037815fa7b413e790b426acb2) C:\Windows\system32\DRIVERS\iBtFltCoex.sys
19:41:36.0808 0404    iBtFltCoex - ok
19:41:37.0453 0404    igfx(78527e6a4d78b1153925914c55872beb) C:\Windows\system32\DRIVERS\igdkmd64.sys
19:41:37.0510 0404    igfx - ok
19:41:37.0944 0404    iirsp (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
19:41:37.0946 0404    iirsp - ok
19:41:38.0010 0404    intelide(f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\DRIVERS\intelide.sys
19:41:38.0012 0404    intelide - ok
19:41:38.0146 0404    intelppm(ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
19:41:38.0148 0404    intelppm - ok
19:41:38.0591 0404    IpFilterDriver(722dd294df62483cecaae6e094b4d695) C:\Windows\system32\DRIVERS\ipfltdrv.sys
19:41:38.0595 0404    IpFilterDriver - ok
19:41:39.0026 0404    IPMIDRV (e2b4a4494db7cb9b89b55ca268c337c5) C:\Windows\system32\DRIVERS\IPMIDrv.sys
19:41:39.0029 0404    IPMIDRV - ok
19:41:39.0462 0404    IPNAT (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
19:41:39.0467 0404    IPNAT - ok
19:41:39.0556 0404    IRENUM(3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
19:41:39.0559 0404    IRENUM - ok
19:41:40.0012 0404    isapnp(2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\DRIVERS\isapnp.sys
19:41:40.0014 0404    isapnp - ok
19:41:40.0458 0404    iScsiPrt(fa4d2557de56d45b0a346f93564be6e1) C:\Windows\system32\DRIVERS\msiscsi.sys
19:41:40.0463 0404    iScsiPrt - ok
19:41:40.0538 0404    kbdclass(bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
19:41:40.0540 0404    kbdclass - ok
19:41:40.0983 0404    kbdhid(6def98f8541e1b5dceb2c822a11f7323) C:\Windows\system32\DRIVERS\kbdhid.sys
19:41:40.0985 0404    kbdhid - ok
19:41:41.0423 0404    KSecDD(e8b6fcc9c83535c67f835d407620bd27) C:\Windows\system32\Drivers\ksecdd.sys
19:41:41.0426 0404    KSecDD - ok
19:41:41.0527 0404    KSecPkg (a8c63880ef6f4d3fec7b616b9c060215) C:\Windows\system32\Drivers\ksecpkg.sys
19:41:41.0531 0404    KSecPkg - ok
19:41:41.0583 0404    ksthunk (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
19:41:41.0585 0404    ksthunk - ok
19:41:42.0041 0404    lltdio(1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
19:41:42.0044 0404    lltdio - ok
19:41:42.0509 0404    LSI_FC(1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
19:41:42.0512 0404    LSI_FC - ok
19:41:42.0944 0404    LSI_SAS (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
19:41:42.0948 0404    LSI_SAS - ok
19:41:43.0012 0404    LSI_SAS2(30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
19:41:43.0015 0404    LSI_SAS2 - ok
19:41:43.0459 0404    LSI_SCSI(0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
19:41:43.0463 0404    LSI_SCSI - ok
19:41:43.0907 0404    luafv (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
19:41:43.0910 0404    luafv - ok
19:41:43.0952 0404    megasas (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
19:41:43.0954 0404    megasas - ok
19:41:44.0016 0404    MegaSR(baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
19:41:44.0022 0404    MegaSR - ok
19:41:44.0453 0404    MEIx64(1c6e73fc46b509eff9d0086aa37132df) C:\Windows\system32\DRIVERS\HECIx64.sys
19:41:44.0455 0404    MEIx64 - ok
19:41:44.0691 0404    Modem (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
19:41:44.0695 0404    Modem - ok
19:41:45.0159 0404    monitor (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
19:41:45.0160 0404    monitor - ok
19:41:45.0593 0404    mouclass(7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
19:41:45.0596 0404    mouclass - ok
19:41:46.0038 0404    mouhid(d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
19:41:46.0041 0404    mouhid - ok
19:41:46.0142 0404    mountmgr(791af66c4d0e7c90a3646066386fb571) C:\Windows\system32\drivers\mountmgr.sys
19:41:46.0145 0404    mountmgr - ok
19:41:46.0224 0404    mpio(609d1d87649ecc19796f4d76d4c15cea) C:\Windows\system32\DRIVERS\mpio.sys
19:41:46.0228 0404    mpio - ok
19:41:46.0249 0404    mpsdrv(6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
19:41:46.0253 0404    mpsdrv - ok
19:41:46.0287 0404    MRxDAV(30524261bb51d96d6fcbac20c810183c) C:\Windows\system32\drivers\mrxdav.sys
19:41:46.0291 0404    MRxDAV - ok
19:41:46.0313 0404    mrxsmb(767a4c3bcf9410c286ced15a2db17108) C:\Windows\system32\DRIVERS\mrxsmb.sys
19:41:46.0318 0404    mrxsmb - ok
19:41:46.0341 0404    mrxsmb10(920ee0ff995fcfdeb08c41605a959e1c) C:\Windows\system32\DRIVERS\mrxsmb10.sys
19:41:46.0347 0404    mrxsmb10 - ok
19:41:46.0365 0404    mrxsmb20(740d7ea9d72c981510a5292cf6adc941) C:\Windows\system32\DRIVERS\mrxsmb20.sys
19:41:46.0367 0404    mrxsmb20 - ok
19:41:46.0385 0404    msahci(bccf16d5fb1109162380e3e28dc9e4e5) C:\Windows\system32\DRIVERS\msahci.sys
19:41:46.0386 0404    msahci - ok
19:41:46.0416 0404    msdsm (8d27b597229aed79430fb9db3bcbfbd0) C:\Windows\system32\DRIVERS\msdsm.sys
19:41:46.0420 0404    msdsm - ok
19:41:46.0446 0404    Msfs(aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
19:41:46.0449 0404    Msfs - ok
19:41:46.0871 0404    mshidkmdf (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
19:41:46.0873 0404    mshidkmdf - ok
19:41:46.0915 0404    msisadrv(d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\DRIVERS\msisadrv.sys
19:41:46.0917 0404    msisadrv - ok
19:41:46.0988 0404    MSKSSRV (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
19:41:46.0991 0404    MSKSSRV - ok
19:41:47.0722 0404    MSPCLOCK(bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
19:41:47.0725 0404    MSPCLOCK - ok
19:41:48.0211 0404    MSPQM (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
19:41:48.0214 0404    MSPQM - ok
19:41:48.0689 0404    MsRPC (89cb141aa8616d8c6a4610fa26c60964) C:\Windows\system32\drivers\MsRPC.sys
19:41:48.0698 0404    MsRPC - ok
19:41:49.0219 0404    mssmbios(0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\DRIVERS\mssmbios.sys
19:41:49.0221 0404    mssmbios - ok
19:41:49.0441 0404    MSTEE (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
19:41:49.0443 0404    MSTEE - ok
19:41:49.0919 0404    MTConfig(7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
19:41:49.0921 0404    MTConfig - ok
19:41:50.0398 0404    Mup (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
19:41:50.0401 0404    Mup - ok
19:41:50.0597 0404    NativeWifiP (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
19:41:50.0605 0404    NativeWifiP - ok
19:41:51.0209 0404    NDIS(a3151b3463eea7e47f618f115d0d142e) C:\Windows\system32\drivers\ndis.sys
19:41:51.0223 0404    NDIS - ok
19:41:51.0297 0404    NdisCap (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
19:41:51.0301 0404    NdisCap - ok
19:41:51.0340 0404    NdisTapi(30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
19:41:51.0343 0404    NdisTapi - ok
19:41:51.0832 0404    Ndisuio (f105ba1e22bf1f2ee8f005d4305e4bec) C:\Windows\system32\DRIVERS\ndisuio.sys
19:41:51.0835 0404    Ndisuio - ok
19:41:51.0892 0404    NdisWan (557dfab9ca1fcb036ac77564c010dad3) C:\Windows\system32\DRIVERS\ndiswan.sys
19:41:51.0895 0404    NdisWan - ok
19:41:52.0349 0404    NDProxy (659b74fb74b86228d6338d643cd3e3cf) C:\Windows\system32\drivers\NDProxy.sys
19:41:52.0352 0404    NDProxy - ok
19:41:52.0780 0404    NetBIOS (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
19:41:52.0781 0404    NetBIOS - ok
19:41:52.0795 0404    NetBT (9162b273a44ab9dce5b44362731d062a) C:\Windows\system32\DRIVERS\netbt.sys
19:41:52.0798 0404    NetBT - ok
19:41:52.0996 0404    NETwNs64(5d262402b0634c998f8cbcead7dd8676) C:\Windows\system32\DRIVERS\NETwNs64.sys
19:41:53.0039 0404    NETwNs64 - ok
19:41:53.0531 0404    nfrd960 (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
19:41:53.0532 0404    nfrd960 - ok
19:41:53.0621 0404    Npfs(1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
19:41:53.0622 0404    Npfs - ok
19:41:53.0813 0404    nsiproxy(e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
19:41:53.0814 0404    nsiproxy - ok
19:41:53.0865 0404    Ntfs(1ad8fef2d6ac7116b68b887a9782fd33) C:\Windows\system32\drivers\Ntfs.sys
19:41:53.0873 0404    Ntfs - ok
19:41:53.0887 0404    Null(9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
19:41:53.0888 0404    Null - ok
19:41:53.0928 0404    nusb3hub(158ad24745bd85ba9be3c51c38f48c32) C:\Windows\system32\DRIVERS\nusb3hub.sys
19:41:53.0929 0404    nusb3hub - ok
19:41:54.0388 0404    nusb3xhc(d40a13b2c0891e218f9523b376955db6) C:\Windows\system32\DRIVERS\nusb3xhc.sys
19:41:54.0390 0404    nusb3xhc - ok
19:41:54.0872 0404    NVHDA (857fb74754ebff94ee3ad40788740916) C:\Windows\system32\drivers\nvhda64v.sys
19:41:54.0873 0404    NVHDA - ok
19:41:55.0144 0404    nvlddmkm(24aa5e3ed7a2b48b8e798a1059a2b323) C:\Windows\system32\DRIVERS\nvlddmkm.sys
19:41:55.0209 0404    nvlddmkm - ok
19:41:55.0268 0404    nvpciflt(58aa797b41410daea6a6eb33e77f9b7a) C:\Windows\system32\DRIVERS\nvpciflt.sys
19:41:55.0269 0404    nvpciflt - ok
19:41:55.0738 0404    nvraid(deab10231cbdb0881fc25428ebe11506) C:\Windows\system32\DRIVERS\nvraid.sys
19:41:55.0739 0404    nvraid - ok
19:41:55.0852 0404    nvstor(0af7b8136794e23e87be138992880e64) C:\Windows\system32\DRIVERS\nvstor.sys
19:41:55.0854 0404    nvstor - ok
19:41:56.0345 0404    nv_agp(270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\DRIVERS\nv_agp.sys
19:41:56.0346 0404    nv_agp - ok
19:41:56.0794 0404    ohci1394(3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\DRIVERS\ohci1394.sys
19:41:56.0795 0404    ohci1394 - ok
19:41:56.0832 0404    Parport (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
19:41:56.0833 0404    Parport - ok
19:41:56.0857 0404    partmgr (7daa117143316c4a1537e074a5a9eaf0) C:\Windows\system32\drivers\partmgr.sys
19:41:56.0858 0404    partmgr - ok
19:41:56.0875 0404    pci (f36f6504009f2fb0dfd1b17a116ad74b) C:\Windows\system32\DRIVERS\pci.sys
19:41:56.0877 0404    pci - ok
19:41:57.0338 0404    pciide(b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\DRIVERS\pciide.sys
19:41:57.0339 0404    pciide - ok
19:41:57.0422 0404    pcmcia(b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
19:41:57.0424 0404    pcmcia - ok
19:41:57.0445 0404    pcw (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
19:41:57.0446 0404    pcw - ok
19:41:57.0466 0404    PEAUTH(68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
19:41:57.0474 0404    PEAUTH - ok
19:41:57.0994 0404    PptpMiniport(27cc19e81ba5e3403c48302127bda717) C:\Windows\system32\DRIVERS\raspptp.sys
19:41:57.0996 0404    PptpMiniport - ok
19:41:58.0439 0404    Processor (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
19:41:58.0440 0404    Processor - ok
19:41:58.0920 0404    Psched(ee992183bd8eaefd9973f352e587a299) C:\Windows\system32\DRIVERS\pacer.sys
19:41:58.0922 0404    Psched - ok
19:41:59.0381 0404    PxHlpa64(87b04878a6d59d6c79251dc960c674c1) C:\Windows\system32\Drivers\PxHlpa64.sys
19:41:59.0381 0404    PxHlpa64 - ok
19:41:59.0488 0404    ql2300(a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
19:41:59.0497 0404    ql2300 - ok
19:41:59.0985 0404    ql40xx(4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
19:41:59.0986 0404    ql40xx - ok
19:42:00.0452 0404    QWAVEdrv(76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
19:42:00.0453 0404    QWAVEdrv - ok
19:42:00.0565 0404    RasAcd(5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
19:42:00.0566 0404    RasAcd - ok
19:42:01.0023 0404    RasAgileVpn (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
19:42:01.0025 0404    RasAgileVpn - ok
19:42:01.0479 0404    Rasl2tp (87a6e852a22991580d6d39adc4790463) C:\Windows\system32\DRIVERS\rasl2tp.sys
19:42:01.0481 0404    Rasl2tp - ok
19:42:01.0636 0404    RasPppoe(855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
19:42:01.0638 0404    RasPppoe - ok
19:42:02.0117 0404    RasSstp (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
19:42:02.0118 0404    RasSstp - ok
19:42:02.0581 0404    rdbss (3bac8142102c15d59a87757c1d41dce5) C:\Windows\system32\DRIVERS\rdbss.sys
19:42:02.0585 0404    rdbss - ok
19:42:03.0102 0404    rdpbus(302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
19:42:03.0103 0404    rdpbus - ok
19:42:03.0169 0404    RDPCDD(cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
19:42:03.0169 0404    RDPCDD - ok
19:42:03.0358 0404    RDPENCDD(bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
19:42:03.0358 0404    RDPENCDD - ok
19:42:03.0384 0404    RDPREFMP(216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
19:42:03.0384 0404    RDPREFMP - ok
19:42:03.0401 0404    RDPWD (8a3e6bea1c53ea6177fe2b6eba2c80d7) C:\Windows\system32\drivers\RDPWD.sys
19:42:03.0405 0404    RDPWD - ok
19:42:03.0885 0404    rdyboost(634b9a2181d98f15941236886164ec8b) C:\Windows\system32\drivers\rdyboost.sys
19:42:03.0886 0404    rdyboost - ok
19:42:04.0354 0404    RFCOMM(3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys
19:42:04.0357 0404    RFCOMM - ok
19:42:04.0960 0404    rspndr(ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
19:42:04.0963 0404    rspndr - ok
19:42:05.0062 0404    RSUSBSTOR (be29b0a3ac1e8bd02ffab8cee86badfa) C:\Windows\system32\Drivers\RtsUStor.sys
19:42:05.0064 0404    RSUSBSTOR - ok
19:42:05.0278 0404    RTL8167 (2777226ee8bf50b059d7a7c90177e99c) C:\Windows\system32\DRIVERS\Rt64win7.sys
19:42:05.0280 0404    RTL8167 - ok
19:42:05.0318 0404    sbp2port(e3bbb89983daf5622c1d50cf49f28227) C:\Windows\system32\DRIVERS\sbp2port.sys
19:42:05.0319 0404    sbp2port - ok
19:42:05.0663 0404    scfilter(c94da20c7e3ba1dca269bc8460d98387) C:\Windows\system32\DRIVERS\scfilter.sys
19:42:05.0664 0404    scfilter - ok
19:42:06.0155 0404    secdrv(3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
19:42:06.0157 0404    secdrv - ok
19:42:06.0635 0404    Serenum (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
19:42:06.0636 0404    Serenum - ok
19:42:07.0115 0404    Serial(c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
19:42:07.0116 0404    Serial - ok
19:42:07.0593 0404    sermouse(1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
19:42:07.0594 0404    sermouse - ok
19:42:08.0060 0404    sffdisk (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys
19:42:08.0060 0404    sffdisk - ok
19:42:08.0504 0404    sffp_mmc(ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\DRIVERS\sffp_mmc.sys
19:42:08.0505 0404    sffp_mmc - ok
19:42:08.0682 0404    sffp_sd (178298f767fe638c9fedcbdef58bb5e4) C:\Windows\system32\DRIVERS\sffp_sd.sys
19:42:08.0683 0404    sffp_sd - ok
19:42:08.0706 0404    sfloppy (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
19:42:08.0707 0404    sfloppy - ok
19:42:09.0251 0404    SiSRaid2(843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
19:42:09.0252 0404    SiSRaid2 - ok
19:42:09.0363 0404    SiSRaid4(6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
19:42:09.0364 0404    SiSRaid4 - ok
19:42:09.0380 0404    Smb (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
19:42:09.0382 0404    Smb - ok
19:42:09.0439 0404    spldr (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
19:42:09.0440 0404    spldr - ok
19:42:09.0482 0404    srv (de6f5658da951c4bc8e498570b5b0d5f) C:\Windows\system32\DRIVERS\srv.sys
19:42:09.0487 0404    srv - ok
19:42:09.0509 0404    srv2(4d33d59c0b930c523d29f9bd40cda9d2) C:\Windows\system32\DRIVERS\srv2.sys
19:42:09.0514 0404    srv2 - ok
19:42:09.0529 0404    srvnet(5a663fd67049267bc5c3f3279e631ffb) C:\Windows\system32\DRIVERS\srvnet.sys
19:42:09.0531 0404    srvnet - ok
19:42:09.0987 0404    stexstor(f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
19:42:09.0988 0404    stexstor - ok
19:42:10.0053 0404    STHDA (ef5acde92ba3f691bbfef781cb063501) C:\Windows\system32\DRIVERS\stwrt64.sys
19:42:10.0056 0404    STHDA - ok
19:42:10.0501 0404    swenum(d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\DRIVERS\swenum.sys
19:42:10.0502 0404    swenum - ok
19:42:11.0074 0404    Tcpip (90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\drivers\tcpip.sys
19:42:11.0085 0404    Tcpip - ok
19:42:11.0663 0404    TCPIP6(90a2d722cf64d911879d6c4a4f802a4d) C:\Windows\system32\DRIVERS\tcpip.sys
19:42:11.0673 0404    TCPIP6 - ok
19:42:12.0123 0404    tcpipreg(76d078af6f587b162d50210f761eb9ed) C:\Windows\system32\drivers\tcpipreg.sys
19:42:12.0124 0404    tcpipreg - ok
19:42:12.0190 0404    TDPIPE(3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
19:42:12.0192 0404    TDPIPE - ok
19:42:12.0213 0404    TDTCP (e4245bda3190a582d55ed09e137401a9) C:\Windows\system32\drivers\tdtcp.sys
19:42:12.0214 0404    TDTCP - ok
19:42:12.0230 0404    tdx (079125c4b17b01fcaeebce0bcb290c0f) C:\Windows\system32\DRIVERS\tdx.sys
19:42:12.0232 0404    tdx - ok
19:42:12.0262 0404    TermDD(c448651339196c0e869a355171875522) C:\Windows\system32\DRIVERS\termdd.sys
19:42:12.0263 0404    TermDD - ok
19:42:12.0694 0404    tssecsrv(61b96c26131e37b24e93327a0bd1fb95) C:\Windows\system32\DRIVERS\tssecsrv.sys
19:42:12.0696 0404    tssecsrv - ok
19:42:13.0164 0404    tunnel(3836171a2cdf3af8ef10856db9835a70) C:\Windows\system32\DRIVERS\tunnel.sys
19:42:13.0166 0404    tunnel - ok
19:42:13.0611 0404    TurboB(fd24f98d2898be093fe926604be7db99) C:\Windows\system32\DRIVERS\TurboB.sys
19:42:13.0611 0404    TurboB - ok
19:42:13.0665 0404    uagp35(b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
19:42:13.0666 0404    uagp35 - ok
19:42:13.0807 0404    udfs(31ba4a33afab6a69ea092b18017f737f) C:\Windows\system32\DRIVERS\udfs.sys
19:42:13.0809 0404    udfs - ok
19:42:14.0229 0404    uliagpkx(4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\DRIVERS\uliagpkx.sys
19:42:14.0230 0404    uliagpkx - ok
19:42:14.0663 0404    umbus (eab6c35e62b1b0db0d1b48b671d3a117) C:\Windows\system32\DRIVERS\umbus.sys
19:42:14.0665 0404    umbus - ok
19:42:14.0697 0404    UmPass(b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
19:42:14.0698 0404    UmPass - ok
19:42:14.0906 0404    usbccgp (945bfba692c0f3cdf5a9d824972188f6) C:\Windows\system32\DRIVERS\usbccgp.sys
19:42:14.0907 0404    usbccgp - ok
19:42:15.0226 0404    usbcir(af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\DRIVERS\usbcir.sys
19:42:15.0228 0404    usbcir - ok
19:42:15.0402 0404    usbehci (b6942800840c9466223aefd4d9a74fbf) C:\Windows\system32\DRIVERS\usbehci.sys
19:42:15.0403 0404    usbehci - ok
19:42:15.0851 0404    usbhub(85bc7b6ee233b4e979e024a3cd15cd49) C:\Windows\system32\DRIVERS\usbhub.sys
19:42:15.0853 0404    usbhub - ok
19:42:16.0233 0404    usbohci (58e546bbaf87664fc57e0f6081e4f609) C:\Windows\system32\DRIVERS\usbohci.sys
19:42:16.0234 0404    usbohci - ok
19:42:16.0269 0404    usbprint(73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
19:42:16.0269 0404    usbprint - ok
19:42:16.0284 0404    USBSTOR (a60e7e0fa88ff067d049d525547cd5e9) C:\Windows\system32\DRIVERS\USBSTOR.SYS
19:42:16.0286 0404    USBSTOR - ok
19:42:16.0300 0404    usbuhci (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\DRIVERS\usbuhci.sys
19:42:16.0301 0404    usbuhci - ok
19:42:16.0744 0404    usbvideo(7cb8c573c6e4a2714402cc0a36eab4fe) C:\Windows\system32\Drivers\usbvideo.sys
19:42:16.0746 0404    usbvideo - ok
19:42:16.0811 0404    vdrvroot(c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\DRIVERS\vdrvroot.sys
19:42:16.0811 0404    vdrvroot - ok
19:42:17.0256 0404    vga (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
19:42:17.0258 0404    vga - ok
19:42:17.0711 0404    VgaSave (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
19:42:17.0712 0404    VgaSave - ok
19:42:17.0750 0404    vhdmp (c82e748660f62a242b2dfac1442f22a4) C:\Windows\system32\DRIVERS\vhdmp.sys
19:42:17.0752 0404    vhdmp - ok
19:42:18.0196 0404    viaide(e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\DRIVERS\viaide.sys
19:42:18.0196 0404    viaide - ok
19:42:18.0333 0404    volmgr(2b1a3dae2b4e70dbba822b7a03fbd4a3) C:\Windows\system32\DRIVERS\volmgr.sys
19:42:18.0334 0404    volmgr - ok
19:42:18.0754 0404    volmgrx (99b0cbb569ca79acaed8c91461d765fb) C:\Windows\system32\drivers\volmgrx.sys
19:42:18.0756 0404    volmgrx - ok
19:42:19.0193 0404    volsnap (58f82eed8ca24b461441f9c3e4f0bf5c) C:\Windows\system32\DRIVERS\volsnap.sys
19:42:19.0195 0404    volsnap - ok
19:42:19.0251 0404    vsmraid (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
19:42:19.0253 0404    vsmraid - ok
19:42:19.0284 0404    vwifibus(36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
19:42:19.0286 0404    vwifibus - ok
19:42:19.0751 0404    vwififlt(6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
19:42:19.0753 0404    vwififlt - ok
19:42:19.0840 0404    vwifimp (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys
19:42:19.0841 0404    vwifimp - ok
19:42:19.0896 0404    WacomPen(4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
19:42:19.0897 0404    WacomPen - ok
19:42:20.0333 0404    WANARP(47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
19:42:20.0335 0404    WANARP - ok
19:42:20.0351 0404    Wanarpv6(47ca49400643effd3f1c9a27e1d69324) C:\Windows\system32\DRIVERS\wanarp.sys
19:42:20.0352 0404    Wanarpv6 - ok
19:42:20.0523 0404    Wd(72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
19:42:20.0524 0404    Wd - ok
19:42:20.0988 0404    Wdf01000(441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
19:42:20.0991 0404    Wdf01000 - ok
19:42:21.0426 0404    wdkmd (94dc2bf6cbaaa95e369c3756d3115a76) C:\Windows\system32\DRIVERS\WDKMD.sys
19:42:21.0427 0404    wdkmd - ok
19:42:21.0508 0404    WfpLwf(611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
19:42:21.0509 0404    WfpLwf - ok
19:42:21.0568 0404    WimFltr (b14ef15bd757fa488f9c970eee9c0d35) C:\Windows\system32\DRIVERS\wimfltr.sys
19:42:21.0569 0404    WimFltr - ok
19:42:21.0596 0404    WIMMount(05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
19:42:21.0597 0404    WIMMount - ok
19:42:22.0051 0404    WmiAcpi (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\DRIVERS\wmiacpi.sys
19:42:22.0052 0404    WmiAcpi - ok
19:42:22.0455 0404    ws2ifsl (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
19:42:22.0456 0404    ws2ifsl - ok
19:42:22.0568 0404    WudfPf(c63907207b837a5c05cf6d1606aa0008) C:\Windows\system32\drivers\WudfPf.sys
19:42:22.0569 0404    WudfPf - ok
19:42:22.0614 0404    WUDFRd(d885a873d733020f8b9b9ff4b1666158) C:\Windows\system32\DRIVERS\WUDFRd.sys
19:42:22.0616 0404    WUDFRd - ok
19:42:22.0655 0404    yukonw7 (b3eeacf62445e24fbb2cd4b0fb4db026) C:\Windows\system32\DRIVERS\yk62x64.sys
19:42:22.0660 0404    yukonw7 - ok
19:42:22.0728 0404    MBR (0x1B8) (de1996b5390bac8242e23168f828c750) \Device\Harddisk0\DR0
19:42:22.0730 0404    \Device\Harddisk0\DR0 ( Rootkit.Win32.TDSS.tdl4 ) - infected
19:42:22.0730 0404    \Device\Harddisk0\DR0 - detected Rootkit.Win32.TDSS.tdl4 (0)
19:42:22.0746 0404    Boot (0x1200) (b4a651ea79a9998884da67ecffb5e2e7) \Device\Harddisk0\DR0\Partition0
19:42:22.0747 0404    \Device\Harddisk0\DR0\Partition0 - ok
19:42:22.0766 0404    Boot (0x1200) (a45e5362663743261736ea90aa094a97) \Device\Harddisk0\DR0\Partition1
19:42:22.0767 0404    \Device\Harddisk0\DR0\Partition1 - ok
19:42:22.0788 0404    Boot (0x1200) (84942d8338da4298cb1c74b4c4b8561f) \Device\Harddisk0\DR0\Partition2
19:42:22.0789 0404    \Device\Harddisk0\DR0\Partition2 - ok
19:42:22.0790 0404    ============================================================
19:42:22.0790 0404    Scan finished
19:42:22.0790 0404    ============================================================
19:42:22.0797 5956    Detected object count: 1
19:42:22.0797 5956    Actual detected object count: 1
19:42:52.0417 5956    \Device\Harddisk0\DR0 ( Rootkit.Win32.TDSS.tdl4 ) - will be cured on reboot
19:42:52.0417 5956    \Device\Harddisk0\DR0 - ok
19:42:52.0418 5956    \Device\Harddisk0\DR0 ( Rootkit.Win32.TDSS.tdl4 ) - User select action: Cure
19:43:27.0653 4336    Deinitialize success

Waves

13.11.2011, 11:41
Flash999 napisał(a):Od czego Wy zaczynacie? Przecież tu jest Alureon! Użyj

[Aby zobaczyć linki, zarejestruj się tutaj]

. Przy wykryciu Rootkita TDL wybierz Cure. To go usunie. Po tym czas na kolejne działania.


Nie miałem pojęcia o Alureonie , więc standardowo OTL Smile
SafeGroup > Bezpieczeństwo > Pomoc po zainfekowaniu > Podejrzenie infekcji