Zaloguj się

Fisz · 28.07.2012, 14:39

Witam,
Wczoraj podłapałem TR/ATRAPS.Gen / Gen2. Zrobiłem skana Combofixem, MBAM''em, Avirą + usunąłem kilka podejrzanych wpisów w OTL.
Czy ten log jest czysty?

Log z OTL:

Kod:

OTL logfile created on: 2012-07-28 15:05:29 - Run 3

OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\Damian\Desktop

Home Premium Edition(Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 9.0.8112.16421)

Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd



3,25 Gb Total Physical Memory | 2,24 Gb Available Physical Memory | 69,02% Memory free

6,50 Gb Paging File | 5,32 Gb Available in Paging File | 81,86% Paging File free

Paging file location(s): d:\pagefile.sys 0 0 [binary data]



%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 29,90 Gb Total Space | 7,04 Gb Free Space | 23,55% Space Free | Partition Type: NTFS

Drive D: | 250,00 Gb Total Space | 32,17 Gb Free Space | 12,87% Space Free | Partition Type: NTFS

Drive E: | 266,17 Gb Total Space | 126,07 Gb Free Space | 47,36% Space Free | Partition Type: NTFS



Computer Name: DAMIAN-KOMPUTER | User Name: Damian | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days



[color=#E56717]========== Processes (SafeList) ==========[/color]



PRC - [2012-07-27 20:18:39 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\Damian\Desktop\OTL.exe

PRC - [2012-07-17 19:58:40 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe

PRC - [2012-05-08 23:15:14 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2012-05-08 23:15:13 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

PRC - [2012-05-08 23:15:13 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2012-05-08 23:15:13 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe

PRC - [2012-02-25 01:16:56 | 000,354,120 | ---- | M] () -- C:\Program Files\Connectify\ConnectifyNetServices.exe

PRC - [2012-02-25 01:16:56 | 000,278,344 | ---- | M] (Connectify) -- C:\Program Files\Connectify\Connectifyd.exe

PRC - [2012-02-25 01:16:40 | 000,069,632 | ---- | M] () -- C:\Program Files\Connectify\ConnectifyService.exe

PRC - [2010-05-10 14:06:56 | 000,139,264 | ---- | M] () -- C:\Program Files\Razer\Abyssus\razertra.exe

PRC - [2010-05-10 14:04:08 | 000,223,744 | ---- | M] () -- C:\Program Files\Razer\Abyssus\razerhid.exe

PRC - [2010-03-10 15:26:48 | 000,189,728 | ---- | M] (Protexis Inc.) -- C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe

PRC - [2009-08-25 16:56:40 | 000,323,658 | ---- | M] (Razer Inc.) -- C:\Program Files\Razer\Abyssus\razerofa.exe

PRC - [2009-07-14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2009-07-14 03:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2009-07-14 03:14:15 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe

PRC - [2008-10-13 23:44:44 | 000,159,232 | ---- | M] (matt.malensek.net) -- C:\Program Files\3RVX\3RVX.exe

PRC - [2006-12-03 01:14:03 | 000,310,784 | ---- | M] (http://autoconnect.prv.pl) -- C:\Program Files\AutoConnect\AutoConnect.exe





[color=#E56717]========== Modules (No Company Name) ==========[/color]



MOD - [2012-07-17 19:58:40 | 002,003,424 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll

MOD - [2012-01-08 15:41:12 | 000,093,696 | ---- | M] () -- C:\Program Files\FileZilla FTP Client\fzshellext.dll

MOD - [2010-08-23 22:00:55 | 000,189,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\MHook\76f6b895f1d8ef95e56a76ec5f82fc8b\MHook.ni.dll

MOD - [2010-08-23 22:00:55 | 000,114,176 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WaveLibMixer\530503f7b0d4e4735962f30d85a04647\WaveLibMixer.ni.dll

MOD - [2010-08-23 22:00:55 | 000,058,368 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\CoreAudioApi\150b3da17e6faf802793f2a44c079616\CoreAudioApi.ni.dll

MOD - [2010-08-23 22:00:54 | 000,238,080 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\3RVX\629fd3d28b8843a5d9bfc2f39bf6d92d\3RVX.ni.exe

MOD - [2010-05-10 14:06:56 | 000,139,264 | ---- | M] () -- C:\Program Files\Razer\Abyssus\razertra.exe

MOD - [2010-05-10 14:04:08 | 000,223,744 | ---- | M] () -- C:\Program Files\Razer\Abyssus\razerhid.exe

MOD - [2009-07-14 10:07:18 | 000,311,296 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_pl_b77a5c561934e089\mscorlib.resources.dll

MOD - [2009-07-14 06:43:04 | 012,430,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\fedf1ba58dced4f0b3f8c457648ceed9\System.Windows.Forms.ni.dll

MOD - [2009-07-14 06:42:57 | 001,586,688 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ead6be8b410d56b5576b10e56af2c180\System.Drawing.ni.dll

MOD - [2009-07-14 06:42:55 | 000,025,600 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\Accessibility\003d2d74243cab7e412d36416bbf0a3d\Accessibility.ni.dll

MOD - [2009-07-14 06:42:40 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5dd9f783008543df3e642ff1e99de4e8\System.Xml.ni.dll

MOD - [2009-07-14 06:42:37 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\4b1350e31ff09cc583b34854816d8036\System.Configuration.ni.dll

MOD - [2009-07-14 06:42:36 | 007,949,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\5ba3bf5367fc012300c6566f20cb7f54\System.ni.dll

MOD - [2009-07-14 06:42:30 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\8c1770d45c63cf5c462eeb945ef9aa5d\mscorlib.ni.dll





[color=#E56717]========== Win32 Services (SafeList) ==========[/color]



SRV - [2012-05-08 23:15:14 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)

SRV - [2012-05-08 23:15:13 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2012-02-25 01:16:40 | 000,069,632 | ---- | M] () [Auto | Running] -- C:\Program Files\Connectify\ConnectifyService.exe -- (Connectify)

SRV - [2011-03-21 13:21:24 | 000,632,832 | ---- | M] (Nokia) [Disabled | Stopped] -- C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- (ServiceLayer)

SRV - [2010-07-20 11:40:48 | 000,407,336 | ---- | M] (Valve Corporation) [Disabled | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2010-06-25 19:07:20 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files\WinPcap\rpcapd.exe -- (rpcapd)

SRV - [2010-06-07 17:05:06 | 000,240,232 | ---- | M] (NVIDIA Corporation) [Disabled | Stopped] -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2010-03-10 15:26:48 | 000,189,728 | ---- | M] (Protexis Inc.) [Auto | Running] -- C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)

SRV - [2009-07-14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009-07-14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2007-05-31 16:21:24 | 000,379,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)

SRV - [2007-05-31 16:21:18 | 000,183,688 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)





[color=#E56717]========== Driver Services (SafeList) ==========[/color]



DRV - File not found [Unknown (0) | Boot | Unknown] ---- (Winflash)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\vmnetadapter.sys -- (VMnetAdapter)

DRV - File not found [Kernel | Boot | Stopped] -- system32\DRIVERS\vmci.sys -- (vmci)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\netr73.sys -- (netr73)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Damian\AppData\Local\Temp\catchme.sys -- (catchme)

DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\ar5211.sys -- (AR5211)

DRV - File not found [Kernel | On_Demand | Unknown] ---- (apqp8zyu)

DRV - [2012-06-05 16:33:00 | 000,158,552 | ---- | M] (Oracle Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\VBoxDrv.sys -- (VBoxDrv)

DRV - [2012-06-05 16:33:00 | 000,116,056 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VBoxNetFlt.sys -- (VBoxNetFlt)

DRV - [2012-06-05 16:33:00 | 000,104,792 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)

DRV - [2012-06-05 16:33:00 | 000,091,992 | ---- | M] (Oracle Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\VBoxUSBMon.sys -- (VBoxUSBMon)

DRV - [2012-05-08 23:15:14 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2012-05-08 23:15:14 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2012-04-07 17:20:50 | 000,013,824 | ---- | M] (Scott) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\USBDrv.sys -- (usbUDisc)

DRV - [2012-02-15 16:23:45 | 000,027,248 | ---- | M] (Connectify) [Kernel | System | Running] -- C:\Windows\System32\drivers\cnnctfy2.sys -- (cnnctfy2)

DRV - [2011-12-19 15:11:58 | 000,082,736 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VBoxUSB.sys -- (VBoxUSB)

DRV - [2011-10-19 17:56:50 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr)

DRV - [2011-09-21 10:25:34 | 000,021,992 | ---- | M] (CPUID) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\cpuz135_x32.sys -- (cpuz135)

DRV - [2010-12-02 15:13:30 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)

DRV - [2010-12-02 15:13:28 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)

DRV - [2010-12-02 15:13:26 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)

DRV - [2010-12-02 15:13:22 | 000,018,304 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)

DRV - [2010-12-02 13:36:42 | 000,137,600 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdnsu.sys -- (nmwcdnsu)

DRV - [2010-12-02 13:36:42 | 000,008,576 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nmwcdnsuc.sys -- (nmwcdnsuc)

DRV - [2010-08-17 22:11:53 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)

DRV - [2010-06-25 19:07:14 | 000,035,088 | ---- | M] (CACE Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\npf.sys -- (NPF)

DRV - [2010-06-17 16:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2010-06-08 01:57:00 | 010,888,168 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2010-05-07 15:53:50 | 001,227,776 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)

DRV - [2009-12-21 21:50:16 | 000,005,760 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vHidDev.sys -- (vHidDev)

DRV - [2009-10-30 10:53:42 | 000,009,216 | ---- | M] (Razer (Asia-Pacific) Pte Ltd) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Abyssus.sys -- (Abyssus03)

DRV - [2009-07-14 01:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)

DRV - [2009-07-14 01:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)

DRV - [2008-08-26 10:26:12 | 000,018,816 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\pccsmcfd.sys -- (pccsmcfd)

DRV - [2006-10-02 04:10:42 | 000,021,048 | ---- | M] (ABIT) [Kernel | System | Running] -- C:\Windows\System32\drivers\uGuru.sys -- (UGURU)





[color=#E56717]========== Standard Registry (SafeList) ==========[/color]





[color=#E56717]========== Internet Explorer ==========[/color]



IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC





IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0





IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1805335180-3843761308-327928693-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-1805335180-3843761308-327928693-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-1805335180-3843761308-327928693-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



[color=#E56717]========== FireFox ==========[/color]



FF - prefs.js..browser.startup.homepage: "www.google.pl"

FF - prefs.js..extensions.enabledItems: {46868735-c3fa-47ce-8ce7-cce51a66aceb}:1.2

FF - prefs.js..extensions.enabledItems: {9D6218B8-03C7-4b91-AA43-680B305DD35C}:1.7.9.7

FF - prefs.js..extensions.enabledItems: [email protected]:1.6.2

FF - prefs.js..extensions.enabledItems: {aff87fa2-a58e-4edd-b852-0a20203c1e17}:0.8

FF - prefs.js..extensions.enabledItems: [email protected]:5.0.31.0

FF - prefs.js..extensions.enabledItems: [email protected]:1.0.53.2

FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.4.51

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - user.js - File not found



FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_262.dll ()

FF - HKLM\Software\MozillaPlugins\@idsoftware.com/QuakeLive: C:\ProgramData\id Software\QuakeLive\npquakezero.dll (id Software Inc.)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)

FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)

FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.450: C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.448: C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)

FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=:File not found

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Damian\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll File not found

FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Damian\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll File not found

FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)



FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012-07-17 19:58:40 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012-04-18 18:52:45 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011-07-01 22:27:04 | 000,000,000 | ---D | M]



[2010-07-08 12:32:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Damian\AppData\Roaming\mozilla\Extensions

[2012-07-13 22:21:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Damian\AppData\Roaming\mozilla\Firefox\Profiles\ioaek3u2.default\extensions

[2010-07-08 12:34:21 | 000,000,000 | ---D | M] (oldbar) -- C:\Users\Damian\AppData\Roaming\mozilla\Firefox\Profiles\ioaek3u2.default\extensions\{46868735-c3fa-47ce-8ce7-cce51a66aceb}

[2011-12-04 17:05:42 | 000,000,000 | ---D | M] (Battlefield Heroes Updater) -- C:\Users\Damian\AppData\Roaming\mozilla\Firefox\Profiles\ioaek3u2.default\extensions\[email protected]

[2011-03-07 16:14:07 | 000,000,000 | ---D | M] (Battlefield Play4Free) -- C:\Users\Damian\AppData\Roaming\mozilla\Firefox\Profiles\ioaek3u2.default\extensions\[email protected]

[2012-02-18 23:41:31 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2011-09-18 13:27:55 | 000,052,184 | ---- | M] () (No name found) -- C:\USERS\DAMIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\IOAEK3U2.DEFAULT\EXTENSIONS\{9D6218B8-03C7-4B91-AA43-680B305DD35C}.XPI

[2011-11-09 18:37:23 | 000,042,737 | ---- | M] () (No name found) -- C:\USERS\DAMIAN\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\IOAEK3U2.DEFAULT\EXTENSIONS\{AFF87FA2-A58E-4EDD-B852-0A20203C1E17}.XPI

[2012-07-17 19:58:40 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2012-02-15 16:48:15 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2012-02-15 16:45:47 | 000,002,767 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml

[2012-02-15 16:45:47 | 000,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml

[2012-02-15 16:45:47 | 000,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml

[2012-02-15 16:45:47 | 000,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml

[2012-02-15 16:45:47 | 000,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml

[2012-02-15 16:45:47 | 000,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml



[color=#E56717]========== Chrome==========[/color]



CHR - default_search_provider: Google (Enabled)

CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}

CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}

CHR - homepage: http://www.google.com/

CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Damian\AppData\Local\Google\Chrome\User Data\PepperFlash\11.1.31.203\pepflashplayer.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Damian\AppData\Local\Google\Chrome\Application\17.0.963.56\gcswf32.dll

CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_262.dll

CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer

CHR - plugin: Native Client (Enabled) = C:\Users\Damian\AppData\Local\Google\Chrome\Application\17.0.963.56\ppGoogleNaClPluginChrome.dll

CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Damian\AppData\Local\Google\Chrome\Application\17.0.963.56\pdf.dll

CHR - plugin: Adobe Acrobat (Disabled) = C:\Program Files\Adobe\Reader 9.0\Reader\Browser\nppdf32.dll

CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll

CHR - plugin: Java Deployment Toolkit 6.0.310.5 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll

CHR - plugin: Java(TM) Platform SE 6 U31 (Enabled) = C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll

CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL

CHR - plugin: RealPlayer(tm) G2 LiveConnect-Enabled Plug-In (32-bit)(Enabled) = C:\Users\Damian\AppData\Local\Google\Chrome\Application\plugins\nppl3260.dll

CHR - plugin: RealPlayer Version Plugin (Enabled) = C:\Users\Damian\AppData\Local\Google\Chrome\Application\plugins\nprpjplug.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Users\Damian\AppData\Local\Google\Chrome\Application\plugins\npqtplugin.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Users\Damian\AppData\Local\Google\Chrome\Application\plugins\npqtplugin2.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Users\Damian\AppData\Local\Google\Chrome\Application\plugins\npqtplugin3.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Users\Damian\AppData\Local\Google\Chrome\Application\plugins\npqtplugin4.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Users\Damian\AppData\Local\Google\Chrome\Application\plugins\npqtplugin5.dll

CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Users\Damian\AppData\Local\Google\Chrome\Application\plugins\npqtplugin6.dll

CHR - plugin: Silverlight Plug-In (Enabled) = C:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll

CHR - plugin: NVIDIA 3D Vision (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dv.dll

CHR - plugin: NVIDIA 3D VISION (Enabled) = C:\Program Files\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll

CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll

CHR - plugin: QUAKE LIVE (Enabled) = C:\ProgramData\id Software\QuakeLive\npquakezero.dll

CHR - plugin: Default Plug-in (Enabled) = default_plugin

CHR - Extension: Angry Birds = C:\Users\Damian\AppData\Local\Google\Chrome\User Data\Default\Extensions\aknpkdffaafgjchaibgeefbgmgeghloj\1.5.0.7_0\



O1 HOSTS File: ([2012-07-27 20:12:16 | 000,000,027 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [Abyssus] C:\Program Files\Razer\Abyssus\razerhid.exe ()

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)

O4 - Startup: C:\Users\Damian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3RVX.exe — skrót.lnk = C:\Program Files\3RVX\3RVX.exe (matt.malensek.net)

O4 - Startup: C:\Users\Damian\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AutoConnect.lnk = C:\Program Files\AutoConnect\AutoConnect.exe (http://autoconnect.prv.pl)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-1805335180-3843761308-327928693-1001\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-1805335180-3843761308-327928693-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-1805335180-3843761308-327928693-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\S-1-5-21-1805335180-3843761308-327928693-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: LogonHoursAction = 2

O7 - HKU\S-1-5-21-1805335180-3843761308-327928693-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: DontDisplayLogonHoursWarnings = 1

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 172.16.200.1 194.204.152.34 194.204.159.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1C406E83-A03C-423B-BD1D-56FAEAAFD4F2}: Domain = connectify

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{347E5095-F227-48E9-B340-3F183FB070F7}: DhcpNameServer = 172.16.200.1 194.204.152.34 194.204.159.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9d361892-e9d9-49f1-add5-2df539f886c8}: NameServer = 194.204.152.34 194.204.159.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D6A69E62-DC94-4D04-B5F8-983E660AE6BA}: NameServer = 192.168.165.1

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -File not found

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009-09-01 14:51:39 | 000,000,000 | R--D | M] - D:\autorun.inf -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = ComFile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)



[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]



[2012-07-27 21:31:16 | 000,000,000 | ---D | C] -- C:\Windows\temp

[2012-07-27 21:30:05 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN

[2012-07-27 20:18:38 | 000,597,504 | ---- | C] (OldTimer Tools) -- C:\Users\Damian\Desktop\OTL.exe

[2012-07-27 20:12:15 | 000,000,000 | ---D | C] -- C:\Users\Damian\AppData\Local\temp

[2012-07-27 20:06:38 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe

[2012-07-27 20:06:38 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe

[2012-07-27 20:06:38 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe

[2012-07-27 20:04:48 | 004,719,842 | R--- | C] (Swearware) -- C:\Users\Damian\Desktop\ComboFix.exe

[2012-07-10 22:55:35 | 000,000,000 | ---D | C] -- C:\Users\Damian\Desktop\szablonzofferia

[2012-07-09 20:30:32 | 000,000,000 | ---D | C] -- C:\Users\Damian\Desktop\sieci

[2012-07-02 21:21:43 | 000,000,000 | ---D | C] -- C:\Users\Damian\Desktop\gtzn



[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]



[2012-07-28 14:17:25 | 000,002,432 | ---- | M] () -- C:\Users\Damian\AppData\Local\TempGz3760.html

[2012-07-28 14:15:01 | 000,750,200 | ---- | M] () -- C:\Windows\System32\perfh015.dat

[2012-07-28 14:15:01 | 000,663,122 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2012-07-28 14:15:01 | 000,160,700 | ---- | M] () -- C:\Windows\System32\perfc015.dat

[2012-07-28 14:15:01 | 000,125,252 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2012-07-28 14:14:01 | 000,022,720 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2012-07-28 14:14:01 | 000,022,720 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2012-07-28 14:08:57 | 000,065,536 | ---- | M] () -- C:\Windows\System32\Ikeext.etl

[2012-07-28 14:08:53 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2012-07-28 14:08:46 | 2616,053,760 | -HS- | M] () -- C:\hiberfil.sys

[2012-07-27 23:34:19 | 000,002,432 | ---- | M] () -- C:\Users\Damian\AppData\Local\TempqT5404.html

[2012-07-27 23:34:19 | 000,002,089 | ---- | M] () -- C:\Users\Damian\AppData\Local\TempZp5404.html

[2012-07-27 20:18:39 | 000,597,504 | ---- | M] (OldTimer Tools) -- C:\Users\Damian\Desktop\OTL.exe

[2012-07-27 20:12:16 | 000,000,027 | ---- | M] () -- C:\Windows\System32\drivers\etc\hosts

[2012-07-27 20:05:13 | 004,719,842 | R--- | M] (Swearware) -- C:\Users\Damian\Desktop\ComboFix.exe

[2012-07-23 07:43:05 | 000,061,174 | ---- | M] () -- C:\Users\Damian\Desktop\allegro-logo.bmp

[2012-07-13 07:16:53 | 000,459,024 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2012-07-10 22:55:11 | 015,829,631 | ---- | M] () -- C:\Users\Damian\Desktop\szablonzofferia.zip

[2012-07-03 16:21:47 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe

[2012-07-03 16:21:47 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl

[2012-07-03 13:46:44 | 000,022,344 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2012-06-28 22:17:27 | 670,967,808 | ---- | M] () -- C:\Users\Damian\Desktop\elementaryos-unstable-i386.20120628.iso



[color=#E56717]========== Files Created - No Company Name ==========[/color]



[2012-07-28 14:10:06 | 000,002,432 | ---- | C] () -- C:\Users\Damian\AppData\Local\TempGz3760.html

[2012-07-27 21:52:52 | 000,002,432 | ---- | C] () -- C:\Users\Damian\AppData\Local\TempqT5404.html

[2012-07-27 21:52:52 | 000,002,089 | ---- | C] () -- C:\Users\Damian\AppData\Local\TempZp5404.html

[2012-07-27 20:06:38 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe

[2012-07-27 20:06:38 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe

[2012-07-27 20:06:38 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe

[2012-07-27 20:06:38 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe

[2012-07-27 20:06:38 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe

[2012-07-23 07:43:09 | 000,061,174 | ---- | C] () -- C:\Users\Damian\Desktop\allegro-logo.bmp

[2012-07-10 22:54:06 | 015,829,631 | ---- | C] () -- C:\Users\Damian\Desktop\szablonzofferia.zip

[2012-06-28 21:45:44 | 670,967,808 | ---- | C] () -- C:\Users\Damian\Desktop\elementaryos-unstable-i386.20120628.iso

[2012-04-21 17:12:45 | 000,000,103 | ---- | C] () -- C:\Windows\pro.INI

[2012-04-12 17:13:36 | 000,110,592 | ---- | C] () -- C:\Windows\System32\FsUsbExDevice.Dll

[2012-04-12 17:04:59 | 000,000,059 | ---- | C] () -- C:\Windows\wininit.ini

[2012-04-12 16:58:31 | 002,067,140 | R--- | C] () -- C:\Windows\System32\avcodec.dll

[2011-12-29 15:06:52 | 000,004,096 | ---- | C] () -- C:\Windows\d3dx.dat

[2011-12-21 19:59:52 | 000,000,032 | R--- | C] () -- C:\ProgramData\hash.dat

[2011-10-10 16:23:49 | 000,000,032 | ---- | C] () -- C:\Windows\Menu.INI

[2011-08-31 23:53:39 | 000,165,672 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat

[2011-05-21 13:57:52 | 000,000,023 | ---- | C] () -- C:\Windows\BlendSettings.ini

[2011-05-14 11:12:01 | 000,000,050 | ---- | C] () -- C:\Windows\System32\BRIDF10A.DAT

[2011-05-14 11:11:59 | 000,000,404 | ---- | C] () -- C:\Windows\BRWMARK.INI

[2011-04-09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat

[2010-12-27 21:53:30 | 000,053,248 | ---- | C] () -- C:\Windows\System32\CommonDL.dll

[2010-12-27 21:53:30 | 000,002,413 | ---- | C] () -- C:\Windows\System32\lgAxconfig.ini

[2010-11-06 12:11:04 | 000,138,056 | ---- | C] () -- C:\Users\Damian\AppData\Roaming\PnkBstrK.sys

[2010-11-06 12:10:42 | 002,427,248 | ---- | C] () -- C:\Windows\System32\pbsvc_heroes.exe

[2010-08-08 14:24:44 | 000,139,080 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys

[2010-08-08 14:24:33 | 000,270,240 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe

[2010-07-08 16:40:29 | 000,000,640 | RHS- | C] () -- C:\Users\Damian\ntuser.pol



[color=#E56717]========== LOP Check ==========[/color]



[2010-09-29 23:39:18 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\.minecraft

[2011-12-29 15:06:55 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\Broken Rules

[2010-08-31 12:58:55 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\Canneverbe Limited

[2012-02-27 00:22:40 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\Crayon Physics Deluxe

[2012-07-02 22:22:40 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\DAEMON Tools Lite

[2012-06-24 00:10:38 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\Dropbox

[2012-07-27 20:34:33 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\FileZilla

[2011-12-07 20:05:55 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\FireShot

[2012-07-17 18:01:16 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\foobar2000

[2010-08-31 22:28:00 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\Gadu-Gadu 10

[2012-04-03 21:30:23 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\gtk-2.0

[2010-12-10 21:36:53 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\HD Tune Pro

[2011-11-10 23:53:54 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\inkscape

[2012-02-20 22:54:03 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\IrfanView

[2011-08-31 14:55:51 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\LolClient

[2011-04-23 19:46:52 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\Need for Speed World

[2010-12-29 19:56:38 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\Nokia

[2010-12-29 19:56:38 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\Nokia Ovi Suite

[2010-07-31 00:07:47 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\NoNameScript

[2012-07-24 16:34:27 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\Notepad++

[2010-07-28 21:21:17 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\OpenFM

[2010-07-09 00:18:13 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\Opera

[2010-12-29 19:52:15 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\PC Suite

[2012-03-28 12:24:52 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\Rovio

[2012-05-01 14:17:11 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\runic games

[2012-04-12 17:20:23 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\Samsung

[2010-09-20 13:15:21 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\Softland

[2011-12-02 20:14:18 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\TS3Client

[2012-07-28 15:05:00 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\uTorrent

[2011-07-04 15:10:17 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\Windows Live Writer

[2012-06-08 20:02:46 | 000,000,000 | ---D | M] -- C:\Users\Damian\AppData\Roaming\Wireshark

[2012-07-27 20:32:11 | 000,032,608 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT



[color=#E56717]========== Purity Check ==========[/color]







< End of report >

Z góry dzięki za pomoc Smile

Waves · 28.07.2012, 15:31

Proszę przeskanuj ten plik na

[Aby zobaczyć linki, zarejestruj się tutaj]

:

Kod:
C:\Windows\System32\pbsvc_heroes.exe

A może go znasz?

Do OTL w własne pole skanowania skrypt wklej:

Kod:
:Processes

Killallprocesses

:Files

C:\Users\Damian\AppData\Local\Temp*

:Commands

[EMPTYTEMP]

[EMPTYFLASH]

Wykonaj skrypt.

Fisz · 28.07.2012, 15:40

pbsvc_heroes.exe = antycheat Battlefield Heroes - plik czysty:

[Aby zobaczyć linki, zarejestruj się tutaj]

Log wykonanego skryptu - firefox się "trochę" wyczyścił Smile

Kod:
All processes killed

========== PROCESSES ==========

========== FILES ==========

C:\Users\Damian\AppData\Local\temp\WPDNSE folder moved successfully.

C:\Users\Damian\AppData\Local\temp\acro_rd_dir folder moved successfully.

C:\Users\Damian\AppData\Local\temp folder moved successfully.

C:\Users\Damian\AppData\Local\TempGz3760.html moved successfully.

C:\Users\Damian\AppData\Local\Temporary Internet Files folder moved successfully.

C:\Users\Damian\AppData\Local\TempqT5404.html moved successfully.

C:\Users\Damian\AppData\Local\TempZp5404.html moved successfully.

========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Damian

->Temporary Internet Files folder emptied: 990987 bytes

->Java cache emptied: 1 bytes

->FireFox cache emptied: 420922007 bytes

->Google Chrome cache emptied: 6116272 bytes

->Apple Safari cache emptied: 0 bytes

->Opera cache emptied: 0 bytes

->Flash cache emptied: 8096 bytes

User: Default

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 0 bytes

User: Public

->Temp folder emptied: 0 bytes

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 0 bytes

%systemroot%\System32 .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 0 bytes

RecycleBin emptied: 0 bytes

Total Files Cleaned = 408,00 mb

[EMPTYFLASH]

User: All Users

User: Damian

->Flash cache emptied: 0 bytes

User: Default

User: Default User

User: Public

Total Flash Files Cleaned = 0,00 mb

OTL by OldTimer - Version 3.2.55.0 log created on 07282012_163458

Files\Folders moved on Reboot...

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Waves · 28.07.2012, 16:20

Wszystko

W OTL sprzątanie.

Fisz · 28.07.2012, 16:43

Wielkie dzięki za pomoc Smile

Zaloguj się
Login:
Hasło:	Nie pamiętam hasła
	Zapamiętaj mnie