Strona z keyloggerem?

W

wheeljack

Użytkownik
Dołączył
Październik 21, 2011
Posty
9
Witam.

Dziś napisał do mnie nieznajomy nr gg i podał sie za mojego znajomego. Najpierw normalnie gadał a potem poprosił o pomoc, abym zarejestrował się na stronie wygrywaj-nagrody.pl gdyz za kazda rejestracje dostaje on punkty. Bez zastanowienia wszedlem na strone, a tam wyskakuje komunikat o javie i kliknalem bez zastanowienia RUN. Teraz wiem, ze na 99% to trojan / keylogger gdyż osoba na gg przestała odpisywać. Przeskanowałem komputer programem ad-aware znalazł on trojana o wysokim stopniu zagrożenia, jednak dalej boje się, że jest to coś gorszego. Załączam skan z hijackThis i silenta. Z góry dziękuję za sprawdzenie.

PS. Może ktoś umiałby sprawdzić tą stronę i dowiedzieć się dokładnie jaki to wirus? Nie chcę stracić danych jakie mam na komputerze dlatego od 2 godzin nigdzie się nie loguję.

Hijack:
Kod: 
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 20:49:58, on 2013-01-31
Platform: Windows 7  (WinNT 6.00.3504)
MSIE: Internet Explorer v9.00 (9.00.8112.16448)
Boot mode: Normal

Running processes:
C:\windows\system32\Dwm.exe
C:\windows\Explorer.EXE
C:\windows\system32\taskhost.exe
C:\windows\system32\taskeng.exe
C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
C:\Program Files\Samsung\Samsung Update Plus\SUPBackground.exe
C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeLauncher.exe
C:\Windows\System32\igfxtray.exe
C:\Windows\System32\hkcmd.exe
C:\Windows\System32\igfxpers.exe
C:\Program Files\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\windows\system32\igfxsrvc.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\windows\system32\igfxext.exe
C:\windows\system32\igfxsrvc.exe
C:\Program Files\Common Files\Java\Java Update\jusched.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Windows\System32\bca2kcpan.exe
C:\Program Files\Winamp\winampa.exe
C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\WapSter\WapSter AQQ\AQQ.exe
C:\Program Files\Creative Professional\E-MU USB Audio\EmuUsbAudioCP.exe
C:\Windows\System32\javaw.exe
C:\windows\system32\SearchFilterHost.exe
C:\Program Files\Opera\opera.exe
C:\Program Files\Trend Micro\HiJackThis\HiJackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 
R3 - URLSearchHook: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - (no file)
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: Pomocnik rejestracji usługi Windows Live - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - (no file)
O2 - BHO: Vuze Remote - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: Vuze Remote Toolbar - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll
O4 - HKLM\..\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [UpdateLBPShortCut] "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5"
O4 - HKLM\..\Run: [CLMLServer] "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe"
O4 - HKLM\..\Run: [UpdateP2GoShortCut] "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0"
O4 - HKLM\..\Run: [UpdatePDRShortCut] "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "Software\CyberLink\PowerDirector\7.0"
O4 - HKLM\..\Run: [RemoteControl8] "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe"
O4 - HKLM\..\Run: [PDVD8LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe"
O4 - HKLM\..\Run: [UpdatePPShortCut] "C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0"
O4 - HKLM\..\Run: [UpdatePSTShortCut] "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter"
O4 - HKLM\..\Run: [APLangApp] "C:\Program Files\AnyPC Client\APLangApp.exe"
O4 - HKLM\..\Run: [fsi] C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeLauncher.exe
O4 - HKLM\..\Run: [IgfxTray] C:\windows\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\windows\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\windows\system32\igfxpers.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [UCam_Menu] "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [UpdReg] C:\windows\UpdReg.EXE
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s
O4 - HKLM\..\Run: [BCA2000] %SystemRoot%\system32\bca2kcpan.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"
O4 - HKLM\..\Run: [Ad-Aware Browsing Protection] "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe"
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [AQQ] C:\PROGRA~1\WapSter\WAPSTE~1\AQQ.exe
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
O4 - HKCU\..\Run: [E-MU USB Audio Control Panel] "C:\Program Files\Creative Professional\E-MU USB Audio\EmuUsbAudioCP.exe"
O4 - HKCU\..\Run: [Oracle Java] "C:\windows\system32\javaw.exe" -jar "C:\Users\eugenia\AppData\Roaming\java_u.jar"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'USŁUGA SIECIOWA')
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: Wpis w blogu - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: &Wpis w blogu w Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - (no file)
O23 - Service: E-MU Audio Service (emaudsv) - E-MU Systems - C:\windows\system32\emaudsv.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: Oberon Media Game Console service (OberonGameConsoleService) - Unknown owner - C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared files\RichVideo.exe

--
End of file - 8728 bytes

silent:
Kod: 
"Silent Runners.vbs", revision 68, http://www.silentrunners.org/
Operating System: Microsoft Windows 7 Home Premium  (32-bit)
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
RocketDock = "C:\Program Files\RocketDock\RocketDock.exe" [null data]
AQQ = C:\PROGRA~1\WapSter\WAPSTE~1\AQQ.exe [Creative Team S.A.]
DAEMON Tools Lite = "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun [DT Soft Ltd]
E-MU USB Audio Control Panel = "C:\Program Files\Creative Professional\E-MU USB Audio\EmuUsbAudioCP.exe" [E-MU Systems]
Oracle Java = "C:\windows\system32\javaw.exe" -jar "C:\Users\eugenia\AppData\Roaming\java_u.jar" [Oracle Corporation]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
SynTPEnh = C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
UpdateLBPShortCut = "C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\LabelPrint" UpdateWithCreateOnce "Software\CyberLink\LabelPrint\2.5" [CyberLink Corp.]
CLMLServer = "C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe" [CyberLink]
UpdateP2GoShortCut = "C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\Power2Go" UpdateWithCreateOnce "SOFTWARE\CyberLink\Power2Go\6.0" [CyberLink Corp.]
UpdatePDRShortCut = "C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerDirector" UpdateWithCreateOnce "Software\CyberLink\PowerDirector\7.0" [CyberLink Corp.]
RemoteControl8 = "C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe" [CyberLink Corp.]
PDVD8LanguageShortcut = "C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe" [CyberLink Corp.]
UpdatePPShortCut = "C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\PowerProducer" UpdateWithCreateOnce "Software\CyberLink\PowerProducer\5.0" [CyberLink Corp.]
UpdatePSTShortCut = "C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\DVD Suite" UpdateWithCreateOnce "Software\CyberLink\PowerStarter" [CyberLink Corp.]
APLangApp = "C:\Program Files\AnyPC Client\APLangApp.exe" [DoctorSoft]
fsi = C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeLauncher.exe [null data]
IgfxTray = C:\windows\system32\igfxtray.exe [Intel Corporation]
HotKeysCmds = C:\windows\system32\hkcmd.exe [Intel Corporation]
Persistence = C:\windows\system32\igfxpers.exe [Intel Corporation]
Adobe Reader Speed Launcher = "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [Adobe Systems Incorporated]
UCam_Menu = "C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Program Files\CyberLink\YouCam" UpdateWithCreateOnce "Software\CyberLink\YouCam\2.0" [CyberLink Corp.]
SunJavaUpdateSched = "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [Sun Microsystems, Inc.]
UpdReg = C:\windows\UpdReg.EXE [Creative Technology Ltd.]
Zune Launcher = "C:\Program Files\Zune\ZuneLauncher.exe" [MS]
RtHDVCpl = C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s [Realtek Semiconductor]
BCA2000 = C:\windows\system32\bca2kcpan.exe
WinampAgent = "C:\Program Files\Winamp\Winampa.exe" [null data]
Ad-Aware Browsing Protection = "C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe" [Lavasoft]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\

{18DF081C-E8AD-4283-A596-FA578C2EBDC3}\(Default) = AcroIEHelperStub
  -> {HKLM…CLSID} = Adobe PDF Link Helper
                 \InProcServer32\(Default) = C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [Adobe Systems Incorporated]

{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided)
  -> {HKLM…CLSID} = Java(tm) Plug-In SSV Helper
                 \InProcServer32\(Default) = C:\Program Files\Java\jre7\bin\ssv.dll [Oracle Corporation]

{9030D464-4C02-4ABF-8ECC-5164760863C6}\(Default) = (no title provided)
  -> {HKLM…CLSID} = Pomocnik rejestracji usługi Windows Live
                 \InProcServer32\(Default) = C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [MS]

{ba14329e-9550-4989-b3f2-9732e92d17cc}\(Default) = Vuze Remote
  -> {HKLM…CLSID} = Vuze Remote Toolbar
                 \InProcServer32\(Default) = C:\Program Files\Vuze_Remote\prxtbVuze.dll [Conduit Ltd.]

{DBC80044-A445-435b-BC74-9C25C1C588A9}\(Default) = (no title provided)
  -> {HKLM…CLSID} = Java(tm) Plug-In 2 SSV Helper
                 \InProcServer32\(Default) = C:\Program Files\Java\jre7\bin\jp2ssv.dll [Oracle Corporation]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\

{2F603045-309F-11CF-9774-0020AFD0CFF6} = Synaptics Control Panel
  -> {HKLM…CLSID} = (no title provided)
                 \InProcServer32\(Default) = C:\Program Files\Synaptics\SynTP\SynTPCpl.dll [Synaptics Incorporated]

{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} = Microsoft Office Metadata Handler
  -> {HKLM…CLSID} = Microsoft Office Metadata Handler
                 \InProcServer32\(Default) = C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll [MS]

{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} = Microsoft Office Thumbnail Handler
  -> {HKLM…CLSID} = Microsoft Office Thumbnail Handler
                 \InProcServer32\(Default) = C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll [MS]

{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C} = Microsoft Office OneNote Namespace Extension for Windows Desktop Search
  -> {HKLM…CLSID} = Microsoft Office OneNote Namespace Extension for Windows Desktop Search
                 \InProcServer32\(Default) = C:\PROGRA~1\MICROS~3\Office12\ONFILTER.DLL [MS]

{42042206-2D85-11D3-8CFF-005004838597} = Microsoft Office HTML Icon Handler
  -> {HKLM…CLSID} = (no title provided)
                 \InProcServer32\(Default) = C:\Program Files\Microsoft Office\Office12\msohevi.dll [MS]

{0563DB41-F538-4B37-A92D-4659049B7766} = WLMD Message Handler
  -> {HKLM…CLSID} = CLSID_WLMCMimeFilter
                 \InProcServer32\(Default) = C:\Program Files\Windows Live\Mail\mailcomm.dll [MS]

{00F33137-EE26-412F-8D71-F84E4C2C6625} = (no title provided)
  -> {HKLM…CLSID} = Windows Live Photo Gallery Viewer Autoplay Shim
                 \InProcServer32\(Default) = C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll [MS]

{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} = Windows Live Photo Gallery Viewer Drop Target Shim
  -> {HKLM…CLSID} = Windows Live Photo Gallery Viewer Shim
                 \InProcServer32\(Default) = C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll [MS]

{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} = Windows Live Photo Gallery Editor Drop Target Shim
  -> {HKLM…CLSID} = Windows Live Photo Gallery Editor Shim
                 \InProcServer32\(Default) = C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll [MS]

{00F30F90-3E96-453B-AFCD-D71989ECC2C7} = Windows Live Photo Gallery Autoplay Drop Target Shim
  -> {HKLM…CLSID} = Windows Live Photo Gallery Viewer Autoplay Shim
                 \InProcServer32\(Default) = C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll [MS]

{B41DB860-8EE4-11D2-9906-E49FADC173CA} = WinRAR shell extension
  -> {HKLM…CLSID} = WinRAR
                 \InProcServer32\(Default) = C:\Program Files\WinRAR\rarext.dll [Alexander Roshal]

{1F77B17B-F531-44DB-ACA4-76ABB5010A28} = AIMP2: ShellExt
  -> {HKLM…CLSID} = AIMP2: ShellExt
                 \InProcServer32\(Default) = C:\PROGRA~1\AIMP2\System\AIMP_S~1.DLL [AIMP DevTeam]

HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\

<<!>> text/xml\CLSID = {807563E5-5146-11D5-A672-00B0D022E945}
  -> {HKLM…CLSID} = Microsoft Office InfoPath XML Mime Filter
                 \InProcServer32\(Default) = C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL [MS]

HKLM\SOFTWARE\Classes\PROTOCOLS\Handler\

<<!>> livecall\CLSID = {828030A1-22C1-4009-854F-8E305202313F}
  -> {HKLM…CLSID} = (no title provided)
                 \InProcServer32\(Default) = C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL [MS]

<<!>> ms-help\CLSID = {314111c7-a502-11d2-bbca-00c04f8ec294}
  -> {HKLM…CLSID} = HxProtocol Class
                 \InProcServer32\(Default) = C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll [MS]

<<!>> ms-itss\CLSID = {0A9007C0-4076-11D3-8789-0000F8105754}
  -> {HKLM…CLSID} = Microsoft Infotech Storage Protocol for IE 4.0
                 \InProcServer32\(Default) = C:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [MS]

<<!>> msnim\CLSID = {828030A1-22C1-4009-854F-8E305202313F}
  -> {HKLM…CLSID} = (no title provided)
                 \InProcServer32\(Default) = C:\PROGRA~1\WIC4A1~1\MESSEN~1\MSGRAP~1.DLL [MS]

<<!>> wlmailhtml\CLSID = {03C514A3-1EFB-4856-9F99-10D7BE1653C0}
  -> {HKLM…CLSID} = Windows Live Mail HTML Asynchronous Pluggable Protocol Handler
                 \InProcServer32\(Default) = C:\Program Files\Windows Live\Mail\mailcomm.dll [MS]

HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\

AIMPClassic\(Default) = {1F77B17B-F531-44DB-ACA4-76ABB5010A28}
  -> {HKLM…CLSID} = AIMP2: ShellExt
                 \InProcServer32\(Default) = C:\PROGRA~1\AIMP2\System\AIMP_S~1.DLL [AIMP DevTeam]

WinRAR\(Default) = {B41DB860-8EE4-11D2-9906-E49FADC173CA}
  -> {HKLM…CLSID} = WinRAR
                 \InProcServer32\(Default) = C:\Program Files\WinRAR\rarext.dll [Alexander Roshal]

HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\

AIMPClassic\(Default) = {1F77B17B-F531-44DB-ACA4-76ABB5010A28}
  -> {HKLM…CLSID} = AIMP2: ShellExt
                 \InProcServer32\(Default) = C:\PROGRA~1\AIMP2\System\AIMP_S~1.DLL [AIMP DevTeam]

WinRAR\(Default) = {B41DB860-8EE4-11D2-9906-E49FADC173CA}
  -> {HKLM…CLSID} = WinRAR
                 \InProcServer32\(Default) = C:\Program Files\WinRAR\rarext.dll [Alexander Roshal]

HKLM\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\

WinRAR\(Default) = {B41DB860-8EE4-11D2-9906-E49FADC173CA}
  -> {HKLM…CLSID} = WinRAR
                 \InProcServer32\(Default) = C:\Program Files\WinRAR\rarext.dll [Alexander Roshal]

HKLM\SOFTWARE\Classes\Directory\Background\shellex\ContextMenuHandlers\

igfxcui\(Default) = {3AB1675A-CCFF-11D2-8B20-00A0C93CB1F4}
  -> {HKLM…CLSID} = GraphicsShellExt Class
                 \InProcServer32\(Default) = C:\windows\system32\igfxpph.dll [Intel Corporation]

HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\

{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = PDF Column Info
  -> {HKLM…CLSID} = PDF Shell Extension
                 \InProcServer32\(Default) = C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll [Adobe Systems, Inc.]

HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\

WinRAR\(Default) = {B41DB860-8EE4-11D2-9906-E49FADC173CA}
  -> {HKLM…CLSID} = WinRAR
                 \InProcServer32\(Default) = C:\Program Files\WinRAR\rarext.dll [Alexander Roshal]

HKLM\SOFTWARE\Classes\Folder\shellex\DragDropHandlers\

WinRAR\(Default) = {B41DB860-8EE4-11D2-9906-E49FADC173CA}
  -> {HKLM…CLSID} = WinRAR
                 \InProcServer32\(Default) = C:\Program Files\WinRAR\rarext.dll [Alexander Roshal]


Default executables:
--------------------

HKLM\SOFTWARE\Classes\.exe\(Default) = exefile
HKLM\SOFTWARE\Classes\.exe\shell\open\command\(Default) = (value not set)

HKLM\SOFTWARE\Classes\.hta\(Default) = htafile
<<!>> HKLM\SOFTWARE\Classes\htafile\shell\open\command\(Default) = "%1" %* [file not found]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
Wallpaper = C:\Users\eugenia\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg


Windows Portable Device AutoPlay Handlers
-----------------------------------------

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\

AIMP.EventCDA\
Provider = AIMP3
InvokeProgID = AIMP.EventCDA
InvokeVerb = open
HKCU\Software\Classes\AIMP.EventCDA\shell\open\command\(Default) = C:\Program Files\AIMP3\AIMP3.exe /CDA %1 [AIMP DevTeam]

AIMP.EventMusic\
Provider = AIMP3
InvokeProgID = AIMP.EventMusic
InvokeVerb = open
HKCU\Software\Classes\AIMP.EventMusic\shell\open\command\(Default) = C:\Program Files\AIMP3\AIMP3.exe /DIR %1 [AIMP DevTeam]

MPCPlayBluRayOnArrival\
Provider = Media Player Classic
InvokeProgID = MediaPlayerClassic.Autorun
InvokeVerb = PlayBlurayMovie
HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayBlurayMovie\command\(Default) = "C:\Program Files\K-Lite Codec Pack\Media Player Classic\mpc-hc.exe" %L\BDMV\INDEX.BDMV [MPC-HC Team]

MPCPlayCDAudioOnArrival\
Provider = Media Player Classic
InvokeProgID = MediaPlayerClassic.Autorun
InvokeVerb = PlayCDAudio
HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayCDAudio\command\(Default) = "C:\Program Files\K-Lite Codec Pack\Media Player Classic\mpc-hc.exe" %1 /cd [MPC-HC Team]

MPCPlayDVDMovieOnArrival\
Provider = Media Player Classic
InvokeProgID = MediaPlayerClassic.Autorun
InvokeVerb = PlayDVDMovie
HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayDVDMovie\command\(Default) = "C:\Program Files\K-Lite Codec Pack\Media Player Classic\mpc-hc.exe" %1 /dvd [MPC-HC Team]

MPCPlayMusicFilesOnArrival\
Provider = Media Player Classic
InvokeProgID = MediaPlayerClassic.Autorun
InvokeVerb = PlayMusicFiles
HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayMusicFiles\command\(Default) = "C:\Program Files\K-Lite Codec Pack\Media Player Classic\mpc-hc.exe" %1 [MPC-HC Team]

MPCPlayVideoFilesOnArrival\
Provider = Media Player Classic
InvokeProgID = MediaPlayerClassic.Autorun
InvokeVerb = PlayVideoFiles
HKLM\SOFTWARE\Classes\MediaPlayerClassic.Autorun\shell\PlayVideoFiles\command\(Default) = "C:\Program Files\K-Lite Codec Pack\Media Player Classic\mpc-hc.exe" %1 [MPC-HC Team]

MSLivePhotoAcqHWEventHandler\
Provider = @%ProgramFiles%\Windows Live\Photo Gallery\regres.dll,-10;pl-pl.8081.0709
ProgID = Microsoft.LivePhotoAcqHWEventHandler
HKLM\SOFTWARE\Classes\Microsoft.LivePhotoAcqHWEventHandler\CLSID\(Default) = {3BD0ACD1-71CA-4475-92CC-E0AA0AAF843F}
  -> {HKLM…CLSID} = (no title provided)
                 \LocalServer32\(Default) = C:\Program Files\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe [MS]

MSLivePhotoAcquireDropHandler\
Provider = @%ProgramFiles%\Windows Live\Photo Gallery\regres.dll,-10;pl-pl.8081.0709
InvokeProgID = Microsoft.LivePhotoAcqDTShim.1
InvokeVerb = open
HKLM\SOFTWARE\Classes\Microsoft.LivePhotoAcqDTShim.1\shell\open\DropTarget\CLSID = {00F33137-EE26-412F-8D71-F84E4C2C6625}
  -> {HKLM…CLSID} = Windows Live Photo Gallery Viewer Autoplay Shim
                 \InProcServer32\(Default) = C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll [MS]

MSLiveShowPicturesOnArrival\
Provider = @%ProgramFiles%\Windows Live\Photo Gallery\regres.dll,-10;pl-pl.8081.0709
InvokeProgID = Microsoft.Photos.LiveAutoplayShim.1
InvokeVerb = open
HKLM\SOFTWARE\Classes\Microsoft.Photos.LiveAutoplayShim.1\shell\open\DropTarget\CLSID = {00F30F90-3E96-453B-AFCD-D71989ECC2C7}
  -> {HKLM…CLSID} = Windows Live Photo Gallery Viewer Autoplay Shim
                 \InProcServer32\(Default) = C:\Program Files\Windows Live\Photo Gallery\PhotoViewerShim.dll [MS]

MSLiveVideoCameraArrivalCaptureWizard\
Provider = @%ProgramFiles%\Windows Live\Photo Gallery\regres.dll,-10
ProgID = WLXAutoPlayMgr.WLXHWEventHandler
InitCmdLine = WLXVideoAcquireWizard
HKLM\SOFTWARE\Classes\WLXAutoPlayMgr.WLXHWEventHandler\CLSID\(Default) = {9B5C97F6-B3A5-4A6D-8B03-993EC7291A22}
  -> {HKLM…CLSID} = WLXWEventHandler Class
                 \LocalServer32\(Default) = "C:\Program Files\Windows Live\Photo Gallery\WLXVideoCameraAutoPlayManager.exe" [MS]

P2GCDBurningOnArrival\
Provider = Power2Go
InvokeProgID = BlankCD
InvokeVerb = OpenWithPower2Go
HKLM\SOFTWARE\Classes\BlankCD\shell\OpenWithPower2Go\Command\(Default) = "C:\Program Files\CyberLink\Power2Go\Power2Go.exe"  "%L" [CyberLink Corp.]

P2GDVDBurningOnArrival\
Provider = Power2Go
InvokeProgID = BlankDVD
InvokeVerb = OpenWithPower2Go
HKLM\SOFTWARE\Classes\BlankDVD\shell\OpenWithPower2Go\Command\(Default) = "C:\Program Files\CyberLink\Power2Go\Power2Go.exe"  "%L" [CyberLink Corp.]

PDirDVArrival\
Provider = PowerDirector
ProgID = Shell.HWEventHandlerShellExecute
InitCmdLine = "C:\Program Files\CyberLink\PowerDirector\PDR.exe" /DV
HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}
  -> {HKLM…CLSID} = Shell Execute Hardware Event Handler
                 \LocalServer32\(Default) = C:\windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7} [MS]

PDVD8PlayCDAudioOnArrival\
Provider = PowerDVD 8
InvokeProgID = AudioCD
InvokeVerb = PlayWithPowerDVD8
HKLM\SOFTWARE\Classes\AudioCD\shell\PlayWithPowerDVD8\Command\(Default) = "C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe"  "%L" [CyberLink Corp.]

PDVD8PlayDVDMovieOnArrival\
Provider = PowerDVD 8
InvokeProgID = DVD
InvokeVerb = PlayWithPowerDVD8
HKLM\SOFTWARE\Classes\DVD\shell\PlayWithPowerDVD8\Command\(Default) = "C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe"  "%L" [CyberLink Corp.]

PDVD8PlaySVCDOnArrival\
Provider = PowerDVD 8
InvokeProgID = SVCD
InvokeVerb = PlayWithPowerDVD8
HKLM\SOFTWARE\Classes\SVCD\shell\PlayWithPowerDVD8\Command\(Default) = "C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe"  "%L" [CyberLink Corp.]

PDVD8PlayVCDMovieOnArrival\
Provider = PowerDVD 8
InvokeProgID = VCD
InvokeVerb = PlayWithPowerDVD8
HKLM\SOFTWARE\Classes\VCD\shell\PlayWithPowerDVD8\Command\(Default) = "C:\Program Files\CyberLink\PowerDVD8\PowerDVD8.exe"  "%L" [CyberLink Corp.]

Power2GoPlayCDAudioOnArrival\
Provider = Power2Go
InvokeProgID = AudioCD
InvokeVerb = PlayWithPower2Go
HKLM\SOFTWARE\Classes\AudioCD\shell\PlayWithPower2Go\Command\(Default) = "C:\Program Files\CyberLink\Power2Go\Power2Go.exe" /AudioRipper "%L" [CyberLink Corp.]

PStarterBlankCDArrival\
Provider = DVD Suite
InvokeProgID = BlankCD
InvokeVerb = OpenWithPowerStarter
HKLM\SOFTWARE\Classes\BlankCD\shell\OpenWithPowerStarter\Command\(Default) = "C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe"  "%L" [CyberLink]

PStarterDVDBurningOnArrival\
Provider = DVD Suite
InvokeProgID = BlankDVD
InvokeVerb = OpenWithPowerStarter
HKLM\SOFTWARE\Classes\BlankDVD\shell\OpenWithPowerStarter\Command\(Default) = "C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe"  "%L" [CyberLink]

PStarterMixedCDArrival\
Provider = DVD Suite
InvokeProgID = MixedContent
InvokeVerb = OpenWithPowerStarter
HKLM\SOFTWARE\Classes\MixedContent\shell\OpenWithPowerStarter\Command\(Default) = "C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe"  "%L" [CyberLink]

PStarterMusicFilesArrival\
Provider = DVD Suite
InvokeProgID = MusicFiles
InvokeVerb = OpenWithPowerStarter
HKLM\SOFTWARE\Classes\MusicFiles\shell\OpenWithPowerStarter\Command\(Default) = "C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe"  "%L" [CyberLink]

PStarterPicturesArrival\
Provider = DVD Suite
InvokeProgID = Picture
InvokeVerb = OpenWithPowerStarter
HKLM\SOFTWARE\Classes\Picture\shell\OpenWithPowerStarter\Command\(Default) = "C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe"  "%L" [CyberLink]

PStarterVideoFilesArrival\
Provider = DVD Suite
InvokeProgID = VideoFiles
InvokeVerb = OpenWithPowerStarter
HKLM\SOFTWARE\Classes\VideoFiles\shell\OpenWithPowerStarter\Command\(Default) = "C:\Program Files\CyberLink\DVD Suite\PowerStarter.exe"  "%L" [CyberLink]

ZunePlayCDAudioOnArrival\
Provider = @C:\Program Files\Zune\ZuneResources.dll,-603
InvokeProgID = Microsoft.Zune.2.AudioCD
InvokeVerb = Play
HKLM\SOFTWARE\Classes\Microsoft.Zune.2.AudioCD\shell\Play\Command\(Default) = "C:\Program Files\Zune\Zune.exe" /PlayCD:"%L" [MS]

ZunePlayMediaOnArrival\
Provider = @C:\Program Files\Zune\ZuneResources.dll,-603
InvokeProgID = Microsoft.Zune.2.PlayMedia
InvokeVerb = Play
HKLM\SOFTWARE\Classes\Microsoft.Zune.2.PlayMedia\shell\Play\Command\(Default) = "C:\Program Files\Zune\Zune.exe" /PlayMedia:"%L" [MS]

ZuneRipCDAudioOnArrival\
Provider = @C:\Program Files\Zune\ZuneResources.dll,-603
InvokeProgID = Microsoft.Zune.2.RipCD
InvokeVerb = Rip
HKLM\SOFTWARE\Classes\Microsoft.Zune.2.RipCD\shell\Rip\Command\(Default) = "C:\Program Files\Zune\Zune.exe" /RipCD:"%L" [MS]


Non-disabled Scheduled Tasks: {++}
-----------------------------

C:\Windows\System32\Tasks
advSRS4 ->  launches: "C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe" [SEC]
APSchedulerC ->  launches: C:\Program Files\AnyPC Client\APLanMgrC.exe -service [DoctorSoft]
BatteryLifeExtender -> (HIDDEN!) launches: C:\Program Files\Samsung\BatteryLifeExtender\BatteryLifeExtender.exe /2 [Samsung Electronics. Co. Ltd.]
EasyBatteryManager -> (HIDDEN!) launches: "%ProgramFiles%\Samsung\EasyBatteryManager\EasyBatteryMgr4.exe" [SAMSUNG Electronics co., LTD.]
EasyDisplayMgr -> (HIDDEN!) launches: "C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe" [Samsung Electronics Co., Ltd.]
EasySpeedUpManager -> (HIDDEN!) launches: %programfiles%\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe [Samsung Electronics Co., Ltd.]
McDefragTask ->  launches: c:\PROGRA~1\mcafee\mqc\QcConsol.exe "C:\windows\system32\defrag.exe" C: -f [file not found]
McQcTask ->  launches: c:\PROGRA~1\mcafee\mqc\QcConsol.exe 14 0 [file not found]
SamsungSupportCenter -> (HIDDEN!) launches: %programfiles%\Samsung\Samsung Support Center\SSCKbdHk.exe [SAMSUNG Electronics]
SpyHunter4Startup ->  launches: "C:\Program Files\Enigma Software Group\SpyHunter\Spyhunter4.exe" /s [file not found]
SUPBackground -> (HIDDEN!) launches: "%ProgramFiles%\Samsung\Samsung Update Plus\SUPBackground.exe" [null data]

C:\Windows\System32\Tasks\Microsoft\Windows\Active Directory Rights Management Services Client
AD RMS Rights Policy Template Management (Manual) ->  launches: {BF5CB148-7C77-4d8a-A53E-D81C70CF743C}
  -> {HKLM…CLSID} = AD RMS Rights Policy Template Management (Manual) Task Handler
                 \InProcServer32\(Default) = C:\windows\system32\msdrm.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience
AitAgent ->  launches: aitagent [MS]
ProgramDataUpdater ->  launches: %windir%\system32\rundll32.exe aepdu.dll,AePduRunUpdate [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Autochk
Proxy ->  launches: %windir%\system32\rundll32.exe /d acproxy.dll,PerformAutochkOperations [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Bluetooth
UninstallDeviceTask ->  launches: BthUdTask.exe $(Arg0) [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\CertificateServicesClient
SystemTask ->  launches: {58fb76b9-ac85-4e55-ac04-427593b1d060}
  -> {HKLM…CLSID} = Certificate Services Client Task Handler
                 \InProcServer32\(Default) = C:\windows\system32\dimsjob.dll [MS]
UserTask ->  launches: {58fb76b9-ac85-4e55-ac04-427593b1d060}
  -> {HKLM…CLSID} = Certificate Services Client Task Handler
                 \InProcServer32\(Default) = C:\windows\system32\dimsjob.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Customer Experience Improvement Program
Consolidator ->  launches: %SystemRoot%\System32\wsqmcons.exe [MS]
KernelCeipTask -> (HIDDEN!) launches: {e7ed314f-2816-4c26-aeb5-54a34d02404c}
  -> {HKLM…CLSID} = KernelCeipCustomHandler
                 \InProcServer32\(Default) = C:\windows\System32\kernelceip.dll [MS]
UsbCeip -> (HIDDEN!) launches: {c27f6b1d-fe0b-45e4-9257-38799fa69bc8}
  -> {HKLM…CLSID} = UsbCeip
                 \InProcServer32\(Default) = C:\windows\System32\usbceip.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Defrag
ScheduledDefrag ->  launches: %windir%\system32\defrag.exe -c [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Diagnosis
Scheduled -> (HIDDEN!) launches: {c1f85ef8-bcc2-4606-bb39-70c523715eb3}
  -> {HKLM…CLSID} = ScheduledDiagnosticCustomHandler
                 \InProcServer32\(Default) = C:\windows\System32\sdiagschd.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Location
Notifications ->  launches: %windir%\System32\LocationNotifications.exe [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Maintenance
WinSAT ->  launches: {A9A33436-678B-4C9C-A211-7CC38785E79D}
  -> {HKLM…CLSID} = WinSAT Task Manger Task
                 \InProcServer32\(Default) = C:\windows\system32\WinSATAPI.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Media Center
ActivateWindowsSearch ->  launches: %SystemRoot%\ehome\ehPrivJob.exe /DoActivateWindowsSearch [MS]
ConfigureInternetTimeService ->  launches: %SystemRoot%\ehome\ehPrivJob.exe /DoConfigureInternetTimeService [MS]
DispatchRecoveryTasks ->  launches: %SystemRoot%\ehome\ehPrivJob.exe /DoRecoveryTasks $(Arg0) [MS]
ehDRMInit ->  launches: %SystemRoot%\ehome\ehPrivJob.exe /DRMInit [MS]
InstallPlayReady ->  launches: %SystemRoot%\ehome\ehPrivJob.exe /InstallPlayReady $(Arg0) [MS]
mcupdate ->  launches: %SystemRoot%\ehome\mcupdate $(Arg0) [MS]
MediaCenterRecoveryTask ->  launches: %SystemRoot%\ehome\mcupdate.exe -MediaCenterRecoveryTask [MS]
ObjectStoreRecoveryTask ->  launches: %SystemRoot%\ehome\mcupdate.exe -ObjectStoreRecoveryTask [MS]
OCURActivate ->  launches: %SystemRoot%\ehome\ehPrivJob.exe /OCURActivate [MS]
OCURDiscovery ->  launches: %SystemRoot%\ehome\ehPrivJob.exe /OCURDiscovery $(Arg0) [MS]
PBDADiscovery ->  launches: %SystemRoot%\ehome\ehPrivJob.exe /PBDADiscovery [MS]
PBDADiscoveryW1 ->  launches: %SystemRoot%\ehome\ehPrivJob.exe /wait:7 /PBDADiscovery [MS]
PBDADiscoveryW2 ->  launches: %SystemRoot%\ehome\ehPrivJob.exe /wait:90 /PBDADiscovery [MS]
PvrRecoveryTask ->  launches: %SystemRoot%\ehome\mcupdate.exe -PvrRecoveryTask [MS]
PvrScheduleTask ->  launches: %SystemRoot%\ehome\mcupdate.exe -PvrSchedule [MS]
RegisterSearch ->  launches: %SystemRoot%\ehome\ehPrivJob.exe /DoRegisterSearch $(Arg0) [MS]
ReindexSearchRoot ->  launches: %SystemRoot%\ehome\ehPrivJob.exe /DoReindexSearchRoot [MS]
SqlLiteRecoveryTask ->  launches: %SystemRoot%\ehome\mcupdate.exe -SqlLiteRecoveryTask [MS]
UpdateRecordPath ->  launches: %SystemRoot%\ehome\ehPrivJob.exe /DoUpdateRecordPath $(Arg0) [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\MemoryDiagnostic
CorruptionDetector -> (HIDDEN!) launches: {190BA3F6-0205-4f46-B589-95C6822899D2}
  -> {HKLM…CLSID} = MemoryDiagnosticCustomHandler
                 \InProcServer32\(Default) = C:\windows\System32\memdiag.dll [MS]
DecompressionFailureDetector -> (HIDDEN!) launches: {190BA3F6-0205-4f46-B589-95C6822899D2}
  -> {HKLM…CLSID} = MemoryDiagnosticCustomHandler
                 \InProcServer32\(Default) = C:\windows\System32\memdiag.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\MobilePC
HotStart ->  launches: {06DA0625-9701-43da-BFD7-FBEEA2180A1E}
  -> {HKLM…CLSID} = HotStart User Agent
                 \InProcServer32\(Default) = C:\windows\System32\HotStartUserAgent.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\MUI
Lpksetup ->  launches: C:\windows\System32\lpksetup.exe -v [MS]
LPRemove ->  launches: %windir%\system32\lpremove.exe [MS]
Mcbuilder ->  launches: C:\windows\System32\mcbuilder.exe [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Multimedia
SystemSoundsService ->  launches: {2DEA658F-54C1-4227-AF9B-260AB5FC3543}
  -> {HKLM…CLSID} = Microsoft PlaySoundService Class
                 \InProcServer32\(Default) = C:\windows\System32\PlaySndSrv.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\NetTrace
GatherNetworkInfo ->  launches: %windir%\system32\gatherNetworkInfo.vbs [null data]

C:\Windows\System32\Tasks\Microsoft\Windows\Power Efficiency Diagnostics
AnalyzeSystem ->  launches: %SystemRoot%\System32\powercfg.exe -energy -auto [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\RAC
RacTask -> (HIDDEN!) launches: {42060D27-CA53-41f5-96E4-B1E8169308A6}
  -> {HKLM…CLSID} = ReliabilityAnalysisCustomHandler
                 \InProcServer32\(Default) = C:\windows\system32\RacEngn.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Ras
MobilityManager ->  launches: {c463a0fc-794f-4fdf-9201-01938ceacafa}
  -> {HKLM…CLSID} = RasMobilityManager
                 \InProcServer32\(Default) = C:\windows\system32\rasmbmgr.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Registry
RegIdleBackup -> (HIDDEN!) launches: {ca767aa8-9157-4604-b64b-40747123d5f2}
  -> {HKLM…CLSID} = RegistryIdleBackupHandler
                 \InProcServer32\(Default) = C:\windows\System32\regidle.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\RemoteAssistance
RemoteAssistanceTask -> (HIDDEN!) launches: %windir%\system32\RAServer.exe /offerraupdate [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\SideShow
GadgetManager ->  launches: {FF87090D-4A9A-4f47-879B-29A80C355D61}
  -> {HKLM…CLSID} = GadgetsManager Class
                 \InProcServer32\(Default) = C:\windows\System32\AuxiliaryDisplayServices.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\SystemRestore
SR ->  launches: %windir%\system32\rundll32.exe /d srrstr.dll,ExecuteScheduledSPPCreation [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Task Manager
Interactive -> (HIDDEN!) launches: {855fec53-d2e4-4999-9e87-3414e9cf0ff4}
  -> {HKLM…CLSID} = RunTask
                 \InProcServer32\(Default) = C:\windows\system32\wdc.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Tcpip
IpAddressConflict1 ->  launches: %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPOffendingSystem [MS]
IpAddressConflict2 ->  launches: %windir%\system32\rundll32.exe ndfapi.dll,NdfRunDllDuplicateIPDefendingSystem [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\TextServicesFramework
MsCtfMonitor -> (HIDDEN!) launches: {01575cfe-9a55-4003-a5e1-f38d1ebdcbe1}
  -> {HKLM…CLSID} = MsCtfMonitor task handler
                 \InProcServer32\(Default) = C:\windows\system32\MsCtfMonitor.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Time Synchronization
SynchronizeTime ->  launches: %windir%\system32\sc.exe start w32time task_started [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\UPnP
UPnPHostConfig ->  launches: sc.exe config upnphost start= auto [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\WDI
ResolutionHost -> (HIDDEN!) launches: {900be39d-6be8-461a-bc4d-b0fa71f5ecb1}
  -> {HKLM…CLSID} = DiagnosticInfrastructureCustomHandler
                 \InProcServer32\(Default) = C:\windows\System32\wdi.dll [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Windows Activation Technologies
ValidationTask -> (HIDDEN!) launches: %SystemRoot%\system32\Wat\WatAdminSvc.exe /run [MS]
ValidationTaskDeadline -> (HIDDEN!) launches: %SystemRoot%\system32\schtasks.exe /run /I /TN "\Microsoft\Windows\Windows Activation Technologies\ValidationTask" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Windows Error Reporting
QueueReporting ->  launches: %windir%\system32\wermgr.exe -queuereporting [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Windows Filtering Platform
BfeOnServiceStartTypeChange -> (HIDDEN!) launches: %windir%\system32\rundll32.exe bfe.dll,BfeOnServiceStartTypeChange [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\Windows Media Sharing
UpdateLibrary ->  launches: "%ProgramFiles%\Windows Media Player\wmpnscfg.exe" [MS]

C:\Windows\System32\Tasks\Microsoft\Windows\WindowsBackup
ConfigNotification ->  launches: %systemroot%\System32\sdclt.exe /CONFIGNOTIFICATION [MS]

C:\Windows\System32\Tasks\Microsoft\Windows Defender
MP Scheduled Scan -> (HIDDEN!) launches: c:\program files\windows defender\MpCmdRun.exe Scan -ScheduleJob -WinTask -RestrictPrivilegesScan [MS]

C:\Windows\System32\Tasks\WPD
SqmUpload_S-1-5-21-1624614489-1438924107-3198493719-1000 -> (HIDDEN!) launches: %windir%\system32\rundll32.exe portabledeviceapi.dll,#1 [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = %SystemRoot%\system32\NLAapi.dll [MS]
000000000002\LibraryPath = %SystemRoot%\System32\mswsock.dll [MS]
000000000003\LibraryPath = %SystemRoot%\System32\winrnr.dll [MS]
000000000004\LibraryPath = %SystemRoot%\system32\napinsp.dll [MS]
000000000005\LibraryPath = %SystemRoot%\system32\pnrpnsp.dll [MS]
000000000006\LibraryPath = %SystemRoot%\system32\pnrpnsp.dll [MS]

Transport Service Providers

HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 26


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\

{BA14329E-9550-4989-B3F2-9732E92D17CC}
  -> {HKLM…CLSID} = Vuze Remote Toolbar
                 \InProcServer32\(Default) = C:\Program Files\Vuze_Remote\prxtbVuze.dll [Conduit Ltd.]

HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar\
{BA14329E-9550-4989-B3F2-9732E92D17CC} = Vuze Remote Toolbar
  -> {HKLM…CLSID} = Vuze Remote Toolbar
                 \InProcServer32\(Default) = C:\Program Files\Vuze_Remote\prxtbVuze.dll [Conduit Ltd.]

Explorer Bars

HKLM\SOFTWARE\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = &Poszukaj
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL [MS]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\
{219C3416-8CB2-491A-A3C7-D9FCDDC9D600}\
ButtonText = Wpis w blogu
MenuText = &Wpis w blogu w Windows Live Writer
CLSIDExtension = {5F7B1267-94A9-47F5-98DB-E99415F33AEC}
  -> {HKLM…CLSID} = BlogThisToolbarButton Class
                 \InProcServer32\(Default) = C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll [MS]

{2670000A-7350-4F3C-8081-5663EE0C6C49}\
ButtonText = Wyślij do programu OneNote
MenuText = Wyślij &do programu OneNote
CLSIDExtension = {48E73304-E1D6-4330-914C-F5F514E3486C}
  -> {HKLM…CLSID} = Send to OneNote from Internet Explorer button
                 \InProcServer32\(Default) = C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll [MS]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
ButtonText = Research
BandCLSID = {FF059E31-CC5A-4E2E-BF3B-96E929D65503}
  -> {HKLM…CLSID} = &Poszukaj
                 \InProcServer32\(Default) = C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL [MS]


Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\
<<H>> {ba14329e-9550-4989-b3f2-9732e92d17cc} = (no title provided)
  -> {HKLM…CLSID} = Vuze Remote Toolbar
                 \InProcServer32\(Default) = C:\Program Files\Vuze_Remote\prxtbVuze.dll [Conduit Ltd.]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Cyberlink RichVideo Service(CRVS), RichVideo, "C:\Program Files\CyberLink\Shared files\RichVideo.exe" [empty string]
E-MU Audio Service, emaudsv, C:\windows\system32\emaudsv.exe [E-MU Systems]
Oberon Media Game Console service, OberonGameConsoleService, "C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe" [null data]


Safe Mode Drivers & Services (subkey name, subkey default value):
-----------------------------------------------------------------

HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\

<<!>> hitmanpro37, 
<<!>> hitmanpro37.sys, 
<<!>> MCODS, (title not found)

HKLM\System\CurrentControlSet\Control\SafeBoot\Network\

<<!>> hitmanpro37, 
<<!>> hitmanpro37.sys, 


Print Monitors:
---------------

HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\
LIDIL hpzllw71\Driver = hpzllw71.dll [Hewlett-Packard Corporation]
Send To Microsoft OneNote Monitor\Driver = msonpmon.dll [MS]


---------- (launch time: 2013-01-31 21:01:29)
<<!>>: Suspicious data at a malware launch point.
<<H>>: Suspicious data at a browser hijack point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
  launch it from a command prompt or a shortcut with the -all parameter.
+ The search for DESKTOP.INI DLL launch points on all local fixed drives
  took 143 seconds.
---------- (total run time: 194 seconds)

OTL:
Kod: 
OTL logfile created on: 1/31/2013 9:14:41 PM - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Program Files\Opera
 Home Premium Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd
 
1.96 Gb Total Physical Memory | 0.96 Gb Available Physical Memory | 49.02% Memory free
3.92 Gb Paging File | 2.75 Gb Available in Paging File | 70.02% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 80.58 Gb Total Space | 15.02 Gb Free Space | 18.63% Space Free | Partition Type: NTFS
Drive D: | 137.21 Gb Total Space | 4.44 Gb Free Space | 3.24% Space Free | Partition Type: NTFS
Drive F: | 1.21 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: CDFS
Drive G: | 941.72 Mb Total Space | 610.08 Mb Free Space | 64.78% Space Free | Partition Type: FAT
 
Computer Name: EUGENIADOM | User Name: eugenia | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
[color=#E56717]========== Processes (SafeList) ==========[/color]
 
PRC - [2013/01/31 21:14:30 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Program Files\Opera\OTL.exe
PRC - [2012/12/20 09:24:22 | 000,942,080 | ---- | M] (Behringer Spezielle Studiotechnik GmbH) -- C:\Windows\System32\bca2kcpan.exe
PRC - [2012/12/12 00:20:50 | 000,542,104 | ---- | M] (Lavasoft) -- C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
PRC - [2012/12/02 23:09:18 | 000,878,480 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe
PRC - [2012/09/30 00:38:34 | 000,174,056 | ---- | M] (Oracle Corporation) -- C:\Windows\System32\javaw.exe
PRC - [2012/07/16 12:15:40 | 010,354,176 | ---- | M] (Creative Team S.A.) -- C:\Program Files\WapSter\WapSter AQQ\AQQ.exe
PRC - [2011/08/05 12:29:56 | 000,159,456 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Zune\ZuneLauncher.exe
PRC - [2011/02/26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010/10/06 22:38:26 | 000,021,504 | ---- | M] (E-MU Systems) -- C:\Windows\System32\emaudsv.exe
PRC - [2010/09/03 15:18:00 | 000,319,488 | ---- | M] (E-MU Systems) -- C:\Program Files\Creative Professional\E-MU USB Audio\EmuUsbAudioCP.exe
PRC - [2009/11/04 05:11:48 | 000,835,072 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
PRC - [2009/10/26 12:53:14 | 000,091,136 | ---- | M] (SAMSUNG Electronics) -- C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
PRC - [2009/10/13 11:03:04 | 000,716,800 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\EasySpeedUpManager\EasySpeedUpManager.exe
PRC - [2009/10/07 02:31:56 | 002,246,144 | ---- | M] (SEC) -- C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
PRC - [2009/08/13 20:58:10 | 000,044,312 | ---- | M] () -- C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe
PRC - [2009/07/24 05:46:14 | 000,650,920 | ---- | M] () -- C:\Program Files\Samsung\Samsung Update Plus\SUPNotifier.exe
PRC - [2009/07/14 02:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009/06/03 12:59:02 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
PRC - [2009/04/15 15:52:06 | 000,091,432 | ---- | M] (CyberLink Corp.) -- C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe
PRC - [2007/09/02 12:58:52 | 000,495,616 | ---- | M] () -- C:\Program Files\RocketDock\RocketDock.exe
PRC - [2003/04/02 03:20:37 | 000,012,288 | ---- | M] () -- C:\Program Files\Winamp\winampa.exe
 
 
[color=#E56717]========== Modules (No Company Name) ==========[/color]
 
MOD - [2013/01/31 20:49:17 | 000,385,024 | ---- | M] () -- C:\Users\eugenia\AppData\Local\Temp\libsqlitejdbc-6382746556152559517.lib
MOD - [2012/12/02 23:09:19 | 000,835,584 | ---- | M] () -- C:\Program Files\Opera\gstreamer\gstreamer.dll
MOD - [2012/12/02 23:09:19 | 000,312,832 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstoggdec.dll
MOD - [2012/12/02 23:09:19 | 000,158,208 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstffmpegcolorspace.dll
MOD - [2012/12/02 23:09:19 | 000,101,888 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstwebmdec.dll
MOD - [2012/12/02 23:09:19 | 000,096,256 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstcoreplugins.dll
MOD - [2012/12/02 23:09:19 | 000,094,208 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstaudioresample.dll
MOD - [2012/12/02 23:09:19 | 000,093,696 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstaudioconvert.dll
MOD - [2012/12/02 23:09:19 | 000,073,728 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstwavparse.dll
MOD - [2012/12/02 23:09:19 | 000,067,072 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstdirectsound.dll
MOD - [2012/12/02 23:09:19 | 000,062,976 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstdecodebin2.dll
MOD - [2012/12/02 23:09:19 | 000,057,344 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstautodetect.dll
MOD - [2012/12/02 23:09:19 | 000,038,912 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstwaveform.dll
MOD - [2012/08/30 22:52:16 | 008,797,856 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32_11_2_202_235.dll
MOD - [2012/07/11 13:54:20 | 000,971,776 | ---- | M] () -- C:\Program Files\WapSter\WapSter AQQ\System\Shared\Plugins\SMS.dll
MOD - [2012/06/25 13:00:16 | 001,187,840 | ---- | M] () -- C:\Program Files\WapSter\WapSter AQQ\System\Shared\Plugins\GGNet.dll
MOD - [2009/07/24 05:46:14 | 000,650,920 | ---- | M] () -- C:\Program Files\Samsung\Samsung Update Plus\SUPNotifier.exe
MOD - [2009/06/03 12:59:14 | 000,013,096 | ---- | M] () -- C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll
MOD - [2009/06/03 12:59:02 | 000,619,816 | ---- | M] () -- C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll
MOD - [2009/05/13 09:51:26 | 000,155,648 | ---- | M] () -- C:\Program Files\Samsung\Samsung Update Plus\HMXML.dll
MOD - [2007/09/17 11:36:04 | 001,720,320 | ---- | M] () -- C:\Program Files\Creative Professional\E-MU USB Audio\QtCore4.dll
MOD - [2007/09/02 12:58:52 | 000,495,616 | ---- | M] () -- C:\Program Files\RocketDock\RocketDock.exe
MOD - [2007/09/02 12:57:36 | 000,069,632 | ---- | M] () -- C:\Program Files\RocketDock\RocketDock.dll
MOD - [2006/10/20 19:25:18 | 003,969,024 | ---- | M] () -- C:\Program Files\Creative Professional\E-MU USB Audio\QtGui4.dll
MOD - [2006/10/20 19:20:14 | 000,204,800 | ---- | M] () -- C:\Program Files\Creative Professional\E-MU USB Audio\QtXml4.dll
MOD - [2006/08/12 04:48:40 | 000,049,152 | ---- | M] () -- C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll
MOD - [2003/04/02 03:20:37 | 000,012,288 | ---- | M] () -- C:\Program Files\Winamp\winampa.exe
 
 
[color=#E56717]========== Services (SafeList) ==========[/color]
 
SRV - [2012/09/06 02:25:06 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/08/31 02:02:34 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2011/08/05 12:30:02 | 000,444,640 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Zune\ZuneWlanCfgSvc.exe -- (ZuneWlanCfgSvc)
SRV - [2011/08/05 12:30:02 | 000,268,512 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Zune\WMZuneComm.exe -- (WMZuneComm)
SRV - [2011/08/05 12:29:56 | 006,363,872 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Zune\ZuneNss.exe -- (ZuneNetworkSvc)
SRV - [2010/10/06 22:38:26 | 000,021,504 | ---- | M] (E-MU Systems) [Auto | Running] -- C:\Windows\System32\emaudsv.exe -- (emaudsv)
SRV - [2009/08/13 20:58:10 | 000,044,312 | ---- | M] () [Auto | Running] -- C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe -- (OberonGameConsoleService)
SRV - [2009/07/14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
 
 
[color=#E56717]========== Driver Services (SafeList) ==========[/color]
 
DRV - File not found [Kernel | System | Stopped] -- C:\windows\system32\drivers\SBREDrv.sys -- (SBRE)
DRV - [2013/01/31 20:19:11 | 000,013,560 | ---- | M] (GFI Software) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\gfibto.sys -- (gfibto)
DRV - [2012/12/20 09:24:22 | 000,094,368 | ---- | M] (Behringer Spezielle Studiotechnik GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BCA2000.SYS -- (BCA2000)
DRV - [2012/12/20 09:24:22 | 000,027,328 | ---- | M] (Behringer Spezielle Studiotechnik GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\BCA2000WDM.SYS -- (BCA2000WDM)
DRV - [2012/11/02 14:06:22 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2011/04/12 10:46:00 | 000,013,824 | ---- | M] (TPMX Electronics Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HPub4DE3.sys -- (HPub4DE3)
DRV - [2011/03/09 09:44:52 | 000,020,992 | ---- | M] (TPMX Electronics Ltd.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\HPMo4DE3.sys -- (HPMo4DE3)
DRV - [2010/10/06 22:41:56 | 000,164,696 | ---- | M] (E-MU Systems) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\emusba10.sys -- (emusba10)
DRV - [2010/06/08 00:10:57 | 000,015,656 | ---- | M] (Windows (R) 2003 DDK 3790 provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rtport.sys -- (rtport)
DRV - [2009/11/06 21:53:58 | 001,227,776 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\athr.sys -- (athr)
DRV - [2009/09/28 10:22:00 | 000,315,392 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7)
DRV - [2009/07/14 00:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009/07/10 14:44:52 | 000,122,880 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService)
DRV - [2009/04/09 06:23:02 | 000,130,424 | ---- | M] (McAfee, Inc.) [Kernel | System | Running] -- C:\Windows\System32\drivers\Mpfp.sys -- (MPFP)
DRV - [2005/05/09 20:08:40 | 000,033,792 | ---- | M] (Team H2O) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\cledx.sys -- (CLEDX)
DRV - [2001/04/09 14:03:56 | 000,017,784 | ---- | M] (Syncrosoft Hard- und Software GmbH) [Kernel | Auto | Stopped] -- C:\windows\System32\drivers\NSynas32.sys -- (Nsynas32)
 
 
[color=#E56717]========== Standard Registry (SafeList) ==========[/color]
 
 
[color=#E56717]========== Internet Explorer ==========[/color]
 
IE - HKLM\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = http://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
IE - HKCU\..\URLSearchHook: {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{5AA7D584-A00A-467D-A74B-C74387EE4916}: "URL" = http://search.conduit.com/Result***t.aspx?q={searchTerms}&SearchSource=4&ctid=CT2504091
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
[color=#E56717]========== FireFox ==========[/color]
 
FF - prefs.js..extensions.enabledAddons: [email protected]:1.3.0.84
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@ganymede/GanymedeNetPlugin,version=1.0: C:\Program Files\Ganymede\Plugins\npganymedenet.dll ( )
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\3.0.40624.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013/01/31 20:17:07 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/11/23 01:20:29 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\[email protected]: C:\Users\eugenia\AppData\Roaming\[email protected] [2013/01/31 20:38:33 | 000,000,000 | ---D | M]
 
[2012/09/11 16:55:20 | 000,000,000 | ---D | M] (No name found) -- C:\Users\eugenia\AppData\Roaming\mozilla\Extensions
[2013/01/05 20:10:53 | 000,000,000 | ---D | M] (No name found) -- C:\Users\eugenia\AppData\Roaming\mozilla\Firefox\Profiles\d21iz0n7.default\extensions
[2013/01/05 20:10:53 | 000,000,000 | ---D | M] (Lavasoft Search Plugin) -- C:\Users\eugenia\AppData\Roaming\mozilla\Firefox\Profiles\d21iz0n7.default\extensions\jid1-yZwVFzbsyfMrqQ@jetpack
[2012/09/11 16:55:45 | 000,000,000 | ---D | M] (PEKAO S.A. Sign Plugin) -- C:\Users\eugenia\AppData\Roaming\mozilla\Firefox\Profiles\d21iz0n7.default\extensions\[email protected]
[2012/09/11 16:55:03 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2012/09/06 02:26:03 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012/07/25 13:57:52 | 000,121,024 | ---- | M] ( ) -- C:\Program Files\mozilla firefox\plugins\npganymedenet.dll
[2012/09/06 03:57:09 | 000,002,767 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml
[2012/09/06 03:57:10 | 000,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml
[2012/09/06 03:57:10 | 000,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml
[2012/09/06 03:57:10 | 000,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml
[2012/09/06 03:57:10 | 000,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml
[2012/09/06 03:57:09 | 000,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml
 
O1 HOSTS File: ([2009/06/10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (no name) - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - No CLSID value found.
O2 - BHO: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Vuze Remote Toolbar) - {ba14329e-9550-4989-b3f2-9732e92d17cc} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (Vuze Remote Toolbar) - {BA14329E-9550-4989-B3F2-9732E92D17CC} - C:\Program Files\Vuze_Remote\prxtbVuze.dll (Conduit Ltd.)
O4 - HKLM..\Run: [Ad-Aware Browsing Protection] C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (Lavasoft)
O4 - HKLM..\Run: [APLangApp] C:\Program Files\AnyPC Client\APLangApp.exe (DoctorSoft)
O4 - HKLM..\Run: [BCA2000] C:\Windows\System32\bca2kcpan.exe (Behringer Spezielle Studiotechnik GmbH)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [fsi] C:\Program Files\Phoenix Technologies Ltd\FailSafe\FailSafeLauncher.exe ()
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RemoteControl8] C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePDRShortCut] C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePPShortCut] C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdReg] C:\Windows\Updreg.EXE (Creative Technology Ltd.)
O4 - HKLM..\Run: [WinampAgent] C:\Program Files\Winamp\Winampa.exe ()
O4 - HKLM..\Run: [Zune Launcher] C:\Program Files\Zune\ZuneLauncher.exe (Microsoft Corporation)
O4 - HKCU..\Run: [AQQ] C:\Program Files\WapSter\WapSter AQQ\AQQ.exe (Creative Team S.A.)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [E-MU USB Audio Control Panel] C:\Program Files\Creative Professional\E-MU USB Audio\EmuUsbAudioCP.exe (E-MU Systems)
O4 - HKCU..\Run: [Oracle Java] C:\windows\System32\javaw.exe (Oracle Corporation)
O4 - HKCU..\Run: [RocketDock] C:\Program Files\RocketDock\RocketDock.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{37E72176-4A42-432A-BED0-ACEFBA4EB236}: DhcpNameServer = 192.168.1.1 192.168.1.1
O18 - Protocol\Handler\sacore - No CLSID value found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O32 - AutoRun File - [2004/08/19 18:41:56 | 000,120,920 | R--- | M] () - F:\Autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2004/08/12 14:06:43 | 000,000,065 | R--- | M] () - F:\Autorun.inf -- [ CDFS ]
O32 - AutoRun File - [2012/08/24 12:09:52 | 000,000,000 | ---D | M] - G:\AutoMapa EU -- [ FAT ]
O33 - MountPoints2\{5bd694bd-2402-11e2-9176-002454a2a5d6}\Shell - "" = AutoRun
O33 - MountPoints2\{5bd694bd-2402-11e2-9176-002454a2a5d6}\Shell\AutoRun\command - "" = F:\Autorun.exe -- [2004/08/19 18:41:56 | 000,120,920 | R--- | M] ()
O33 - MountPoints2\{7caf27ae-577a-11e2-b172-002454a2a5d6}\Shell - "" = AutoRun
O33 - MountPoints2\{7caf27ae-577a-11e2-b172-002454a2a5d6}\Shell\AutoRun\command - "" = H:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]
 
[2013/01/31 20:38:33 | 000,000,000 | ---D | C] -- C:\Users\eugenia\AppData\Roaming\[email protected]
[2013/01/31 20:32:26 | 000,000,000 | ---D | C] -- C:\Program Files\Trend Micro
[2013/01/31 20:32:26 | 000,000,000 | ---D | C] -- C:\Users\eugenia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\HiJackThis
[2013/01/31 20:27:31 | 000,000,000 | ---D | C] -- C:\Users\eugenia\Documents\DO LOGOW SYSTEMU
[2013/01/31 20:25:34 | 000,000,000 | ---D | C] -- C:\Users\eugenia\AppData\Local\adawarebp
[2013/01/31 20:07:08 | 000,000,000 | ---D | C] -- C:\Users\eugenia\AppData\Roaming\Chrome_manager
[2013/01/14 20:53:20 | 000,000,000 | ---D | C] -- C:\Users\eugenia\AppData\Local\Diagnostics
[2013/01/11 19:26:46 | 000,000,000 | ---D | C] -- C:\Users\eugenia\Desktop\Nowy folder
[2013/01/05 22:02:48 | 000,000,000 | ---D | C] -- C:\Users\eugenia\Desktop\JPC
[2013/01/05 22:00:41 | 000,000,000 | ---D | C] -- C:\ProgramData\HitmanPro
[2013/01/05 20:50:12 | 000,237,072 | ---- | C] (Microsoft Corporation) -- C:\windows\System32\MpSigStub.exe
[2013/01/05 20:35:28 | 000,000,000 | ---D | C] -- C:\Users\eugenia\AppData\Local\Programs
[2013/01/05 20:34:57 | 000,000,000 | ---D | C] -- C:\Users\eugenia\AppData\Roaming\Malwarebytes
[2013/01/05 20:34:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013/01/05 20:28:33 | 000,000,000 | ---D | C] -- C:\Users\eugenia\AppData\Roaming\LavasoftStatistics
[2013/01/05 20:13:05 | 000,000,000 | ---D | C] -- C:\Users\eugenia\AppData\Local\Downloaded Installations
[2013/01/05 20:13:00 | 000,013,560 | ---- | C] (GFI Software) -- C:\windows\System32\drivers\gfibto.sys
[2013/01/05 20:12:33 | 008,939,896 | ---- | C] (SurfRight B.V.) -- C:\Users\eugenia\Documents\hitman-pro.exe
[2013/01/05 20:12:22 | 010,523,968 | ---- | C] (Malwarebytes Corporation                                    ) -- C:\Users\eugenia\Documents\mbam-setup.exe
[2013/01/05 20:11:00 | 000,000,000 | ---D | C] -- C:\ProgramData\blekko toolbars
[2013/01/05 20:10:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Ad-Aware Browsing Protection
[2013/01/05 20:10:55 | 000,000,000 | ---D | C] -- C:\Program Files\adawaretb
[2013/01/05 20:10:54 | 000,000,000 | ---D | C] -- C:\Program Files\Toolbar Cleaner
[2013/01/05 20:10:15 | 006,133,368 | ---- | C] (Lavasoft Limited) -- C:\Users\eugenia\Documents\Adaware_Installer.exe
[2013/01/05 20:04:32 | 000,000,000 | ---D | C] -- C:\Users\eugenia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\SpyHunter
[2013/01/05 20:04:32 | 000,000,000 | ---D | C] -- C:\sh4ldr
[2013/01/05 19:56:42 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group
[2013/01/05 19:56:42 | 000,000,000 | ---D | C] -- C:\Users\eugenia\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
[2013/01/05 19:56:20 | 002,617,648 | ---- | C] (VS Revo Group Ltd.) -- C:\Users\eugenia\Documents\revosetup.exe
[2013/01/05 19:51:17 | 000,000,000 | ---D | C] -- C:\Program Files\Enigma Software Group
[2013/01/05 19:26:20 | 000,202,280 | ---- | C] (PC Tools) -- C:\windows\System32\drivers\PCTSD.sys
[2013/01/05 19:26:19 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\PC Tools
[2013/01/05 19:25:40 | 000,000,000 | ---D | C] -- C:\Users\eugenia\AppData\Roaming\TestApp
[2013/01/05 19:25:40 | 000,000,000 | ---D | C] -- C:\ProgramData\PC Tools
[2013/01/05 19:25:31 | 004,125,360 | ---- | C] (PC Tools) -- C:\Users\eugenia\Documents\PCTools_Safe_Install_SDAV.exe
[2013/01/05 19:25:31 | 000,726,464 | ---- | C] (Enigma Software Group USA, LLC.) -- C:\Users\eugenia\Documents\SpyHunter-Installer.exe
[2013/01/05 19:16:35 | 000,000,000 | ---D | C] -- C:\ProgramData\684ED493C7AAAC060000684E6C4CB35E
[2013/01/05 03:56:46 | 000,000,000 | ---D | C] -- C:\Users\eugenia\Desktop\MAGDY 18
[2013/01/04 20:05:02 | 000,000,000 | ---D | C] -- C:\Users\eugenia\Desktop\Popek-Monster-PL-2013
[2 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
 
[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]
 
[2013/01/31 20:56:08 | 000,014,736 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/01/31 20:56:08 | 000,014,736 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/01/31 20:53:40 | 000,737,480 | ---- | M] () -- C:\windows\System32\perfh015.dat
[2013/01/31 20:53:40 | 000,651,648 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2013/01/31 20:53:40 | 000,154,136 | ---- | M] () -- C:\windows\System32\perfc015.dat
[2013/01/31 20:53:40 | 000,120,580 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2013/01/31 20:48:53 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2013/01/31 20:48:47 | 1579,634,688 | -HS- | M] () -- C:\hiberfil.sys
[2013/01/31 20:32:26 | 000,002,973 | ---- | M] () -- C:\Users\eugenia\Desktop\HiJackThis.lnk
[2013/01/31 20:19:11 | 000,013,560 | ---- | M] (GFI Software) -- C:\windows\System32\drivers\gfibto.sys
[2013/01/31 20:08:31 | 000,809,111 | ---- | M] () -- C:\Users\eugenia\AppData\Roaming\java_u.jar
[2013/01/31 20:07:16 | 001,335,014 | ---- | M] () -- C:\Users\eugenia\AppData\Roaming\sqlite.jar
[2013/01/30 21:02:17 | 000,069,247 | ---- | M] () -- C:\Users\eugenia\Desktop\TR_DETAILS_20130130205830.pdf
[2013/01/17 11:17:29 | 000,753,622 | ---- | M] () -- C:\Users\eugenia\Documents\tibiacast_3_0_64.zip
[2013/01/15 01:00:00 | 000,000,368 | ---- | M] () -- C:\windows\tasks\McDefragTask.job
[2013/01/09 23:56:26 | 000,004,130 | ---- | M] () -- C:\Users\eugenia\Documents\The Hobbit 2012 DVDSCR Xvid READNFO AC3 5.1-REVOLUTIONRG.avi.torrent
[2013/01/05 22:00:54 | 008,939,896 | ---- | M] (SurfRight B.V.) -- C:\Users\eugenia\Documents\hitman-pro.exe
[2013/01/05 20:12:44 | 010,523,968 | ---- | M] (Malwarebytes Corporation                                    ) -- C:\Users\eugenia\Documents\mbam-setup.exe
[2013/01/05 20:12:33 | 001,422,336 | ---- | M] () -- C:\Users\eugenia\Documents\rogue-killer.exe
[2013/01/05 20:10:22 | 006,133,368 | ---- | M] (Lavasoft Limited) -- C:\Users\eugenia\Documents\Adaware_Installer.exe
[2013/01/05 20:03:48 | 015,397,208 | ---- | M] () -- C:\Users\eugenia\Documents\SpyHunter 4.1.11.0 [ENG] [Crack].exe
[2013/01/05 19:56:31 | 002,617,648 | ---- | M] (VS Revo Group Ltd.) -- C:\Users\eugenia\Documents\revosetup.exe
[2013/01/05 19:50:18 | 000,496,232 | ---- | M] () -- C:\Users\eugenia\Documents\Revo-Uninstaller(12741).exe
[2013/01/05 19:27:11 | 001,141,176 | ---- | M] () -- C:\windows\System32\drivers\Cat.DB
[2013/01/05 19:21:06 | 000,726,464 | ---- | M] (Enigma Software Group USA, LLC.) -- C:\Users\eugenia\Documents\SpyHunter-Installer.exe
[2013/01/05 19:20:58 | 004,125,360 | ---- | M] (PC Tools) -- C:\Users\eugenia\Documents\PCTools_Safe_Install_SDAV.exe
[2013/01/03 22:51:40 | 008,470,325 | ---- | M] () -- C:\Users\eugenia\Desktop\Hi-Fi - Bujaj Się Tak! .mp3
[2013/01/02 06:15:19 | 010,645,543 | ---- | M] () -- C:\Users\eugenia\Desktop\Anastasia Petrik (8-years old) Philip Kirkorov singing Snow (English lyrics).mp3
[2 C:\windows\*.tmp files -> C:\windows\*.tmp -> ]
 
[color=#E56717]========== Files Created - No Company Name ==========[/color]
 
[2013/01/31 20:32:26 | 000,002,973 | ---- | C] () -- C:\Users\eugenia\Desktop\HiJackThis.lnk
[2013/01/31 20:07:09 | 001,335,014 | ---- | C] () -- C:\Users\eugenia\AppData\Roaming\sqlite.jar
[2013/01/31 20:07:07 | 000,809,111 | ---- | C] () -- C:\Users\eugenia\AppData\Roaming\java_u.jar
[2013/01/30 21:02:17 | 000,069,247 | ---- | C] () -- C:\Users\eugenia\Desktop\TR_DETAILS_20130130205830.pdf
[2013/01/17 11:17:29 | 000,753,622 | ---- | C] () -- C:\Users\eugenia\Documents\tibiacast_3_0_64.zip
[2013/01/11 04:04:11 | 004,995,062 | ---- | C] () -- C:\Users\eugenia\Desktop\shakira - loca .mp3
[2013/01/09 23:56:25 | 000,004,130 | ---- | C] () -- C:\Users\eugenia\Documents\The Hobbit 2012 DVDSCR Xvid READNFO AC3 5.1-REVOLUTIONRG.avi.torrent
[2013/01/05 20:12:28 | 001,422,336 | ---- | C] () -- C:\Users\eugenia\Documents\rogue-killer.exe
[2013/01/05 20:02:58 | 015,397,208 | ---- | C] () -- C:\Users\eugenia\Documents\SpyHunter 4.1.11.0 [ENG] [Crack].exe
[2013/01/05 19:50:12 | 000,496,232 | ---- | C] () -- C:\Users\eugenia\Documents\Revo-Uninstaller(12741).exe
[2013/01/05 19:26:25 | 001,141,176 | ---- | C] () -- C:\windows\System32\drivers\Cat.DB
[2013/01/03 22:48:45 | 008,470,325 | ---- | C] () -- C:\Users\eugenia\Desktop\Hi-Fi - Bujaj Się Tak! .mp3
[2013/01/02 06:15:08 | 010,645,543 | ---- | C] () -- C:\Users\eugenia\Desktop\Anastasia Petrik (8-years old) Philip Kirkorov singing Snow (English lyrics).mp3
[2012/12/31 19:23:46 | 000,000,095 | ---- | C] () -- C:\windows\winamp.ini
[2012/11/20 14:58:43 | 000,003,584 | ---- | C] () -- C:\Users\eugenia\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012/08/31 05:00:38 | 000,175,616 | ---- | C] () -- C:\windows\System32\unrar.dll
[2012/08/31 05:00:36 | 000,650,752 | ---- | C] () -- C:\windows\System32\xvidcore.dll
[2012/08/31 05:00:36 | 000,243,200 | ---- | C] () -- C:\windows\System32\xvidvfw.dll
[2012/08/31 05:00:36 | 000,079,360 | ---- | C] () -- C:\windows\System32\ff_vfw.dll
[2012/08/30 22:38:42 | 000,000,262 | ---- | C] () -- C:\windows\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
[2010/07/17 22:06:48 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe
 
[color=#E56717]========== ZeroAccess Check ==========[/color]
 
[2009/07/14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012/06/09 05:46:56 | 012,868,608 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009/07/14 02:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009/07/14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[color=#E56717]========== Files - Unicode (All) ==========[/color]
[2012/11/20 02:51:27 | 009,652,906 | ---- | M] ()(C:\Users\eugenia\Desktop\Svetlana Roerich - Hands ???????? ????? - ??????? (lyrics translation).mp3) -- C:\Users\eugenia\Desktop\Svetlana Roerich - Hands Светлана Рерих - Ладошки (lyrics translation).mp3
[2012/11/20 02:50:53 | 009,652,906 | ---- | C] ()(C:\Users\eugenia\Desktop\Svetlana Roerich - Hands ???????? ????? - ??????? (lyrics translation).mp3) -- C:\Users\eugenia\Desktop\Svetlana Roerich - Hands Светлана Рерих - Ладошки (lyrics translation).mp3
 
[color=#E56717]========== Alternate Data Streams ==========[/color]
 
@Alternate Data Stream - 127 bytes -> C:\ProgramData\Temp:430C6D84
@Alternate Data Stream - 105 bytes -> C:\ProgramData\Temp:DFC5A2B2

< End of report >
 
Ostatnia edycja:
HeadShotDeluxe

HeadShotDeluxe

Użytkownik
Dołączył
Grudzień 17, 2012
Posty
86
Kod: 
[Oracle Java] "C:\windows\system32\[U]javaw.exe[/U]" -jar "C:\Users\eugenia\AppData\Roaming\[U]java_u.jar[/U]"
Te pliki są bardzo podejrzane. Jak się da to wywal te pliki ręcznie. Więcej znajdziesz TU.
Dla bezpieczeństwa pozmieniaj sobie hasła na stronach www.
 
You must log in or register to reply here.
Do góry Bottom