(((((((((((((((((((((((((((((((((((((((   Usunięto   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\windows\svchost.exe

.
(((((((((((((((((((((((((   Pliki utworzone od 2009-05-08 do 2009-06-08  )))))))))))))))))))))))))))))))
.

2009-06-08 13:45 . 2009-06-08 13:45	--------	d-----w-	C:\temp
2009-06-08 13:45 . 2009-06-08 13:45	--------	d-----w-	\temp
2009-06-08 13:33 . 2009-06-08 13:45	--------	d-s---w-	\ComboFix
2009-06-08 13:33 . 2009-06-08 13:34	--------	d-----w-	\Qoobox
2009-06-08 12:30 . 2009-06-08 12:30	--------	d-----w-	c:\windows\Sun
2009-06-08 06:43 . 2009-06-08 06:43	--------	d-----w-	c:\program files\Trend Micro
2009-06-04 20:00 . 2009-06-04 20:26	--------	d-----w-	c:\program files\Grupa IMAGE
2009-06-01 23:01 . 2009-06-01 23:01	--------	d-----w-	c:\windows\system32\1033
2009-06-01 15:43 . 2009-06-01 15:43	--------	d-----w-	c:\program files\Microsoft SQL Server 2005 Mobile Edition
2009-06-01 14:49 . 2009-06-01 15:00	--------	d-----w-	c:\program files\HTML Help Workshop
2009-06-01 14:49 . 2009-06-01 14:50	--------	d-----w-	c:\program files\Common Files\Business Objects
2009-06-01 14:49 . 2009-06-01 14:49	--------	d-----w-	c:\programdata\PreEmptive Solutions
2009-06-01 14:49 . 2009-06-01 14:49	--------	d-----w-	c:\windows\Symbols
2009-06-01 14:49 . 2009-06-01 14:49	--------	d-----w-	c:\program files\CE Remote Tools
2009-06-01 14:48 . 2009-06-01 22:59	--------	d-----w-	c:\program files\Common Files\Merge Modules
2009-05-20 15:32 . 2009-05-20 15:32	--------	d-----w-	c:\users\Vilu\AppData\Roaming\PSpad
2009-05-20 15:32 . 2009-05-20 15:32	--------	d-----w-	c:\program files\PSPad editor
2009-05-20 15:28 . 2009-05-20 15:28	--------	d-----w-	c:\program files\WinSCP

.
((((((((((((((((((((((((((((((((((((((((   Sekcja Find3M   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-06-08 13:35 . 2009-01-06 08:48	755472	----a-w-	c:\windows\system32\perfh015.dat
2009-06-08 13:35 . 2009-01-06 08:48	162372	----a-w-	c:\windows\system32\perfc015.dat
2009-06-08 12:20 . 2009-01-07 09:55	77896	----a-w-	c:\programdata\nvModes.dat
2009-06-08 12:19 . 2009-01-06 01:56	3533172736	--sha-w-	\pagefile.sys
2009-06-08 06:44 . 2009-01-17 10:48	1660	----a-w-	c:\windows\bthservsdp.dat
2009-06-07 21:50 . 2009-03-20 07:50	--------	d-----w-	c:\users\Vilu\AppData\Roaming\TeraCopy
2009-06-05 07:59 . 2009-01-06 08:42	135968	----a-w-	c:\users\Vilu\AppData\Local\GDIPFONTCACHEV1.DAT
2009-06-04 13:51 . 2009-01-06 10:43	--------	d-----w-	c:\programdata\Microsoft Help
2009-06-02 13:21 . 2009-01-06 09:25	--------	d-----w-	c:\users\Vilu\AppData\Roaming\BESTplayer
2009-06-01 22:58 . 2009-01-06 14:56	--------	d-----w-	c:\program files\Microsoft Visual Studio 8
2009-06-01 14:37 . 2009-01-06 10:47	--------	d-----w-	c:\program files\Microsoft Visual Studio 9.0
2009-06-01 14:37 . 2006-11-02 12:37	--------	d-----w-	c:\program files\MSBuild
2009-06-01 11:17 . 2009-01-06 09:28	--------	d-----w-	c:\program files\Gadu-Gadu
2009-05-28 11:59 . 2009-01-14 18:15	7592	----a-w-	c:\users\Vilu\AppData\Local\d3d9caps.dat
2009-05-14 13:04 . 2006-11-02 11:18	--------	d-----w-	c:\program files\Windows Mail
2009-05-09 10:09 . 2009-02-04 22:28	--------	d-----w-	c:\program files\NAPI-PROJEKT
2009-05-07 13:41 . 2009-05-07 13:41	--------	d-----w-	c:\program files\Common Files\PCSuite
2009-05-07 13:40 . 2009-05-07 13:40	--------	d-----w-	c:\program files\Common Files\Nokia
2009-05-07 13:40 . 2009-05-06 09:47	--------	d-----w-	c:\program files\Nokia
2009-05-07 13:29 . 2009-05-06 09:51	--------	d-----w-	c:\users\Vilu\AppData\Roaming\Nokia
2009-05-06 10:02 . 2009-05-06 10:02	--------	d-----w-	c:\program files\PC Connectivity Solution
2009-05-06 09:55 . 2009-05-06 09:55	8192	----a-w-	c:\programdata\Installations\{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}\Installer\CommonCustomActions\UninstCCD.exe
2009-05-06 09:55 . 2009-05-06 09:55	61440	----a-w-	c:\programdata\Installations\{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-05-06 09:55 . 2009-05-06 09:55	10240	----a-w-	c:\programdata\Installations\{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}\Installer\CommonCustomActions\UninstPCS.exe
2009-05-06 09:55 . 2009-05-06 09:46	--------	d-----w-	c:\programdata\Installations
2009-05-06 09:55 . 2009-05-06 09:55	34723736	----a-w-	c:\programdata\Installations\{7694EC32-CB0E-4B35-9088-7B320CB1F4FE}\Nokia_PC_Suite_7_1_26_0_pol.exe
2009-05-06 09:53 . 2009-05-06 09:51	--------	d-----w-	c:\users\Vilu\AppData\Roaming\PC Suite
2009-05-06 09:53 . 2009-05-06 09:51	--------	d-----w-	c:\programdata\PC Suite
2009-05-06 09:50 . 2009-05-06 09:50	--------	d-----w-	c:\program files\DIFX
2009-05-06 09:47 . 2009-05-06 09:47	8192	----a-w-	c:\programdata\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstCCD.exe
2009-05-06 09:47 . 2009-05-06 09:47	61440	----a-w-	c:\programdata\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstPCSFEMsi.exe
2009-05-06 09:47 . 2009-05-06 09:47	10240	----a-w-	c:\programdata\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Installer\CommonCustomActions\UninstPCS.exe
2009-05-06 09:44 . 2009-05-06 09:47	34040128	----a-w-	c:\programdata\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Nokia_PC_Suite_7_1_18_0_pol_web.exe
2009-05-06 09:08 . 2009-03-13 20:15	--------	d-----w-	c:\users\Vilu\AppData\Roaming\Autodesk
2009-05-06 09:08 . 2009-03-13 20:15	--------	d-----w-	c:\programdata\Autodesk
2009-05-05 15:10 . 2009-05-05 14:16	3041	----a-w-	c:\windows\checkip.dat
2009-04-28 22:33 . 2009-04-28 22:30	96104	----a-w-	c:\windows\system32\drivers\avipbb.sys
2009-04-28 22:33 . 2009-04-28 22:30	55640	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2009-04-28 22:30 . 2009-04-28 22:30	--------	d-----w-	c:\programdata\Avira
2009-04-28 22:30 . 2009-04-28 22:30	--------	d-----w-	c:\program files\Avira
2009-04-19 14:24 . 2009-01-17 18:53	--------	d-----w-	c:\programdata\Apple Computer
2009-04-19 14:22 . 2009-04-19 14:22	--------	d-----w-	c:\program files\Apple Software Update
2009-04-19 14:22 . 2009-04-19 14:22	--------	d-----w-	c:\programdata\Apple
2009-04-19 13:53 . 2009-01-17 18:53	--------	d-----w-	c:\program files\MpcStar
2009-04-15 15:24 . 2009-04-15 15:24	--------	d-----w-	c:\programdata\Codemasters
2009-04-15 15:24 . 2009-04-15 15:24	444952	----a-w-	c:\windows\system32\wrap_oal.dll
2009-04-15 15:24 . 2009-04-15 15:24	109080	----a-w-	c:\windows\system32\OpenAL32.dll
2009-04-15 15:24 . 2009-04-15 15:24	--------	d-----w-	c:\program files\OpenAL
2009-04-15 11:39 . 2009-03-20 07:50	--------	d-----w-	c:\program files\TeraCopy
2009-03-17 03:38 . 2009-04-15 10:50	13824	----a-w-	c:\windows\system32\apilogen.dll
2009-03-17 03:38 . 2009-04-15 10:50	24064	----a-w-	c:\windows\system32\amxread.dll
2009-03-16 12:18 . 2009-04-15 15:24	69448	----a-w-	c:\windows\system32\XAPOFX1_3.dll
2009-03-16 12:18 . 2009-04-15 15:24	517448	----a-w-	c:\windows\system32\XAudio2_4.dll
2009-03-16 12:18 . 2009-04-15 15:24	235352	----a-w-	c:\windows\system32\xactengine3_4.dll
2009-03-16 12:18 . 2009-04-15 15:24	22360	----a-w-	c:\windows\system32\X3DAudio1_6.dll
2009-03-13 20:23 . 2009-03-13 20:23	10134	----a-r-	c:\users\Vilu\AppData\Roaming\Microsoft\Installer\{E3E71D07-CD27-46CB-8448-16D4FB29AA13}\ARPPRODUCTICON.exe
2009-01-06 17:28 . 2009-01-06 17:28	22	--sha-w-	c:\windows\SMINST\HPCD.sys
.

(((((((((((((((((((((((((((((((((((((   Wpisy startowe rejestru   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane  
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2008-01-19 202240]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPStart"="c:\program files\Synaptics\SynTP\SynTPStart.exe" [2007-09-15 102400]
"IAAnotif"="c:\program files\Intel\Intel Matrix Storage Manager\iaanotif.exe" [2008-12-04 186904]
"QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2007-09-30 181544]
"QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-09-19 202032]
"OnScreenDisplay"="c:\program files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe" [2007-09-04 554320]
"HP Health Check Scheduler"="c:\program files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2008-06-16 75008]
"hpWirelessAssistant"="c:\program files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-09-13 480560]
"WAWifiMessage"="c:\program files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-08 311296]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-03-28 1045800]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-12-04 13556256]
"NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-12-04 92704]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"<NO NAME>"= dword:000000ff

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\disallowrun]
"msconfig.exe"= msconfig.exe
"regedit.exe"= regedit.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{794239B8-A624-4AEF-B748-BD08FA9B485E}"= c:\program files\Cyberlink\PowerDirector\PDR.EXE:CyberLink PowerDirector
"{689629F6-AA28-482F-AA56-76C716B095F3}"= c:\program files\HP\QuickPlay\QP.exe:Quick Play
"{181445A7-93F6-4979-A670-47228DF657AB}"= c:\program files\HP\QuickPlay\QPService.exe:Quick Play Resident Program
"{EADFA6BE-868B-43FB-B0BF-9711CEC125DB}"= Profile=Private|c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"{C6CE4B68-652F-49A9-ADE4-213B1D376C7A}"= Disabled:c:\program files\MSN Messenger\livecall.exe:Windows Live Messenger 8.1 (Phone)
"TCP Query User{EB3573FF-A10C-4A3A-B4C5-A2FB6753FAEB}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{7E969DB9-9FEE-4C1B-92FA-D9061B99C127}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"{84328538-6EEA-4960-ACF5-8E7B3177276A}"= UDP:17056:BitComet 17056 TCP
"{87083621-F829-4886-8D99-0C8C3275F31E}"= TCP:17056:BitComet 17056 UDP
"{B5C82350-B925-44C6-A356-0A84559EA39C}"= UDP:c:\program files\Lexmark 3600-4600 Series\lxdxmon.exe:Printer Device Monitor
"{73AB4805-D33A-4130-9618-652F89C62AAB}"= TCP:c:\program files\Lexmark 3600-4600 Series\lxdxmon.exe:Printer Device Monitor
"{E7A22115-D976-4882-A0D0-2088D7FE4334}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\lxdxtime.exe:Lexmark Connect Time Executable
"{588FF368-F7F7-4DE6-A487-9E175E3F7401}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\lxdxtime.exe:Lexmark Connect Time Executable
"{F2B2151D-0ABC-4CBC-B3BE-E53DF4B2B441}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\lxdxjswx.exe:Job Status Window Interface
"{07889541-19C2-4AAF-A7E7-1B3275C5A270}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\lxdxjswx.exe:Job Status Window Interface
"TCP Query User{F0411ACC-61EB-48A2-99EC-6763692946C3}c:\\games\\counter-strike source\\hl2.exe"= UDP:c:\games\counter-strike source\hl2.exe:hl2
"UDP Query User{E9DE5FA1-362F-4F12-9085-7A55E4B8282F}c:\\games\\counter-strike source\\hl2.exe"= TCP:c:\games\counter-strike source\hl2.exe:hl2
"TCP Query User{534415AE-EBAE-4192-9C57-0774B78BFCD6}c:\\program files\\bearshare\\bearshare.exe"= UDP:c:\program files\bearshare\bearshare.exe:BearShare
"UDP Query User{3ADB0C80-F90B-42D1-A4B1-ADBA6A84969C}c:\\program files\\bearshare\\bearshare.exe"= TCP:c:\program files\bearshare\bearshare.exe:BearShare
"{E3F86FB5-2C0B-41AA-910C-7CD3BB7F2DBC}"= c:\program files\Skype\Phone\Skype.exe:Skype
"{3288B9F3-C9D1-4075-A2D4-4797EFFD35D1}"= TCP:6004|c:\program files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook
"{3FD3E625-B373-40EC-AAED-FEB12CDC09DA}"= UDP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{51A0D5C1-578E-4F3F-8D8B-2032F5082461}"= TCP:c:\program files\Microsoft Office\Office12\GROOVE.EXE:Microsoft Office Groove
"{73BD42F7-8723-46A5-B861-DA68DB760D07}"= UDP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{F7684469-E35B-4773-82D1-637403CE786C}"= TCP:c:\program files\Microsoft Office\Office12\ONENOTE.EXE:Microsoft Office OneNote
"{EE3A50B1-33F5-4E17-9772-BEA9DA25A161}"= UDP:c:\windows\System32\lxdxcoms.exe:Lexmark Communications System
"{54D24787-33DE-4365-A92D-ED367561A388}"= TCP:c:\windows\System32\lxdxcoms.exe:Lexmark Communications System
"{F1A49B9A-C8FE-4CC2-AD6E-23162781EAB0}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\lxdxpswx.exe:Printer Status Window
"{893EFD22-F964-4085-9ABE-E9284893C5AB}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\lxdxpswx.exe:Printer Status Window
"{A6C35100-BFAC-4A0D-93AE-97BB57BB58A3}"= UDP:c:\program files\Lexmark 3600-4600 Series\lxdxamon.exe:Lexmark Device Monitor
"{CA534AF4-D380-480E-BAEF-F0F99D020BEF}"= TCP:c:\program files\Lexmark 3600-4600 Series\lxdxamon.exe:Lexmark Device Monitor
"{E144C3C9-E062-4EE4-83E5-84C4577B0A85}"= UDP:c:\program files\Lexmark 3600-4600 Series\frun.exe:Lexmark Productivity Studio
"{D4CFCD37-046F-45D3-A174-A26790BBE638}"= TCP:c:\program files\Lexmark 3600-4600 Series\frun.exe:Lexmark Productivity Studio
"{E42AC1E0-FC30-4D28-AE64-9435DE728FAA}"= UDP:c:\program files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:ABBYY FineReader
"{A63B023A-DFCF-4E82-A163-D25CD9D25B78}"= TCP:c:\program files\Abbyy FineReader 6.0 Sprint\Scan\ScanMan6.exe:ABBYY FineReader
"TCP Query User{291BC373-FB64-4C35-805F-94BB53395710}c:\\program files\\gadu-gadu\\gg.exe"= UDP:c:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny
"UDP Query User{A055CFA8-7CF8-4547-9FC2-90FE952088E8}c:\\program files\\gadu-gadu\\gg.exe"= TCP:c:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny
"TCP Query User{7DBC66F6-3406-4C5D-A61E-37D04DE4A719}c:\\program files\\java\\jre6\\bin\\javaw.exe"= UDP:c:\program files\java\jre6\bin\javaw.exe:Java(TM) Platform SE binary
"UDP Query User{DE5F77EF-8648-4EC7-A872-9976F536EE59}c:\\program files\\java\\jre6\\bin\\javaw.exe"= TCP:c:\program files\java\jre6\bin\javaw.exe:Java(TM) Platform SE binary
"{5E728BD5-56EE-48EB-ACE1-B42C9FA9C8BB}"= UDP:17056:BitComet 17056 TCP
"{9EA08F8C-137D-4213-89EA-14F8002FCC1C}"= TCP:17056:BitComet 17056 UDP
"TCP Query User{5DBE4B15-A823-447F-B49F-9F11A886FBAD}c:\\program files\\bitcomet\\bitcomet.exe"= UDP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"UDP Query User{71AD345E-4CEF-47B3-BAB0-85CDF6B03798}c:\\program files\\bitcomet\\bitcomet.exe"= TCP:c:\program files\bitcomet\bitcomet.exe:BitComet - a BitTorrent Client
"TCP Query User{72163796-CFCD-4CC8-98B7-A29E0DE843E8}c:\\program files\\opera\\opera.exe"= UDP:c:\program files\opera\opera.exe:Opera Internet Browser
"UDP Query User{E66A90F9-B61A-4E31-BE8F-8621288D69E7}c:\\program files\\opera\\opera.exe"= TCP:c:\program files\opera\opera.exe:Opera Internet Browser
"{C40E52C1-D118-48C2-8436-A6908016D44C}"= UDP:c:\windows\System32\spool\drivers\w32x86\3\lxdxwbgw.exe:Lexmark Web Gateway
"{1D0A946C-1587-4243-85F6-23632C3070D9}"= TCP:c:\windows\System32\spool\drivers\w32x86\3\lxdxwbgw.exe:Lexmark Web Gateway
"TCP Query User{0562D004-21E1-48A6-8903-8F8494CE75B0}c:\\games\\counter-strike source\\hl2.exe"= UDP:c:\games\counter-strike source\hl2.exe:hl2
"UDP Query User{42AB1A22-75E1-4D1A-9014-9776F8D83BD0}c:\\games\\counter-strike source\\hl2.exe"= TCP:c:\games\counter-strike source\hl2.exe:hl2
"{4A00B4EC-A2A7-4F01-81CD-874719843392}"= c:\program files\Skype\Phone\Skype.exe:Skype
"TCP Query User{4B9DF3E4-34D2-4A96-9862-A7193EF4C470}c:\\program files\\bearshare\\bearshare.exe"= UDP:c:\program files\bearshare\bearshare.exe:BearShare
"UDP Query User{93A1DF16-4AFB-4531-9FBA-C5C2E5CD7E95}c:\\program files\\bearshare\\bearshare.exe"= TCP:c:\program files\bearshare\bearshare.exe:BearShare
"TCP Query User{22D394A0-A763-46FE-82A2-728665968842}c:\\games\\grid\\grid.exe"= UDP:c:\games\grid\grid.exe:GRID Executable
"UDP Query User{9E77B24E-2BD6-450C-BB2C-915050F1FE29}c:\\games\\grid\\grid.exe"= TCP:c:\games\grid\grid.exe:GRID Executable
"TCP Query User{2AC18C2D-BB74-4FA6-A5F0-CF396E0BABFA}c:\\windows\\system32\\spool\\drivers\\w32x86\\3\\lxdxpswx.exe"= UDP:c:\windows\system32\spool\drivers\w32x86\3\lxdxpswx.exe:Printer Status Window Interface
"UDP Query User{112D6826-33B9-4EB1-A3F8-04FA7F7AB69B}c:\\windows\\system32\\spool\\drivers\\w32x86\\3\\lxdxpswx.exe"= TCP:c:\windows\system32\spool\drivers\w32x86\3\lxdxpswx.exe:Printer Status Window Interface
"TCP Query User{6166ACA0-F955-48FD-B39B-4C9F2F662FCD}c:\\program files\\matlab\\r2008a\\bin\\win32\\matlab.exe"= UDP:c:\program files\matlab\r2008a\bin\win32\matlab.exe:MATLAB
"UDP Query User{A6C1A57B-86AB-4AFA-BCE8-DAD27EE8A8DD}c:\\program files\\matlab\\r2008a\\bin\\win32\\matlab.exe"= TCP:c:\program files\matlab\r2008a\bin\win32\matlab.exe:MATLAB
"{E8E3CA57-B9EB-40D3-914A-FA71958AB8F2}"= UDP:c:\users\Vilu\AppData\Local\Temp\lxdx\wireless\lxdxwpss.exe: 
"{DEAE15E6-1072-460F-AB63-771EF6DB11FC}"= TCP:c:\users\Vilu\AppData\Local\Temp\lxdx\wireless\lxdxwpss.exe: 
"{C73B45C3-D9D7-461A-BB1E-4C70703468D7}"= UDP:c:\windows\System32\lxdxcfg.exe:Printer Communication System
"{19859093-014A-47B7-8E3D-72AE29F55114}"= TCP:c:\windows\System32\lxdxcfg.exe:Printer Communication System
"TCP Query User{4C462E57-23F6-4947-8E3C-B13DC6C0D1AC}c:\\program files\\lexmark 3600-4600 series\\lxdxmon.exe"= UDP:c:\program files\lexmark 3600-4600 series\lxdxmon.exe:Printer Device Monitor
"UDP Query User{261F4093-3529-42A5-B840-8BCBA6DFBBA1}c:\\program files\\lexmark 3600-4600 series\\lxdxmon.exe"= TCP:c:\program files\lexmark 3600-4600 series\lxdxmon.exe:Printer Device Monitor
"TCP Query User{F889CD29-498E-4626-8D09-6945D986F37C}c:\\program files\\lexmark 3600-4600 series\\frun.exe"= UDP:c:\program files\lexmark 3600-4600 series\frun.exe:Printing Application
"UDP Query User{EC6257F0-6973-4102-98E1-71C99041B27B}c:\\program files\\lexmark 3600-4600 series\\frun.exe"= TCP:c:\program files\lexmark 3600-4600 series\frun.exe:Printing Application
"TCP Query User{66BE3FBA-B869-440E-A1B5-68FEB81B5B78}c:\\program files\\gadu-gadu\\gg.exe"= UDP:c:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny
"UDP Query User{8B18C642-AF8A-45AF-9F18-48A461E5F03D}c:\\program files\\gadu-gadu\\gg.exe"= TCP:c:\program files\gadu-gadu\gg.exe:Gadu-Gadu - program główny

R2 AntiVirSchedulerService;Avira AntiVir Scheduler;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-04-29 108289]
R2 lxdx_device;lxdx_device;c:\windows\system32\lxdxcoms.exe -service --> c:\windows\system32\lxdxcoms.exe -service [?]
R2 lxdxCATSCustConnectService;lxdxCATSCustConnectService;c:\windows\System32\spool\drivers\w32x86\3\lxdxserv.exe [2009-01-06 98984]
R2 pgsql-8.3;PostgreSQL Database Server 8.3;c:\program files\PostgreSQL\8.3\bin\pg_ctl.exe [2008-09-19 65536]
R3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\System32\drivers\NETw5v32.sys [2008-11-17 3668480]
S2 AcronisOSSReinstallSvc;Acronis OS Selector Reinstall Service;c:\program files\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe [2007-03-09 2232177]
S4 msvsmon80;Visual Studio 2005 Remote Debugger;c:\program files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2007-02-22 2808664]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\>{60B49E34-C7CC-11D0-8953-00A0C90347FF}]
"c:\windows\System32\rundll32.exe" "c:\windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"c:\program files\Common Files\LightScribe\LSRunOnce.exe"
.
Zawartość folderu 'Zaplanowane zadania'

2009-06-06 c:\windows\Tasks\HPCeeScheduleForVilu.job
- c:\program files\Hewlett-Packard\SDP\Ceement\HPCEE.exe [2009-01-06 10:58]
.
- - - - USUNIĘTO PUSTE WPISY - - - -

SafeBoot-procexp90.Sys


.
------- Skan uzupełniający -------
.
uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=pl_pl&c=81&bd=Pavilion&pf=laptop
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=pl_pl&c=81&bd=Pavilion&pf=laptop
IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-06-08 15:45
Windows 6.0.6001 Service Pack 1 NTFS

skanowanie ukrytych procesów ...  

skanowanie ukrytych wpisów autostartu ... 

skanowanie ukrytych plików ...  

skanowanie pomyślnie ukończone
ukryte pliki: 0

**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:51:45, on 2009-06-08
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Program Files\Synaptics\SynTP\SynTPStart.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
C:\Windows\ehome\ehtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Gadu-Gadu\gg.exe.bin
C:\Windows\system32\conime.exe
C:\Windows\system32\notepad.exe
C:\Windows\Explorer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=pl_pl&c=81&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=pl_pl&c=81&bd=Pavilion&pf=laptop
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~3\Office12\GRA8E1~1.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O4 - HKLM\..\Run: [SynTPStart] C:\Program Files\Synaptics\SynTP\SynTPStart.exe
O4 - HKLM\..\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [OnScreenDisplay] C:\Program Files\Hewlett-Packard\HP QuickTouch\HPKBDAPP.exe
O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [WAWifiMessage] C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKUS\S-1-5-21-3157898589-3115730694-2996433070-1008\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'bd_projekt')
O4 - HKUS\S-1-5-21-3157898589-3115730694-2996433070-1008\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'bd_projekt')
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix: 
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~3\Office12\GR99D3~1.DLL
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Acronis OS Selector Reinstall Service (AcronisOSSReinstallSvc) - Unknown owner - C:\Program Files\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe
O23 - Service: Avira AntiVir Scheduler (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Autodesk Data Management Job Dispatch - Autodesk - C:\Program Files\Autodesk\Data Management Server 2008\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe
O23 - Service: Autodesk EDM Server - Autodesk - C:\Program Files\Autodesk\Data Management Server 2008\Server\Webserver\Connectivity.EDMWS.Server.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxdxCATSCustConnectService - Lexmark International, Inc. - C:\Windows\system32\spool\DRIVERS\W32X86\3\\lxdxserv.exe
O23 - Service: lxdx_device -   - C:\Windows\system32\lxdxcoms.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: PostgreSQL Database Server 8.3 (pgsql-8.3) - PostgreSQL Global Development Group - C:\Program Files\PostgreSQL\8.3\bin\pg_ctl.exe
O23 - Service: QuickPlay Background Capture Service (QBCS) (QPCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPCapSvc.exe
O23 - Service: QuickPlay Task Scheduler (QTS) (QPSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\QPSched.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

--
End of file - 8580 bytes

O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)
O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing)

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\disallowrun]
"msconfig.exe"=-
"regedit.exe"=-

:Reg
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\disallowrun]
"msconfig.exe"=-
"regedit.exe"=-