Skocz do zawartości

Zarchiwizowany

Ten temat jest archiwizowany i nie można dodawać nowych odpowiedzi.

b3rt

Windows 7 - dziwne programy proszą o dostęp do sieci

Przez b3rt, w Programy

Polecane posty

b3rt Smok

b3rt

Napisano
Napisano

Witam.

Wczoraj w końcu dorwałem swoje łapy do Windows 7 (wersja OEM, Ultimate, 32-bitowa). Zainstalowałem, skopiowałem dokumenty ze starego systemu i zabrałem się za instalację programów i gier.

Tu jednak pojawił się problem. Podczas instalacji programu Games for Windows LIVE dla Resident Evil 5, Comodo wyrzucił mi trzy zapytania o dostęp do sieci (dokładnie to programów dm1.exe, 59684668.ex_ oraz setupv.exe). Zablokowałem wszystkim trzem dostęp do internetu (prawie zawsze tak robię kiedy pojawiają się nieznane programy), i wydawało mi się że nic się nie stało. Jednak po włączeniu Firefoxa zauważyłem że strona startowa sama ustawiła się na jakieś pornosy, a wyszukiwarka z toolbara zmieniła się na "IWeird" czy jakoś tak. Poprzestawiałem wszystko na swoje własne ustawienia, i jak na razie nie stwierdziłem żadnych niepokojących akcji komputera. Dla pewności prosiłbym jednak o sprawdzenie logów:

Malwarebytes Anti-Malware:

Pierwszy skan:

Malwarebytes' Anti-Malware 1.44

Wersja bazy definicji: 3884

Windows 6.1.7600

Internet Explorer 8.0.7600.16385


2010-03-19 08:02:38

mbam-log-2010-03-19 (08-02-38).txt


Typ skanowania: Pełne skanowanie (C:\|D:\|)

Przeskanowane obiekty: 186769

Upłynęło: 12 minute(s), 49 second(s)


Zainfekowane procesy w pamięci: 0

Zainfekowane moduły pamięci: 0

Zainfekowane klucze rejestru: 5

Zainfekowane wartości rejestru: 0

Zainfekowane pliki rejestru: 0

Zainfekowane foldery: 0

Zainfekowane pliki: 2


Zainfekowane procesy w pamięci:

(Nie wykryto groźnych plików)


Zainfekowane moduły pamięci:

(Nie wykryto groźnych plików)


Zainfekowane klucze rejestru:

HKEY_CLASSES_ROOT\CLSID\{fe5b2d9d-91b0-b04b-ac20-14a260769687} (Adware.ColorSoft) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\6d-nuenaqfz4uz (Adware.Adrotator) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\AppDataLow\HavingFunOnline (Adware.BHO.FL) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{acf7af75-6528-a79b-033a-96a8af6c8be7} (Adware.BHO) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{acf7af75-6528-a79b-033a-96a8af6c8be7} (Adware.BHO) -> Quarantined and deleted successfully.


Zainfekowane wartości rejestru:

(Nie wykryto groźnych plików)


Zainfekowane pliki rejestru:

(Nie wykryto groźnych plików)


Zainfekowane foldery:

(Nie wykryto groźnych plików)


Zainfekowane pliki:

C:\Windows\System32\6d-NUEnAQfZ4UZ.exe (Adware.Adrotator) -> Quarantined and deleted successfully.

C:\Windows\System32\spsRJsYp.dll (Adware.BHO) -> Quarantined and deleted successfully.

Skan po usunięciu zakażonych plików 

Malwarebytes' Anti-Malware 1.44

Wersja bazy definicji: 3884

Windows 6.1.7600

Internet Explorer 8.0.7600.16385


2010-03-19 08:19:14

mbam-log-2010-03-19 (08-19-14).txt


Typ skanowania: Pełne skanowanie (C:\|)

Przeskanowane obiekty: 183907

Upłynęło: 13 minute(s), 56 second(s)


Zainfekowane procesy w pamięci: 0

Zainfekowane moduły pamięci: 0

Zainfekowane klucze rejestru: 0

Zainfekowane wartości rejestru: 0

Zainfekowane pliki rejestru: 0

Zainfekowane foldery: 0

Zainfekowane pliki: 0


Zainfekowane procesy w pamięci:

(Nie wykryto groźnych plików)


Zainfekowane moduły pamięci:

(Nie wykryto groźnych plików)


Zainfekowane klucze rejestru:

(Nie wykryto groźnych plików)


Zainfekowane wartości rejestru:

(Nie wykryto groźnych plików)


Zainfekowane pliki rejestru:

(Nie wykryto groźnych plików)


Zainfekowane foldery:

(Nie wykryto groźnych plików)


Zainfekowane pliki:

(Nie wykryto groźnych plików)

OTL

OTL logfile created on: 2010-03-19 08:16:10 - Run 3

OTL by OldTimer - Version 3.1.37.3     Folder = C:\Users\b3rt\Downloads

 Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.7600.16385)

Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd


3,00 Gb Total Physical Memory | 2,00 Gb Available Physical Memory | 65,00% Memory free

6,00 Gb Paging File | 5,00 Gb Available in Paging File | 79,00% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]


%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files

Drive C: | 195,31 Gb Total Space | 160,56 Gb Free Space | 82,21% Space Free | Partition Type: NTFS

Drive D: | 270,44 Gb Total Space | 242,75 Gb Free Space | 89,76% Space Free | Partition Type: NTFS

E: Drive not present or media not loaded

F: Drive not present or media not loaded

G: Drive not present or media not loaded

H: Drive not present or media not loaded

I: Drive not present or media not loaded


Computer Name: B3RT-KOMPUTER

Current User Name: b3rt

Logged in as Administrator.


Current Boot Mode: Normal

Scan Mode: All users

Company Name Whitelist: Off

Skip Microsoft Files: Off

File Age = 30 Days

Output = Standard


[color=#E56717]========== Processes (SafeList) ==========[/color]


PRC - [2010-03-19 00:38:21 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Users\b3rt\Downloads\OTL.exe

PRC - [2010-03-03 19:54:44 | 000,960,080 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe

PRC - [2010-03-03 19:54:32 | 001,983,760 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cfp.exe

PRC - [2010-02-12 19:23:32 | 000,148,744 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO livePCsupport\CLPSLS.exe

PRC - [2010-01-16 04:18:19 | 000,910,296 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe

PRC - [2010-01-11 21:00:00 | 000,240,232 | ---- | M] (NVIDIA Corporation) -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe

PRC - [2010-01-07 16:07:10 | 001,394,000 | ---- | M] (Malwarebytes Corporation) -- C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

PRC - [2009-11-17 15:18:22 | 006,807,552 | ---- | M] (Creative Team S.A.) -- C:\Program Files\WapSter\WapSter AQQ\AQQ.exe

PRC - [2009-07-21 13:34:33 | 000,185,089 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe

PRC - [2009-07-14 02:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe

PRC - [2009-07-14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe

PRC - [2009-05-13 15:48:22 | 000,108,289 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe

PRC - [2009-03-02 12:08:47 | 000,209,153 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe



[color=#E56717]========== Modules (SafeList) ==========[/color]


MOD - [2010-03-19 00:38:21 | 000,555,520 | ---- | M] (OldTimer Tools) -- C:\Users\b3rt\Downloads\OTL.exe

MOD - [2010-03-03 19:54:42 | 000,276,648 | ---- | M] (COMODO) -- C:\Windows\System32\guard32.dll

MOD - [2009-07-14 02:16:15 | 000,099,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sspicli.dll

MOD - [2009-07-14 02:16:13 | 000,092,160 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\sechost.dll

MOD - [2009-07-14 02:16:13 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\samcli.dll

MOD - [2009-07-14 02:16:12 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\profapi.dll

MOD - [2009-07-14 02:16:03 | 000,022,016 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\netutils.dll

MOD - [2009-07-14 02:15:35 | 000,288,256 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\KernelBase.dll

MOD - [2009-07-14 02:15:13 | 000,067,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dwmapi.dll

MOD - [2009-07-14 02:15:11 | 000,064,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\devobj.dll

MOD - [2009-07-14 02:15:07 | 000,036,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cryptbase.dll

MOD - [2009-07-14 02:15:02 | 000,145,920 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\cfgmgr32.dll

MOD - [2009-07-14 02:03:50 | 001,680,896 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc\comctl32.dll



[color=#E56717]========== Win32 Services (SafeList) ==========[/color]


SRV - [2010-03-18 22:28:41 | 000,332,720 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)

SRV - [2010-03-03 19:54:44 | 000,960,080 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent)

SRV - [2010-02-12 19:23:32 | 000,148,744 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO livePCsupport\CLPSLS.exe -- (CLPSLS)

SRV - [2010-01-11 21:00:00 | 000,240,232 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)

SRV - [2009-07-21 13:34:33 | 000,185,089 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)

SRV - [2009-07-14 02:16:21 | 000,185,856 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\wwansvc.dll -- (WwanSvc)

SRV - [2009-07-14 02:16:17 | 000,151,552 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\wbiosrvc.dll -- (WbioSrvc)

SRV - [2009-07-14 02:16:17 | 000,119,808 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\umpo.dll -- (Power)

SRV - [2009-07-14 02:16:16 | 000,037,376 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\themeservice.dll -- (Themes)

SRV - [2009-07-14 02:16:15 | 000,053,760 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sppuinotify.dll -- (sppuinotify)

SRV - [2009-07-14 02:16:13 | 000,043,520 | ---- | M] (Microsoft Corporation) [Unknown | Running] -- C:\Windows\System32\RpcEpMap.dll -- (RpcEptMapper)

SRV - [2009-07-14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)

SRV - [2009-07-14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)

SRV - [2009-07-14 02:16:12 | 000,269,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpsvc.dll -- (PNRPsvc)

SRV - [2009-07-14 02:16:12 | 000,269,824 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpsvc.dll -- (p2pimsvc)

SRV - [2009-07-14 02:16:12 | 000,165,376 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Windows\System32\provsvc.dll -- (HomeGroupProvider)

SRV - [2009-07-14 02:16:12 | 000,020,480 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\pnrpauto.dll -- (PNRPAutoReg)

SRV - [2009-07-14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)

SRV - [2009-07-14 02:15:36 | 000,194,560 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\ListSvc.dll -- (HomeGroupListener)

SRV - [2009-07-14 02:15:21 | 000,797,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\FntCache.dll -- (FontCache)

SRV - [2009-07-14 02:15:11 | 000,253,440 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\System32\dhcpcore.dll -- (Dhcp)

SRV - [2009-07-14 02:15:10 | 000,218,624 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\defragsvc.dll -- (defragsvc)

SRV - [2009-07-14 02:14:59 | 000,076,800 | ---- | M] (Microsoft Corporation) [Unknown | Stopped] -- C:\Windows\System32\bdesvc.dll -- (BDESVC)

SRV - [2009-07-14 02:14:58 | 000,088,064 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\AxInstSv.dll -- (AxInstSV) Instalator formantów ActiveX (AxInstSV)

SRV - [2009-07-14 02:14:53 | 000,027,648 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\appidsvc.dll -- (AppIDSvc)

SRV - [2009-07-14 02:14:29 | 003,179,520 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\System32\sppsvc.exe -- (sppsvc)

SRV - [2009-05-13 15:48:22 | 000,108,289 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)



[color=#E56717]========== Driver Services (SafeList) ==========[/color]


DRV - [2010-03-03 19:54:06 | 000,074,328 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\Windows\System32\drivers\inspect.sys -- (inspect)

DRV - [2010-03-03 19:54:06 | 000,030,032 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\Windows\System32\drivers\cmdhlp.sys -- (cmdHlp)

DRV - [2010-03-03 19:54:04 | 000,208,192 | ---- | M] (COMODO) [File_System | System | Running] -- C:\Windows\System32\drivers\cmdGuard.sys -- (cmdGuard)

DRV - [2010-01-12 05:03:33 | 011,586,280 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)

DRV - [2010-01-07 16:07:14 | 000,038,224 | ---- | M] (Malwarebytes Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\mbamswissarmy.sys -- (MBAMSwissArmy)

DRV - [2009-07-30 12:58:26 | 000,187,392 | ---- | M] (Realtek                                            ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rt86win7.sys -- (RTL8167)

DRV - [2009-07-28 15:33:56 | 000,055,656 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)

DRV - [2009-07-14 02:26:21 | 000,015,952 | ---- | M] (CMD Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\cmdide.sys -- (cmdide)

DRV - [2009-07-14 02:26:17 | 000,297,552 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\adpahci.sys -- (adpahci)

DRV - [2009-07-14 02:26:15 | 000,422,976 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\adp94xx.sys -- (adp94xx)

DRV - [2009-07-14 02:26:15 | 000,159,312 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdsbs.sys -- (amdsbs)

DRV - [2009-07-14 02:26:15 | 000,146,512 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\adpu320.sys -- (adpu320)

DRV - [2009-07-14 02:26:15 | 000,086,608 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\arcsas.sys -- (arcsas)

DRV - [2009-07-14 02:26:15 | 000,079,952 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\amdsata.sys -- (amdsata)

DRV - [2009-07-14 02:26:15 | 000,076,368 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\arc.sys -- (arc)

DRV - [2009-07-14 02:26:15 | 000,023,616 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\amdxata.sys -- (amdxata)

DRV - [2009-07-14 02:26:15 | 000,014,400 | ---- | M] (Acer Laboratories Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\aliide.sys -- (aliide)

DRV - [2009-07-14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\nvstor.sys -- (nvstor)

DRV - [2009-07-14 02:20:44 | 000,117,312 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\nvraid.sys -- (nvraid)

DRV - [2009-07-14 02:20:44 | 000,044,624 | ---- | M] (IBM Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\nfrd960.sys -- (nfrd960)

DRV - [2009-07-14 02:20:37 | 000,089,168 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_sas.sys -- (LSI_SAS)

DRV - [2009-07-14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\iaStorV.sys -- (iaStorV)

DRV - [2009-07-14 02:20:36 | 000,235,584 | ---- | M] (LSI Corporation, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\MegaSR.sys -- (MegaSR)

DRV - [2009-07-14 02:20:36 | 000,133,200 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\ksecpkg.sys -- (KSecPkg)

DRV - [2009-07-14 02:20:36 | 000,096,848 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_scsi.sys -- (LSI_SCSI)

DRV - [2009-07-14 02:20:36 | 000,095,824 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_fc.sys -- (LSI_FC)

DRV - [2009-07-14 02:20:36 | 000,054,864 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\lsi_sas2.sys -- (LSI_SAS2)

DRV - [2009-07-14 02:20:36 | 000,041,040 | ---- | M] (Intel Corp./ICP vortex GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\iirsp.sys -- (iirsp)

DRV - [2009-07-14 02:20:36 | 000,030,800 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\megasas.sys -- (megasas)

DRV - [2009-07-14 02:20:36 | 000,013,904 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\hwpolicy.sys -- (hwpolicy)

DRV - [2009-07-14 02:20:28 | 000,453,712 | ---- | M] (Emulex) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\elxstor.sys -- (elxstor)

DRV - [2009-07-14 02:20:28 | 000,070,720 | ---- | M] (Adaptec, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\djsvs.sys -- (aic78xx)

DRV - [2009-07-14 02:20:28 | 000,067,152 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\HpSAMD.sys -- (HpSAMD)

DRV - [2009-07-14 02:20:28 | 000,046,160 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\fsdepends.sys -- (FsDepends)

DRV - [2009-07-14 02:19:11 | 000,141,904 | ---- | M] (VIA Technologies Inc.,Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vsmraid.sys -- (vsmraid)

DRV - [2009-07-14 02:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus)

DRV - [2009-07-14 02:19:10 | 000,159,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vhdmp.sys -- (vhdmp)

DRV - [2009-07-14 02:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vmstorfl.sys -- (storflt)

DRV - [2009-07-14 02:19:10 | 000,032,832 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vdrvroot.sys -- (vdrvroot)

DRV - [2009-07-14 02:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc)

DRV - [2009-07-14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\wimmount.sys -- (WIMMount)

DRV - [2009-07-14 02:19:10 | 000,016,976 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\viaide.sys -- (viaide)

DRV - [2009-07-14 02:19:04 | 001,383,488 | ---- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\ql2300.sys -- (ql2300)

DRV - [2009-07-14 02:19:04 | 000,173,648 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\rdyboost.sys -- (rdyboost)

DRV - [2009-07-14 02:19:04 | 000,106,064 | ---- | M] (QLogic Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\ql40xx.sys -- (ql40xx)

DRV - [2009-07-14 02:19:04 | 000,077,888 | ---- | M] (Silicon Integrated Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\sisraid4.sys -- (SiSRaid4)

DRV - [2009-07-14 02:19:04 | 000,043,088 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\pcw.sys -- (pcw)

DRV - [2009-07-14 02:19:04 | 000,040,016 | ---- | M] (Silicon Integrated Systems Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\SiSRaid2.sys -- (SiSRaid2)

DRV - [2009-07-14 02:19:04 | 000,021,072 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\stexstor.sys -- (stexstor)

DRV - [2009-07-14 02:17:54 | 000,369,568 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\cng.sys -- (CNG)

DRV - [2009-07-14 01:57:25 | 000,272,128 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\Brserid.sys -- (Brserid) Brother MFC Serial Port Interface Driver (WDM)

DRV - [2009-07-14 01:02:41 | 000,018,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\rdpbus.sys -- (rdpbus)

DRV - [2009-07-14 01:01:41 | 000,007,168 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\RDPREFMP.sys -- (RDPREFMP)

DRV - [2009-07-14 00:55:00 | 000,049,152 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\agilevpn.sys -- (RasAgileVpn) WAN Miniport (IKEv2)

DRV - [2009-07-14 00:53:51 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\wfplwf.sys -- (WfpLwf)

DRV - [2009-07-14 00:52:44 | 000,027,136 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ndiscap.sys -- (NdisCap)

DRV - [2009-07-14 00:52:02 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vwifibus.sys -- (vwifibus)

DRV - [2009-07-14 00:52:00 | 000,163,328 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\1394ohci.sys -- (1394ohci)

DRV - [2009-07-14 00:51:35 | 000,008,192 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\umpass.sys -- (UmPass)

DRV - [2009-07-14 00:51:08 | 000,004,096 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\mshidkmdf.sys -- (mshidkmdf)

DRV - [2009-07-14 00:46:55 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\MTConfig.sys -- (MTConfig)

DRV - [2009-07-14 00:45:26 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CompositeBus.sys -- (CompositeBus)

DRV - [2009-07-14 00:36:52 | 000,050,176 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\appid.sys -- (AppID)

DRV - [2009-07-14 00:33:50 | 000,026,624 | ---- | M] (Microsoft Corporation) [Kernel | Unknown | Stopped] -- C:\Windows\System32\drivers\scfilter.sys -- (scfilter)

DRV - [2009-07-14 00:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap)

DRV - [2009-07-14 00:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID)

DRV - [2009-07-14 00:24:05 | 000,032,256 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\System32\drivers\discache.sys -- (discache)

DRV - [2009-07-14 00:19:21 | 000,021,504 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\HidBatt.sys -- (HidBatt)

DRV - [2009-07-14 00:16:36 | 000,009,728 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\acpipmi.sys -- (AcpiPmi)

DRV - [2009-07-14 00:11:04 | 000,052,736 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\amdppm.sys -- (AmdPPM)

DRV - [2009-07-13 23:54:14 | 000,026,624 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\hcw85cir.sys -- (hcw85cir)

DRV - [2009-07-13 23:53:33 | 000,012,160 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\BrUsbMdm.sys -- (BrUsbMdm)

DRV - [2009-07-13 23:53:33 | 000,011,904 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\BrUsbSer.sys -- (BrUsbSer)

DRV - [2009-07-13 23:53:32 | 000,062,336 | ---- | M] (Brother Industries Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\Drivers\BrSerWdm.sys -- (BrSerWdm)

DRV - [2009-07-13 23:53:28 | 000,013,568 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\BrFiltLo.sys -- (BrFiltLo)

DRV - [2009-07-13 23:53:28 | 000,005,248 | ---- | M] (Brother Industries, Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\BrFiltUp.sys -- (BrFiltUp)

DRV - [2009-07-13 23:02:49 | 000,229,888 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\b57nd60x.sys -- (b57nd60x)

DRV - [2009-07-13 23:02:48 | 003,100,160 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\evbdx.sys -- (ebdrv)

DRV - [2009-07-13 23:02:48 | 000,430,080 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\bxvbdx.sys -- (b06bdrv)

DRV - [2009-05-11 09:12:24 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)

DRV - [2009-03-30 09:33:07 | 000,096,104 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)

DRV - [2009-02-13 11:35:05 | 000,011,608 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys -- (avgio)



[color=#E56717]========== Standard Registry (SafeList) ==========[/color]



[color=#E56717]========== Internet Explorer ==========[/color]




IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0




IE - HKU\S-1-5-21-2345122944-109170285-3351383334-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = 

IE - HKU\S-1-5-21-2345122944-109170285-3351383334-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


[color=#E56717]========== FireFox ==========[/color]


FF - prefs.js..browser.search.defaultenginename: "Search"

FF - prefs.js..browser.search.defaulturl: ""

FF - prefs.js..browser.search.selectedEngine: "Google"

FF - prefs.js..browser.startup.homepage: "http://www.google.pl/"

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.1.3

FF - prefs.js..extensions.enabledItems: {D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}:0.9.6.7

FF - prefs.js..extensions.enabledItems: {b0c795cb-d5cc-5b3f-5707-3d304cc5f2d9}:4.6.6.4



FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2010-03-18 21:43:45 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Firefox 3.6\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2010-03-18 21:43:45 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2010-03-18 21:43:45 | 000,000,000 | ---D | M]

FF - HKLM\software\mozilla\Mozilla Thunderbird 2.0.0.23\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins


[2010-03-18 21:34:18 | 000,000,000 | ---D | M] -- C:\Users\b3rt\AppData\Roaming\mozilla\Extensions

[2010-03-19 08:12:50 | 000,000,000 | ---D | M] -- C:\Users\b3rt\AppData\Roaming\mozilla\Firefox\Profiles\8kffjvnm.default\extensions

[2010-03-18 21:58:49 | 000,000,000 | ---D | M] (FoxyTunes) -- C:\Users\b3rt\AppData\Roaming\mozilla\Firefox\Profiles\8kffjvnm.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}

[2010-03-18 21:56:25 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\b3rt\AppData\Roaming\mozilla\Firefox\Profiles\8kffjvnm.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}

[2010-03-18 21:59:40 | 000,000,000 | ---D | M] (Download Statusbar) -- C:\Users\b3rt\AppData\Roaming\mozilla\Firefox\Profiles\8kffjvnm.default\extensions\{D4DD63FA-01E4-46a7-B6B1-EDAB7D6AD389}

[2010-03-19 00:02:20 | 000,000,000 | ---D | M] -- C:\Program Files\Mozilla Firefox\extensions

[2010-03-19 00:02:20 | 000,000,000 | ---D | M] (LoudMo Contextual Ad Assistant) -- C:\Program Files\Mozilla Firefox\extensions\{b0c795cb-d5cc-5b3f-5707-3d304cc5f2d9}

[2010-01-16 02:08:36 | 000,002,767 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\allegro-pl.xml

[2010-01-16 02:08:36 | 000,001,406 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\fbc-pl.xml

[2010-01-16 02:08:36 | 000,000,917 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\merlin-pl.xml

[2010-01-16 02:08:36 | 000,000,858 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\pwn-pl.xml

[2010-01-16 02:08:36 | 000,001,183 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-pl.xml

[2010-01-16 02:08:36 | 000,001,683 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wp-pl.xml


O1 HOSTS File: ([2010-03-19 00:44:27 | 000,000,098 | ---- | M]) - C:\Windows\System32\drivers\etc\Hosts

O1 - Hosts: 127.0.0.1       localhost

O1 - Hosts: ::1       localhost

O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)

O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cfp.exe (COMODO)

O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)

O4 - HKU\S-1-5-21-2345122944-109170285-3351383334-1000..\Run: [AQQ] C:\Program Files\WapSter\WapSter AQQ\AQQ.exe (Creative Team S.A.)

O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)

O4 - Startup: C:\Users\b3rt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\esport1.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3

O13 - gopher Prefix: missing

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 194.204.152.34 194.204.159.1

O20 - AppInit_DLLs: (C:\Windows\system32\guard32.dll) - C:\Windows\System32\guard32.dll (COMODO)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)

O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.

O30 - LSA: Security Packages - (pku2u) - C:\Windows\System32\pku2u.dll (Microsoft Corporation)

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2009-06-10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *) -  File not found

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*


[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]


[2010-03-19 07:47:59 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Roaming\Malwarebytes

[2010-03-19 07:47:56 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys

[2010-03-19 07:47:54 | 000,019,160 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys

[2010-03-19 07:47:54 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware

[2010-03-19 07:47:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes

[2010-03-19 00:44:21 | 000,000,000 | ---D | C] -- C:\_OTL

[2010-03-19 00:05:08 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\microsoft

[2010-03-18 23:53:00 | 002,036,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_40.dll

[2010-03-18 23:53:00 | 000,452,440 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_40.dll

[2010-03-18 23:52:59 | 004,379,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_40.dll

[2010-03-18 23:46:54 | 000,000,000 | ---D | C] -- C:\Program Files\CAPCOM

[2010-03-18 23:46:10 | 000,000,000 | ---D | C] -- C:\Windows\System32\xlive

[2010-03-18 23:46:10 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft Games for Windows - LIVE

[2010-03-18 23:28:46 | 000,528,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_6.dll

[2010-03-18 23:28:46 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_6.dll

[2010-03-18 23:28:46 | 000,074,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_4.dll

[2010-03-18 23:28:46 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_7.dll

[2010-03-18 23:28:45 | 005,501,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dcsx_42.dll

[2010-03-18 23:28:45 | 001,974,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_42.dll

[2010-03-18 23:28:45 | 000,515,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_5.dll

[2010-03-18 23:28:45 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_42.dll

[2010-03-18 23:28:45 | 000,238,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_5.dll

[2010-03-18 23:28:45 | 000,235,344 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx11_42.dll

[2010-03-18 23:28:44 | 004,178,264 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_41.dll

[2010-03-18 23:28:44 | 001,892,184 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_42.dll

[2010-03-18 23:28:44 | 001,846,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_41.dll

[2010-03-18 23:28:44 | 000,517,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_4.dll

[2010-03-18 23:28:44 | 000,453,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_41.dll

[2010-03-18 23:28:44 | 000,235,352 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_4.dll

[2010-03-18 23:28:44 | 000,069,464 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_3.dll

[2010-03-18 23:28:44 | 000,022,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_6.dll

[2010-03-18 23:28:43 | 003,851,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_39.dll

[2010-03-18 23:28:43 | 001,493,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_39.dll

[2010-03-18 23:28:43 | 000,514,384 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_3.dll

[2010-03-18 23:28:43 | 000,509,448 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_2.dll

[2010-03-18 23:28:43 | 000,507,400 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_1.dll

[2010-03-18 23:28:43 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_39.dll

[2010-03-18 23:28:43 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_2.dll

[2010-03-18 23:28:43 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_1.dll

[2010-03-18 23:28:43 | 000,235,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_3.dll

[2010-03-18 23:28:43 | 000,070,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_2.dll

[2010-03-18 23:28:43 | 000,068,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_1.dll

[2010-03-18 23:28:43 | 000,065,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAPOFX1_0.dll

[2010-03-18 23:28:43 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_4.dll

[2010-03-18 23:28:43 | 000,023,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_5.dll

[2010-03-18 23:28:42 | 003,850,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_38.dll

[2010-03-18 23:28:42 | 003,786,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DX9_37.dll

[2010-03-18 23:28:42 | 001,491,992 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_38.dll

[2010-03-18 23:28:42 | 001,420,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_37.dll

[2010-03-18 23:28:42 | 000,479,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XAudio2_0.dll

[2010-03-18 23:28:42 | 000,467,984 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_38.dll

[2010-03-18 23:28:42 | 000,462,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_37.dll

[2010-03-18 23:28:42 | 000,267,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_10.dll

[2010-03-18 23:28:42 | 000,238,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine3_0.dll

[2010-03-18 23:28:42 | 000,025,608 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_3.dll

[2010-03-18 23:28:41 | 003,734,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_36.dll

[2010-03-18 23:28:41 | 003,727,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_35.dll

[2010-03-18 23:28:41 | 001,374,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_36.dll

[2010-03-18 23:28:41 | 001,358,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_35.dll

[2010-03-18 23:28:41 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_36.dll

[2010-03-18 23:28:41 | 000,444,776 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_35.dll

[2010-03-18 23:28:41 | 000,267,112 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_9.dll

[2010-03-18 23:28:41 | 000,266,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_8.dll

[2010-03-18 23:28:41 | 000,017,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\X3DAudio1_2.dll

[2010-03-18 23:28:40 | 003,497,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_34.dll

[2010-03-18 23:28:40 | 003,495,784 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_33.dll

[2010-03-18 23:28:40 | 001,124,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_34.dll

[2010-03-18 23:28:40 | 001,123,696 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\D3DCompiler_33.dll

[2010-03-18 23:28:40 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_34.dll

[2010-03-18 23:28:40 | 000,443,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10_33.dll

[2010-03-18 23:28:40 | 000,261,480 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_7.dll

[2010-03-18 23:28:40 | 000,255,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_6.dll

[2010-03-18 23:28:40 | 000,081,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xinput1_3.dll

[2010-03-18 23:28:39 | 003,426,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_32.dll

[2010-03-18 23:28:39 | 002,414,360 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_31.dll

[2010-03-18 23:28:39 | 000,440,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx10.dll

[2010-03-18 23:28:39 | 000,251,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_5.dll

[2010-03-18 23:28:39 | 000,237,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_4.dll

[2010-03-18 23:28:39 | 000,236,824 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_3.dll

[2010-03-18 23:28:39 | 000,230,168 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_2.dll

[2010-03-18 23:28:39 | 000,229,584 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_1.dll

[2010-03-18 23:28:39 | 000,062,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xinput1_2.dll

[2010-03-18 23:28:39 | 000,062,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xinput1_1.dll

[2010-03-18 23:28:39 | 000,015,128 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\x3daudio1_1.dll

[2010-03-18 23:28:38 | 002,388,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_30.dll

[2010-03-18 23:28:37 | 002,337,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_25.dll

[2010-03-18 23:28:37 | 002,332,368 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_29.dll

[2010-03-18 23:28:37 | 002,323,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_28.dll

[2010-03-18 23:28:37 | 002,319,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_27.dll

[2010-03-18 23:28:37 | 002,297,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_26.dll

[2010-03-18 23:28:37 | 002,222,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\d3dx9_24.dll

[2010-03-18 23:28:37 | 000,230,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\xactengine2_0.dll

[2010-03-18 23:28:37 | 000,014,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\x3daudio1_0.dll

[2010-03-18 23:23:03 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Local\GHISLER

[2010-03-18 23:23:03 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Local\Divinity 2

[2010-03-18 23:20:10 | 000,000,000 | ---D | C] -- C:\Windows\System32\directx

[2010-03-18 23:18:53 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Roaming\ProtectDisc

[2010-03-18 23:17:46 | 000,000,000 | ---D | C] -- C:\totalcmd

[2010-03-18 23:17:46 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Roaming\GHISLER

[2010-03-18 23:11:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Divinity 2

[2010-03-18 23:02:55 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Local\Microsoft Games

[2010-03-18 22:58:11 | 000,000,000 | ---D | C] -- C:\Program Files\Divinity II - Ego Draconis

[2010-03-18 22:53:18 | 000,094,208 | ---- | C] (Realtek Semiconductor Corporation) -- C:\Windows\System32\RTNUninst32.dll

[2010-03-18 22:53:06 | 000,187,392 | ---- | C] (Realtek                                            ) -- C:\Windows\System32\drivers\Rt86win7.sys

[2010-03-18 22:53:05 | 000,000,000 | -H-D | C] -- C:\Program Files\InstallShield Installation Information

[2010-03-18 22:53:05 | 000,000,000 | ---D | C] -- C:\Program Files\Realtek

[2010-03-18 22:27:16 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Roaming\WinRAR

[2010-03-18 22:27:04 | 000,000,000 | ---D | C] -- C:\Program Files\WinRAR

[2010-03-18 22:25:41 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Steam

[2010-03-18 22:25:40 | 000,000,000 | ---D | C] -- C:\Program Files\Steam

[2010-03-18 22:23:00 | 000,000,000 | ---D | C] -- C:\ProgramData\COMODO

[2010-03-18 22:21:20 | 000,000,000 | ---D | C] -- C:\ProgramData\NVIDIA

[2010-03-18 22:21:03 | 000,000,000 | ---D | C] -- C:\Program Files\AGEIA Technologies

[2010-03-18 22:20:57 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Wise Installation Wizard

[2010-03-18 22:20:55 | 000,000,000 | ---D | C] -- C:\Program Files\NVIDIA Corporation

[2010-03-18 22:20:33 | 011,586,280 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvlddmkm.sys

[2010-03-18 22:20:33 | 000,795,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dpinst.exe

[2010-03-18 22:20:33 | 000,068,200 | ---- | C] (Khronos Group) -- C:\Windows\System32\OpenCL.dll

[2010-03-18 22:20:33 | 000,010,920 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\drivers\nvBridge.kmd

[2010-03-18 22:20:32 | 014,924,392 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvoglv32.dll

[2010-03-18 22:20:32 | 004,338,792 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvencodemft.dll

[2010-03-18 22:20:32 | 002,243,176 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvid.dll

[2010-03-18 22:20:32 | 000,318,568 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvdecodemft.dll

[2010-03-18 22:20:31 | 011,639,400 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcompiler.dll

[2010-03-18 22:20:31 | 004,077,672 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuvenc.dll

[2010-03-18 22:20:31 | 004,061,800 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcuda.dll

[2010-03-18 22:20:31 | 001,280,616 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvapi.dll

[2010-03-18 22:20:31 | 000,182,888 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcod189.dll

[2010-03-18 22:20:31 | 000,182,888 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\nvcod.dll

[2010-03-18 22:20:29 | 000,000,000 | ---D | C] -- C:\NVIDIA

[2010-03-18 22:14:28 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Roaming\Media Player Classic

[2010-03-18 22:09:05 | 000,000,000 | ---D | C] -- C:\Program Files\Combined Community Codec Pack

[2010-03-18 22:07:24 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Roaming\Xfire

[2010-03-18 22:07:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Xfire

[2010-03-18 22:07:23 | 000,000,000 | ---D | C] -- C:\Program Files\Xfire

[2010-03-18 22:01:20 | 000,000,000 | ---D | C] -- C:\Program Files\COMODO

[2010-03-18 21:55:47 | 000,000,000 | ---D | C] -- C:\ProgramData\Comodo Downloader

[2010-03-18 21:53:00 | 000,096,104 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys

[2010-03-18 21:53:00 | 000,055,656 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys

[2010-03-18 21:53:00 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys

[2010-03-18 21:52:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira

[2010-03-18 21:52:59 | 000,000,000 | ---D | C] -- C:\Program Files\Avira

[2010-03-18 21:51:58 | 000,000,000 | -HSD | C] -- C:\Windows\Installer

[2010-03-18 21:49:17 | 000,181,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe

[2010-03-18 21:48:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Last.fm

[2010-03-18 21:48:06 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Local\Last.fm

[2010-03-18 21:48:05 | 000,000,000 | ---D | C] -- C:\Program Files\Last.fm

[2010-03-18 21:44:46 | 000,000,000 | ---D | C] -- C:\Users\b3rt\WapSter

[2010-03-18 21:43:59 | 000,000,000 | ---D | C] -- C:\Program Files\WapSter

[2010-03-18 21:43:44 | 000,278,528 | ---- | C] (Real Networks, Inc) -- C:\Windows\System32\pncrt.dll

[2010-03-18 21:43:44 | 000,185,920 | ---- | C] (RealNetworks, Inc.) -- C:\Windows\System32\rmoc3260.dll

[2010-03-18 21:43:44 | 000,006,656 | ---- | C] (RealNetworks, Inc.) -- C:\Windows\System32\pndx5016.dll

[2010-03-18 21:43:44 | 000,005,632 | ---- | C] (RealNetworks, Inc.) -- C:\Windows\System32\pndx5032.dll

[2010-03-18 21:43:43 | 000,499,712 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msvcp71.dll

[2010-03-18 21:43:43 | 000,348,160 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msvcr71.dll

[2010-03-18 21:43:43 | 000,000,000 | ---D | C] -- C:\Program Files\Real Alternative

[2010-03-18 21:36:19 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Roaming\foobar2000

[2010-03-18 21:36:15 | 000,000,000 | ---D | C] -- C:\Program Files\foobar2000

[2010-03-18 21:35:25 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Roaming\Thunderbird

[2010-03-18 21:35:25 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Local\Thunderbird

[2010-03-18 21:35:21 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Thunderbird

[2010-03-18 21:34:11 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Roaming\Mozilla

[2010-03-18 21:34:11 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Local\Mozilla

[2010-03-18 21:34:08 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox

[2010-03-18 21:33:52 | 000,000,000 | ---D | C] -- C:\Users\b3rt\Documents\Save

[2010-03-18 21:33:46 | 000,000,000 | ---D | C] -- C:\Users\b3rt\Documents\Pobieranie

[2010-03-18 21:33:45 | 000,000,000 | ---D | C] -- C:\Users\b3rt\Documents\Ikony Ergum

[2010-03-18 21:33:30 | 000,000,000 | R--D | C] -- C:\Users\b3rt\Documents\Downloads

[2010-03-18 21:33:30 | 000,000,000 | ---D | C] -- C:\Users\b3rt\Documents\CAPCOM

[2010-03-18 21:33:27 | 000,000,000 | ---D | C] -- C:\Users\b3rt\Documents\szkola

[2010-03-18 21:30:34 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Roaming\Macromedia

[2010-03-18 21:30:34 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Roaming\Adobe

[2010-03-18 21:30:33 | 000,000,000 | ---D | C] -- C:\Windows\System32\Macromed

[2010-03-18 21:28:38 | 000,000,000 | R--D | C] -- C:\Users\b3rt\Searches

[2010-03-18 21:28:30 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Roaming\Identities

[2010-03-18 21:28:29 | 000,000,000 | R--D | C] -- C:\Users\b3rt\Contacts

[2010-03-18 21:28:23 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Local\VirtualStore

[2010-03-18 21:28:22 | 000,000,000 | --SD | C] -- C:\Users\b3rt\AppData\Roaming\Microsoft

[2010-03-18 21:28:22 | 000,000,000 | RHSD | C] -- C:\Users\b3rt\Documents\Moje obrazy

[2010-03-18 21:28:22 | 000,000,000 | RHSD | C] -- C:\Users\b3rt\Documents\Moja muzyka

[2010-03-18 21:28:22 | 000,000,000 | R--D | C] -- C:\Users\b3rt\Videos

[2010-03-18 21:28:22 | 000,000,000 | R--D | C] -- C:\Users\b3rt\Saved Games

[2010-03-18 21:28:22 | 000,000,000 | R--D | C] -- C:\Users\b3rt\Pictures

[2010-03-18 21:28:22 | 000,000,000 | R--D | C] -- C:\Users\b3rt\Music

[2010-03-18 21:28:22 | 000,000,000 | R--D | C] -- C:\Users\b3rt\Links

[2010-03-18 21:28:22 | 000,000,000 | R--D | C] -- C:\Users\b3rt\Favorites

[2010-03-18 21:28:22 | 000,000,000 | R--D | C] -- C:\Users\b3rt\Downloads

[2010-03-18 21:28:22 | 000,000,000 | R--D | C] -- C:\Users\b3rt\Documents

[2010-03-18 21:28:22 | 000,000,000 | R--D | C] -- C:\Users\b3rt\Desktop

[2010-03-18 21:28:22 | 000,000,000 | -HSD | C] -- C:\Users\b3rt\Ustawienia lokalne

[2010-03-18 21:28:22 | 000,000,000 | -HSD | C] -- C:\Users\b3rt\AppData\Local\Temporary Internet Files

[2010-03-18 21:28:22 | 000,000,000 | -HSD | C] -- C:\Users\b3rt\Szablony

[2010-03-18 21:28:22 | 000,000,000 | -HSD | C] -- C:\Users\b3rt\SendTo

[2010-03-18 21:28:22 | 000,000,000 | -HSD | C] -- C:\Users\b3rt\Recent

[2010-03-18 21:28:22 | 000,000,000 | -HSD | C] -- C:\Users\b3rt\PrintHood

[2010-03-18 21:28:22 | 000,000,000 | -HSD | C] -- C:\Users\b3rt\NetHood

[2010-03-18 21:28:22 | 000,000,000 | -HSD | C] -- C:\Users\b3rt\Documents\Moje wideo

[2010-03-18 21:28:22 | 000,000,000 | -HSD | C] -- C:\Users\b3rt\Moje dokumenty

[2010-03-18 21:28:22 | 000,000,000 | -HSD | C] -- C:\Users\b3rt\Menu Start

[2010-03-18 21:28:22 | 000,000,000 | -HSD | C] -- C:\Users\b3rt\AppData\Local\Historia

[2010-03-18 21:28:22 | 000,000,000 | -HSD | C] -- C:\Users\b3rt\Dane aplikacji

[2010-03-18 21:28:22 | 000,000,000 | -HSD | C] -- C:\Users\b3rt\AppData\Local\Dane aplikacji

[2010-03-18 21:28:22 | 000,000,000 | -HSD | C] -- C:\Users\b3rt\Cookies

[2010-03-18 21:28:22 | 000,000,000 | -H-D | C] -- C:\Users\b3rt\AppData

[2010-03-18 21:28:22 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Local\Temp

[2010-03-18 21:28:22 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Local\Microsoft

[2010-03-18 21:28:22 | 000,000,000 | ---D | C] -- C:\Users\b3rt\AppData\Roaming\Media Center Programs

[2010-03-18 21:27:38 | 000,000,000 | -HSD | C] -- C:\ProgramData\Ulubione

[2010-03-18 21:27:38 | 000,000,000 | -HSD | C] -- C:\ProgramData\Szablony

[2010-03-18 21:27:38 | 000,000,000 | -HSD | C] -- C:\Recovery

[2010-03-18 21:27:38 | 000,000,000 | -HSD | C] -- C:\ProgramData\Pulpit

[2010-03-18 21:27:38 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Moje wideo

[2010-03-18 21:27:38 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Moje obrazy

[2010-03-18 21:27:38 | 000,000,000 | -HSD | C] -- C:\Users\Public\Documents\Moja muzyka

[2010-03-18 21:27:38 | 000,000,000 | -HSD | C] -- C:\ProgramData\Menu Start

[2010-03-18 21:27:38 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dokumenty

[2010-03-18 21:27:38 | 000,000,000 | -HSD | C] -- C:\ProgramData\Dane aplikacji

[2010-03-18 21:24:29 | 000,000,000 | ---D | C] -- C:\Windows\SoftwareDistribution

[2010-03-18 21:22:03 | 000,000,000 | ---D | C] -- C:\Windows\Prefetch

[2010-03-18 21:21:45 | 000,000,000 | -HSD | C] -- C:\System Volume Information

[2010-03-18 21:21:05 | 000,000,000 | ---D | C] -- C:\Windows\Panther

[2010-03-18 21:20:52 | 000,000,000 | -HSD | C] -- C:\Boot

[2010-03-18 21:20:44 | 000,000,000 | ---D | C] -- C:\Windows\System32\OEM

[2010-03-03 19:54:42 | 000,276,648 | ---- | C] (COMODO) -- C:\Windows\System32\guard32.dll

[2010-03-03 19:54:06 | 000,074,328 | ---- | C] (COMODO) -- C:\Windows\System32\drivers\inspect.sys

[2010-03-03 19:54:06 | 000,030,032 | ---- | C] (COMODO) -- C:\Windows\System32\drivers\cmdhlp.sys

[2010-03-03 19:54:04 | 000,208,192 | ---- | C] (COMODO) -- C:\Windows\System32\drivers\cmdGuard.sys

[2010-03-03 19:54:04 | 000,016,664 | ---- | C] (COMODO) -- C:\Windows\System32\drivers\cmderd.sys


[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]


[2010-03-19 08:16:41 | 001,835,008 | -HS- | M] () -- C:\Users\b3rt\NTUSER.DAT

[2010-03-19 08:11:51 | 000,010,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2010-03-19 08:11:51 | 000,010,016 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2010-03-19 08:11:07 | 001,523,412 | ---- | M] () -- C:\Windows\System32\PerfStringBackup.INI

[2010-03-19 08:11:07 | 000,687,590 | ---- | M] () -- C:\Windows\System32\perfh015.dat

[2010-03-19 08:11:07 | 000,606,992 | ---- | M] () -- C:\Windows\System32\perfh009.dat

[2010-03-19 08:11:07 | 000,131,176 | ---- | M] () -- C:\Windows\System32\perfc015.dat

[2010-03-19 08:11:07 | 000,103,370 | ---- | M] () -- C:\Windows\System32\perfc009.dat

[2010-03-19 08:04:11 | 000,000,006 | -H-- | M] () -- C:\Windows\tasks\SA.DAT

[2010-03-19 08:04:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2010-03-19 08:04:05 | 2516,033,536 | -HS- | M] () -- C:\hiberfil.sys

[2010-03-19 08:03:30 | 001,649,464 | -H-- | M] () -- C:\Users\b3rt\AppData\Local\IconCache.db

[2010-03-19 00:44:27 | 000,000,098 | ---- | M] () -- C:\Windows\System32\drivers\etc\Hosts

[2010-03-19 00:08:27 | 000,000,136 | ---- | M] () -- C:\Users\b3rt\Desktop\Resident Evil 5.lnk

[2010-03-18 23:29:08 | 000,004,096 | ---- | M] () -- C:\Users\Public\Documents\000012A3.LCS

[2010-03-18 23:18:15 | 002,933,866 | ---- | M] () -- C:\Users\b3rt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\esport1.exe

[2010-03-18 23:11:30 | 000,002,082 | ---- | M] () -- C:\Users\b3rt\Desktop\Divinity II - Ego Draconis.lnk

[2010-03-18 22:35:48 | 000,001,827 | ---- | M] () -- C:\Users\b3rt\Desktop\Left 4 Dead.lnk

[2010-03-18 21:44:59 | 000,057,560 | ---- | M] () -- C:\Users\b3rt\AppData\Local\GDIPFONTCACHEV1.DAT

[2010-03-18 21:35:25 | 000,000,000 | ---- | M] () -- C:\Windows\nsreg.dat

[2010-03-18 21:33:33 | 000,004,299 | ---- | M] () -- C:\Users\b3rt\Documents\avast! Registration.eml

[2010-03-18 21:28:47 | 000,524,288 | -HS- | M] () -- C:\Users\b3rt\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms

[2010-03-18 21:28:47 | 000,524,288 | -HS- | M] () -- C:\Users\b3rt\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms

[2010-03-18 21:28:47 | 000,065,536 | -HS- | M] () -- C:\Users\b3rt\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf

[2010-03-18 21:28:22 | 000,000,020 | -HS- | M] () -- C:\Users\b3rt\ntuser.ini

[2010-03-18 21:28:12 | 000,171,136 | RHS- | M] () -- C:\W7LDR

[2010-03-18 21:25:07 | 000,067,908 | ---- | M] () -- C:\Windows\System32\license.rtf

[2010-03-18 21:22:10 | 000,265,896 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT

[2010-03-18 21:20:53 | 000,008,192 | RHS- | M] () -- C:\BOOTSECT.BAK

[2010-03-05 01:11:22 | 000,041,872 | ---- | M] () -- C:\Windows\System32\xfcodec.dll

[2010-03-03 19:54:42 | 000,276,648 | ---- | M] (COMODO) -- C:\Windows\System32\guard32.dll

[2010-03-03 19:54:06 | 000,074,328 | ---- | M] (COMODO) -- C:\Windows\System32\drivers\inspect.sys

[2010-03-03 19:54:06 | 000,030,032 | ---- | M] (COMODO) -- C:\Windows\System32\drivers\cmdhlp.sys

[2010-03-03 19:54:04 | 000,208,192 | ---- | M] (COMODO) -- C:\Windows\System32\drivers\cmdGuard.sys

[2010-03-03 19:54:04 | 000,016,664 | ---- | M] (COMODO) -- C:\Windows\System32\drivers\cmderd.sys

[2010-02-24 10:16:06 | 000,181,632 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe


[color=#E56717]========== Files Created - No Company Name ==========[/color]


[2010-03-19 00:08:27 | 000,000,136 | ---- | C] () -- C:\Users\b3rt\Desktop\Resident Evil 5.lnk

[2010-03-18 23:18:54 | 000,004,096 | ---- | C] () -- C:\Users\Public\Documents\000012A3.LCS

[2010-03-18 23:17:51 | 002,933,866 | ---- | C] () -- C:\Users\b3rt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\esport1.exe

[2010-03-18 23:17:46 | 000,000,545 | ---- | C] () -- C:\Windows\UC.PIF

[2010-03-18 23:17:46 | 000,000,545 | ---- | C] () -- C:\Windows\RAR.PIF

[2010-03-18 23:17:46 | 000,000,545 | ---- | C] () -- C:\Windows\PKZIP.PIF

[2010-03-18 23:17:46 | 000,000,545 | ---- | C] () -- C:\Windows\PKUNZIP.PIF

[2010-03-18 23:17:46 | 000,000,545 | ---- | C] () -- C:\Windows\NOCLOSE.PIF

[2010-03-18 23:17:46 | 000,000,545 | ---- | C] () -- C:\Windows\LHA.PIF

[2010-03-18 23:17:46 | 000,000,545 | ---- | C] () -- C:\Windows\ARJ.PIF

[2010-03-18 23:11:30 | 000,002,082 | ---- | C] () -- C:\Users\b3rt\Desktop\Divinity II - Ego Draconis.lnk

[2010-03-18 22:53:18 | 000,073,728 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll

[2010-03-18 22:35:48 | 000,001,827 | ---- | C] () -- C:\Users\b3rt\Desktop\Left 4 Dead.lnk

[2010-03-18 22:20:33 | 000,007,437 | ---- | C] () -- C:\Windows\System32\nvinfo.pb

[2010-03-18 21:35:25 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat

[2010-03-18 21:33:30 | 018,859,561 | ---- | C] () -- C:\Users\b3rt\Documents\Quake.rar

[2010-03-18 21:33:30 | 007,276,497 | ---- | C] () -- C:\Users\b3rt\Documents\Beyond_Good_and_Evil_-_Poradnik_Gry-OnLine.exe

[2010-03-18 21:33:30 | 001,461,791 | ---- | C] () -- C:\Users\b3rt\Documents\GuildWars Tyria Map.jpg

[2010-03-18 21:33:30 | 000,046,592 | ---- | C] () -- C:\Users\b3rt\Documents\Prezentacja Matura!!.doc

[2010-03-18 21:33:30 | 000,004,299 | ---- | C] () -- C:\Users\b3rt\Documents\avast! Registration.eml

[2010-03-18 21:28:22 | 001,835,008 | -HS- | C] () -- C:\Users\b3rt\NTUSER.DAT

[2010-03-18 21:28:22 | 000,524,288 | -HS- | C] () -- C:\Users\b3rt\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms

[2010-03-18 21:28:22 | 000,524,288 | -HS- | C] () -- C:\Users\b3rt\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms

[2010-03-18 21:28:22 | 000,065,536 | -HS- | C] () -- C:\Users\b3rt\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf

[2010-03-18 21:28:22 | 000,000,020 | -HS- | C] () -- C:\Users\b3rt\ntuser.ini

[2010-03-18 21:28:12 | 000,171,136 | RHS- | C] () -- C:\W7LDR

[2010-03-18 21:21:45 | 2516,033,536 | -HS- | C] () -- C:\hiberfil.sys

[2010-03-18 21:20:53 | 000,008,192 | RHS- | C] () -- C:\BOOTSECT.BAK

[2010-03-18 21:20:52 | 000,383,562 | RHS- | C] () -- C:\bootmgr

[2010-03-05 01:11:22 | 000,041,872 | ---- | C] () -- C:\Windows\System32\xfcodec.dll

[2009-07-14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll

[2009-07-14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll

[2009-04-22 00:19:06 | 000,172,173 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat


[color=#E56717]========== LOP Check ==========[/color]


[2010-03-18 22:03:06 | 000,000,000 | ---D | M] -- C:\Users\b3rt\AppData\Roaming\foobar2000

[2010-03-18 23:17:46 | 000,000,000 | ---D | M] -- C:\Users\b3rt\AppData\Roaming\GHISLER

[2010-03-18 23:29:00 | 000,000,000 | ---D | M] -- C:\Users\b3rt\AppData\Roaming\ProtectDisc

[2010-03-18 21:35:25 | 000,000,000 | ---D | M] -- C:\Users\b3rt\AppData\Roaming\Thunderbird

[2009-07-14 05:53:46 | 000,002,756 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT


[color=#E56717]========== Purity Check ==========[/color]




[color=#E56717]========== Alternate Data Streams ==========[/color]


@Alternate Data Stream - 785 bytes -> C:\Users\b3rt\Documents\avast! Registration.eml:OECustomProperty

< End of report >

Jakby były potrzebne jeszcze logi z jakichś programów to proszę pisać, a w miarę możliwości postaram się je utworzyć i zamieścić.

EDIT

Przeprowadziłem dodatkowy skan dysków programem Dr.Web CureIt! i program nic nie znalazł. Ale co dziwne, zaraz po wyłączeniu programu wyskoczył BSOD i komputer się zrestartował (pierwszy raz mi się to zdarzyło). Nie wiem czy faktycznie coś mi w systemie siedzi, czy może jestem po prostu przewrażliwiony...

Link do komentarza
Udostępnij na innych stronach
Sevard Balrog

Sevard

Napisano
Napisano

Nie podoba mi się plik

C:\Users\b3rt\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\esport1.exe

Sprawdź go na VirusTotal i daj tutaj wyniki.

Usuń też wszystkie pliki tymczasowe za pomocą Temp File Cleaner.

Następnie sprawdź komputer za pomocą jakiegoś skanera Antyspyware, np. a-squared Free.

Link do komentarza
Udostępnij na innych stronach
b3rt Smok

b3rt

Napisano
  • Autor
Napisano

Wyniki z VirusTotal

Wyczyściłem Temp za pomocą TFC, cała operacja przebiegła bez problemów.

a-squared właśnie się instaluje, jak tylko będzie na dysku to zrobię skan.

EDIT

Gruntowny skan a-squared Free nie pokazał nic niepokojącego. Chyba 5 plików oznaczonych jako "niskie zagrożenie", które bez problemu zostały usunięte. Nic ponad to.

Link do komentarza
Udostępnij na innych stronach
Sevard Balrog

Sevard

Napisano
Napisano

Usuń ten plik. Nie znam żadnego programu, który umieszczałby w autostarcie plik wykonywalny zamiast skrótu, a sam plik wykonywalny o tej nazwie jest często powiązany ze szkodliwym oprogramowaniem.

Innych rzeczy nie widać.

[edit]

Wróć. Jest jeszcze jedna rzecz do sprawdzenia.

Wklej na forum zawartość pliku

C:\autoexec.bat

Link do komentarza
Udostępnij na innych stronach
Przejdź do listy tematów

  • Kto przegląda   0 użytkowników

    • Brak zalogowanych użytkowników przeglądających tę stronę.
×
×
  • Utwórz nowe...