Log z malwarebytes bo otl nie chce zrobić logów


(drdala) #1

Witam wrzucam log z malwarebytes z pełnego scanu przerwanego ponieważ otl nie może zrobić logów ponieważ po skanowaniu wyskakuje komunikat nie można odnaleźć pliku czy utworzyć? klikam tak i nic się nie dzieje tylko pokazuje się pusty plik tekstowy

Malwarebytes Anti-Malware 1.65.0.1400

www.malwarebytes.org


Wersja bazy: v2012.09.26.02


Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Izabella :: IZA [administrator]


2012-09-26 08:26:22

mbam-log-2012-09-26 (08-26-22).txt


Typ skanowania: Pełne skanowanie (C:\|D:\|E:\|F:\|G:\|H:\|I:\|J:\|K:\|L:\|M:\|)

Zaznaczone opcje skanowania: Pamięć | Rozruch | Rejestr | System plików | Heurystyka/Dodatkowe | Heuristyka/Shuriken | PUP | PUM

Odznaczone opcje skanowania: P2P

Przeskanowano obiektów: 89992

Upłynęło: 19 minut(y), 24 sekund(y) [anulowane]


Wykrytych procesów w pamięci: 1

C:\Program Files\RelevantKnowledge\rlvknlg.exe (PUP.Adware.RelevantKnowledge) -> 224 -> Usuń po ponownym uruchomieniu.


Wykrytych modułów w pamięci: 0

(Nie znaleziono zagrożeń)


Wykrytych kluczy rejestru: 1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{d08d9f98-1c78-4704-87e6-368b0023d831} (PUP.Adware.RelevantKnowledge) -> Dodanie do kwarantanny i usunięcie pliku zakończyły się powodzeniem.


Wykrytych wartości rejestru: 1

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|RelevantKnowledge (PUP.Adware.RelevantKnowledge) -> Data: C:\Program Files\RelevantKnowledge\rlvknlg.exe -boot -> Dodanie do kwarantanny i usunięcie pliku zakończyły się powodzeniem.


Wykryte wpisy rejestru systemowego: 0

(Nie znaleziono zagrożeń)


wykrytych folderów: 0

(Nie znaleziono zagrożeń)


Wykrytych plików: 5

C:\Program Files\RelevantKnowledge\rlvknlg.exe (PUP.Adware.RelevantKnowledge) -> Usuń po ponownym uruchomieniu.

C:\Program Files\RelevantKnowledge\rlls.dll (PUP.Adware.RelevantKnowledge) -> Dodanie do kwarantanny i usunięcie pliku zakończyły się powodzeniem.

C:\Program Files\RelevantKnowledge\rlls64.dll (PUP.Adware.RelevantKnowledge) -> Dodanie do kwarantanny i usunięcie pliku zakończyły się powodzeniem.

C:\Program Files\RelevantKnowledge\rlservice.exe (PUP.Adware.RelevantKnowledge) -> Dodanie do kwarantanny i usunięcie pliku zakończyły się powodzeniem.

C:\Program Files\RelevantKnowledge\rlvknlg64.exe (PUP.Adware.RelevantKnowledge) -> Dodanie do kwarantanny i usunięcie pliku zakończyły się powodzeniem.


(zakończone)

pomocy a tu log z szybkiego skanu nie przerwanego:)

Malwarebytes Anti-Malware 1.65.0.1400

www.malwarebytes.org


Wersja bazy: v2012.09.26.02


Windows XP Service Pack 3 x86 NTFS

Internet Explorer 8.0.6001.18702

Izabella :: IZA [administrator]


2012-09-26 09:10:07

mbam-log-2012-09-26 (09-17-30).txt


Typ skanowania: Szybkie skanowanie

Zaznaczone opcje skanowania: Pamięć | Rozruch | Rejestr | System plików | Heurystyka/Dodatkowe | Heuristyka/Shuriken | PUP | PUM

Odznaczone opcje skanowania: P2P

Przeskanowano obiektów: 216865

Upłynęło: 4 minut(y), 34 sekund(y)


Wykrytych procesów w pamięci: 0

(Nie znaleziono zagrożeń)


Wykrytych modułów w pamięci: 0

(Nie znaleziono zagrożeń)


Wykrytych kluczy rejestru: 0

(Nie znaleziono zagrożeń)


Wykrytych wartości rejestru: 0

(Nie znaleziono zagrożeń)


Wykryte wpisy rejestru systemowego: 0

(Nie znaleziono zagrożeń)


wykrytych folderów: 2

C:\Program Files\RelevantKnowledge (PUP.Spyware.MarketScore) -> Nie wykonano akcji.

C:\Documents and Settings\All Users\Menu Start\Programy\RelevantKnowledge (PUP.Spyware.MarketScore) -> Nie wykonano akcji.


Wykrytych plików: 9

C:\RECYCLER\S-1-5-21-507921405-1897051121-1417001333-1004\Dc53.dll (PUP.Adware.RelevantKnowledge) -> Nie wykonano akcji.

C:\Program Files\RelevantKnowledge\ncncf.dat (PUP.Spyware.MarketScore) -> Nie wykonano akcji.

C:\Program Files\RelevantKnowledge\nscf.dat (PUP.Spyware.MarketScore) -> Nie wykonano akcji.

C:\Program Files\RelevantKnowledge\rloci.bin (PUP.Spyware.MarketScore) -> Nie wykonano akcji.

C:\Documents and Settings\All Users\Menu Start\Programy\RelevantKnowledge\About RelevantKnowledge.lnk (PUP.Spyware.MarketScore) -> Nie wykonano akcji.

C:\Documents and Settings\All Users\Menu Start\Programy\RelevantKnowledge\Member of GRID - Goodware Repository Information Database.lnk (PUP.Spyware.MarketScore) -> Nie wykonano akcji.

C:\Documents and Settings\All Users\Menu Start\Programy\RelevantKnowledge\Privacy Policy and User License Agreement.lnk (PUP.Spyware.MarketScore) -> Nie wykonano akcji.

C:\Documents and Settings\All Users\Menu Start\Programy\RelevantKnowledge\Support.lnk (PUP.Spyware.MarketScore) -> Nie wykonano akcji.

C:\Documents and Settings\All Users\Menu Start\Programy\RelevantKnowledge\Uninstall Instructions.lnk (PUP.Spyware.MarketScore) -> Nie wykonano akcji.


(zakończone)

wszystkie te infekcje usunąłem co dalej? po uruchomieniu komputera zrobiłem szybki skan malwarebytes i nic nie znalazł czy już wszystko ok jest z moim komputerem? teraz jestem w trakcie pełnego skanu... dlaczego otl nie może zrobić logów? pomóżcie bo nie wiem co robić ok po usunięciu malwarebytes wszystkich zagrożeń udało się OTLowi zrobić logi po skanowaniu przedstawiam wam je

OTL logfile created on: 2012-09-26 10:06:30 - Run 2

OTL by OldTimer - Version 3.2.68.0 Folder = C:\Documents and Settings\Izabella\Pulpit

Windows XP Home Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd


1,99 Gb Total Physical Memory | 1,53 Gb Available Physical Memory | 77,02% Memory free

3,84 Gb Paging File | 3,53 Gb Available in Paging File | 92,02% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]


%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 116,44 Gb Total Space | 49,00 Gb Free Space | 42,08% Space Free | Partition Type: NTFS

Drive D: | 116,44 Gb Total Space | 66,74 Gb Free Space | 57,32% Space Free | Partition Type: NTFS


Computer Name: IZA | User Name: Izabella | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days


[color=#E56717]========== Processes (SafeList) ==========[/color]


PRC - [2012-09-26 08:39:27 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Izabella\Pulpit\OTL.exe

PRC - [2012-09-07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Programy\Malwarebytes' Anti-Malware\mbamscheduler.exe

PRC - [2010-02-09 17:43:16 | 002,621,440 | R--- | M] (Brother Industries, Ltd.) -- C:\Program Files\Browny02\Brother\BrStMonW.exe

PRC - [2010-01-25 09:22:56 | 000,245,760 | ---- | M] (Brother Industries, Ltd.) -- C:\Program Files\Browny02\BrYNSvc.exe

PRC - [2009-12-07 01:19:00 | 001,590,216 | ---- | M] (UltraVNC) -- C:\Program Files\UltraVNC\WinVNC.exe

PRC - [2009-09-11 07:24:32 | 000,735,960 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

PRC - [2009-09-11 07:23:46 | 002,054,360 | ---- | M] (ESET) -- C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe

PRC - [2008-04-15 14:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2008-01-31 14:03:42 | 000,094,208 | R--- | M] (Brother Industries, Ltd.) -- C:\Program Files\Brother\Brmfcmon\BrMfimon.exe

PRC - [2007-06-01 11:21:30 | 001,209,904 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

PRC - [2007-06-01 11:21:08 | 000,153,136 | ---- | M] (Nero AG) -- C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe



[color=#E56717]========== Modules (No Company Name) ==========[/color]


MOD - [2009-02-27 17:38:20 | 000,139,264 | R--- | M] () -- C:\Program Files\Brother\BrUtilities\BrLogAPI.dll



[color=#E56717]========== Services (SafeList) ==========[/color]


SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)

SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)

SRV - [2012-09-26 08:48:46 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)

SRV - [2012-09-21 13:20:11 | 000,250,288 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2012-09-07 17:04:46 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Programy\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)

SRV - [2012-09-07 17:04:46 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programy\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)

SRV - [2010-01-25 09:22:56 | 000,245,760 | ---- | M] (Brother Industries, Ltd.) [On_Demand | Running] -- C:\Program Files\Browny02\BrYNSvc.exe -- (BrYNSvc)

SRV - [2009-12-07 01:19:00 | 001,590,216 | ---- | M] (UltraVNC) [Auto | Running] -- C:\Program Files\UltraVNC\WinVNC.exe -- (uvnc_service)

SRV - [2009-09-11 07:33:18 | 000,020,680 | ---- | M] (ESET) [On_Demand | Stopped] -- C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe -- (EhttpSrv)

SRV - [2009-09-11 07:24:32 | 000,735,960 | ---- | M] (ESET) [Auto | Running] -- C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe -- (ekrn)



[color=#E56717]========== Driver Services (SafeList) ==========[/color]


DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)

DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)

DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)

DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)

DRV - File not found [Kernel | System | Stopped] -- -- (Changer)

DRV - File not found [Kernel | Auto | Stopped] -- C:\DOCUME~1\Izabella\USTAWI~1\Temp\5728.sys -- (5728)

DRV - [2012-09-07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mbam.sys -- (MBAMProtector)

DRV - [2012-01-05 11:34:04 | 000,007,168 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\utq3ntyy.sys -- (utq3ntyy)

DRV - [2011-11-14 09:46:13 | 000,011,496 | ---- | M] (UVNC BVBA) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\mv2.sys -- (mv2)

DRV - [2010-09-03 14:25:06 | 000,016,376 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\gdrv.sys -- (gdrv)

DRV - [2009-09-11 07:26:26 | 000,096,408 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\epfwtdir.sys -- (epfwtdir)

DRV - [2009-09-11 07:23:50 | 000,108,792 | ---- | M] (ESET) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\ehdrv.sys -- (ehdrv)

DRV - [2009-09-11 07:17:16 | 000,116,008 | ---- | M] (ESET) [File_System | Auto | Running] -- C:\WINDOWS\system32\drivers\eamon.sys -- (eamon)

DRV - [2007-09-19 15:44:46 | 000,101,504 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)

DRV - [2007-09-19 11:16:32 | 004,617,728 | R--- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService)



[color=#E56717]========== Standard Registry (SafeList) ==========[/color]



[color=#E56717]========== Internet Explorer ==========[/color]


IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}



IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0




IE - HKU\S-1-5-21-507921405-1897051121-1417001333-1004\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/

IE - HKU\S-1-5-21-507921405-1897051121-1417001333-1004\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKU\S-1-5-21-507921405-1897051121-1417001333-1004\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC

IE - HKU\S-1-5-21-507921405-1897051121-1417001333-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-507921405-1897051121-1417001333-1004\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:296


[color=#E56717]========== FireFox ==========[/color]


FF - prefs.js..browser.startup.homepage: "www.google.pl"

FF - prefs.js..extensions.enabledAddons: jqs@sun.com:1.0

FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23

FF - prefs.js..extensions.enabledItems: jqs@sun.com:1.0

FF - prefs.js..network.proxy.http: "127.0.0.1"

FF - prefs.js..network.proxy.http_port: 296

FF - user.js - File not found


FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_4_402_278.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)


FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012-09-26 08:48:48 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012-01-13 16:11:36 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\eplgTb@eset.com: C:\Program Files\ESET\ESET NOD32 Antivirus\Mozilla Thunderbird [2010-09-03 14:47:44 | 000,000,000 | ---D | M]


[2010-09-06 08:52:13 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Izabella\Dane aplikacji\Mozilla\Extensions

[2010-09-06 08:52:13 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Izabella\Dane aplikacji\Mozilla\Firefox\Profiles\j71spj5u.default\extensions

[2012-09-26 08:48:50 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2011-02-04 14:55:21 | 000,000,000 | ---D | M] (Java Quick Starter) -- C:\PROGRAM FILES\JAVA\JRE6\LIB\DEPLOY\JQS\FF

[2012-09-26 08:48:47 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2011-11-10 06:54:13 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

[2012-09-26 08:48:44 | 000,002,767 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml

[2012-09-26 08:48:44 | 000,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml

[2012-09-26 08:48:44 | 000,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml

[2012-09-26 08:48:44 | 000,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml

[2012-09-26 08:48:44 | 000,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml

[2012-09-26 08:48:44 | 000,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml


O1 HOSTS File: ([2012-01-02 11:50:18 | 000,000,027 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)

O4 - HKLM..\Run: [BrStsMon00] C:\Program Files\Browny02\Brother\BrStMonW.exe (Brother Industries, Ltd.)

O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)

O4 - HKLM..\Run: [egui] C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe (ESET)

O4 - HKU\S-1-5-21-507921405-1897051121-1417001333-1004..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe (Nero AG)

O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145

O7 - HKU\S-1-5-21-507921405-1897051121-1417001333-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present

O7 - HKU\S-1-5-21-507921405-1897051121-1417001333-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 323

O7 - HKU\S-1-5-21-507921405-1897051121-1417001333-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutoRun = 67108863

O7 - HKU\S-1-5-21-507921405-1897051121-1417001333-1004\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0

O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} http://www.mks.com.pl/skaner/SkanerOnline.cab (MksSkanerOnline Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O16 - DPF: {92ECE6FA-AC2E-4042-BFAE-0C8608E52A43} https://www.bph.pl/sezam/components/SignActivX.cab (SignActivX Control)

O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D42741C2-E0CA-46D6-B8E7-73120F07AC35}: NameServer = 10.2.12.246

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home

O24 - Desktop WallPaper: C:\Documents and Settings\Izabella\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp

O24 - Desktop BackupWallPaper: C:\Documents and Settings\Izabella\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2010-09-03 12:47:19 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [NTFS]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)


[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]


[2012-09-26 08:48:53 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Maintenance Service

[2012-09-26 08:48:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Mozilla

[2012-09-26 08:39:26 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Izabella\Pulpit\OTL.exe

[2012-09-26 08:20:18 | 010,524,080 | ---- | C] (Malwarebytes Corporation ) -- C:\Documents and Settings\Izabella\Pulpit\mbam-setup-1.65.0.1400.exe

[2012-09-18 09:46:50 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Izabella\Dane aplikacji\screenrecorder

[2012-09-18 09:46:30 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Cute Screen Recorder Free Version

[2012-09-18 09:46:29 | 000,000,000 | ---D | C] -- C:\Program Files\Cute Screen Recorder

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp ->]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp ->]


[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]


[2012-09-26 10:05:10 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2012-09-26 09:20:15 | 000,000,930 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job

[2012-09-26 08:39:27 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Izabella\Pulpit\OTL.exe

[2012-09-26 08:20:44 | 000,000,733 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes Anti-Malware.lnk

[2012-09-26 08:20:28 | 010,524,080 | ---- | M] (Malwarebytes Corporation ) -- C:\Documents and Settings\Izabella\Pulpit\mbam-setup-1.65.0.1400.exe

[2012-09-26 08:11:39 | 000,000,898 | ---- | M] () -- C:\Documents and Settings\Izabella\Pulpit\Skrót do SPRZEDAŻ DZIENNA - 2 0 1 2.lnk

[2012-09-26 07:50:18 | 000,000,711 | ---- | M] () -- C:\Documents and Settings\Izabella\Pulpit\ZAMÓWIONKA.lnk

[2012-09-26 07:45:26 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2012-09-21 13:20:11 | 000,696,240 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe

[2012-09-21 13:20:11 | 000,073,136 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl

[2012-09-18 09:50:14 | 000,000,149 | ---- | M] () -- C:\Documents and Settings\Izabella\default.pls

[2012-09-18 09:47:46 | 000,000,069 | ---- | M] () -- C:\WINDOWS\NeroDigital.ini

[2012-09-18 09:46:30 | 000,000,816 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Cute Screen Recorder Free Version.lnk

[2012-09-17 10:08:41 | 000,000,625 | ---- | M] () -- C:\Documents and Settings\Izabella\Pulpit\Skrót do Zamówienia produk.- Iwona na K62-hermar.lnk

[2012-09-14 07:44:49 | 000,000,696 | ---- | M] () -- C:\Documents and Settings\Izabella\Pulpit\Fakturowanie.lnk

[2012-09-13 03:01:39 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2012-09-10 13:07:05 | 000,000,714 | ---- | M] () -- C:\Documents and Settings\Izabella\Pulpit\Skrót do DokFIKSZestawienia.lnk

[2012-09-07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[2012-09-07 09:28:55 | 000,000,822 | ---- | M] () -- C:\Documents and Settings\Izabella\Pulpit\Realizacja zamówień.lnk

[2012-08-28 20:48:44 | 011,111,424 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ieframe.dll

[2012-08-28 17:18:53 | 000,916,992 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wininet.dll

[2012-08-28 17:18:52 | 001,212,416 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\urlmon.dll

[2012-08-28 17:18:51 | 000,206,848 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\occache.dll

[2012-08-28 17:18:51 | 000,105,984 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\url.dll

[2012-08-28 17:18:51 | 000,105,984 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\url.dll

[2012-08-28 17:18:50 | 000,611,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\mstime.dll

[2012-08-28 17:18:50 | 000,611,840 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mstime.dll

[2012-08-28 17:18:50 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtmled.dll

[2012-08-28 17:18:49 | 006,008,832 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mshtml.dll

[2012-08-28 17:18:45 | 000,630,272 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msfeeds.dll

[2012-08-28 17:18:45 | 000,630,272 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeeds.dll

[2012-08-28 17:18:45 | 000,055,296 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\msfeedsbs.dll

[2012-08-28 17:18:45 | 000,055,296 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeedsbs.dll

[2012-08-28 17:18:44 | 001,469,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\inetcpl.cpl

[2012-08-28 17:18:44 | 001,469,440 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\inetcpl.cpl

[2012-08-28 17:18:44 | 000,521,728 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsdbgui.dll

[2012-08-28 17:18:44 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\licmgr10.dll

[2012-08-28 17:18:44 | 000,043,520 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\licmgr10.dll

[2012-08-28 17:18:44 | 000,025,600 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\jsproxy.dll

[2012-08-28 17:18:44 | 000,025,600 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsproxy.dll

[2012-08-28 17:18:43 | 002,000,384 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iertutil.dll

[2012-08-28 17:18:43 | 000,184,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\iepeers.dll

[2012-08-28 17:18:43 | 000,184,320 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iepeers.dll

[2012-08-28 17:18:41 | 000,743,424 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedvtool.dll

[2012-08-28 17:18:40 | 000,387,584 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\iedkcs32.dll

[2012-08-28 17:18:40 | 000,387,584 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedkcs32.dll

[2012-08-28 14:07:34 | 000,174,080 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\ie4uinit.exe

[2012-08-28 14:07:34 | 000,174,080 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ie4uinit.exe

[2012-08-28 14:07:32 | 000,385,024 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\System32\html.iec

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp ->]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp ->]


[color=#E56717]========== Files Created - No Company Name ==========[/color]


[2012-09-26 08:20:44 | 000,000,733 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes Anti-Malware.lnk

[2012-09-18 09:46:30 | 000,000,816 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Cute Screen Recorder Free Version.lnk

[2012-08-03 12:45:01 | 000,105,354 | ---- | C] () -- C:\WINDOWS\hpoins07.dat.temp

[2012-08-03 12:45:01 | 000,017,505 | ---- | C] () -- C:\WINDOWS\hpomdl07.dat.temp

[2012-08-03 12:06:13 | 000,105,354 | ---- | C] () -- C:\WINDOWS\hpoins07.dat

[2012-08-03 12:06:13 | 000,017,505 | ---- | C] () -- C:\WINDOWS\hpomdl07.dat

[2012-02-15 07:28:15 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll

[2012-02-01 14:50:04 | 000,000,050 | ---- | C] () -- C:\WINDOWS\System32\BRIDF10B.DAT

[2012-01-05 11:34:00 | 000,007,168 | ---- | C] () -- C:\WINDOWS\System32\drivers\utq3ntyy.sys

[2011-11-10 11:15:22 | 000,000,034 | ---- | C] () -- C:\WINDOWS\System32\BD7030.DAT

[2011-04-09 07:21:01 | 000,000,151 | ---- | C] () -- C:\WINDOWS\PhotoSnapViewer.INI

[2011-02-09 12:56:56 | 000,000,149 | ---- | C] () -- C:\Documents and Settings\Izabella\default.pls

[2011-01-28 09:14:10 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini

[2010-10-13 15:03:29 | 000,000,118 | ---- | C] () -- C:\WINDOWS\System32\MRT.INI

[2010-09-22 14:36:59 | 000,032,768 | ---- | C] () -- C:\Documents and Settings\Izabella\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini


[color=#E56717]========== ZeroAccess Check ==========[/color]



[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]


[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]


[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shdocvw.dll -- [2010-06-24 14:12:34 | 001,509,888 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment


[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009-02-09 12:53:44 | 000,473,600 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free


[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008-04-15 14:00:00 | 000,273,920 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both


[color=#E56717]========== LOP Check ==========[/color]


[2010-09-03 14:47:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ESET

[2011-01-26 11:49:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\LightScribe

[2010-09-06 08:46:45 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ScanSoft

[2012-01-02 09:55:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Izabella\Dane aplikacji\LimeRunner

[2011-04-07 14:13:16 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Izabella\Dane aplikacji\MacroBASE

[2010-09-06 14:49:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Izabella\Dane aplikacji\ScanSoft

[2012-09-18 10:07:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Izabella\Dane aplikacji\screenrecorder


[color=#E56717]========== Purity Check ==========[/color]




< End of report >

OTL Extras logfile created on: 2012-09-26 10:06:31 - Run 2

OTL by OldTimer - Version 3.2.68.0 Folder = C:\Documents and Settings\Izabella\Pulpit

Windows XP Home Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd


1,99 Gb Total Physical Memory | 1,53 Gb Available Physical Memory | 77,02% Memory free

3,84 Gb Paging File | 3,53 Gb Available in Paging File | 92,02% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]


%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 116,44 Gb Total Space | 49,00 Gb Free Space | 42,08% Space Free | Partition Type: NTFS

Drive D: | 116,44 Gb Total Space | 66,74 Gb Free Space | 57,32% Space Free | Partition Type: NTFS


Computer Name: IZA | User Name: Izabella | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: All users

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days


[color=#E56717]========== Extra Registry (SafeList) ==========[/color]



[color=#E56717]========== File Associations ==========[/color]


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\]

.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*


[HKEY_USERS\S-1-5-21-507921405-1897051121-1417001333-1004\SOFTWARE\Classes\]

.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)


[color=#E56717]========== Shell Spawning ==========[/color]


[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\\shell\[command]\command]

batfile [open] -- "%1" %*

cmdfile [open] -- "%1" %*

comfile [open] -- "%1" %*

cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*

exefile [open] -- "%1" %*

piffile [open] -- "%1" %*

regfile [merge] -- Reg Error: Key error.

scrfile [config] -- "%1"

scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l

scrfile [open] -- "%1" /S

txtfile [edit] -- Reg Error: Key error.

Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1

Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)

Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)

Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)


[color=#E56717]========== Security Center Settings ==========[/color]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]

"FirstRunDisabled" = 1

"AntiVirusDisableNotify" = 0

"FirewallDisableNotify" = 0

"UpdatesDisableNotify" = 0

"AntiVirusOverride" = 0

"FirewallOverride" = 0


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]


[color=#E56717]========== System Restore Settings ==========[/color]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]

"DisableSR" = 1


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]

"Start" = 4


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]

"Start" = 2


[color=#E56717]========== Firewall Settings ==========[/color]


[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]


[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]


[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]

"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004

"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005

"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001

"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002

"54925:UDP" = 54925:UDP:*:Enabled:Brother Network Scanner

"5900:TCP" = 5900:TCP:*:Enabled:vnc5900

"5800:TCP" = 5800:TCP:*:Enabled:vnc5800

"24162:TCP" = 24162:TCP:LocalSubNet:Enabled:Emule

"9910:UDP" = 9910:UDP:LocalSubNet:Enabled:Emule

"20284:TCP" = 20284:TCP:LocalSubNet:Enabled:AresXZ


[color=#E56717]========== Authorized Applications List ==========[/color]


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]

"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]

"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)

"C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE" = C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook -- (Microsoft Corporation)

"C:\Program Files\Brother\Brmfl07b\FAXRX.exe" = C:\Program Files\Brother\Brmfl07b\FAXRX.exe:*:Enabled:FAXRX.EXE -- (Brother Industries Ltd.)

"C:\Program Files\UltraVNC\winvnc.exe" = C:\Program Files\UltraVNC\winvnc.exe:*:Enabled:winvnc.exe -- (UltraVNC)

"C:\Program Files\UltraVNC\vncviewer.exe" = C:\Program Files\UltraVNC\vncviewer.exe:*:Enabled:vncviewer.exe -- (UltraVNC)

"C:\Program Files\Java\jre6\bin\javaw.exe" = C:\Program Files\Java\jre6\bin\javaw.exe:*:Disabled:Java(TM) Platform SE binary -- (Sun Microsystems, Inc.)

"C:\Documents and Settings\Izabella\Dane aplikacji\A446B\AB781.exe" = C:\Documents and Settings\Izabella\Dane aplikacji\A446B\AB781.exe:*:Disabled:AB781

"C:\Program Files\6BA94\lvvm.exe" = C:\Program Files\6BA94\lvvm.exe:*:Disabled:lvvm

"C:\Documents and Settings\Izabella\Ustawienia lokalne\Temp\7zS4207\HPDiagnosticCoreUI.exe" = C:\Documents and Settings\Izabella\Ustawienia lokalne\Temp\7zS4207\HPDiagnosticCoreUI.exe:*:Enabled:HPSAPS -- (Hewlett-Packard)

"C:\Documents and Settings\Izabella\Ustawienia lokalne\Temp\7zS4316\HPDiagnosticCoreUI.exe" = C:\Documents and Settings\Izabella\Ustawienia lokalne\Temp\7zS4316\HPDiagnosticCoreUI.exe:*:Enabled:HPSAPS -- (Hewlett-Packard)

"C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqscnvw.exe:*:Enabled:hpqscnvw.exe -- ()

"C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe" = C:\Program Files\HP\Digital Imaging\bin\hpqkygrp.exe:*:Enabled:hpqkygrp.exe -- (Hewlett-Packard)

"c:\program files\relevantknowledge\rlvknlg.exe" = c:\program files\relevantknowledge\rlvknlg.exe:*:Enabled:rlvknlg.exe



[color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]

"{0360D8F0-626A-4E87-8A16-938BD0BEBCC5}" = 32 Bit HP CIO Components Installer

"{0B33B738-AD79-4E32-90C5-E67BFB10BBFF}" = AiO_Scan

"{1A6A6531-08FC-47AD-BAC4-C41497E71045}" = Nero 7 Essentials

"{1F5A8225-A37D-4274-A402-2C7A8401AE2E}" = Macrologic - komponenty MacroCRview

"{26A24AE4-039D-4CA4-87B4-2F83216023FF}" = Java(TM) 6 Update 30

"{2BC2781A-F7F6-452E-95EB-018A522F1B2C}" = PaperPort Image Printer

"{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP

"{46E1B1F2-A279-4356-9B17-029F9CC72EAE}" = Brother MFL-Pro Suite

"{49FB31C1-26EC-44c6-AB47-73C66E2BC41E}" = HP PSC & Officejet 5.3.B Corporate Edition

"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater

"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml

"{5A7B12EE-49F5-4019-8EA1-4BA4C41132E5}" = ESET NOD32 Antivirus

"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable

"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053

"{7FB6B1B7-075B-4B7F-BEB6-97584F73C7B5}" = Brother MFL-Pro Suite DCP-J515W

"{8777AC6D-89F9-4793-8266-DE406F343E89}" = QFolder

"{90120000-0010-0415-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (Polish) 12

"{90120000-0015-0415-0000-0000000FF1CE}" = Microsoft Office Access MUI (Polish) 2007

"{90120000-0015-0415-0000-0000000FF1CE}_PROHYBRIDR_{01CC3B2D-70DB-49DC-839A-A923D2A39EA4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0016-0415-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Polish) 2007

"{90120000-0016-0415-0000-0000000FF1CE}_PROHYBRIDR_{01CC3B2D-70DB-49DC-839A-A923D2A39EA4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0018-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Polish) 2007

"{90120000-0018-0415-0000-0000000FF1CE}_PROHYBRIDR_{01CC3B2D-70DB-49DC-839A-A923D2A39EA4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-0019-0415-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Polish) 2007

"{90120000-0019-0415-0000-0000000FF1CE}_PROHYBRIDR_{01CC3B2D-70DB-49DC-839A-A923D2A39EA4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001A-0415-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Polish) 2007

"{90120000-001A-0415-0000-0000000FF1CE}_PROHYBRIDR_{01CC3B2D-70DB-49DC-839A-A923D2A39EA4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001B-0415-0000-0000000FF1CE}" = Microsoft Office Word MUI (Polish) 2007

"{90120000-001B-0415-0000-0000000FF1CE}_PROHYBRIDR_{01CC3B2D-70DB-49DC-839A-A923D2A39EA4}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007

"{90120000-001F-0407-0000-0000000FF1CE}_PROHYBRIDR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007

"{90120000-001F-0409-0000-0000000FF1CE}_PROHYBRIDR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2007

"{90120000-001F-0415-0000-0000000FF1CE}_PROHYBRIDR_{9CC96D78-9E1D-46E0-AF4D-3EB440CD4619}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)

"{90120000-002C-0415-0000-0000000FF1CE}" = Microsoft Office Proofing (Polish) 2007

"{90120000-006E-0415-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Polish) 2007

"{90120000-006E-0415-0000-0000000FF1CE}_PROHYBRIDR_{0C8AB602-A234-45AB-B355-4C863C1D2FA8}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In

"{91120000-0031-0000-0000-0000000FF1CE}" = Microsoft Office Professional Hybrid 2007

"{91120000-0031-0000-0000-0000000FF1CE}_PROHYBRIDR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)

"{AC76BA86-7AD7-1045-7B44-A95000000001}" = Adobe Reader 9.5.0 - Polish

"{B395BC1D-CC06-425E-9049-4CD985EFF004}" = LightScribe 1.8.15.1

"{C506A18C-1469-4678-B094-F4EC9DAE6DB7}" = Scan

"{C549017A-FFAB-4679-9112-26E83DD82DB5}" = Enterprise

"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver

"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver

"{F7B0E599-C114-4493-BC4D-D8FC7CBBABBB}" = 32 Bit HP CIO Components Installer

"{FA0E44BC-3731-42D5-BA98-E99DD5D70A83}" = ScanSoft PaperPort 11

"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX

"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin

"Cute Screen Recorder Free Version_is1" = Cute Screen Recorder Free Version 1.7.0.0

"HDMI" = Intel(R) Graphics Media Accelerator Driver

"HijackThis" = HijackThis 2.0.2

"ie8" = Windows Internet Explorer 8

"Macrologic Xpertis jTerm 2011+ (11.22)_is1" = Macrologic Xpertis jTerm 2011+ (11.22)

"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware wersja 1.65.0.1400

"Mozilla Firefox 12.0 (x86 pl)" = Mozilla Firefox 12.0 (x86 pl)

"MozillaMaintenanceService" = Mozilla Maintenance Service

"PROHYBRIDR" = 2007 Microsoft Office system

"SkanerOnline" = Skaner on-line mks_vir

"Ultravnc2_is1" = UltraVNC 1.0.8.2

"Windows Media Format Runtime" = Windows Media Format Runtime


[color=#E56717]========== Last 20 Event Log Errors ==========[/color]


[Application Events]

Error - 2012-09-25 02:11:30 | Computer Name = IZA | Source = Brother BrLog | ID = 1001

Description = STI BrtSTI: [2012/09/25 08:11:30.534]: [00000400]: GetDeviceIpAddress:

 GetAddressByName [BRN008077DE380F] Error  


Error - 2012-09-25 02:12:07 | Computer Name = IZA | Source = Brother BrLog | ID = 1001

Description = STI BrtSTI: [2012/09/25 08:12:07.503]: [00000400]: SendSKeySettingToDevice::

 Snmp Load Error[-1] To[10.2.12.92]  


Error - 2012-09-25 02:12:07 | Computer Name = IZA | Source = Brother BrLog | ID = 1001

Description = STI BrtSTI: [2012/09/25 08:12:07.565]: [00000400]: GetDeviceIpAddress:

 GetAddressByName [BRN008077DE380F] Error  


Error - 2012-09-25 02:12:37 | Computer Name = IZA | Source = Brother BrLog | ID = 1001

Description = STI BrtSTI: [2012/09/25 08:12:37.596]: [00000400]: GetDeviceIpAddress:

 GetAddressByName [BRN008077DE380F] Error  


Error - 2012-09-25 02:13:16 | Computer Name = IZA | Source = Brother BrLog | ID = 1001

Description = STI BrtSTI: [2012/09/25 08:13:16.503]: [00000400]: SendSKeySettingToDevice::

 Snmp Load Error[-1] To[10.2.12.92]  


Error - 2012-09-25 02:13:16 | Computer Name = IZA | Source = Brother BrLog | ID = 1001

Description = STI BrtSTI: [2012/09/25 08:13:16.565]: [00000400]: GetDeviceIpAddress:

 GetAddressByName [BRN008077DE380F] Error  


Error - 2012-09-25 02:13:46 | Computer Name = IZA | Source = Brother BrLog | ID = 1001

Description = STI BrtSTI: [2012/09/25 08:13:46.596]: [00000400]: GetDeviceIpAddress:

 GetAddressByName [BRN008077DE380F] Error  


Error - 2012-09-25 02:14:25 | Computer Name = IZA | Source = Brother BrLog | ID = 1001

Description = STI BrtSTI: [2012/09/25 08:14:25.503]: [00000400]: SendSKeySettingToDevice::

 Snmp Load Error[-1] To[10.2.12.92]  


Error - 2012-09-25 02:14:25 | Computer Name = IZA | Source = Brother BrLog | ID = 1001

Description = STI BrtSTI: [2012/09/25 08:14:25.565]: [00000400]: GetDeviceIpAddress:

 GetAddressByName [BRN008077DE380F] Error  


Error - 2012-09-26 02:18:59 | Computer Name = IZA | Source = Application Hang | ID = 1002

Description = Aplikacja zawieszająca DokFIKSZestawienia.exe, wersja 2012.9.24.0,

 moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.


[OSession Events]

Error - 2010-09-06 02:38:21 | Computer Name = IZA | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:

 12.0.6535.5005, Microsoft Office Version: 12.0.6425.1000. This session lasted 1886

 seconds with 120 seconds of active time. This session ended with a crash.


Error - 2010-10-23 06:06:52 | Computer Name = IZA | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:

 12.0.6539.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 18286

 seconds with 1440 seconds of active time. This session ended with a crash.


Error - 2011-01-03 05:52:21 | Computer Name = IZA | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:

 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 695

 seconds with 420 seconds of active time. This session ended with a crash.


Error - 2011-01-10 09:27:53 | Computer Name = IZA | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:

 12.0.6548.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 26877

 seconds with 7140 seconds of active time. This session ended with a crash.


Error - 2011-05-10 01:03:01 | Computer Name = IZA | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 6, Application Name: Microsoft Office Outlook, Application Version:

 12.0.6555.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 8

 seconds with 0 seconds of active time. This session ended with a crash.


Error - 2011-08-10 07:33:23 | Computer Name = IZA | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:

 12.0.6557.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 733

 seconds with 540 seconds of active time. This session ended with a crash.


Error - 2011-11-24 02:24:59 | Computer Name = IZA | Source = Microsoft Office 12 Sessions | ID = 7001

Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:

 12.0.6565.5003, Microsoft Office Version: 12.0.6425.1000. This session lasted 49

 seconds with 0 seconds of active time. This session ended with a crash.


[System Events]

Error - 2012-09-24 01:53:33 | Computer Name = IZA | Source = Service Control Manager | ID = 7000

Description = Nie można uruchomić usługi 5728 z powodu następującego błędu: %%2


Error - 2012-09-25 01:27:02 | Computer Name = IZA | Source = Service Control Manager | ID = 7000

Description = Nie można uruchomić usługi 5728 z powodu następującego błędu: %%2


Error - 2012-09-25 01:38:25 | Computer Name = IZA | Source = Service Control Manager | ID = 7000

Description = Nie można uruchomić usługi 5728 z powodu następującego błędu: %%2


Error - 2012-09-25 02:28:36 | Computer Name = IZA | Source = NetBT | ID = 4321

Description = Nie można zarejestrować nazwy „HERMAR :1d” w interfejsie o

 adresie IP 10.2.12.22. Komputer o adresie IP 10.2.12.98 nie zezwolił na przejęcie

 tej nazwy przez ten komputer.


Error - 2012-09-26 01:45:36 | Computer Name = IZA | Source = Service Control Manager | ID = 7000

Description = Nie można uruchomić usługi 5728 z powodu następującego błędu: %%2


Error - 2012-09-26 02:22:31 | Computer Name = IZA | Source = Service Control Manager | ID = 7000

Description = Nie można uruchomić usługi 5728 z powodu następującego błędu: %%2


Error - 2012-09-26 02:24:46 | Computer Name = IZA | Source = Service Control Manager | ID = 7000

Description = Nie można uruchomić usługi 5728 z powodu następującego błędu: %%2


Error - 2012-09-26 02:48:02 | Computer Name = IZA | Source = Service Control Manager | ID = 7000

Description = Nie można uruchomić usługi 5728 z powodu następującego błędu: %%2


Error - 2012-09-26 03:22:17 | Computer Name = IZA | Source = Service Control Manager | ID = 7000

Description = Nie można uruchomić usługi 5728 z powodu następującego błędu: %%2


Error - 2012-09-26 04:05:21 | Computer Name = IZA | Source = Service Control Manager | ID = 7000

Description = Nie można uruchomić usługi 5728 z powodu następującego błędu: %%2



< End of report >

i jak teraz sytuacja wygląda? czysty już jest komputer czy coś jeszcze mam robić?