Jak wykryć keyloggera?

lukki78 · 5 Października 2012

Witam.Mam pytanie jak zobaczyć czy ma się keyloggera??Tylko nie dawać mi jakiś programów ,bo dużo z nich nie wykrywają keyloggera. Jest jakiś pewny sposób na jego znalezienie.Chyba wydaje mi się ,że przez cmd się da się jakoś szukać tylko za pomniałem jak...??Wydaje mi się,że go nie mam ,ale lepiej być pewnym.Formata nie chce mi się na razie.

ernest011 · 5 Października 2012

Start >>> Uruchom >>> Wpisujemy cmd >>> Wyświetli się okno wpisujesz w nim >>> netstat -ano

Gdy w tabeli "Stan" jest napisane: "Nasłuchiwanie", a w tabeli "Obcy Adres" 0.0.0.0.0, nie mamy się czego obawiać, nikt nas nie podsłuchuje, nasz komputer jest bezpieczny.

Jednak gdy w tabeli znajduje się jakieś IP, np. "55.292.1.72" oznacza to, że nasz komputer ma podsłuch, lecz łatwo można usunąć intruza .

Fr3shMak3r · 5 Października 2012

Za pomocą OTL ?

Chociaż ty se w tym nie poradzisz bo to program tworzący log.

Do tego trzeba osoby która się na tym zna.

Pobierasz stąd :

http://www.dobreprogramy.pl/OTL,Program,Windows,19450.html

Zaznaczasz wszystko na użyj filtrowania i zaznacz jeszcze infekcja PURITY i LOP.

I klik na skanuj.

I przesyłasz owe logi w załączniku.

lukki78 · 5 Października 2012

Ernest011. zrobiłem ss'y z cmd według tego mam keyloggera???

http://zapodaj.net/5...f9d103.bmp.html

http://zapodaj.net/2...dcbf29.bmp.html

edit;

jeszcze spróbuje zrobić z otl skan dam log zaraz.

Logi otll.

Przepraszam ,że nie są w załączniku ,bo nie wiem jak dać je.

OTL logfile created on: 2012-10-05 15:09:03 - Run 1

OTL by OldTimer - Version 3.2.70.2 Folder = C:\Documents and Settings\Rafał\Moje dokumenty\Pobieranie

Windows XP Home Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation

Internet Explorer (Version = 8.0.6001.18702)

Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

2,00 Gb Total Physical Memory | 1,34 Gb Available Physical Memory | 67,14% Memory free

3,85 Gb Paging File | 3,36 Gb Available in Paging File | 87,39% Paging File free

Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files

Drive C: | 48,83 Gb Total Space | 16,03 Gb Free Space | 32,82% Space Free | Partition Type: NTFS

Drive D: | 195,31 Gb Total Space | 170,67 Gb Free Space | 87,38% Space Free | Partition Type: NTFS

Drive E: | 221,62 Gb Total Space | 161,69 Gb Free Space | 72,96% Space Free | Partition Type: NTFS

Computer Name: RAFA-754A9F5580 | User Name: Rafał | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2012-10-05 15:07:44 | 000,601,088 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Rafał\Moje dokumenty\Pobieranie\OTL.exe

PRC - [2012-09-07 16:54:25 | 000,917,984 | ---- | M] (Mozilla Corporation) -- C:\Program Files\Mozilla Firefox\firefox.exe

PRC - [2012-05-04 19:29:46 | 000,161,664 | ---- | M] (Oracle Corporation) -- C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe

PRC - [2011-05-05 14:45:16 | 000,537,184 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\open-fm.exe

PRC - [2009-07-08 11:01:54 | 005,782,528 | ---- | M] () -- C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe

PRC - [2008-04-15 14:00:00 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe

PRC - [2006-07-07 14:36:08 | 000,839,680 | ---- | M] () -- C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

PRC - [2005-12-06 13:53:30 | 000,819,200 | ---- | M] (France Télécom R&D) -- C:\Program Files\neostrada tp\neostradatp.exe

PRC - [2005-11-22 11:54:18 | 000,249,856 | ---- | M] (France Télécom R&D) -- C:\Program Files\neostrada tp\ComComp.exe

PRC - [2004-11-02 14:31:20 | 000,069,632 | ---- | M] (France Telecom R&D) -- C:\Program Files\neostrada tp\Toaster.exe

PRC - [2004-10-27 10:30:44 | 000,032,768 | ---- | M] () -- C:\Program Files\neostrada tp\Inactivity.exe

PRC - [2004-10-27 10:07:06 | 000,069,632 | ---- | M] () -- C:\Program Files\neostrada tp\PollingModule.exe

PRC - [2004-10-21 07:50:52 | 000,045,056 | ---- | M] () -- C:\WINDOWS\system32\AlertModule\AlertModule.exe

PRC - [2004-10-05 16:00:12 | 000,061,440 | ---- | M] (France Télécom R&D) -- C:\Program Files\neostrada tp\TaskBarIcon.exe

PRC - [2004-08-23 13:49:56 | 000,040,960 | ---- | M] (France Telecom) -- C:\WINDOWS\system32\FTRTSVC.exe

PRC - [2004-08-23 13:49:56 | 000,020,480 | ---- | M] (France Télécom R&D) -- C:\Program Files\neostrada tp\Watch.exe

========== Modules (No Company Name) ==========

MOD - [2012-09-07 16:54:25 | 002,244,064 | ---- | M] () -- C:\Program Files\Mozilla Firefox\mozjs.dll

MOD - [2012-06-15 20:37:23 | 006,271,136 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll

MOD - [2011-05-05 14:45:36 | 000,152,160 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\ggzip.dll

MOD - [2011-05-05 14:45:34 | 000,270,944 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\ggwebkit.dll

MOD - [2011-05-05 14:45:32 | 000,111,200 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\ggradiocore.dll

MOD - [2011-05-05 14:45:30 | 000,111,200 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\ggradio.dll

MOD - [2011-05-05 14:45:28 | 000,217,696 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\gglog.dll

MOD - [2011-05-05 14:45:26 | 000,127,584 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\ggipcimproxy.dll

MOD - [2011-05-05 14:45:24 | 000,017,504 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\ggipc.dll

MOD - [2011-05-05 14:45:22 | 000,086,624 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\gghttp.dll

MOD - [2011-05-05 14:45:22 | 000,027,744 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\ggcrypto.dll

MOD - [2011-05-05 14:45:18 | 000,356,960 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\ggcommon.dll

MOD - [2011-05-05 14:45:16 | 002,302,560 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\ggaac.dll

MOD - [2011-05-05 14:45:16 | 000,537,184 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\open-fm.exe

MOD - [2011-04-16 05:04:30 | 014,749,696 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\QtWebKit4.dll

MOD - [2011-04-06 00:07:14 | 000,335,872 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\gstplugins\libgstdirectsound.dll

MOD - [2011-04-06 00:07:14 | 000,069,632 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\gstplugins\libgstaacdec.dll

MOD - [2011-04-06 00:07:14 | 000,045,056 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\gstplugins\libgstneon.dll

MOD - [2011-04-06 00:07:14 | 000,032,256 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\gstplugins\libgstwavparse.dll

MOD - [2011-04-06 00:07:14 | 000,014,336 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\gstplugins\libgsticydemux.dll

MOD - [2011-02-17 11:00:28 | 000,327,680 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\QtSvg4.dll

MOD - [2011-02-17 11:00:26 | 001,044,480 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\QtNetwork4.dll

MOD - [2011-02-17 11:00:24 | 009,097,216 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\QtGui4.dll

MOD - [2011-02-17 11:00:24 | 002,560,000 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\QtCore4.dll

MOD - [2011-02-17 10:59:40 | 000,946,688 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\libxml2.dll

MOD - [2011-02-17 10:59:40 | 000,438,272 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\libgstreamer-0.10.dll

MOD - [2011-02-17 10:59:40 | 000,311,296 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\imageformats\qtiff4.dll

MOD - [2011-02-17 10:59:40 | 000,274,432 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\imageformats\qmng4.dll

MOD - [2011-02-17 10:59:40 | 000,155,648 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\libgstbase-0.10.dll

MOD - [2011-02-17 10:59:40 | 000,143,360 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\imageformats\qjpeg4.dll

MOD - [2011-02-17 10:59:40 | 000,081,920 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\libgstaudio-0.10.dll

MOD - [2011-02-17 10:59:40 | 000,049,152 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\libgsttag-0.10.dll

MOD - [2011-02-17 10:59:40 | 000,036,864 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\libgstriff-0.10.dll

MOD - [2011-02-17 10:59:40 | 000,036,864 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\libgstinterfaces-0.10.dll

MOD - [2011-02-17 10:59:40 | 000,033,098 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\iconv.dll

MOD - [2011-02-17 10:59:40 | 000,027,648 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\imageformats\qgif4.dll

MOD - [2011-02-17 10:59:40 | 000,018,944 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\imageformats\qsvg4.dll

MOD - [2011-02-17 10:59:38 | 000,159,744 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\gstplugins\libgstcoreelements.dll

MOD - [2011-02-17 10:59:38 | 000,049,152 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\gstplugins\libgsttypefindfunctions.dll

MOD - [2011-02-17 10:59:38 | 000,024,576 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\gstplugins\libgstaudiorate.dll

MOD - [2011-02-17 10:59:32 | 000,059,904 | ---- | M] () -- C:\Program Files\Gadu-Gadu 10\zlib1.dll

MOD - [2009-07-08 11:01:54 | 005,782,528 | ---- | M] () -- C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe

MOD - [2009-03-25 16:53:14 | 000,053,248 | ---- | M] () -- C:\Program Files\ASUS\EPU-4 Engine\AsSpindownTimeout.dll

MOD - [2009-02-27 19:04:20 | 000,311,296 | ---- | M] () -- C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\pdfshell.POL

MOD - [2009-01-15 14:55:10 | 000,565,248 | ---- | M] () -- C:\Program Files\ASUS\EPU-4 Engine\pngio.dll

MOD - [2008-01-10 14:17:30 | 000,022,723 | ---- | M] () -- C:\WINDOWS\system32\ssp2ml3.dll

MOD - [2006-07-07 14:36:08 | 000,839,680 | ---- | M] () -- C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

MOD - [2006-06-08 12:44:02 | 000,094,208 | ---- | M] () -- C:\Program Files\SAGEM\SAGEM F@st 800-840\Languages\polish.dll

MOD - [2006-05-22 13:29:28 | 001,802,240 | ---- | M] () -- c:\Program Files\neostrada tp\skin\Default\main\ResourceStyle.dll

MOD - [2006-01-10 10:50:20 | 000,024,576 | R--- | M] () -- C:\WINDOWS\system32\AsIO.dll

MOD - [2004-11-16 17:10:52 | 000,053,248 | ---- | M] () -- C:\Program Files\neostrada tp\SynchroDll.dll

MOD - [2004-10-27 10:30:44 | 000,032,768 | ---- | M] () -- C:\Program Files\neostrada tp\Inactivity.exe

MOD - [2004-10-27 10:07:06 | 000,069,632 | ---- | M] () -- C:\Program Files\neostrada tp\PollingModule.exe

MOD - [2004-10-26 08:49:34 | 000,028,672 | ---- | M] () -- C:\Program Files\neostrada tp\Inactivity.dll

MOD - [2004-10-21 17:27:38 | 000,036,864 | ---- | M] () -- C:\WINDOWS\system32\AlertModule\AlertClient.dll

MOD - [2004-10-21 07:50:52 | 000,045,056 | ---- | M] () -- C:\WINDOWS\system32\AlertModule\AlertModule.exe

MOD - [2004-08-23 13:49:58 | 000,188,416 | ---- | M] () -- C:\Program Files\neostrada tp\PhoneManager.dll

MOD - [2004-08-23 13:49:56 | 000,036,864 | ---- | M] () -- C:\Program Files\neostrada tp\PMStub.dll

MOD - [2004-04-19 07:28:06 | 000,090,112 | ---- | M] () -- C:\Program Files\neostrada tp\DetectComponent.dll

========== Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)

SRV - File not found [On_Demand | Stopped] -- %SystemRoot%\System32\appmgmts.dll -- (AppMgmt)

SRV - [2012-05-04 19:29:46 | 000,161,664 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jqs.exe -- (JavaQuickStarterService)

SRV - [2004-08-23 13:49:56 | 000,040,960 | ---- | M] (France Telecom) [Auto | Running] -- C:\WINDOWS\system32\FTRTSVC.exe -- (FTRTSVC)

========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)

DRV - File not found [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\Drivers\SSPORT.sys -- (SSPORT)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)

DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\PCAMPR5.SYS -- (PCAMPR5)

DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)

DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)

DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\EagleNT.sys -- (EagleNT)

DRV - File not found [Kernel | System | Stopped] -- -- (Changer)

DRV - [2009-08-12 00:19:20 | 000,056,992 | R--- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\nvhda32.sys -- (NVHDA)

DRV - [2009-07-10 05:03:04 | 001,381,632 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\viahduaa.sys -- (VIAHdAudAddService)

DRV - [2009-05-25 09:21:28 | 000,142,336 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)

DRV - [2008-01-10 03:34:57 | 000,041,984 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Running] -- C:\WINDOWS\system32\drivers\DGIVECP.SYS -- (DgiVecp)

DRV - [2007-12-17 11:14:06 | 000,012,400 | R--- | M] () [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AsIO.sys -- (AsIO)

DRV - [2007-04-16 16:46:34 | 000,033,792 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdPPM.sys -- (AmdPPM)

DRV - [2006-11-08 21:19:18 | 000,004,544 | ---- | M] (SweetLow) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\hidusbf.sys -- (hidusbf)

DRV - [2006-09-19 11:03:28 | 000,116,992 | ---- | M] (Analog Devices Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\e4usbaw.sys -- (e4usbaw)

DRV - [2006-09-15 11:07:54 | 000,064,000 | ---- | M] (Analog Deivces) [Kernel | Auto | Stopped] -- C:\WINDOWS\system32\drivers\e4ldr.sys -- (IKANLOADER2)

DRV - [2004-08-13 04:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)

DRV - [2003-08-04 13:22:44 | 000,016,128 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\PCANDIS5.SYS -- (PCANDIS5)

========== Standard Registry (SafeList) ==========

========== Internet Explorer ==========

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.babylon.com/?babsrc=HP_Prot

IE - HKCU\..\URLSearchHook: {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\Program Files\neostrada tp\SearchPageURL.dll ()

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"

FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"

FF - prefs.js..browser.startup.homepage: "http://www.google.pl/"

FF - prefs.js..keyword.URL: "http://search.babylon.com/?affID=111434&tt=010712_5&babsrc=KW_ss&mntrId=c4dce4b8000000000000002618e47aac&q="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012-09-07 16:54:25 | 000,000,000 | ---D | M]

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2012-06-15 20:50:11 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Extensions

[2012-08-26 14:26:53 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Rafał\Dane aplikacji\Mozilla\Firefox\Profiles\wsslb65b.default\extensions

[2012-09-07 16:54:20 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions

[2012-09-07 16:54:25 | 000,266,720 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll

[2012-08-31 08:57:53 | 000,002,767 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml

[2012-07-07 15:51:59 | 000,002,351 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\babylon.xml

[2012-08-31 08:57:53 | 000,001,406 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml

[2012-08-31 08:57:53 | 000,000,917 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml

[2012-08-31 08:57:53 | 000,000,858 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml

[2012-08-31 08:57:53 | 000,001,183 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml

[2012-08-31 08:57:53 | 000,001,683 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml

O1 HOSTS File: ([2008-04-15 14:00:00 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts

O1 - Hosts: 127.0.0.1 localhost

O2 - BHO: (Java Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (Java Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)

O4 - HKLM..\Run: [adiras] adiras.exe File not found

O4 - HKLM..\Run: [Aeria Ignite] C:\Program Files\Aeria Games\Ignite\aeriaignite.exe (Aeria Games & Entertainment)

O4 - HKLM..\Run: [autoclk] autoclk.exe File not found

O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\NvMcTray.dll (NVIDIA Corporation)

O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nView\nwiz.exe ()

O4 - HKLM..\Run: [six Engine] C:\Program Files\ASUS\EPU-4 Engine\FourEngine.exe ()

O4 - HKLM..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\GestMaj.exe TaskBarIcon.exe File not found

O4 - HKLM..\Run: [WOOWATCH] C:\Program Files\neostrada tp\Watch.exe (France Télécom R&D)

O4 - Startup: C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe ()

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 0

O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 95 00 00 00 [binary data]

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} http://windowsupdate.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1343676115156 (WUWebControl Class)

O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/products/plugin/autodl/jinstall-1_4_0_03-win.cab (Java Plug-in 1.4.0_03)

O16 - DPF: {CAFEEFAC-0014-0000-0003-ABCDEFFEDCBA} http://java.sun.com/products/plugin/autodl/jinstall-1_4_0_03-win.cab (Java Plug-in 1.4.0_03)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1FD349D5-5A77-4854-8D29-B6354EF8448A}: NameServer = 194.204.159.1 194.204.152.34

O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)

O24 - Desktop Components:0 (Moja bieżąca strona główna) - about:Home

O24 - Desktop WallPaper: C:\WINDOWS\Web\Wallpaper\Idylla.bmp

O24 - Desktop BackupWallPaper: C:\WINDOWS\Web\Wallpaper\Idylla.bmp

O32 - HKLM CDRom: AutoRun - 1

O32 - AutoRun File - [2012-06-15 20:31:34 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]

O32 - AutoRun File - [2012-01-17 15:59:32 | 000,000,208 | ---- | M] () - E:\auto group elf bot.doc -- [ NTFS ]

O34 - HKLM BootExecute: (autocheck autochk *)

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2012-10-04 20:53:09 | 000,000,000 | ---D | C] -- C:\WINDOWS\ie8updates

[2012-10-04 16:25:49 | 000,630,272 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeeds.dll

[2012-10-04 16:25:48 | 002,000,384 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iertutil.dll

[2012-10-04 16:25:48 | 000,521,728 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\jsdbgui.dll

[2012-10-04 16:25:48 | 000,055,296 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\msfeedsbs.dll

[2012-10-04 16:25:47 | 000,743,424 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\iedvtool.dll

[2012-10-04 07:21:20 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\Rafał\IETldCache

[2012-10-04 01:06:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\WBEM

[2012-10-04 01:05:51 | 000,000,000 | -H-D | C] -- C:\WINDOWS\ie8

[2012-10-04 00:57:38 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2012-10-04 00:49:27 | 000,000,000 | ---D | C] -- C:\Program Files\MSXML 4.0

[2012-10-03 23:32:22 | 000,273,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthport.sys

[2012-10-03 23:27:43 | 000,456,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mrxsmb.sys

[2012-10-03 23:09:17 | 000,293,376 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\browserchoice.exe

[2012-10-03 22:51:40 | 002,193,920 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntoskrnl.exe

[2012-10-03 22:51:40 | 002,149,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlmp.exe

[2012-10-03 22:51:40 | 002,070,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlpa.exe

[2012-10-03 22:51:40 | 002,028,032 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrpamp.exe

[2012-10-03 21:15:05 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\PreInstall

[2012-10-03 21:15:03 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$hf_mig$

[2012-10-03 18:39:23 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\SoftwareDistribution

[2012-10-03 15:46:44 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Rafał\Recent

[2012-09-25 17:59:39 | 000,000,000 | ---D | C] -- C:\Program Files\Counter-Strike

[2012-09-21 19:05:25 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Rafał\Pulpit\savegame1

[2012-09-21 16:02:42 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Rafał\Dane aplikacji\FS2011 Fruit-importer

[2012-09-12 18:46:58 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\AeriaGames

[2012-09-12 18:46:58 | 000,000,000 | ---D | C] -- C:\Program Files\Aeria Games

[2012-09-09 14:27:53 | 000,148,992 | ---- | C] (OtLand) -- C:\Documents and Settings\Rafał\Pulpit\OtLand IP Changer.exe

[2012-09-09 14:21:44 | 000,000,000 | ---D | C] -- C:\Program Files\9.6

[2012-09-09 13:46:10 | 000,000,000 | ---D | C] -- C:\Program Files\Tibia 9.6

[2012-09-09 13:45:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Rafał\Ustawienia lokalne\Dane aplikacji\OtLand

[2012-09-08 17:52:39 | 000,000,000 | ---D | C] -- C:\Program Files\VirtualMT2

[2012-09-08 15:40:56 | 000,000,000 | ---D | C] -- C:\Program Files\Metin2

[2012-09-08 14:54:43 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Rafał\Pulpit\sssss

[2012-09-08 11:16:15 | 000,000,000 | ---D | C] -- C:\Program Files\XenoXMT2client_11.02.2012r_by_Pawemol

[2012-09-07 16:54:20 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012-10-05 15:04:40 | 000,001,503 | ---- | M] () -- C:\Documents and Settings\Rafał\Pulpit\Paint.lnk

[2012-10-05 15:04:29 | 003,686,454 | ---- | M] () -- C:\Documents and Settings\Rafał\Pulpit\keyyu.bmp

[2012-10-05 15:03:58 | 003,686,454 | ---- | M] () -- C:\Documents and Settings\Rafał\Pulpit\key.bmp

[2012-10-05 14:45:42 | 000,000,223 | RHS- | M] () -- C:\boot.ini

[2012-10-05 14:41:57 | 000,000,256 | ---- | M] () -- C:\Documents and Settings\Rafał\Pulpit\gammacfg.ini

[2012-10-05 14:19:00 | 000,000,930 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job

[2012-10-05 12:43:41 | 000,248,830 | ---- | M] () -- C:\WINDOWS\System32\NvApps.xml

[2012-10-05 12:43:37 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat

[2012-10-04 20:53:32 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK

[2012-10-04 07:21:13 | 000,096,664 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2012-10-04 01:04:17 | 000,490,614 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat

[2012-10-04 01:04:17 | 000,432,492 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat

[2012-10-04 01:04:17 | 000,083,864 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat

[2012-10-04 01:04:17 | 000,067,448 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat

[2012-09-29 11:54:42 | 001,719,126 | ---- | M] () -- C:\Documents and Settings\Rafał\Pulpit\Screny.rar

[2012-09-26 17:22:54 | 004,443,225 | ---- | M] () -- C:\Documents and Settings\Rafał\Pulpit\ss.rar

[2012-09-25 18:00:43 | 000,001,616 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Counter-Strike.lnk

[2012-09-25 17:59:19 | 000,001,590 | ---- | M] () -- C:\Documents and Settings\Rafał\Pulpit\userconfig.cfg

[2012-09-25 17:49:16 | 000,001,514 | ---- | M] () -- C:\Documents and Settings\Rafał\cfgmaker.properties

[2012-09-21 14:36:47 | 000,013,646 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl

[2012-09-17 18:39:32 | 000,000,784 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Malwarebytes Anti-Malware.lnk

[2012-09-14 16:14:34 | 000,000,754 | ---- | M] () -- C:\WINDOWS\WORDPAD.INI

[2012-09-12 18:46:58 | 000,001,753 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Aeria Ignite.lnk

[2012-09-09 18:31:32 | 000,011,710 | ---- | M] () -- C:\Documents and Settings\Rafał\Pulpit\modDesc.xml

[2012-09-09 14:27:32 | 000,000,706 | ---- | M] () -- C:\Documents and Settings\Rafał\Pulpit\9.6.lnk

[2012-09-09 14:27:14 | 000,001,649 | ---- | M] () -- C:\Documents and Settings\Rafał\Pulpit\Tibia Auto.lnk

[2012-09-09 13:44:16 | 000,148,992 | ---- | M] (OtLand) -- C:\Documents and Settings\Rafał\Pulpit\OtLand IP Changer.exe

[2012-09-08 17:54:02 | 000,000,781 | ---- | M] () -- C:\Documents and Settings\Rafał\Pulpit\Skrót do VirtualMT2 (bez patchera).lnk

[2012-09-08 15:42:21 | 000,000,654 | ---- | M] () -- C:\Documents and Settings\All Users\Pulpit\Metin2.lnk

[2012-09-08 15:26:14 | 002,859,854 | ---- | M] () -- C:\Documents and Settings\Rafał\Pulpit\bb.bmp

[2012-09-07 17:04:46 | 000,022,856 | ---- | M] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys

[3 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012-10-05 15:04:29 | 003,686,454 | ---- | C] () -- C:\Documents and Settings\Rafał\Pulpit\keyyu.bmp

[2012-10-05 15:03:57 | 003,686,454 | ---- | C] () -- C:\Documents and Settings\Rafał\Pulpit\key.bmp

[2012-10-04 07:27:20 | 000,062,304 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat

[2012-10-03 22:50:52 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\iacenc.dll

[2012-10-03 22:50:52 | 000,003,072 | ---- | C] () -- C:\WINDOWS\System32\dllcache\iacenc.dll

[2012-10-03 21:15:06 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK

[2012-09-29 11:54:35 | 001,719,126 | ---- | C] () -- C:\Documents and Settings\Rafał\Pulpit\Screny.rar

[2012-09-26 16:22:51 | 004,443,225 | ---- | C] () -- C:\Documents and Settings\Rafał\Pulpit\ss.rar

[2012-09-25 18:00:43 | 000,001,616 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Counter-Strike.lnk

[2012-09-25 17:49:01 | 000,001,514 | ---- | C] () -- C:\Documents and Settings\Rafał\cfgmaker.properties

[2012-09-24 20:01:18 | 000,011,710 | ---- | C] () -- C:\Documents and Settings\Rafał\Pulpit\modDesc.xml

[2012-09-12 18:46:58 | 000,001,753 | ---- | C] () -- C:\Documents and Settings\All Users\Pulpit\Aeria Ignite.lnk

[2012-09-09 14:27:32 | 000,000,706 | ---- | C] () -- C:\Documents and Settings\Rafał\Pulpit\9.6.lnk

[2012-09-08 17:54:02 | 000,000,781 | ---- | C] () -- C:\Documents and Settings\Rafał\Pulpit\Skrót do VirtualMT2 (bez patchera).lnk

[2012-09-08 15:26:14 | 002,859,854 | ---- | C] () -- C:\Documents and Settings\Rafał\Pulpit\bb.bmp

[2012-07-22 16:24:58 | 000,000,168 | ---- | C] () -- C:\WINDOWS\adidsl.ini

[2012-07-22 16:24:58 | 000,000,021 | ---- | C] () -- C:\WINDOWS\Fast800.ini

[2012-07-22 16:24:54 | 000,127,456 | ---- | C] () -- C:\WINDOWS\System32\IPDETECT.EXE

[2012-07-22 16:24:53 | 000,152,220 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4I2.BIN

[2012-07-22 16:24:53 | 000,152,220 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4I1.BIN

[2012-07-22 16:24:53 | 000,152,220 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4I0.BIN

[2012-07-22 16:24:53 | 000,152,132 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4P2.BIN

[2012-07-22 16:24:53 | 000,152,132 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4P1.BIN

[2012-07-22 16:24:53 | 000,152,132 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4P0.BIN

[2012-07-22 16:24:53 | 000,152,126 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E9P2.BIN

[2012-07-22 16:24:53 | 000,152,126 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E9P1.BIN

[2012-07-22 16:24:53 | 000,152,126 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E9P0.BIN

[2012-07-22 16:24:53 | 000,152,126 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E9I2.BIN

[2012-07-22 16:24:53 | 000,152,126 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E9I1.BIN

[2012-07-22 16:24:53 | 000,152,126 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E9I0.BIN

[2012-07-22 16:24:53 | 000,152,036 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4D2.BIN

[2012-07-22 16:24:53 | 000,152,034 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4D1.BIN

[2012-07-22 16:24:53 | 000,152,034 | ---- | C] () -- C:\WINDOWS\System32\drivers\L1E4D0.BIN

[2012-07-22 16:24:53 | 000,126,976 | ---- | C] () -- C:\WINDOWS\System32\coclassfast.dll

[2012-07-22 16:24:53 | 000,046,892 | ---- | C] () -- C:\WINDOWS\System32\ADADIX16.DLL

[2012-07-22 16:24:53 | 000,024,576 | ---- | C] () -- C:\WINDOWS\enddisk32.exe

[2012-07-22 16:24:53 | 000,022,395 | ---- | C] () -- C:\WINDOWS\System32\drivers\fpga.bin

[2012-07-22 16:15:32 | 000,000,046 | ---- | C] () -- C:\WINDOWS\adiras.ini

[2012-06-28 12:51:36 | 000,024,497 | ---- | C] () -- C:\Documents and Settings\Rafał\s

[2012-06-28 12:50:09 | 000,479,232 | ---- | C] () -- C:\WINDOWS\ssndii.exe

[2012-06-28 12:49:42 | 000,022,723 | ---- | C] () -- C:\WINDOWS\System32\ssp2ml3.dll

[2012-06-21 13:30:20 | 1230,953,171 | ---- | C] () -- C:\Program Files\VirtualMT2.rar

[2012-06-21 11:41:33 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI

[2012-06-15 22:24:19 | 000,004,293 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI

[2012-06-15 22:23:21 | 000,096,664 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT

[2012-06-15 20:58:25 | 001,867,776 | ---- | C] () -- C:\WINDOWS\System32\python24.dll

[2012-06-15 20:50:09 | 000,000,000 | ---- | C] () -- C:\WINDOWS\nsreg.dat

[2012-06-15 20:45:15 | 000,041,068 | ---- | C] () -- C:\WINDOWS\System32\ActPanel.dll

[2012-06-15 20:38:39 | 000,073,728 | R--- | C] () -- C:\WINDOWS\System32\RtNicProp32.dll

[2012-06-15 20:38:09 | 000,024,576 | R--- | C] () -- C:\WINDOWS\System32\AsIO.dll

[2012-06-15 20:38:09 | 000,012,400 | R--- | C] () -- C:\WINDOWS\System32\drivers\AsIO.sys

[2012-06-15 20:38:08 | 000,011,832 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp64.sys

[2012-06-15 20:38:08 | 000,010,216 | ---- | C] () -- C:\WINDOWS\System32\drivers\AsInsHelp32.sys

[2012-06-15 20:36:34 | 000,038,075 | ---- | C] () -- C:\WINDOWS\Ascd_log.ini

[2012-06-15 20:35:43 | 000,005,810 | R--- | C] () -- C:\WINDOWS\System32\drivers\ASACPI.sys

[2012-06-15 20:35:36 | 000,001,746 | ---- | C] () -- C:\WINDOWS\Language_trs.ini

[2012-06-15 20:35:30 | 000,030,605 | ---- | C] () -- C:\WINDOWS\Ascd_tmp.ini

[2012-06-15 20:35:29 | 000,010,296 | ---- | C] () -- C:\WINDOWS\System32\drivers\ASUSHWIO.SYS

[2012-06-15 20:32:48 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat

[2012-06-15 20:29:28 | 000,021,856 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

========== ZeroAccess Check ==========

[2012-06-24 08:06:40 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shdocvw.dll -- [2012-08-30 22:33:28 | 001,510,400 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009-02-09 12:53:44 | 000,473,600 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008-04-15 14:00:00 | 000,273,920 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

========== LOP Check ==========

[2012-09-03 17:31:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\036E1BA60054DF95F7D797A181CB3F95

[2012-07-07 15:51:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Babylon

[2012-06-15 20:38:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Gadu-Gadu 10

[2012-10-04 13:17:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\OpenFM

[2012-10-05 11:55:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\TEMP

[2012-09-07 15:39:48 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rafał\Dane aplikacji\.minecraft

[2012-08-03 11:15:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rafał\Dane aplikacji\Aeria Games & Entertainment

[2012-07-07 15:51:51 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rafał\Dane aplikacji\Babylon

[2012-09-21 16:02:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rafał\Dane aplikacji\FS2011 Fruit-importer

[2012-06-15 20:40:37 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rafał\Dane aplikacji\Gadu-Gadu 10

[2012-09-03 18:02:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rafał\Dane aplikacji\Ifonov

[2012-06-15 21:08:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rafał\Dane aplikacji\OpenFM

[2012-06-15 23:46:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rafał\Dane aplikacji\Oracle

[2012-09-03 17:27:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rafał\Dane aplikacji\Quig

[2012-09-29 14:24:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rafał\Dane aplikacji\Tibia

[2012-09-03 18:53:09 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Rafał\Dane aplikacji\Ycwi

========== Purity Check ==========

========== Alternate Data Streams ==========

@Alternate Data Stream - 231 bytes -> C:\Documents and Settings\All Users\Dane aplikacji\TEMP:6BE50C2B

< End of report >

OTL Extras logfile created on: 2012-10-05 15:09:03 - Run 1