OTL logfile created on: 2009-11-07 11:29:47 - Run 3 OTL by OldTimer - Version 3.0.18.4 Folder = C:\Users\Gogola\Downloads Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation Internet Explorer (Version = 7.0.6001.18000) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 2,00 Gb Total Physical Memory | 1,60 Gb Available Physical Memory | 79,91% Memory free 4,00 Gb Paging File | 3,95 Gb Available in Paging File | 98,82% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 97,66 Gb Total Space | 45,97 Gb Free Space | 47,08% Space Free | Partition Type: NTFS Drive D: | 244,14 Gb Total Space | 203,67 Gb Free Space | 83,42% Space Free | Partition Type: NTFS Drive E: | 146,48 Gb Total Space | 146,26 Gb Free Space | 99,85% Space Free | Partition Type: NTFS Drive F: | 150,43 Gb Total Space | 142,61 Gb Free Space | 94,80% Space Free | Partition Type: NTFS Drive G: | 59,91 Gb Total Space | 54,80 Gb Free Space | 91,47% Space Free | Partition Type: NTFS Drive H: | 2,32 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF I: Drive not present or media not loaded Computer Name: GREDEL-PC Current User Name: Gogola Logged in as Administrator. Current Boot Mode: SafeMode with Networking Scan Mode: All users Company Name Whitelist: Off Skip Microsoft Files: Off File Age = 30 Days Output = Standard ========== Processes (SafeList) ========== PRC - [2008-10-29 07:29:41 | 02,927,104 | ---- | M] (Microsoft Corporation) – C:\Windows\Explorer.EXE PRC - [2008-01-21 03:25:33 | 00,202,240 | ---- | M] (Microsoft Corporation) – C:\Program Files\Windows Media Player\wmpnscfg.exe PRC - [2009-10-06 18:28:26 | 00,520,704 | ---- | M] (OldTimer Tools) – C:\Users\Gogola\Downloads\OTL.exe ========== Win32 Services (SafeList) ========== SRV - [2007-06-07 00:41:36 | 00,086,016 | ---- | M] (Andrea Electronics Corporation) – C:\Windows\System32\AEADISRV.EXE – (AEADIFilters [Auto | Stopped]) SRV - [2008-11-28 16:12:10 | 00,304,528 | ---- | M] (Protection Technology) – C:\Windows\System32\appdrvrem01.exe – (appdrvrem01 [Auto | Stopped]) SRV - [2009-08-28 18:42:54 | 00,144,672 | ---- | M] (Apple Inc.) – C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe – (Apple Mobile Device [Auto | Stopped]) SRV - [2009-08-22 07:09:55 | 00,908,056 | ---- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG8\avgemc.exe – (avg8emc [Auto | Stopped]) SRV - [2009-08-22 07:09:54 | 00,297,752 | ---- | M] (AVG Technologies CZ, s.r.o.) – C:\Program Files\AVG\AVG8\avgwdsvc.exe – (avg8wd [Auto | Stopped]) SRV - File not found – -- (Bonjour Service [Auto | Stopped]) SRV - [2008-07-27 19:03:13 | 00,069,632 | ---- | M] (Microsoft Corporation) – C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe – (clr_optimization_v2.0.50727_32 [On_Demand | Stopped]) SRV - [1997-04-09 21:04:50 | 00,050,176 | ---- | M] () – C:\Windows\System32\crypserv.exe – (Crypkey License [Auto | Stopped]) SRV - [2009-03-12 12:25:40 | 00,221,184 | ---- | M] (Droppix) – C:\Program Files\Common Files\Droppix\DxService.exe – (Droppix Service [On_Demand | Stopped]) SRV - [2008-01-21 03:25:09 | 00,292,352 | ---- | M] (Microsoft Corporation) – C:\Windows\ehome\ehRecvr.exe – (ehRecvr [On_Demand | Stopped]) SRV - [2006-11-02 13:35:29 | 00,131,072 | ---- | M] (Microsoft Corporation) – C:\Windows\ehome\ehsched.exe – (ehSched [On_Demand | Stopped]) SRV - [2006-11-02 13:35:29 | 00,013,312 | ---- | M] (Microsoft Corporation) – C:\Windows\ehome\ehstart.dll – (ehstart [Auto | Stopped]) SRV - [2008-01-21 03:23:49 | 01,013,760 | ---- | M] (Microsoft Corporation) – C:\Windows\System32\wevtsvc.dll – (Eventlog [Auto | Running]) SRV - [2008-06-20 02:14:44 | 00,046,104 | ---- | M] (Microsoft Corporation) – C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe – (FontCache3.0.0.0 [On_Demand | Stopped]) SRV - [2009-06-22 10:48:33 | 00,182,768 | ---- | M] (Google) – C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe – (gusvc [On_Demand | Stopped]) SRV - [2008-06-20 02:14:31 | 00,881,664 | ---- | M] (Microsoft Corporation) – C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe – (idsvc [unknown | Stopped]) SRV - [2009-09-08 20:09:30 | 00,545,568 | ---- | M] (Apple Inc.) – C:\Program Files\iPod\bin\iPodService.exe – (iPod Service [On_Demand | Stopped]) SRV - [2008-08-22 14:19:14 | 00,073,728 | ---- | M] (Hewlett-Packard Company) – C:\Program Files\Common Files\LightScribe\LSSrvc.exe – (LightScribeService [Auto | Stopped]) SRV - [2008-06-20 02:14:31 | 00,132,096 | ---- | M] (Microsoft Corporation) – C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe – (NetTcpPortSharing [Disabled | Stopped]) SRV - [2009-03-27 23:03:00 | 00,207,392 | ---- | M] (NVIDIA Corporation) – C:\Windows\System32\nvvsvc.exe – (nvsvc [Auto | Stopped]) SRV - [2008-11-04 00:06:28 | 00,441,712 | ---- | M] (Microsoft Corporation) – C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE – (odserv [On_Demand | Stopped]) SRV - [2006-10-26 12:03:08 | 00,145,184 | ---- | M] (Microsoft Corporation) – C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE – (ose [On_Demand | Stopped]) SRV - [2009-05-19 10:36:18 | 00,240,512 | ---- | M] (Microsoft Corporation) – C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe – (SeaPort [Auto | Stopped]) SRV - [2008-01-21 03:23:32 | 00,272,952 | ---- | M] (Microsoft Corporation) – C:\Program Files\Windows Defender\mpsvc.dll – (WinDefend [Auto | Running]) SRV - [2009-03-30 15:28:36 | 01,533,808 | ---- | M] (Microsoft Corporation) – C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE – (wlidsvc [Auto | Stopped]) SRV - [2008-01-21 03:25:33 | 00,896,512 | ---- | M] (Microsoft Corporation) – C:\Program Files\Windows Media Player\wmpnetwk.exe – (WMPNetworkSvc [On_Demand | Stopped]) ========== Driver Services (SafeList) ========== DRV - [2008-01-21 03:23:23 | 00,045,696 | ---- | M] (Microsoft Corporation) – C:\Windows\System32\DRIVERS\61883.sys – (61883 [On_Demand | Stopped]) DRV - [2007-07-18 21:16:14 | 00,342,528 | ---- | M] (Analog Devices, Inc.) – C:\Windows\System32\drivers\ADIHdAud.sys – (ADIHdAudAddService [On_Demand | Stopped]) DRV - [2008-01-21 03:23:21 | 00,422,968 | ---- | M] (Adaptec, Inc.) – C:\Windows\system32\drivers\adp94xx.sys – (adp94xx [Disabled | Stopped]) DRV - [2008-01-21 03:23:25 | 00,300,600 | ---- | M] (Adaptec, Inc.) – C:\Windows\system32\drivers\adpahci.sys – (adpahci [Disabled | Stopped]) DRV - [2008-01-21 03:23:26 | 00,101,432 | ---- | M] (Adaptec, Inc.) – C:\Windows\system32\drivers\adpu160m.sys – (adpu160m [Disabled | Stopped]) DRV - [2008-01-21 03:23:27 | 00,149,560 | ---- | M] (Adaptec, Inc.) – C:\Windows\system32\drivers\adpu320.sys – (adpu320 [Disabled | Stopped]) DRV - [2006-11-02 10:50:11 | 00,071,272 | ---- | M] (Adaptec, Inc.) – C:\Windows\system32\drivers\djsvs.sys – (aic78xx [Disabled | Stopped]) DRV - [2008-01-21 03:23:00 | 00,017,464 | ---- | M] (Acer Laboratories Inc.) – C:\Windows\system32\drivers\aliide.sys – (aliide [Disabled | Stopped]) DRV - [2008-11-28 16:12:10 | 02,915,944 | ---- | M] (Protection Technology) – C:\Windows\System32\Drivers\appdrv01.sys – (appdrv01 [system | Stopped]) DRV - [2008-01-21 03:23:23 | 00,079,416 | ---- | M] (Adaptec, Inc.) – C:\Windows\system32\drivers\arc.sys – (arc [Disabled | Stopped]) DRV - [2008-01-21 03:23:24 | 00,079,928 | ---- | M] (Adaptec, Inc.) – C:\Windows\system32\drivers\arcsas.sys – (arcsas [Disabled | Stopped]) DRV - [2006-10-18 20:12:16 | 00,012,664 | R— | M] () – C:\Windows\System32\drivers\AsIO.sys – (AsIO [system | Stopped]) DRV - [2008-01-21 03:23:20 | 00,040,448 | ---- | M] (Microsoft Corporation) – C:\Windows\System32\DRIVERS\avc.sys – (Avc [On_Demand | Stopped]) DRV - [2009-08-22 07:09:59 | 00,335,240 | ---- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\Drivers\avgldx86.sys – (AvgLdx86 [system | Stopped]) DRV - [2009-08-22 07:09:58 | 00,027,784 | ---- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\Drivers\avgmfx86.sys – (AvgMfx86 [system | Stopped]) DRV - [2009-05-06 08:03:24 | 00,108,552 | ---- | M] (AVG Technologies CZ, s.r.o.) – C:\Windows\System32\Drivers\avgtdix.sys – (AvgTdiX [system | Running]) DRV - [2006-11-02 09:24:45 | 00,013,568 | ---- | M] (Brother Industries, Ltd.) – C:\Windows\system32\drivers\brfiltlo.sys – (BrFiltLo [On_Demand | Stopped]) DRV - [2006-11-02 09:24:46 | 00,005,248 | ---- | M] (Brother Industries, Ltd.) – C:\Windows\system32\drivers\brfiltup.sys – (BrFiltUp [On_Demand | Stopped]) DRV - [2006-11-02 09:25:24 | 00,071,808 | ---- | M] (Brother Industries Ltd.) – C:\Windows\system32\drivers\brserid.sys – (Brserid [Disabled | Stopped]) DRV - [2006-11-02 09:24:44 | 00,062,336 | ---- | M] (Brother Industries Ltd.) – C:\Windows\system32\drivers\brserwdm.sys – (BrSerWdm [Disabled | Stopped]) DRV - [2006-11-02 09:24:44 | 00,012,160 | ---- | M] (Brother Industries Ltd.) – C:\Windows\system32\drivers\brusbmdm.sys – (BrUsbMdm [Disabled | Stopped]) DRV - [2006-11-02 09:24:47 | 00,011,904 | ---- | M] (Brother Industries Ltd.) – C:\Windows\system32\drivers\brusbser.sys – (BrUsbSer [On_Demand | Stopped]) DRV - [2008-01-21 03:23:00 | 00,019,000 | ---- | M] (CMD Technology, Inc.) – C:\Windows\system32\drivers\cmdide.sys – (cmdide [Disabled | Stopped]) DRV - [2008-01-21 03:23:24 | 00,118,784 | ---- | M] (Intel Corporation) – C:\Windows\System32\DRIVERS\E1G60I32.sys – (E1G60 [On_Demand | Stopped]) DRV - [2008-01-21 03:23:22 | 00,342,584 | ---- | M] (Emulex) – C:\Windows\system32\drivers\elxstor.sys – (elxstor [Disabled | Stopped]) DRV - [2009-05-18 13:17:00 | 00,026,600 | ---- | M] (GEAR Software Inc.) – C:\Windows\System32\Drivers\GEARAspiWDM.sys – (GEARAspiWDM [On_Demand | Running]) DRV - [2009-03-27 20:22:26 | 00,013,224 | ---- | M] (Sony Ericsson Mobile Communications) – C:\Windows\System32\DRIVERS\ggflt.sys – (ggflt [On_Demand | Stopped]) DRV - [2009-03-27 20:22:26 | 00,024,616 | ---- | M] (Sony Ericsson Mobile Communications) – C:\Windows\System32\DRIVERS\ggsemc.sys – (ggsemc [On_Demand | Stopped]) DRV - [2008-01-21 03:23:26 | 00,040,504 | ---- | M] (Hewlett-Packard Company) – C:\Windows\system32\drivers\hpcisss.sys – (HpCISSs [Disabled | Stopped]) DRV - [2008-01-21 03:23:23 | 00,235,064 | ---- | M] (Intel Corporation) – C:\Windows\system32\drivers\iastorv.sys – (iaStorV [Disabled | Stopped]) DRV - [2006-11-02 10:50:17 | 00,041,576 | ---- | M] (Intel Corp./ICP vortex GmbH) – C:\Windows\system32\drivers\iirsp.sys – (iirsp [Disabled | Stopped]) DRV - [1998-11-27 18:57:18 | 00,006,144 | ---- | M] (Erik Salaj) – C:\Windows\System32\DRIVERS\IOPORT.SYS – (IOPort [Auto | Stopped]) DRV - [2006-11-02 10:50:07 | 00,035,944 | ---- | M] (Integrated Technology Express, Inc.) – C:\Windows\system32\drivers\iteatapi.sys – (iteatapi [Disabled | Stopped]) DRV - [2006-11-02 10:50:09 | 00,035,944 | ---- | M] (Integrated Technology Express, Inc.) – C:\Windows\system32\drivers\iteraid.sys – (iteraid [Disabled | Stopped]) DRV - [2008-01-21 03:23:23 | 00,096,312 | ---- | M] (LSI Logic) – C:\Windows\system32\drivers\lsi_fc.sys – (LSI_FC [Disabled | Stopped]) DRV - [2008-01-21 03:23:25 | 00,089,656 | ---- | M] (LSI Logic) – C:\Windows\system32\drivers\lsi_sas.sys – (LSI_SAS [Disabled | Stopped]) DRV - [2008-01-21 03:23:23 | 00,096,312 | ---- | M] (LSI Logic) – C:\Windows\system32\drivers\lsi_scsi.sys – (LSI_SCSI [Disabled | Stopped]) DRV - [2008-01-21 03:23:27 | 00,031,288 | ---- | M] (LSI Corporation) – C:\Windows\system32\drivers\megasas.sys – (megasas [Disabled | Stopped]) DRV - [2008-01-21 03:23:27 | 00,386,616 | ---- | M] (LSI Corporation, Inc.) – C:\Windows\system32\drivers\megasr.sys – (MegaSR [Disabled | Stopped]) DRV - [2006-11-02 10:49:59 | 00,033,384 | ---- | M] (LSI Logic Corporation) – C:\Windows\system32\drivers\mraid35x.sys – (Mraid35x [Disabled | Stopped]) DRV - [2008-01-21 03:23:26 | 00,052,608 | ---- | M] (Microsoft Corporation) – C:\Windows\System32\DRIVERS\msdv.sys – (MSDV [On_Demand | Stopped]) DRV - [2006-10-18 06:44:48 | 00,007,680 | ---- | M] () – C:\Windows\System32\DRIVERS\ASACPI.sys – (MTsensor [On_Demand | Running]) DRV - [1997-04-09 20:31:22 | 00,020,768 | ---- | M] () – C:\Windows\system32\ckldrv.sys – (NetworkX [system | Stopped]) DRV - [2006-11-02 10:50:19 | 00,045,160 | ---- | M] (IBM Corporation) – C:\Windows\system32\drivers\nfrd960.sys – (nfrd960 [Disabled | Stopped]) DRV - [2006-11-02 08:36:50 | 00,020,608 | ---- | M] (N-trig Innovative Technologies) – C:\Windows\system32\drivers\ntrigdigi.sys – (ntrigdigi [Disabled | Stopped]) DRV - [2009-03-27 23:03:00 | 07,738,816 | ---- | M] (NVIDIA Corporation) – C:\Windows\System32\DRIVERS\nvlddmkm.sys – (nvlddmkm [On_Demand | Stopped]) DRV - [2008-01-21 03:23:21 | 00,102,968 | ---- | M] (NVIDIA Corporation) – C:\Windows\system32\drivers\nvraid.sys – (nvraid [Disabled | Stopped]) DRV - [2008-01-21 03:23:21 | 00,045,112 | ---- | M] (NVIDIA Corporation) – C:\Windows\system32\drivers\nvstor.sys – (nvstor [Disabled | Stopped]) DRV - [2007-03-08 00:51:00 | 00,043,528 | ---- | M] (Sonic Solutions) – C:\Windows\system32\Drivers\PxHelp20.sys – (PxHelp20 [boot | Running]) DRV - [2008-01-21 03:23:24 | 01,122,360 | ---- | M] (QLogic Corporation) – C:\Windows\system32\drivers\ql2300.sys – (ql2300 [Disabled | Stopped]) DRV - [2006-11-02 10:50:35 | 00,106,088 | ---- | M] (QLogic Corporation) – C:\Windows\system32\drivers\ql40xx.sys – (ql40xx [Disabled | Stopped]) DRV - [2007-04-04 12:43:20 | 00,083,208 | ---- | M] (MCCI Corporation) – C:\Windows\System32\DRIVERS\s716bus.sys – (s716bus [On_Demand | Stopped]) DRV - [2007-04-04 12:43:32 | 00,015,112 | ---- | M] (MCCI Corporation) – C:\Windows\System32\DRIVERS\s716mdfl.sys – (s716mdfl [On_Demand | Stopped]) DRV - [2007-04-04 12:43:34 | 00,108,552 | ---- | M] (MCCI Corporation) – C:\Windows\System32\DRIVERS\s716mdm.sys – (s716mdm [On_Demand | Stopped]) DRV - [2007-04-04 12:43:34 | 00,100,360 | ---- | M] (MCCI Corporation) – C:\Windows\System32\DRIVERS\s716mgmt.sys – (s716mgmt [On_Demand | Stopped]) DRV - [2007-04-04 12:43:36 | 00,023,176 | ---- | M] (MCCI Corporation) – C:\Windows\System32\DRIVERS\s716nd5.sys – (s716nd5 [On_Demand | Stopped]) DRV - [2007-04-04 12:43:36 | 00,098,568 | ---- | M] (MCCI Corporation) – C:\Windows\System32\DRIVERS\s716obex.sys – (s716obex [On_Demand | Stopped]) DRV - [2007-04-04 12:43:38 | 00,098,952 | ---- | M] (MCCI Corporation) – C:\Windows\System32\DRIVERS\s716unic.sys – (s716unic [On_Demand | Stopped]) DRV - [2006-11-02 07:37:21 | 00,020,480 | ---- | M] (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K.) – C:\Windows\System32\drivers\secdrv.sys – (secdrv [Auto | Stopped]) DRV - [2008-01-21 03:23:26 | 00,074,808 | ---- | M] (Silicon Integrated Systems) – C:\Windows\system32\drivers\sisraid4.sys – (SiSRaid4 [Disabled | Stopped]) DRV - [2006-11-02 10:50:05 | 00,035,944 | ---- | M] (LSI Logic) – C:\Windows\system32\drivers\symc8xx.sys – (Symc8xx [Disabled | Stopped]) DRV - [2006-11-02 10:49:56 | 00,031,848 | ---- | M] (LSI Logic) – C:\Windows\system32\drivers\sym_hi.sys – (Sym_hi [Disabled | Stopped]) DRV - [2006-11-02 10:50:03 | 00,034,920 | ---- | M] (LSI Logic) – C:\Windows\system32\drivers\sym_u3.sys – (Sym_u3 [Disabled | Stopped]) DRV - [2007-03-16 09:11:38 | 00,012,256 | ---- | M] (Windows ® 2000 DDK provider) – C:\Windows\System32\drivers\TBPanel.sys – (TBPanel [Auto | Stopped]) DRV - [2008-01-21 03:23:20 | 00,238,648 | ---- | M] (ULi Electronics Inc.) – C:\Windows\system32\drivers\uliahci.sys – (uliahci [Disabled | Stopped]) DRV - [2006-11-02 10:50:35 | 00,098,408 | ---- | M] (Promise Technology, Inc.) – C:\Windows\system32\drivers\ulsata.sys – (UlSata [Disabled | Stopped]) DRV - [2008-01-21 03:23:23 | 00,115,816 | ---- | M] (Promise Technology, Inc.) – C:\Windows\system32\drivers\ulsata2.sys – (ulsata2 [Disabled | Stopped]) DRV - [2008-01-21 03:23:00 | 00,020,024 | ---- | M] (VIA Technologies, Inc.) – C:\Windows\system32\drivers\viaide.sys – (viaide [Disabled | Stopped]) DRV - [2008-01-21 03:23:23 | 00,130,616 | ---- | M] (VIA Technologies Inc.,Ltd) – C:\Windows\system32\drivers\vsmraid.sys – (vsmraid [Disabled | Stopped]) DRV - [2007-12-06 09:51:00 | 00,298,496 | ---- | M] (Marvell) – C:\Windows\System32\DRIVERS\yk60x86.sys – (yukonwlh [On_Demand | Running]) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [binary data] IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Extensions Off Page = about:NoAdd-ons IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Security Risk Page = about:SecurityRisk IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 IE - HKLM…\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) IE - HKU.DEFAULT.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: “ProxyEnable” = 0 IE - HKU\S-1-5-18\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: “ProxyEnable” = 0 IE - HKU\S-1-5-21-2667736401-2583558282-641259272-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.nasza-klasa.pl IE - HKU\S-1-5-21-2667736401-2583558282-641259272-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\system32\blank.htm IE - HKU\S-1-5-21-2667736401-2583558282-641259272-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 IE - HKU\S-1-5-21-2667736401-2583558282-641259272-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKU\S-1-5-21-2667736401-2583558282-641259272-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.speedbit.com/ IE - HKU\S-1-5-21-2667736401-2583558282-641259272-1000\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\S-1-5-21-2667736401-2583558282-641259272-1000…\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) IE - HKU\S-1-5-21-2667736401-2583558282-641259272-1000…\URLSearchHook: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - Reg Error: Key error. File not found IE - HKU\S-1-5-21-2667736401-2583558282-641259272-1000\S-1-5-21-2667736401-2583558282-641259272-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: “ProxyEnable” = 0 IE - HKU\S-1-5-21-2667736401-2583558282-641259272-1000\S-1-5-21-2667736401-2583558282-641259272-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: “ProxyOverride” = *.local ========== FireFox ========== FF - prefs.js…browser.search.defaultenginename: “Winamp Search” FF - prefs.js…browser.search.defaulturl: “http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=” FF - prefs.js…browser.search.selectedEngine: “Google” FF - prefs.js…browser.search.useDBForOrder: true FF - prefs.js…browser.startup.homepage: “http://google.pl” FF - prefs.js…extensions.enabledItems: {E9A1DEE0-C623-4439-8932-001E7D17607D}:2.1.0.2 FF - prefs.js…extensions.enabledItems: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}:6.0.11 FF - prefs.js…extensions.enabledItems: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA}:6.0.13 FF - prefs.js…extensions.enabledItems: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA}:6.0.15 FF - prefs.js…extensions.enabledItems: {20a82645-c095-46ed-80e3-08825760534b}:1.1 FF - prefs.js…extensions.enabledItems: {37E4D8EA-8BDA-4831-8EA1-89053939A250}:2.2.0.2 FF - prefs.js…extensions.enabledItems: {EBFCD017-BCAD-42C3-9ED5-89DBDFC59171}:1.0.0 FF - prefs.js…extensions.enabledItems: {46551EC9-40F0-4e47-8E18-8E5CF550CFB8}:1.0.6 FF - prefs.js…extensions.enabledItems: {0b38152b-1b20-484d-a11f-5e04a9b0661f}:5.6.11.2 FF - prefs.js…extensions.enabledItems: {972ce4c6-7e08-4474-a285-3208198ce6fd}:3.0.15 FF - prefs.js…keyword.URL: “http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampab&query=” FF - HKLM\software\mozilla\Firefox\Extensions\{20a82645-c095-46ed-80e3-08825760534b}: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\ [2009-06-25 08:28:33 | 00,000,000 | —D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.15\extensions\Components: C:\Program Files\Mozilla Firefox\components [2009-11-07 11:21:53 | 00,000,000 | —D | M] FF - HKLM\software\mozilla\Mozilla Firefox 3.0.15\extensions\Plugins: C:\Program Files\Mozilla Firefox\plugins [2009-11-07 11:21:53 | 00,000,000 | —D | M] [2008-09-16 12:20:51 | 00,000,000 | —D | M] – C:\Users\Gogola\AppData\Roaming\mozilla\Extensions [2008-09-16 12:20:51 | 00,000,000 | —D | M] – C:\Users\Gogola\AppData\Roaming\mozilla\Extensions{ec8030f7-c20a-464f-9b0e-13a3a9e97384} [2009-11-06 19:55:32 | 00,000,000 | —D | M] – C:\Users\Gogola\AppData\Roaming\mozilla\Firefox\Profiles\td5ko3jh.default\extensions [2009-08-18 10:08:52 | 00,000,000 | —D | M] – C:\Users\Gogola\AppData\Roaming\mozilla\Firefox\Profiles\td5ko3jh.default\extensions{0b38152b-1b20-484d-a11f-5e04a9b0661f} [2009-06-25 11:00:09 | 00,000,000 | —D | M] – C:\Users\Gogola\AppData\Roaming\mozilla\Firefox\Profiles\td5ko3jh.default\extensions{20a82645-c095-46ed-80e3-08825760534b} [2009-10-11 15:43:43 | 00,000,000 | —D | M] – C:\Users\Gogola\AppData\Roaming\mozilla\Firefox\Profiles\td5ko3jh.default\extensions{37E4D8EA-8BDA-4831-8EA1-89053939A250} [2009-09-30 15:49:54 | 00,000,000 | —D | M] – C:\Users\Gogola\AppData\Roaming\mozilla\Firefox\Profiles\td5ko3jh.default\extensions{46551EC9-40F0-4e47-8E18-8E5CF550CFB8} [2008-12-13 13:44:52 | 00,000,000 | —D | M] – C:\Users\Gogola\AppData\Roaming\mozilla\Firefox\Profiles\td5ko3jh.default\extensions{E9A1DEE0-C623-4439-8932-001E7D17607D} [2008-12-13 14:02:03 | 00,000,682 | ---- | M] () – C:\Users\Gogola\AppData\Roaming\Mozilla\FireFox\Profiles\td5ko3jh.default\searchplugins\ask.xml [2009-06-16 20:59:43 | 00,001,196 | ---- | M] () – C:\Users\Gogola\AppData\Roaming\Mozilla\FireFox\Profiles\td5ko3jh.default\searchplugins\winamp-search.xml [2009-03-19 07:39:47 | 00,002,542 | ---- | M] () – C:\Users\Gogola\AppData\Roaming\Mozilla\FireFox\Profiles\td5ko3jh.default\searchplugins\wyszukiwarka-onetpl.xml [2009-11-07 11:21:56 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions [2009-11-07 11:21:53 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions{972ce4c6-7e08-4474-a285-3208198ce6fd} [2009-02-27 13:19:30 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions{B13721C7-F507-4982-B2E5-502A71474FED} [2008-12-13 13:50:01 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} [2009-03-25 16:32:40 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} [2009-09-16 18:35:04 | 00,000,000 | —D | M] – C:\Program Files\mozilla firefox\extensions{CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} [2009-11-07 11:21:53 | 00,023,032 | ---- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\browserdirprovider.dll [2009-11-07 11:21:53 | 00,134,648 | ---- | M] (Mozilla Foundation) – C:\Program Files\mozilla firefox\components\brwsrcmp.dll [2007-04-30 15:29:22 | 00,049,152 | ---- | M] (Adobe Systems, Inc.) – C:\Program Files\mozilla firefox\plugins\np32dsw.dll [2009-07-25 04:23:01 | 00,411,368 | ---- | M] (Sun Microsystems, Inc.) – C:\Program Files\mozilla firefox\plugins\npdeploytk.dll [2008-06-27 16:03:12 | 01,446,440 | ---- | M] (Microsoft Corporation) – C:\Program Files\mozilla firefox\plugins\npLegitCheckPlugin.dll [2009-11-07 11:21:53 | 00,065,528 | ---- | M] (mozilla.org) – C:\Program Files\mozilla firefox\plugins\npnul32.dll [2006-10-26 19:12:16 | 00,016,192 | ---- | M] (Microsoft Corporation) – C:\Program Files\mozilla firefox\plugins\NPOFF12.DLL [2005-09-24 05:44:16 | 00,077,824 | ---- | M] (Adobe Systems Inc.) – C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2009-09-11 15:19:21 | 00,159,744 | ---- | M] (Apple Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin.dll [2009-09-11 15:19:21 | 00,159,744 | ---- | M] (Apple Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin2.dll [2009-09-11 15:19:21 | 00,159,744 | ---- | M] (Apple Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin3.dll [2009-09-11 15:19:21 | 00,159,744 | ---- | M] (Apple Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin4.dll [2009-09-11 15:19:21 | 00,159,744 | ---- | M] (Apple Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin5.dll [2009-09-11 15:19:22 | 00,159,744 | ---- | M] (Apple Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin6.dll [2009-09-11 15:19:22 | 00,159,744 | ---- | M] (Apple Inc.) – C:\Program Files\mozilla firefox\plugins\npqtplugin7.dll [2009-09-12 15:14:08 | 00,002,767 | ---- | M] () – C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml [2009-09-12 15:14:08 | 00,001,406 | ---- | M] () – C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml [2009-09-12 15:14:08 | 00,001,706 | ---- | M] () – C:\Program Files\mozilla firefox\searchplugins\google.xml [2009-09-12 15:14:08 | 00,000,917 | ---- | M] () – C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml [2009-09-12 15:14:08 | 00,000,858 | ---- | M] () – C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml [2009-09-12 15:14:08 | 00,001,183 | ---- | M] () – C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml [2009-09-12 15:14:08 | 00,001,683 | ---- | M] () – C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml O1 HOSTS File: (736 bytes) - C:\Windows\System32\drivers\etc\Hosts O1 - Hosts: ::1 localhost O2 - BHO: (AcroIEHlprObj Class) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx () O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) O2 - BHO: (AVG Safe Search) - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (AVG Technologies CZ, s.r.o.) O2 - BHO: (SPEEDBIT1 Class) - {425E30F0-CCC6-4E24-BBEB-BCBD31720B37} - C:\Program Files\SpeedBit Toolbar\Toolbar\SpeedBit.dll () O2 - BHO: (Search Helper) - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll (Microsoft Corporation) O2 - BHO: (Pomocnik rejestrowania za pomocą identyfikatora Windows Live) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation) O2 - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.3.4501.1418\swg.dll (Google Inc.) O2 - BHO: (PDFCreator Toolbar Helper) - {C451C08A-EC37-45DF-AAAD-18B51AB5E837} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll () O2 - BHO: (Google Dictionary Compression sdch) - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll (Google Inc.) O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Windows Live Toolbar Helper) - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O2 - BHO: (IEPluginBHO Class) - {F5CC7F02-6F4E-4462-B5B1-394A57FD3E0D} - C:\Users\Gogola\AppData\Roaming\Nowe Gadu-Gadu_userdata\ggbho.1.dll (GG Network S.A.) O3 - HKLM…\Toolbar: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O3 - HKLM…\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKLM…\Toolbar: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll () O3 - HKLM…\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) O3 - HKLM…\Toolbar: (SpeedBit) - {EBFCD017-BCAD-42C3-9ED5-89DBDFC59171} - C:\Program Files\SpeedBit Toolbar\Toolbar\SpeedBit.dll () O3 - HKU\S-1-5-21-2667736401-2583558282-641259272-1000…\Toolbar\WebBrowser: (&Windows Live Toolbar) - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll (Microsoft Corporation) O3 - HKU\S-1-5-21-2667736401-2583558282-641259272-1000…\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.) O3 - HKU\S-1-5-21-2667736401-2583558282-641259272-1000…\Toolbar\WebBrowser: (PDFCreator Toolbar) - {31CF9EBE-5755-4A1D-AC25-2834D952D9B4} - C:\Program Files\PDFCreator Toolbar\v3.3.0.1\PDFCreator_Toolbar.dll () O3 - HKU\S-1-5-21-2667736401-2583558282-641259272-1000…\Toolbar\WebBrowser: (Winamp Toolbar) - {EBF2BA02-9094-4C5A-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) O3 - HKU\S-1-5-21-2667736401-2583558282-641259272-1000…\Toolbar\WebBrowser: (SpeedBit) - {EBFCD017-BCAD-42C3-9ED5-89DBDFC59171} - C:\Program Files\SpeedBit Toolbar\Toolbar\SpeedBit.dll () O4 - HKLM…\Run: [Ai Nap] C:\Program Files\ASUS\Ai Suite\AiNap\AiNap.exe () O4 - HKLM…\Run: [AVG8_TRAY] C:\Program Files\AVG\AVG8\avgtray.exe (AVG Technologies CZ, s.r.o.) O4 - HKLM…\Run: [Cpu Level Up help] C:\Program Files\ASUS\Ai Suite\CpuLevelUpHelp.exe () O4 - HKLM…\Run: [CPU Power Monitor] C:\Program Files\ASUS\Ai Suite\AiGear3\CpuPowerMonitor.exe () O4 - HKLM…\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe (Apple Inc.) O4 - HKLM…\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes’ Anti-Malware\mbam.exe (Malwarebytes Corporation) O4 - HKLM…\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.DLL (NVIDIA Corporation) O4 - HKLM…\Run: [NvMediaCenter] C:\Windows\System32\NvMcTray.DLL (NVIDIA Corporation) O4 - HKLM…\Run: [QuickTime Task] C:\Program Files\QuickTime\QTTask.exe (Apple Inc.) O4 - HKLM…\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe (Sun Microsystems, Inc.) O4 - HKLM…\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKU\S-1-5-19…\Run: [sidebar] C:\Program Files\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-19…\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.DLL (Microsoft Corporation) O4 - HKU\S-1-5-20…\Run: [sidebar] C:\Program Files\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-20…\Run: [WindowsWelcomeCenter] C:\Windows\System32\oobefldr.DLL (Microsoft Corporation) O4 - HKU\S-1-5-21-2667736401-2583558282-641259272-1000…\Run: [ares] C:\Program Files\Ares\Ares.exe (Ares Development Group) O4 - HKU\S-1-5-21-2667736401-2583558282-641259272-1000…\Run: [DownloadAccelerator] File not found O4 - HKU\S-1-5-21-2667736401-2583558282-641259272-1000…\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-2667736401-2583558282-641259272-1000…\Run: [Nowe Gadu-Gadu] File not found O4 - HKU\S-1-5-21-2667736401-2583558282-641259272-1000…\Run: [Orb] C:\Program Files\Winamp Remote\bin\OrbTray.exe (Orb Networks) O4 - HKU\S-1-5-21-2667736401-2583558282-641259272-1000…\Run: [sidebar] C:\Program Files\Windows Sidebar\sidebar.exe (Microsoft Corporation) O4 - HKU\S-1-5-21-2667736401-2583558282-641259272-1000…\Run: [skype] C:\Program Files\Skype\Phone\Skype.exe (Skype Technologies S.A.) O4 - HKU\S-1-5-21-2667736401-2583558282-641259272-1000…\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (Google Inc.) O4 - HKU\S-1-5-21-2667736401-2583558282-641259272-1000…\Run: [TBPanel] C:\Program Files\Vtune\TBPanel.exe () O4 - HKU\S-1-5-21-2667736401-2583558282-641259272-1000…\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (Microsoft Corporation) O4 - HKLM…\RunOnce: [EraserRestartErase (1)] C:\Windows\System32\Eraserl.exe (-) O4 - HKLM…\RunOnce: [EraserRestartErase (2)] C:\Windows\System32\Eraserl.exe (-) O4 - HKLM…\RunOnce: [EraserRestartErase (3)] C:\Windows\System32\Eraserl.exe (-) O4 - HKLM…\RunOnce: [EraserRestartErase (4)] C:\Windows\System32\Eraserl.exe (-) O4 - HKLM…\RunOnce: [Malwarebytes’ Anti-Malware] C:\Program Files\Malwarebytes’ Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableInstallerDetection = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableSecureUIAPaths = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableVirtualization = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ValidateAdminCodeSignatures = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: dontdisplaylastusername = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticecaption = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: legalnoticetext = O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: scforceoption = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: shutdownwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: undockwithoutlogon = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: FilterAdministratorToken = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableUIADesktopToggle = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_TEXT = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_BITMAP = 2 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_OEMTEXT = 7 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIB = 8 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_PALETTE = 9 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_UNICODETEXT = 13 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\UIPI\Clipboard\ExceptionFormats: CF_DIBV5 = 17 O7 - HKU.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = [binary data] O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = [binary data] O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html () O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - C:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Wpis w blogu - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra ‘Tools’ menuitem : &Wpis w blogu w Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra ‘Tools’ menuitem : Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\Program Files\Paltalk Messenger\Paltalk.exe File not found O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Program Files\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000001 [] - C:\Windows\System32\NLAapi.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000002 [] - C:\Windows\System32\napinsp.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000003 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000004 [] - C:\Windows\System32\pnrpnsp.dll (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll File not found O13 - gopher Prefix: missing O16 - DPF: {65D72393-E210-4A2A-B8E0-10AC45986770} https://megapanel.gem.pl/WebInstaller.dll (GWebInstallControl Object) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinsta … s-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} http://fpdownload.macromedia.com/get/fl … rashim.cab (Reg Error: Key error.) O16 - DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta … s-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinsta … s-i586.cab (Java Plug-in 1.6.0_15) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/f … wflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.250 O18 - Protocol\Handler\linkscanner {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll (AVG Technologies CZ, s.r.o.) O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8064.0206.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Program Files\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Filter: - text/xml - C:\Program Files\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (avgrsstx.dll) - C:\Windows\System32\avgrsstx.dll (AVG Technologies CZ, s.r.o.) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O31 - SafeBoot: AlternateShell - cmd.exe O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006-09-18 22:43:36 | 00,000,024 | ---- | M] () - C:\autoexec.bat – [NTFS] O32 - AutoRun File - [2007-08-25 01:11:07 | 00,402,696 | R— | M] (Electronic Arts) - H:\AutoRun.exe – [UDF] O32 - AutoRun File - [2007-08-25 01:11:07 | 00,402,696 | R— | M] (Electronic Arts) - H:\Autorun.exe – [UDF] O32 - AutoRun File - [2007-08-25 01:11:06 | 04,381,696 | R— | M] () - H:\autorun.dat – [UDF] O32 - AutoRun File - [2007-08-25 01:10:43 | 00,000,133 | R— | M] () - H:\autorun.inf – [UDF] O33 - MountPoints2{bbdb8e29-8329-11dd-9b9d-806e6f6e6963}\Shell - “” = AutoRun O33 - MountPoints2{bbdb8e29-8329-11dd-9b9d-806e6f6e6963}\Shell\AutoRun\command - “” = H:\Autorun.exe – [2007-08-25 01:11:07 | 00,402,696 | R— | M] (Electronic Arts) O34 - HKLM BootExecute: (autocheck) - File not found O34 - HKLM BootExecute: (autochk) - C:\Windows\System32\autochk.exe (Microsoft Corporation) O34 - HKLM BootExecute: (*) - File not found O35 - comfile [open] – “%1” %* File not found O35 - exefile [open] – “%1” %* File not found ========== Files/Folders - Created Within 30 Days ========== [2009-11-05 18:12:51 | 00,000,000 | —D | C] – C:\ProgramData\335E [2009-10-14 14:19:54 | 00,000,000 | —D | C] – C:\Users\Gogola\AppData\Local\Yenka [2009-10-19 18:48:05 | 00,000,000 | —D | C] – C:\Program Files\trend micro [2009-11-07 11:26:16 | 00,000,000 | —D | C] – C:_OTL [2009-10-19 18:48:04 | 00,000,000 | —D | C] – C:\rsit [2009-10-14 07:09:59 | 00,144,896 | ---- | C] (Microsoft Corporation) – C:\Windows\System32\drivers\srv2.sys [2009-10-14 07:09:59 | 00,061,440 | ---- | C] (Microsoft Corporation) – C:\Windows\System32\msasn1.dll [2009-10-14 07:09:58 | 00,604,672 | ---- | C] (Microsoft Corporation) – C:\Windows\System32\WMSPDMOD.DLL ========== Files - Modified Within 30 Days ========== [2009-11-07 11:28:58 | 00,001,356 | ---- | M] () – C:\Users\Gogola\AppData\Local\d3d9caps.dat [2009-11-07 11:28:05 | 00,067,584 | --S- | M] () – C:\Windows\bootstat.dat [2009-11-07 11:21:31 | 01,468,980 | ---- | M] () – C:\Windows\System32\PerfStringBackup.INI [2009-11-07 11:21:31 | 00,661,070 | ---- | M] () – C:\Windows\System32\perfh015.dat [2009-11-07 11:21:31 | 00,586,568 | ---- | M] () – C:\Windows\System32\perfh009.dat [2009-11-07 11:21:31 | 00,126,324 | ---- | M] () – C:\Windows\System32\perfc015.dat [2009-11-07 11:21:31 | 00,100,640 | ---- | M] () – C:\Windows\System32\perfc009.dat [2009-11-07 11:12:12 | 00,004,320 | -H-- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2009-11-07 11:12:12 | 00,004,320 | -H-- | M] () – C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2009-11-07 10:21:49 | 00,086,275 | ---- | M] () – C:\Windows\System32\drivers\Avg\microavi.avg [2009-11-07 10:21:48 | 44,777,068 | ---- | M] () – C:\Windows\System32\drivers\Avg\incavi.avm [2009-11-06 17:24:53 | 00,016,013 | ---- | M] () – C:\Users\Gogola\Desktop\nnnnnnnnnnn.pdf [2009-11-06 16:48:24 | 00,004,016 | ---- | M] () – C:\Users\Gogola\Desktop\radio.pdf [2009-11-06 15:26:30 | 00,567,489 | ---- | M] () – C:\Users\Gogola\Desktop\AVT2481[1].pdf [2009-11-02 20:42:06 | 00,195,456 | ---- | M] (Microsoft Corporation) – C:\Windows\System32\MpSigStub.exe [2009-11-02 16:45:03 | 00,028,672 | ---- | M] () – C:\Users\Gogola\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009-10-25 15:12:27 | 00,001,201 | ---- | M] () – C:\Users\Gogola\AppData\Roaming\bascom-avr.xml [2009-10-24 20:23:38 | 04,635,664 | ---- | M] () – C:\Users\Gogola\Desktop\PICT0043.JPG [2009-10-24 20:23:37 | 04,608,529 | ---- | M] () – C:\Users\Gogola\Desktop\PICT0039.JPG [2009-10-24 20:23:36 | 03,475,495 | ---- | M] () – C:\Users\Gogola\Desktop\PICT0036.JPG [2009-10-24 18:53:44 | 05,397,596 | ---- | M] () – C:\Users\Gogola\Desktop\PICT0018.JPG [2009-10-24 18:53:43 | 04,713,764 | ---- | M] () – C:\Users\Gogola\Desktop\PICT0015.JPG [2009-10-24 18:53:42 | 04,671,755 | ---- | M] () – C:\Users\Gogola\Desktop\PICT0014.JPG [2009-10-24 18:53:41 | 04,966,694 | ---- | M] () – C:\Users\Gogola\Desktop\PICT0012.JPG [2009-10-20 16:16:09 | 00,520,147 | ---- | M] () – C:\Users\Gogola\Desktop\ble ble.lsl [2009-10-19 18:53:43 | 00,000,098 | ---- | M] () – C:\Windows\System32\1255974823.(null) [2009-10-19 18:53:09 | 00,000,094 | ---- | M] () – C:\Windows\System32\1255974788.(null) [2009-10-19 18:53:01 | 00,000,050 | ---- | M] () – C:\Windows\System32\1255974781.(null) [2009-10-19 18:51:45 | 00,000,094 | ---- | M] () – C:\Windows\System32\1255974704.(null) [2009-10-19 18:49:49 | 00,001,891 | ---- | M] () – C:\Users\Gogola\Desktop\Blender.lnk [2009-10-19 18:47:28 | 00,000,669 | ---- | M] () – C:\Users\Public\Desktop\Google SketchUp.lnk [2009-10-16 20:28:51 | 03,852,538 | ---- | M] () – C:\Users\Gogola\Desktop\pupa.mp3 [2009-10-15 14:22:54 | 00,366,201 | ---- | M] () – C:\Users\Gogola\Desktop\fizyka_0708a.pdf [2009-10-15 14:22:54 | 00,249,639 | ---- | M] () – C:\Users\Gogola\Desktop\fizyka_0607a.pdf [2009-10-08 19:08:27 | 00,051,811 | ---- | M] () – C:\Users\Gogola\Desktop\Dok3.pdf [2009-10-08 18:57:40 | 00,003,842 | ---- | M] () – C:\Users\Gogola\Desktop\nowy pomysł.pdf ========== Files - No Company Name ========== [2009-11-06 17:24:53 | 00,016,013 | ---- | C] () – C:\Users\Gogola\Desktop\nnnnnnnnnnn.pdf [2009-11-06 16:48:24 | 00,004,016 | ---- | C] () – C:\Users\Gogola\Desktop\radio.pdf [2009-11-06 15:26:30 | 00,567,489 | ---- | C] () – C:\Users\Gogola\Desktop\AVT2481[1].pdf [2009-10-24 20:23:37 | 04,635,664 | ---- | C] () – C:\Users\Gogola\Desktop\PICT0043.JPG [2009-10-24 20:23:36 | 04,608,529 | ---- | C] () – C:\Users\Gogola\Desktop\PICT0039.JPG [2009-10-24 20:23:35 | 03,475,495 | ---- | C] () – C:\Users\Gogola\Desktop\PICT0036.JPG [2009-10-24 18:53:43 | 05,397,596 | ---- | C] () – C:\Users\Gogola\Desktop\PICT0018.JPG [2009-10-24 18:53:42 | 04,713,764 | ---- | C] () – C:\Users\Gogola\Desktop\PICT0015.JPG [2009-10-24 18:53:41 | 04,671,755 | ---- | C] () – C:\Users\Gogola\Desktop\PICT0014.JPG [2009-10-24 18:53:40 | 04,966,694 | ---- | C] () – C:\Users\Gogola\Desktop\PICT0012.JPG [2009-10-20 16:16:09 | 00,520,147 | ---- | C] () – C:\Users\Gogola\Desktop\ble ble.lsl [2009-10-19 18:53:43 | 00,000,098 | ---- | C] () – C:\Windows\System32\1255974823.(null) [2009-10-19 18:53:08 | 00,000,094 | ---- | C] () – C:\Windows\System32\1255974788.(null) [2009-10-19 18:53:01 | 00,000,050 | ---- | C] () – C:\Windows\System32\1255974781.(null) [2009-10-19 18:51:44 | 00,000,094 | ---- | C] () – C:\Windows\System32\1255974704.(null) [2009-10-19 18:49:49 | 00,001,891 | ---- | C] () – C:\Users\Gogola\Desktop\Blender.lnk [2009-10-19 18:47:28 | 00,000,669 | ---- | C] () – C:\Users\Public\Desktop\Google SketchUp.lnk [2009-10-16 20:25:55 | 03,852,538 | ---- | C] () – C:\Users\Gogola\Desktop\pupa.mp3 [2009-10-15 14:22:54 | 00,366,201 | ---- | C] () – C:\Users\Gogola\Desktop\fizyka_0708a.pdf [2009-10-15 14:22:52 | 00,249,639 | ---- | C] () – C:\Users\Gogola\Desktop\fizyka_0607a.pdf [2009-10-08 19:08:27 | 00,051,811 | ---- | C] () – C:\Users\Gogola\Desktop\Dok3.pdf [2009-10-08 18:57:40 | 00,003,842 | ---- | C] () – C:\Users\Gogola\Desktop\nowy pomysł.pdf [2009-10-06 18:49:31 | 00,020,768 | ---- | C] () – C:\Windows\System32\CKLDRV.sys [2009-09-28 16:00:17 | 00,000,131 | -H-- | C] () – C:\Windows\tsetup.ini [2009-09-23 16:53:11 | 00,003,802 | ---- | C] () – C:\Windows\Client99SE.INI [2009-09-23 16:53:11 | 00,000,385 | ---- | C] () – C:\Windows\AdvSch99SE.ini [2009-09-23 16:53:11 | 00,000,369 | ---- | C] () – C:\Windows\HelpAdvisor99SE.ini [2009-09-23 16:53:11 | 00,000,332 | ---- | C] () – C:\Windows\CRYPKEY.INI [2009-09-23 16:53:11 | 00,000,073 | ---- | C] () – C:\Windows\AdvSIM99SE.INI [2009-09-12 12:31:42 | 00,001,201 | ---- | C] () – C:\Users\Gogola\AppData\Roaming\bascom-avr.xml [2009-09-05 07:46:05 | 00,003,631 | ---- | C] () – C:\Windows\scad3.INI [2009-06-19 13:41:15 | 00,076,407 | ---- | C] () – C:\Users\Gogola\AppData\Roaming\Smiley.ico [2009-06-10 22:10:47 | 00,000,759 | ---- | C] () – C:\Windows\GFACT.INI [2009-01-14 20:28:55 | 00,000,048 | ---- | C] () – C:\Windows\winfile.ini [2009-01-09 20:43:29 | 00,000,136 | ---- | C] () – C:\Users\Gogola\AppData\Roaming\mainhst.zgh [2008-10-29 20:20:10 | 00,069,632 | ---- | C] () – C:\Windows\System32\xmltok.dll [2008-10-29 20:20:10 | 00,036,864 | ---- | C] () – C:\Windows\System32\xmlparse.dll [2008-10-12 16:28:29 | 00,000,266 | RHS- | C] () – C:\ProgramData\ntuser.pol [2008-10-04 16:26:32 | 02,070,035 | ---- | C] () – C:\Users\Gogola\AppData\Roaming\UserTile.png [2008-09-18 16:03:17 | 00,028,672 | ---- | C] () – C:\Users\Gogola\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008-09-17 16:51:14 | 00,003,654 | ---- | C] () – C:\Windows\System32\drivers\Sonyhcp.dll [2008-09-15 15:02:37 | 00,024,576 | R— | C] () – C:\Windows\System32\AsIO.dll [2008-09-15 15:02:37 | 00,012,664 | R— | C] () – C:\Windows\System32\drivers\AsIO.sys [2008-09-15 15:02:35 | 00,012,096 | ---- | C] () – C:\Windows\System32\drivers\AsInsHelp64.sys [2008-09-15 15:02:35 | 00,010,304 | ---- | C] () – C:\Windows\System32\drivers\AsInsHelp32.sys [2008-09-15 14:37:59 | 00,026,488 | ---- | C] () – C:\Windows\Ascd_log.ini [2008-09-15 14:37:45 | 00,007,680 | ---- | C] () – C:\Windows\System32\drivers\ASACPI.sys [2008-09-15 14:37:44 | 00,026,174 | ---- | C] () – C:\Windows\Ascd_tmp.ini [2008-09-15 14:36:13 | 00,069,344 | ---- | C] () – C:\Users\Gogola\AppData\Local\GDIPFONTCACHEV1.DAT [2008-09-15 14:35:56 | 00,001,356 | ---- | C] () – C:\Users\Gogola\AppData\Local\d3d9caps.dat [2007-08-01 04:39:28 | 00,012,536 | ---- | C] () – C:\Windows\System32\drivers\ASUSHWIO.SYS [2006-11-02 13:50:50 | 00,000,174 | -HS- | C] () – C:\Program Files\desktop.ini [2006-11-02 13:35:32 | 00,005,632 | ---- | C] () – C:\Windows\System32\sysprepMCE.dll [2006-11-02 11:23:31 | 00,000,443 | ---- | C] () – C:\Windows\win.ini [2006-11-02 11:23:31 | 00,000,219 | ---- | C] () – C:\Windows\system.ini [2006-11-02 08:40:29 | 00,013,750 | ---- | C] () – C:\Windows\System32\pacerprf.ini ========== Alternate Data Streams ========== @Alternate Data Stream - 186 bytes -> C:\ProgramData\TEMP:69D4A686 @Alternate Data Stream - 126 bytes -> C:\ProgramData\TEMP:A9662AE0 < End of report >