prosze o pomoc w spr loga z otl oraz dziwny log z routera

[dylemat1]

siemka od jakiegoś czasu komputer zwalnia. nie wiem co jest przyczyną. dodam, iż wyłączyłem kilka programów w autostarcie oraz usług - uprzednio sprawdziłem na forach by upewnić się czy to bezpieczne i stabilne dla systemu. przeskanowałem kompa mbam oraz hitmanem i nic nie wykryło. lecz ostatnio podczas logowania na router pokazała mi się taka wiadomość (załącznik na końcu posta)


nie wiem czy to bezpieczne czy nie dlatego zwracam się z prośbą.
logi z otl.txt:

OTL logfile created on: 2012-04-13 21:39:59 - Run 1
OTL by OldTimer - Version 3.2.39.2 Folder = C:\DefenseWallVC_Apps\HarddiskVolume1\Documents and Settings\LOLO\My Documents\Pobieranie
Windows XP Media Center Edition Service Pack 2 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.2180)
Locale: 00000415 | Country: Poland | Language: PLK | Date Format: yyyy-MM-dd

1013,98 Mb Total Physical Memory | 319,57 Mb Available Physical Memory | 31,52% Memory free
2,39 Gb Paging File | 1,86 Gb Available in Paging File | 77,96% Paging File free
Paging file location(s): C:\pagefile.sys 1524 3048 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 25,35 Gb Total Space | 1,31 Gb Free Space | 5,17% Space Free | Partition Type: NTFS
Drive D: | 61,74 Gb Total Space | 3,28 Gb Free Space | 5,32% Space Free | Partition Type: NTFS
Drive E: | 61,72 Gb Total Space | 1,09 Gb Free Space | 1,77% Space Free | Partition Type: NTFS

Computer Name: TRON | User Name: LOLO | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: Off | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012-04-13 21:30:30 | 000,593,920 | ---- | M](OldTimer Tools) -- C:\DefenseWallVC_Apps\HarddiskVolume1\Documents and Settings\LOLO\My Documents\Pobieranie\OTL.exe
PRC - [2012-03-02 16:36:00 | 000,389,120 | ---- | M]() -- C:\Program Files\5 Minute Break\5 Minute Break.exe
PRC - [2011-12-21 09:04:05 | 000,924,632 | ---- | M](Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011-07-20 13:29:45 | 000,778,240 | ---- | M](SoftSphere Technologies) -- C:\Program Files\DefenseWall\defensewall.exe
PRC - [2011-05-27 14:06:41 | 000,167,936 | ---- | M](SoftSphere Technologies) -- C:\WINDOWS\system32\defensewall_serv.exe
PRC - [2005-12-20 20:22:14 | 000,035,328 | ---- | M](TOSHIBA Corp.) -- C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
PRC - [2005-12-05 21:37:40 | 000,667,718 | ---- | M](Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\ZCfgSvc.exe
PRC - [2005-11-28 20:41:50 | 000,602,182 | ---- | M](Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\iFrmewrk.exe
PRC - [2005-11-28 20:37:52 | 000,397,381 | ---- | M](Intel Corporation) -- C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
PRC - [2005-08-16 20:23:12 | 000,188,416 | ---- | M](TOSHIBA Corporation) -- C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
PRC - [2005-07-13 02:14:42 | 000,040,960 | ---- | M]() -- c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
PRC - [2005-06-01 06:00:12 | 000,282,624 | ---- | M](TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSMain.exe
PRC - [2005-06-01 05:59:58 | 000,045,056 | ---- | M](TOSHIBA Corporation) -- C:\WINDOWS\system32\TPSBattM.exe
PRC - [2005-03-12 00:03:16 | 000,073,728 | ---- | M](TOSHIBA Corporation) -- C:\WINDOWS\system32\TDispVol.exe
PRC - [2004-08-28 09:37:00 | 000,155,648 | ---- | M](Matsushita Electric Industrial Co., Ltd.) -- C:\WINDOWS\system32\RAMASST.exe
PRC - [2004-08-10 13:00:00 | 001,032,192 | ---- | M](Microsoft Corporation) -- C:\WINDOWS\explorer.exe


========== Modules (No Company Name) ==========

MOD - [2012-03-02 16:36:00 | 000,389,120 | ---- | M]() -- C:\Program Files\5 Minute Break\5 Minute Break.exe
MOD - [2012-01-07 19:35:44 | 008,527,008 | ---- | M]() -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll
MOD - [2011-12-21 09:04:06 | 002,124,760 | ---- | M]() -- C:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2011-11-02 00:26:32 | 000,087,912 | ---- | M]() -- C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011-11-02 00:26:12 | 001,242,472 | ---- | M]() -- C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011-03-26 16:24:53 | 000,573,440 | ---- | M]() -- C:\WINDOWS\system32\dwall_mrk.dll
MOD - [2011-02-04 17:48:30 | 000,291,840 | ---- | M]() -- C:\WINDOWS\system32\sbe.dll
MOD - [2010-02-05 19:14:43 | 001,291,776 | ---- | M]() -- C:\WINDOWS\system32\quartz.dll
MOD - [2005-11-28 20:59:16 | 000,876,544 | ---- | M]() -- C:\Program Files\Intel\Wireless\Bin\Libeay32.dll
MOD - [2005-11-28 20:59:16 | 000,208,965 | ---- | M]() -- C:\Program Files\Intel\Wireless\Bin\iWMSProv.dll
MOD - [2005-11-28 20:59:16 | 000,053,322 | ---- | M]() -- C:\Program Files\Intel\Wireless\Bin\IntStngs.dll
MOD - [2005-11-23 23:55:38 | 000,118,784 | ---- | M]() -- C:\WINDOWS\system32\TCtrlIO.dll
MOD - [2005-11-03 20:37:58 | 000,970,862 | ---- | M]() -- C:\Program Files\Intel\Wireless\Bin\acAuth.dll
MOD - [2005-07-13 02:14:42 | 000,040,960 | ---- | M]() -- c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
MOD - [2004-08-10 13:00:00 | 000,059,904 | ---- | M]() -- C:\WINDOWS\system32\devenum.dll
MOD - [2004-08-10 13:00:00 | 000,014,336 | ---- | M]() -- C:\WINDOWS\system32\msdmo.dll
MOD - [2004-07-21 02:04:02 | 000,094,208 | ---- | M]() -- C:\WINDOWS\system32\TosBtHcrpAPI.dll
MOD - [2002-03-03 13:40:00 | 000,045,056 | ---- | M]() -- C:\WINDOWS\system32\TDispVol.dll


========== Win32 Services (SafeList) ==========

SRV - File not found [Auto | Stopped]-- C:\Program Files\M-Audio MA_CMIDI\MA_CMIDI_Inst.exe -- (MA_CMIDI_InstallerService)
SRV - File not found [Disabled | Stopped]-- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2011-06-29 15:59:18 | 000,155,344 | ---- | M](Avanquest Software) [On_Demand | Stopped]-- C:\Program Files\Sony Ericsson\Sony Ericsson PC Companion\PCCService.exe -- (Sony Ericsson PCCompanion)
SRV - [2011-05-27 14:06:41 | 000,167,936 | ---- | M](SoftSphere Technologies) [Auto | Running]-- C:\WINDOWS\system32\defensewall_serv.exe -- (defensewall_serv)
SRV - [2009-11-17 19:44:54 | 000,040,960 | ---- | M]() [Disabled | Stopped]-- C:\Program Files\Common Files\DeviceHelper\DeviceManager.exe -- (DeviceManager)
SRV - [2005-12-20 20:22:14 | 000,035,328 | ---- | M](TOSHIBA Corp.) [Auto | Running]-- C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe -- (TAPPSRV)
SRV - [2005-07-13 02:14:42 | 000,040,960 | ---- | M]() [Auto | Running]-- c:\TOSHIBA\IVP\swupdate\swupdtmr.exe -- (Swupdtmr)
SRV - [2005-01-18 01:38:38 | 000,040,960 | ---- | M](TOSHIBA CORPORATION) [Disabled | Stopped]-- C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe -- (CFSvcs)
SRV - [2004-08-28 09:33:00 | 000,110,592 | ---- | M](Matsushita Electric Industrial Co., Ltd.) [Disabled | Stopped]-- C:\WINDOWS\system32\DVDRAMSV.exe -- (DVD-RAM_Service)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped]---- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped]-- C:\SYSPREP\PEDrv.sys -- (SVRPEDRV)
DRV - File not found [Kernel | On_Demand | Stopped]---- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped]---- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped]---- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped]---- (PDCOMP)
DRV - File not found [Kernel | System | Stopped]---- (PCIDump)
DRV - File not found [Kernel | System | Stopped]---- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped]---- (i2omgmt)
DRV - File not found [Kernel | System | Stopped]---- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped]-- C:\DOCUME~1\LOLO\LOCALS~1\Temp\catchme.sys -- (catchme)
DRV - [2011-11-28 20:33:57 | 000,025,512 | ---- | M](Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped]-- C:\WINDOWS\system32\drivers\ggsemc.sys -- (ggsemc)
DRV - [2011-11-28 20:33:57 | 000,013,224 | ---- | M](Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped]-- C:\WINDOWS\system32\drivers\ggflt.sys -- (ggflt)
DRV - [2011-07-20 02:20:59 | 001,057,792 | ---- | M](SoftSphere Technologies) [Kernel | System | Running]-- C:\WINDOWS\system32\drivers\dwall.sys -- (dwall)
DRV - [2009-11-17 19:44:54 | 000,105,344 | ---- | M](TCT International Mobile Ltd) [Kernel | On_Demand | Stopped]-- C:\WINDOWS\system32\drivers\jrdusbser.sys -- (jrdusbser)
DRV - [2008-07-07 08:40:49 | 000,056,108 | ---- | M](PowerISO Computing, Inc.) [Kernel | System | Running]-- C:\WINDOWS\System32\drivers\scdemu.sys -- (SCDEmu)
DRV - [2006-02-16 10:56:07 | 000,008,552 | ---- | M](Windows ® 2000 DDK provider) [Kernel | Auto | Running]-- C:\WINDOWS\System32\drivers\asctrm.sys -- (ASCTRM)
DRV - [2005-12-10 01:48:40 | 004,123,136 | ---- | M](Realtek Semiconductor Corp.) [Kernel | On_Demand | Running]-- C:\WINDOWS\system32\drivers\RtkHDAud.Sys -- (IntcAzAudAddService) Service for Realtek HD Audio (WDM)
DRV - [2005-12-04 18:55:30 | 001,428,096 | ---- | M](Intel® Corporation) [Kernel | On_Demand | Running]-- C:\WINDOWS\system32\drivers\w39n51.sys -- (w39n51) Intel®
DRV - [2005-11-30 20:01:02 | 000,043,392 | ---- | M](TOSHIBA Corporation) [Kernel | On_Demand | Running]-- C:\WINDOWS\system32\drivers\Tvs.sys -- (Tvs)
DRV - [2005-11-30 19:12:00 | 000,162,560 | ---- | M](Texas Instruments) [Kernel | On_Demand | Running]-- C:\WINDOWS\system32\drivers\tifm21.sys -- (tifm21)
DRV - [2005-11-28 21:09:26 | 000,013,568 | ---- | M](Intel Corporation) [Kernel | Auto | Running]-- C:\WINDOWS\system32\drivers\s24trans.sys -- (s24trans)
DRV - [2005-11-15 18:00:22 | 001,122,656 | ---- | M](Agere Systems) [Kernel | On_Demand | Running]-- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem)
DRV - [2005-10-20 23:03:42 | 000,006,144 | ---- | M](Toshiba Corporation) [Kernel | On_Demand | Running]-- C:\WINDOWS\system32\drivers\NBSMI.sys -- (TVALD)
DRV - [2005-10-06 14:20:00 | 000,094,332 | ---- | M](Sonic Solutions) [File_System | Auto | Running]-- C:\WINDOWS\system32\DLA\DLAUDFAM.SYS -- (DLAUDFAM)
DRV - [2005-10-06 14:20:00 | 000,087,036 | ---- | M](Sonic Solutions) [File_System | Auto | Running]-- C:\WINDOWS\system32\DLA\DLAUDF_M.SYS -- (DLAUDF_M)
DRV - [2005-10-06 14:20:00 | 000,086,524 | ---- | M](Sonic Solutions) [File_System | Auto | Running]-- C:\WINDOWS\system32\DLA\DLAIFS_M.SYS -- (DLAIFS_M)
DRV - [2005-10-06 14:20:00 | 000,025,628 | ---- | M](Sonic Solutions) [File_System | Auto | Running]-- C:\WINDOWS\system32\DLA\DLABOIOM.SYS -- (DLABOIOM)
DRV - [2005-10-06 14:20:00 | 000,014,684 | ---- | M](Sonic Solutions) [File_System | Auto | Running]-- C:\WINDOWS\system32\DLA\DLAOPIOM.SYS -- (DLAOPIOM)
DRV - [2005-10-06 14:20:00 | 000,006,364 | ---- | M](Sonic Solutions) [File_System | Auto | Running]-- C:\WINDOWS\system32\DLA\DLAPoolM.SYS -- (DLAPoolM)
DRV - [2005-10-06 14:20:00 | 000,002,496 | ---- | M](Sonic Solutions) [File_System | Auto | Running]-- C:\WINDOWS\system32\DLA\DLADResN.SYS -- (DLADResN)
DRV - [2005-09-09 23:47:10 | 000,009,344 | ---- | M](TOSHIBA Corporation) [Kernel | On_Demand | Stopped]-- C:\WINDOWS\system32\drivers\tosrfec.sys -- (tosrfec)
DRV - [2005-08-25 21:16:52 | 000,005,628 | ---- | M](Sonic Solutions) [File_System | System | Running]-- C:\WINDOWS\system32\drivers\DLACDBHM.SYS -- (DLACDBHM)
DRV - [2005-08-25 21:16:16 | 000,022,684 | ---- | M](Sonic Solutions) [File_System | System | Running]-- C:\WINDOWS\system32\drivers\DLARTL_N.SYS -- (DLARTL_N)
DRV - [2005-08-25 00:20:28 | 000,009,472 | ---- | M]() [Kernel | On_Demand | Running]-- C:\WINDOWS\system32\drivers\tbiosdrv.sys -- (tbiosdrv)
DRV - [2005-06-14 14:44:00 | 000,021,888 | ---- | M](M-Audio) [Kernel | On_Demand | Stopped]-- C:\WINDOWS\system32\drivers\ma_cmidi.sys -- (MA_CMIDI)
DRV - [2005-06-02 12:33:00 | 000,102,384 | ---- | M](Matsushita Electric Industrial Co.,Ltd.) [File_System | System | Running]-- C:\WINDOWS\system32\drivers\meiudf.sys -- (meiudf)
DRV - [2005-02-11 10:24:24 | 000,079,488 | ---- | M](MCCI) [Kernel | On_Demand | Stopped]-- C:\WINDOWS\system32\drivers\k750obex.sys -- (k750obex)
DRV - [2005-02-11 10:22:48 | 000,081,728 | ---- | M](MCCI) [Kernel | On_Demand | Stopped]-- C:\WINDOWS\system32\drivers\k750mgmt.sys -- (k750mgmt)
DRV - [2005-02-11 10:21:10 | 000,089,872 | ---- | M](MCCI) [Kernel | On_Demand | Stopped]-- C:\WINDOWS\system32\drivers\k750mdm.sys -- (k750mdm)
DRV - [2005-02-11 10:21:02 | 000,006,576 | ---- | M](MCCI) [Kernel | On_Demand | Stopped]-- C:\WINDOWS\system32\drivers\k750mdfl.sys -- (k750mdfl)
DRV - [2005-02-11 10:19:20 | 000,055,216 | ---- | M](MCCI) [Kernel | On_Demand | Stopped]-- C:\WINDOWS\system32\drivers\k750bus.sys -- (k750bus) Sony Ericsson 750 driver (WDM)
DRV - [2005-01-12 09:05:46 | 000,204,160 | ---- | M](TOSHIBA CORPORATION) [Kernel | Boot | Running]-- C:\WINDOWS\system32\drivers\KR10N.sys -- (KR10N)
DRV - [2003-01-29 23:35:00 | 000,012,032 | ---- | M](TOSHIBA Corporation.) [Kernel | Auto | Running]-- C:\WINDOWS\system32\drivers\Netdevio.sys -- (Netdevio)
DRV - [2003-01-10 21:13:04 | 000,033,588 | R--- | M](America Online, Inc.) [Kernel | On_Demand | Stopped]-- C:\WINDOWS\system32\drivers\wanatw4.sys -- (wanatw) WAN Miniport (ATW)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =

[Aby zobaczyć linki, zarejestruj się tutaj]

IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =

[Aby zobaczyć linki, zarejestruj się tutaj]

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar =

[Aby zobaczyć linki, zarejestruj się tutaj]

IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =

[Aby zobaczyć linki, zarejestruj się tutaj]

IE - HKU\S-1-5-21-3852616517-519138961-1039179079-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com
IE - HKU\S-1-5-21-3852616517-519138961-1039179079-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3852616517-519138961-1039179079-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

========== FireFox ==========

FF - prefs.js..network.proxy.no_proxies_on: "*.local"
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@AppLe.com/iTunes,version=:File not found
FF - HKLM\Software\MozillaPlugins\@AppLe.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@ganymede/GanymedeNetPlugin,version=1.0: C:\Program Files\Ganymede\Plugins\npganymedenet.dll ( )
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.0.61118.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.0.3: C:\Program Files\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKLM\Software\MozillaPlugins\@viewpoint.com/VMP: C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll ()

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012-03-29 13:18:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012-03-29 13:18:16 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Pale Moon 9.1\extensions\\Components: C:\Program Files\Pale Moon\components [2012-03-29 13:18:17 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Pale Moon 9.1\extensions\\Plugins: C:\Program Files\Pale Moon\plugins

[2011-02-08 01:51:43 | 000,000,000 | ---D | M](No name found) -- C:\Documents and Settings\LOLO\Application Data\Mozilla\Extensions
[2012-01-16 21:16:57 | 000,000,000 | ---D | M](No name found) -- C:\Documents and Settings\LOLO\Application Data\Mozilla\Firefox\Profiles\gpthw0hm.default\extensions
[2012-01-16 21:16:58 | 000,000,000 | ---D | M]("Free YouTube Download (Free Studio) Menu") -- C:\Documents and Settings\LOLO\Application Data\Mozilla\Firefox\Profiles\gpthw0hm.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012-01-10 08:34:52 | 000,000,000 | ---D | M](cacaoweb) -- C:\Documents and Settings\LOLO\Application Data\Mozilla\Firefox\Profiles\gpthw0hm.default\extensions\[email protected]
[2012-02-28 17:04:10 | 000,000,000 | ---D | M](No name found) -- C:\Documents and Settings\LOLO\Application Data\Mozilla\Firefox\Profiles\gpthw0hm.default\extensions\[email protected]
[2012-01-09 20:50:20 | 000,000,000 | ---D | M](No name found) -- C:\Documents and Settings\LOLO\Application Data\Mozilla\Firefox\Profiles\gpthw0hm.default\extensions\staged
[2012-01-09 20:06:58 | 000,000,000 | ---D | M](No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011-11-15 11:23:25 | 000,000,000 | ---D | M](Skype Click to Call) -- C:\Program Files\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
() (No name found) -- C:\PROGRAM FILES\PALE MOON\EXTENSIONS\[email protected]
[2011-12-21 09:04:06 | 000,121,816 | ---- | M](Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011-11-28 20:31:35 | 000,476,904 | ---- | M](Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011-04-06 11:43:28 | 000,120,296 | ---- | M]( ) -- C:\Program Files\mozilla firefox\plugins\npganymedenet.dll
[2011-12-21 06:04:32 | 000,002,767 | ---- | M]() -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml
[2011-12-21 06:04:32 | 000,001,406 | ---- | M]() -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml
[2011-12-21 06:04:32 | 000,000,917 | ---- | M]() -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml
[2011-12-21 06:04:32 | 000,000,858 | ---- | M]() -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml
[2011-12-21 06:04:32 | 000,001,183 | ---- | M]() -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml
[2011-12-21 06:04:32 | 000,001,683 | ---- | M]() -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml

O1 HOSTS File: ([2011-07-20 01:41:32 | 000,000,027 | ---- | M] ) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\DLA\DLASHX_W.DLL (Sonic Solutions)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O3 - HKU\S-1-5-21-3852616517-519138961-1039179079-1005\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [Copy Handler] File not found
O4 - HKLM..\Run: [DefenseWall]C:\Program Files\DefenseWall\DefenseWall.exe (SoftSphere Technologies)
O4 - HKLM..\Run: [IntelWireless]C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe (Intel Corporation)
O4 - HKLM..\Run: [IntelZeroConfig]C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe (Intel Corporation)
O4 - HKLM..\Run: [NeroFilterCheck]C:\WINDOWS\system32\NeroCheck.exe (Ahead Software Gmbh)
O4 - HKLM..\Run: [TDispVol]C:\WINDOWS\System32\TDispVol.exe (TOSHIBA Corporation)
O4 - HKLM..\Run: [TFncKy]TFncKy.exe File not found
O4 - HKLM..\Run: [TPSMain]C:\WINDOWS\System32\TPSMain.exe (TOSHIBA Corporation)
O4 - HKU\S-1-5-21-3852616517-519138961-1039179079-1005..\Run: [5 Minute Break]C:\Program Files\5 Minute Break\5 Minute Break.exe ()
O4 - Startup: C:\Documents and Settings\All Users\Start Menu\Programs\Startup\RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe (Matsushita Electric Industrial Co., Ltd.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Infodelivery present
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallVisualStyle = C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles (Microsoft)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: InstallTheme = C:\WINDOWS\Resources\Themes\Royale.theme ()
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3852616517-519138961-1039179079-1005\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3852616517-519138961-1039179079-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 36
O7 - HKU\S-1-5-21-3852616517-519138961-1039179079-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = FF FF FF FF[binary data]
O7 - HKU\S-1-5-21-3852616517-519138961-1039179079-1005\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8 - Extra context menu item: Dodaj link do Bulk Image Downloader - Menedżera Zadań - C:\Program Files\Bulk Image Downloader\iemenu\iebidlinkqueue.htm ()
O8 - Extra context menu item: Dodaj stronę do kolejki Bulk Image Downloader - Menedżera Zadań - C:\Program Files\Bulk Image Downloader\iemenu\iebidqueue.htm ()
O8 - Extra context menu item: E&xport to Microsoft Excel -

[Aby zobaczyć linki, zarejestruj się tutaj]

:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Documents and Settings\LOLO\Application Data\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Otwórz link w Bulk Image Downloader - C:\Program Files\Bulk Image Downloader\iemenu\iebidlink.htm ()
O8 - Extra context menu item: Otwórz stronę w Bulk Image Downloader - C:\Program Files\Bulk Image Downloader\iemenu\iebid.htm ()
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra ''Tools'' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 []- C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93}

[Aby zobaczyć linki, zarejestruj się tutaj]

(Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}

[Aby zobaczyć linki, zarejestruj się tutaj]

(Java Plug-in 1.6.0_29)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}

[Aby zobaczyć linki, zarejestruj się tutaj]

(Java Plug-in 1.6.0_29)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.168.4.100 194.168.8.100
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7D2137FB-EF5C-45FB-9ECC-631FD87F86C5}: DhcpNameServer = 194.168.4.100 194.168.8.100
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (Userinit.exe) - C:\WINDOWS\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Documents and Settings\LOLO\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\LOLO\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006-02-15 16:38:58 | 000,000,000 | ---- | M]() - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2011-07-08 17:24:42 | 000,000,000 | R--D | M]- C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2011-07-08 17:24:42 | 000,000,000 | R--D | M]- D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2011-07-20 22:56:26 | 000,000,000 | RHSD | M]- E:\autorun.inf -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open]-- "%1" %*
O35 - HKLM\..exefile [open]-- "%1" %*
O37 - HKLM\...com [@ = comfile]-- "%1" %*
O37 - HKLM\...exe [@ = exefile]-- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012-04-02 11:07:15 | 000,000,000 | ---D | C]-- C:\Documents and Settings\LOLO\Application Data\Ahead
[2012-04-02 11:00:41 | 000,000,000 | ---D | C]-- C:\Documents and Settings\All Users\Start Menu\Programs\Nero
[2012-04-02 10:57:58 | 000,106,496 | ---- | C](Pegasus Software) -- C:\WINDOWS\System32\TwnLib20.dll
[2012-04-02 10:57:51 | 000,038,912 | ---- | C](Pegasus Imaging Corp.) -- C:\WINDOWS\System32\picn20.dll
[2012-04-02 10:57:48 | 000,569,344 | ---- | C](Pegasus Software,LLC) -- C:\WINDOWS\System32\imagr5.dll
[2012-04-02 10:57:48 | 000,544,768 | ---- | C](Pegasus Software, LLC) -- C:\WINDOWS\System32\imagx5.dll
[2012-04-02 10:57:48 | 000,283,920 | ---- | C](Pegasus Software, LLC) -- C:\WINDOWS\System32\ImagXpr5.dll
[2012-04-02 10:57:45 | 000,000,000 | ---D | C]-- C:\Program Files\Common Files\Ahead
[2012-04-02 10:57:44 | 000,155,648 | ---- | C](Ahead Software Gmbh) -- C:\WINDOWS\System32\NeroCheck.exe
[2012-04-02 10:57:39 | 000,000,000 | ---D | C]-- C:\Program Files\Ahead
[2012-03-29 13:17:49 | 000,000,000 | ---D | C]-- C:\Documents and Settings\All Users\Start Menu\Programs\QuickTime
[2012-03-29 13:17:27 | 000,000,000 | ---D | C]-- C:\Program Files\QuickTime
[2012-03-20 18:41:43 | 000,000,000 | ---D | C]-- C:\Documents and Settings\LOLO\Application Data\Workrave
[2012-03-20 18:41:30 | 000,000,000 | ---D | C]-- C:\Program Files\5 Minute Break
[2012-03-20 18:41:30 | 000,000,000 | ---D | C]-- C:\Documents and Settings\All Users\Start Menu\Programs\5 Minute Break
[2012-03-20 18:41:04 | 000,000,000 | ---D | C]-- C:\Documents and Settings\All Users\Start Menu\Programs\Workrave
[2012-03-20 18:40:53 | 000,000,000 | ---D | C]-- C:\Program Files\Workrave
[2012-03-18 11:13:06 | 000,131,072 | ---- | C](PlanetSoft.org) -- C:\Documents and Settings\LOLO\Desktop\BootTimer.exe
[2012-03-16 21:50:58 | 000,000,000 | R--D | C]-- C:\Documents and Settings\LOLO\Desktop\Acoustiwc guitar 10 samples track-1 Project
[2012-03-16 21:31:23 | 000,000,000 | RH-D | C]-- C:\Documents and Settings\LOLO\Recent
[12 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012-04-13 21:48:19 | 000,071,699 | ---- | M]() -- C:\Documents and Settings\LOLO\Desktop\router log.JPG
[2012-04-13 21:37:13 | 001,113,654 | ---- | M]() -- C:\Documents and Settings\LOLO\Desktop\router log.bmp
[2012-04-13 21:07:23 | 000,000,006 | -H-- | M]() -- C:\WINDOWS\tasks\SA.DAT
[2012-04-13 21:07:00 | 000,002,048 | --S- | M]() -- C:\WINDOWS\bootstat.dat
[2012-04-13 21:06:45 | 1063,309,312 | -HS- | M]() -- C:\hiberfil.sys
[2012-04-13 21:06:03 | 006,029,312 | -H-- | M]() -- C:\Documents and Settings\LOLO\NTUSER.DAT
[2012-04-13 21:06:03 | 000,000,178 | -HS- | M]() -- C:\Documents and Settings\LOLO\ntuser.ini
[2012-04-13 20:09:25 | 000,000,155 | ---- | M]() -- C:\WINDOWS\winamp.ini
[2012-04-13 19:59:28 | 000,000,049 | ---- | M]() -- C:\WINDOWS\NeroDigital.ini
[2012-04-11 14:21:15 | 000,000,790 | ---- | M]() -- C:\Documents and Settings\All Users\Desktop\Malwarebytes Anti-Malware.lnk
[2012-04-10 18:42:14 | 000,001,158 | ---- | M]() -- C:\WINDOWS\System32\wpa.dbl
[2012-04-05 19:11:33 | 000,120,832 | ---- | M]() -- C:\Documents and Settings\LOLO\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012-04-04 15:56:40 | 000,022,344 | ---- | M](Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys
[2012-04-02 11:00:55 | 000,001,263 | ---- | M]() -- C:\Documents and Settings\LOLO\Application Data\Microsoft\Internet Explorer\Quick Launch\Nero StartSmart.lnk
[2012-04-02 11:00:55 | 000,001,245 | ---- | M]() -- C:\Documents and Settings\All Users\Desktop\Nero StartSmart.lnk
[2012-03-29 13:45:23 | 000,002,474 | ---- | M]() -- C:\WINDOWS\wincmd.ini
[2012-03-29 11:25:48 | 000,054,156 | -H-- | M]() -- C:\WINDOWS\QTFont.qfn
[2012-03-20 18:48:43 | 000,000,218 | ---- | M]() -- C:\Documents and Settings\LOLO\.recently-used.xbel
[2012-03-19 21:45:21 | 000,002,267 | ---- | M]() -- C:\Documents and Settings\All Users\Desktop\Skype.lnk
[2012-03-18 11:13:00 | 000,131,072 | ---- | M](PlanetSoft.org) -- C:\Documents and Settings\LOLO\Desktop\BootTimer.exe
[12 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012-04-13 21:48:19 | 000,071,699 | ---- | C]() -- C:\Documents and Settings\LOLO\Desktop\router log.JPG
[2012-04-13 21:37:13 | 001,113,654 | ---- | C]() -- C:\Documents and Settings\LOLO\Desktop\router log.bmp
[2012-04-05 17:42:03 | 000,000,049 | ---- | C]() -- C:\WINDOWS\NeroDigital.ini
[2012-04-02 11:00:55 | 000,001,263 | ---- | C]() -- C:\Documents and Settings\LOLO\Application Data\Microsoft\Internet Explorer\Quick Launch\Nero StartSmart.lnk
[2012-04-02 11:00:55 | 000,001,245 | ---- | C]() -- C:\Documents and Settings\All Users\Desktop\Nero StartSmart.lnk
[2012-03-20 18:48:43 | 000,000,218 | ---- | C]() -- C:\Documents and Settings\LOLO\.recently-used.xbel
[2012-03-07 12:21:14 | 000,002,474 | ---- | C]() -- C:\WINDOWS\wincmd.ini
[2012-03-05 13:18:24 | 000,798,681 | ---- | C]() -- C:\Program Files\Voxengo Primary User Guide en.pdf
[2012-03-05 13:18:24 | 000,380,337 | ---- | C]() -- C:\Program Files\Voxengo Elephant User Guide en.pdf
[2012-03-05 13:18:24 | 000,009,847 | ---- | C]() -- C:\Program Files\License Agreement.rtf
[2012-02-02 02:16:23 | 002,638,742 | -H-- | C]() -- C:\Documents and Settings\LOLO\Local Settings\Application Data\IconCache.db
[2011-10-18 15:07:06 | 000,023,624 | ---- | C]() -- C:\WINDOWS\System32\drivers\hitmanpro35.sys
[2011-10-17 13:06:40 | 000,000,685 | ---- | C]() -- C:\WINDOWS\wininit.ini
[2011-08-14 11:40:06 | 000,573,440 | ---- | C]() -- C:\WINDOWS\System32\dwall_mrk.dll
[2011-07-20 01:28:52 | 000,256,000 | ---- | C]() -- C:\WINDOWS\PEV.exe
[2011-07-20 01:28:52 | 000,208,896 | ---- | C]() -- C:\WINDOWS\MBR.exe
[2011-07-20 01:28:52 | 000,098,816 | ---- | C]() -- C:\WINDOWS\sed.exe
[2011-07-20 01:28:52 | 000,080,412 | ---- | C]() -- C:\WINDOWS\grep.exe
[2011-07-20 01:28:52 | 000,068,096 | ---- | C]() -- C:\WINDOWS\zip.exe
[2011-03-18 01:53:24 | 006,578,688 | ---- | C]() -- C:\WINDOWS\System32\PSP MicroWarmer.dll
[2011-03-18 01:53:23 | 006,617,600 | ---- | C]() -- C:\WINDOWS\System32\PSP VintageWarmer2.dll
[2011-03-18 01:53:23 | 006,610,432 | ---- | C]() -- C:\WINDOWS\System32\PSP VintageWarmer.dll
[2011-02-23 18:46:51 | 000,057,344 | ---- | C]( ) -- C:\WINDOWS\System32\dwall_shell.dll
[2011-02-23 18:46:51 | 000,053,248 | ---- | C]() -- C:\WINDOWS\System32\dwall_wamp.dll
[2011-02-23 18:46:51 | 000,053,248 | ---- | C]() -- C:\WINDOWS\System32\dwall_excel.dll
[2011-02-23 18:46:51 | 000,045,056 | ---- | C]() -- C:\WINDOWS\System32\dwall_service.dll
[2011-02-23 18:46:51 | 000,045,056 | ---- | C]() -- C:\WINDOWS\System32\dwall_ldr.dll
[2011-02-08 02:03:24 | 000,000,155 | ---- | C]() -- C:\WINDOWS\winamp.ini
[2011-02-05 09:46:30 | 000,120,832 | ---- | C]() -- C:\Documents and Settings\LOLO\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011-02-05 08:05:37 | 000,034,288 | ---- | C]() -- C:\Documents and Settings\LOLO\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
[2011-02-05 08:05:37 | 000,000,136 | ---- | C]() -- C:\Documents and Settings\LOLO\Local Settings\Application Data\fusioncache.dat
[2011-02-05 07:52:00 | 000,000,061 | ---- | C]() -- C:\WINDOWS\smscfg.ini

========== LOP Check ==========

[2006-02-16 10:18:29 | 000,000,000 | ---D | M]-- C:\Documents and Settings\Administrator\Application Data\toshiba
[2011-02-09 18:35:53 | 000,000,000 | ---D | M]-- C:\Documents and Settings\All Users\Application Data\Ableton
[2012-02-15 12:22:20 | 000,000,000 | ---D | M]-- C:\Documents and Settings\All Users\Application Data\AllDup
[2012-03-05 12:02:44 | 000,000,000 | ---D | M]-- C:\Documents and Settings\All Users\Application Data\AltrixSoft
[2012-03-05 12:06:39 | 000,000,000 | ---D | M]-- C:\Documents and Settings\All Users\Application Data\Caphyon
[2012-04-10 18:43:56 | 000,000,000 | ---D | M]-- C:\Documents and Settings\All Users\Application Data\DefenseWall HIPS
[2011-10-18 15:12:34 | 000,000,000 | ---D | M]-- C:\Documents and Settings\All Users\Application Data\Hitman Pro
[2011-12-20 19:37:17 | 000,000,000 | ---D | M]-- C:\Documents and Settings\All Users\Application Data\IObit
[2012-03-05 12:06:35 | 000,000,000 | ---D | M]-- C:\Documents and Settings\All Users\Application Data\Key Metric Software
[2011-10-21 15:51:34 | 000,000,000 | ---D | M]-- C:\Documents and Settings\All Users\Application Data\Native Instruments
[2011-12-20 19:37:05 | 000,000,000 | ---D | M]-- C:\Documents and Settings\All Users\Application Data\QFX Software
[2011-10-20 19:28:46 | 000,000,000 | ---D | M]-- C:\Documents and Settings\All Users\Application Data\TEMP
[2012-03-08 14:55:11 | 000,000,000 | ---D | M]-- C:\Documents and Settings\All Users\Application Data\TuneUp Software
[2006-02-16 10:55:51 | 000,000,000 | ---D | M]-- C:\Documents and Settings\All Users\Application Data\Viewpoint
[2011-06-15 19:55:30 | 000,000,000 | ---D | M]-- C:\Documents and Settings\All Users\Application Data\VirginMedia
[2011-07-19 22:47:03 | 000,000,000 | ---D | M]-- C:\Documents and Settings\All Users\Application Data\WildTangent
[2011-07-19 22:43:11 | 000,000,000 | ---D | M]-- C:\Documents and Settings\All Users\Application Data\YAHOO
[2012-03-08 14:22:02 | 000,000,000 | ---D | M]-- C:\Documents and Settings\All Users\Application Data\YouTube Downloader
[2012-03-08 14:52:45 | 000,000,000 | -HSD | M]-- C:\Documents and Settings\All Users\Application Data\{32364CEA-7855-4A3C-B674-53D8E9B97936}
[2012-01-24 12:19:10 | 000,000,000 | ---D | M]-- C:\Documents and Settings\All Users\Application Data\{429CAD59-35B1-4DBC-BB6D-1DB246563521}
[2006-02-16 10:18:29 | 000,000,000 | ---D | M]-- C:\Documents and Settings\Default User\Application Data\toshiba
[2012-03-08 15:10:18 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\.oit
[2012-02-12 22:38:08 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\Ableton
[2012-03-09 13:54:28 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\AllDup
[2012-03-07 15:20:30 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\Ashampoo
[2011-03-18 02:06:33 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\Audio Ease
[2011-02-14 13:03:49 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\BID
[2012-02-06 21:29:55 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\cacaoweb
[2011-12-17 19:42:14 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\com.adobe.example.wilq.31780CAEAAA26670054AA51B21F17F0B86A843CE.1
[2012-04-13 22:10:51 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\DefenseWall HIPS
[2012-01-16 21:17:16 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\DVDVideoSoft
[2012-01-16 21:16:56 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\DVDVideoSoftIEHelpers
[2011-08-25 13:04:11 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\Easeware
[2012-03-13 01:06:13 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\FabFilter
[2011-05-18 00:53:38 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\FMA
[2011-05-24 17:13:05 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\GanymedeNet
[2011-02-19 17:53:21 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\InterVideo
[2011-12-20 19:36:02 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\IObit
[2011-04-10 10:31:40 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\IrfanView
[2012-01-04 14:18:37 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\IVONA ControlCenter
[2011-03-18 02:06:05 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\iZotope
[2012-03-05 12:07:30 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\Key Metric Software
[2012-01-29 17:43:58 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\Moonchild Productions
[2011-07-19 23:05:58 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\Opera
[2011-12-20 19:37:06 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\QFX Software
[2012-02-15 12:27:39 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\Rainmeter
[2011-11-23 02:02:33 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\Sony
[2012-03-12 22:07:26 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\TeamViewer
[2006-02-16 10:18:29 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\toshiba
[2012-03-08 14:54:10 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\TuneUp Software
[2012-03-05 13:27:42 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\Voxengo
[2012-03-20 18:42:00 | 000,000,000 | ---D | M]-- C:\Documents and Settings\LOLO\Application Data\Workrave
[2011-08-25 13:03:04 | 000,000,404 | ---- | M]() -- C:\WINDOWS\Tasks\DriverEasy Scheduled Scan.job

========== Purity Check ==========



========== Alternate Data Streams ==========

@Alternate Data Stream - 138 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C43ED645


z góry dziekuje i pozdrawiam

[Eugeniusz]

Możesz pokazać początek tej tabeli? Interesuje mnie który adres jest źródłowy a który docelowy.

[dylemat1]

proszę bardzo

---

Dodano: 14 kwie 2012, 19:36

a dokładnie:
Target: 192.168.0.2:0
Source: 176.9.17.226:0 / 79.125.9.76:0 /213.186.33.18:0/ 87.98.239.4:0/ 37.59.0.137:0 / 87.98.239.19:0/
przepraszam,ze w taki sposób ale nie wiem jak zrobić by rozszerzyć tabele

[Eugeniusz]

Fałszywy alarm SPI. Nie ma wpływu na sytuację.

C:\DefenseWallVC_Apps\HarddiskVolume1\Documents and Settings\LOLO\My Documents\Pobieranie

Uruchamiałeś OTL w trybie ograniczonym DefenseWall?

[dylemat1]

Nie.czy to znaczy ,że mam wyłączyć DefenseWalla i zrobić jeszcze skan otl-em?

[zord]

Logi prosze umieszczać w załączniku lub na dedykowanych do tego stronach np:

[Aby zobaczyć linki, zarejestruj się tutaj]

[Aby zobaczyć linki, zarejestruj się tutaj]

[Aby zobaczyć linki, zarejestruj się tutaj]

[Street]

siemka od jakiegoś czasu komputer zwalnia

A no siemano Skoro hitman i mbam nic nie wykrył być może wystarczy zwyczajna optymalizacja systemu, aktualizacja sterowników i defragmentacja dysku.

[Fix00ser]

pozostałość po usłudze Bonjour w wejściu

Kod:

O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)

może mieć wpływ na wolniejsze działanienetu lub też zrywanie połączeń sieciowych
Naprawa łańcuch-a Winsocka

[Aby zobaczyć linki, zarejestruj się tutaj]

natomiast tutek do skryptu OLDTimera poniżej

[Aby zobaczyć linki, zarejestruj się tutaj]

[Chakra]

ComboFix został użyty - pokaż zawartość pliku C:\ComboFix.txt.

Do OTL wklej:

Kod:

:OTL
O3 - HKU\S-1-5-21-3852616517-519138961-1039179079-1005\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O4 - HKLM..\Run: [Copy Handler] File not found
@Alternate Data Stream - 138 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:C43ED645

:Commands
[emptytemp]

Wykonaj skrypt,pokaż raport.

Uruchom OTL ponownie i wklej:

Kod:

msconfig
netsvcs
/md5start
atapi.sys
winlogon.exe
explorer.exe
beep.sys
agp440.sys
svchost.exe
userinit.exe
ntfs.sys
/md5stop

Skanuj,pokaż log. (wraz z Extras! Do tego musisz uaktywnić opcję Rejestr dodatkowy )


Zaprezentuj jeszcze logi z RSIT i Gmer:

[Aby zobaczyć linki, zarejestruj się tutaj]

[Aby zobaczyć linki, zarejestruj się tutaj]

[dylemat1]

Witam ponownie!
raport po wykonaniu skryptu

[Aby zobaczyć linki, zarejestruj się tutaj]

potem próbowałem bezskutecznie wykonać te polecenia,dla pewności wyłączyłem DefenseWall:
msconfig
netsvcs
/md5start
atapi.sys
winlogon.exe
explorer.exe
beep.sys
agp440.sys
svchost.exe
userinit.exe
ntfs.sys
/md5stop
raport

[Aby zobaczyć linki, zarejestruj się tutaj]

[Chakra]

Co z plikiem ComboFix.txt?

Po tym skrypcie:

Kod:

msconfig
netsvcs
/md5start
atapi.sys
winlogon.exe
explorer.exe
beep.sys
agp440.sys
svchost.exe
userinit.exe
ntfs.sys
/md5stop

w OTL należy kliknąć Skanuj,a nie Wykonaj skrypt.(wyłącz przy okazji ochronę rezydentną na czas tych działań, by nic ich nie zakłócało)

Czekam też na logi z RSIT i Gmer.

[dylemat1]

nowe logi
OTL

[Aby zobaczyć linki, zarejestruj się tutaj]

EXTRAS

[Aby zobaczyć linki, zarejestruj się tutaj]

ComboFixa używałem wieki temu i nie pamiętam nawet co to było, ale na wszelki wypadek wstawiam:

[Aby zobaczyć linki, zarejestruj się tutaj]

logi z RSIT
info

[Aby zobaczyć linki, zarejestruj się tutaj]

log

[Aby zobaczyć linki, zarejestruj się tutaj]

co do gmera straszliwie długgggggggo to trwa ale dodam jak tylko skończy

[Chakra]

Log z ComboFix wskazuje, że kiedyś była dosyć spora infekcja. Sprawdzimy, czy aby wszystko z wtedy się usunęło (już wtedy nie zostało wszystko usunięte, ale możliwe że antywirus od tamtego czasu już to wykrył).

Do OTL wklej:

Kod:

:Files
C:\DOCUME~1\LOLO\LOCALS~1\Temp\catchme.sys
C:\WINDOWS\PEV.exe
C:\WINDOWS\MBR.exe
C:\WINDOWS\sed.exe
C:\WINDOWS\grep.exe
C:\WINDOWS\zip.exe

:Services
catchme

Wykonaj skrypt,pokaż raport.

Co z poprzednim skryptem do OTL po którym trzeba kliknąć Skanuj?

Pobierz

[Aby zobaczyć linki, zarejestruj się tutaj]

i wklej do niego:

Kod:

:dir
C:\Documents and Settings\kkk\Application Data
C:\WINDOWS
C:\
D:\
E:\

:reg
HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2

:service
MHN

Look,pokaż raport.

[dylemat1]

Siemandero, to jedziemy
log z systemlook

[Aby zobaczyć linki, zarejestruj się tutaj]

Do OTL wklej:

Kod: Zaznacz cały
:Files
C:\DOCUME~1\LOLO\LOCALS~1\Temp\catchme.sys
C:\WINDOWS\PEV.exe
C:\WINDOWS\MBR.exe
C:\WINDOWS\sed.exe
C:\WINDOWS\grep.exe
C:\WINDOWS\zip.exe

:Services
catchme

otrzymany log:

[Aby zobaczyć linki, zarejestruj się tutaj]

po skanowaniu otl-em
extras

[Aby zobaczyć linki, zarejestruj się tutaj]

otl.txt

[Aby zobaczyć linki, zarejestruj się tutaj]

---

Dodano: 18 kwie 2012, 13:12

log z gmera

[Aby zobaczyć linki, zarejestruj się tutaj]

[Chakra]

Do OTL wklej:

Kod:

:Files
C:\WINDOWS\SWREG.exe
C:\WINDOWS\SWSC.exe
C:\WINDOWS\SWXCACLS.exe
C:\ComboFix
C:\Qoobox
Recycled /alldrives

Wykonaj skrypt,pokaż raport.

Podepnij wszystkie pamięci przenośne jakie posiadasz i użyj

[Aby zobaczyć linki, zarejestruj się tutaj]

z opcji Research.Pokaż raport.

Pliki:

Kod:

C:\WINDOWS\NOCLOSE.PIF
C:\END

wrzuć na jakiś serwer (np. mediafire) i podaj link.

[dylemat1]

Do OTL wklej:

Kod: Zaznacz cały
:Files
C:\WINDOWS\SWREG.exe
C:\WINDOWS\SWSC.exe
C:\WINDOWS\SWXCACLS.exe
C:\ComboFix
C:\Qoobox
Recycled /alldrives


Wykonaj skrypt, pokaż raport.

[Aby zobaczyć linki, zarejestruj się tutaj]

log z usbfix

[Aby zobaczyć linki, zarejestruj się tutaj]

plik/katalog: C:\ENDzostał usuniety przez Advanced SystemCare 5 dzis,bo zdiagozawal go jako malware. co do C:\WINDOWS\NOCLOSE.PIFistnieje tylko skrot do tego pliku, nie moge znalezc calosci.
poza tym komuputer muli okrutnie, ogladanie czy sluchanie muzyki mija sie z celem. uzylem boot timera zeby zobaczyc jak dlugo trwa ladowanie - pokazal 222 sek, a jeszcze niedawno trawlo to wszystko niespelna 60sek. skanowanie, wykonywanie skryptow itp trwa cala wiecznosc. uzylem wspomnianego Advanced SystemCaredo optymalizacji i nic. uzylem CCleaner oraz Puran Defrag - zero rezultatow. chyba jeszcze tylko sterownikow nie aktualizowalem. co do pendrivow to pamietam ze uzywalem PANDA USB VACCINE, ktory modyfikuje autostart.inf i nie dopuszcza do infekcji,czy jakos tak...Malwarebytes Anti-Malware zauktualizowane nic nie znajduje...juz nie wiem co robic...format?

[Chakra]

Podepnij pamięci ponownie i użyj USBFix z opcji Deletion.

Ten plik (nawet jeśli to jest skrót, to nadal można na nim wykonać operacje):

Kod:

C:\WINDOWS\NOCLOSE.PIF

kliknij PPM -> Właściwości -> pokaż screen z karty Ogólne.

uzylem boot timera zeby zobaczyc jak dlugo trwa ladowanie - pokazal 222 sek

Pamiętasz może, co wyznaczył jako najbardziej czasożerne?

Wykonaj pełne skanowanie dysków poprzez

[Aby zobaczyć linki, zarejestruj się tutaj]

Napisz, jeśli coś wykryje (podaj dokładne lokalizacje).

[dylemat1]

Nie było mnie dłuższy czas, ponieważ komp zupełnie odmówił posłuszeństwa. wczesnej jednak zrobiłem skanDr.Web CureIT! jak zalecałeś. nic nie znalazł, za to uznał OTL-a za zagrożenie????

Pamiętasz może, co wyznaczył jako najbardziej czasożerne?

niestety bootimer, którego używałem mierzy tylko czas od resetu do załadowania windowsa, bardzo ograniczony programik. próbowałem zainstalować inne dostępne programy:BootVis Tool , Solute i paru innych,już nie pamiętam jakich. i żaden. ŻADEN. nie chciał się zainstalować, wyskakiwały jakieś błędy - porażka.
nie pozostało mi nic innego jak postawić system od nowa i tak tez zrobiłem. chciałbym podziękować wszystkim za rady i pomoc. niech moc będzie z Wami temat do zamknięcia.

[ReviewsAntivirus]

za to uznał OTL-a za zagrożenie????

To jest false positive (fałszywy alarm).