logi - Wirus 239.exe i inne losowe numery

Mam kłopot z wirusem, który wkradł się na mój komputer. Tworzy on pliki w folderze TEMP (C:\Users\Acer\APPDATA\LOCAL\TEMP) o nazwach składających się z losowych numerów jak 512.exe, 784.exe, 789.exe etc.
Zainstalowałem Kasperskiego, który powykrywał w niektórych plikach systemu i programów trojana Win32.FakeAV w różnych odmianach.
Aktualnie alerty ucichły za wyjątkiem jednego, mianowicie otrzymuję komunikat, że plik explorer.exe wykonuje podejrzaną czynność: "PDM.Private data and passwords access".
Nie wiem czy wystarczy podmienić mi ten plik na systemowy z płyty Windows, dlatego wrzucam też logi z OTL mam nadzieję, że coś wynajdziecie jeszcze co może otwierać drzwi dla wirusów na moim komputerze:

OTL log:

OTL logfile created on: 2012-02-07 13:44:16 - Run 2
OTL by OldTimer - Version 3.2.31.0	 Folder = F:\pobieranie
Professional  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000415 | Country: Polsko | Language: PLK | Date Format: yyyy-MM-dd

2,93 Gb Total Physical Memory | 1,23 Gb Available Physical Memory | 42,07% Memory free
2,93 Gb Paging File | 1,19 Gb Available in Paging File | 40,62% Paging File free
Paging file location(s):  [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 119,97 Gb Total Space | 78,15 Gb Free Space | 65,14% Space Free | Partition Type: NTFS
Drive F: | 103,51 Gb Total Space | 13,95 Gb Free Space | 13,48% Space Free | Partition Type: NTFS

Computer Name: ACER-PC | User Name: Acer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

[color=#E56717]========== Processes (SafeList) ==========[/color]

PRC - [2012-02-03 13:09:39 | 000,584,192 | ---- | M] (OldTimer Tools) -- F:\pobieranie\OTL.exe
PRC - [2012-01-03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012-01-02 01:58:57 | 000,924,632 | ---- | M] (Mozilla Corporation) -- F:\Program Files\Mozilla Firefox\firefox.exe
PRC - [2011-08-07 19:46:44 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2011-04-24 23:15:02 | 000,202,296 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe
PRC - [2010-11-07 14:18:22 | 000,068,608 | ---- | M] (http://sf.net/projects/noautorun/) -- F:\pobieranie\NoAutorun-win32-bin-1.1.2.25\NoAutorun.exe
PRC - [2010-11-01 03:30:40 | 000,816,224 | ---- | M] ( ) -- F:\Program Files\Miranda IM\miranda32.exe
PRC - [2010-05-25 18:53:46 | 002,139,400 | ---- | M] () -- C:\Program Files\Acronis\DiskDirector\OSS\reinstall_svc.exe
PRC - [2009-07-14 02:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009-07-09 15:23:58 | 000,707,104 | ---- | M] (Acer Incorporated) -- C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
PRC - [2009-07-09 15:23:56 | 000,707,104 | ---- | M] (Acer Incorporated) -- C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
PRC - [2009-07-09 15:23:56 | 000,453,152 | ---- | M] (Acer Incorporated) -- C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe
PRC - [2009-05-13 11:22:06 | 003,355,648 | ---- | M] (Egis Technology Inc.) -- C:\Program Files\Acer Bio Protection\CompPtcVUI.exe


[color=#E56717]========== Modules (No Company Name) ==========[/color]

MOD - [2012-01-18 13:27:53 | 008,527,008 | ---- | M] () -- C:\Windows\System32\Macromed\Flash\NPSWF32.dll
MOD - [2012-01-02 01:58:57 | 002,124,760 | ---- | M] () -- F:\Program Files\Mozilla Firefox\mozjs.dll
MOD - [2011-04-24 23:13:30 | 007,008,656 | ---- | M] () -- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\qtgui4.dll
MOD - [2011-04-24 23:13:28 | 000,192,912 | ---- | M] () -- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\qtsql4.dll
MOD - [2011-04-24 23:13:26 | 001,270,160 | ---- | M] () -- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\qtscript4.dll
MOD - [2011-04-24 23:13:26 | 000,758,160 | ---- | M] () -- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\qtnetwork4.dll
MOD - [2011-04-24 23:13:24 | 002,118,032 | ---- | M] () -- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\qtcore4.dll
MOD - [2011-04-24 23:13:24 | 002,089,360 | ---- | M] () -- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\qtdeclarative4.dll
MOD - [2011-04-20 19:56:28 | 000,025,088 | ---- | M] () -- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\imageformats\qgif4.dll
MOD - [2010-11-15 23:49:58 | 000,110,592 | ---- | M] () -- F:\Program Files\Miranda IM\Plugins\Variables.dll
MOD - [2010-11-15 23:49:54 | 000,028,672 | ---- | M] () -- F:\Program Files\Miranda IM\Plugins\extendedIdle.dll
MOD - [2010-11-15 23:38:30 | 000,157,696 | ---- | M] () -- F:\Program Files\Miranda IM\Plugins\versioninfo.dll
MOD - [2010-11-15 23:38:28 | 000,159,744 | ---- | M] () -- F:\Program Files\Miranda IM\ssleay32.dll
MOD - [2010-11-15 23:38:26 | 000,839,680 | ---- | M] () -- F:\Program Files\Miranda IM\libeay32.dll
MOD - [2010-11-01 03:30:16 | 000,054,372 | ---- | M] () -- F:\Program Files\Miranda IM\zlib.dll
MOD - [2010-11-01 03:30:02 | 000,335,978 | ---- | M] () -- F:\Program Files\Miranda IM\Plugins\ICQ.dll
MOD - [2010-11-01 03:29:50 | 000,036,973 | ---- | M] () -- F:\Program Files\Miranda IM\Plugins\dbx_mmap.dll
MOD - [2010-11-01 03:29:40 | 000,061,550 | ---- | M] () -- F:\Program Files\Miranda IM\Plugins\clist_classic.dll
MOD - [2010-11-01 03:29:36 | 000,245,860 | ---- | M] () -- F:\Program Files\Miranda IM\Plugins\chat.dll
MOD - [2010-11-01 03:29:22 | 000,199,273 | ---- | M] () -- F:\Program Files\Miranda IM\Plugins\Aim.dll
MOD - [2010-11-01 03:29:06 | 000,377,445 | ---- | M] () -- F:\Program Files\Miranda IM\Plugins\IRC.dll
MOD - [2010-07-04 22:32:38 | 000,010,752 | ---- | M] () -- C:\Program Files\Unlocker\UnlockerCOM.dll
MOD - [2010-03-07 18:03:38 | 000,240,128 | ---- | M] () -- C:\Program Files\Copy Handler\chext.dll
MOD - [2009-01-04 12:16:16 | 000,045,568 | ---- | M] () -- C:\Windows\System32\chckshll.dll


[color=#E56717]========== Win32 Services (SafeList) ==========[/color]

SRV - File not found [On_Demand | Stopped] --  -- (WPFFontCache_v0400)
SRV - File not found [Unknown | Stopped] --  -- (WatAdminSvc)
SRV - [2012-01-03 14:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011-04-24 23:15:02 | 000,202,296 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe -- (AVP)
SRV - [2010-05-25 18:53:46 | 002,139,400 | ---- | M] () [Auto | Running] -- C:\Program Files\Acronis\DiskDirector\OSS\reinstall_svc.exe -- (OS Selector)
SRV - [2009-07-14 02:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009-07-14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009-07-14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009-07-14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009-07-09 15:23:56 | 000,707,104 | ---- | M] (Acer Incorporated) [Auto | Running] -- C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe -- (ePowerSvc)
SRV - [2009-05-13 11:22:16 | 003,445,248 | ---- | M] (Egis Technology Inc.) [Disabled | Stopped] -- C:\Program Files\Acer Bio Protection\BASVC.exe -- (IGBASVC)
SRV - [2009-05-05 08:10:32 | 000,117,256 | ---- | M] (Dritek System Inc.) [Disabled | Stopped] -- C:\Program Files\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2009-04-13 11:21:26 | 000,578,848 | ---- | M] (Broadcom Corporation.) [Disabled | Stopped] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2009-04-11 18:32:00 | 000,061,184 | ---- | M] (NewTech Infosystems, Inc.) [Disabled | Stopped] -- C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2009-02-11 16:38:40 | 000,354,840 | ---- | M] (Intel Corporation) [Disabled | Stopped] -- C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe -- (IAANTMON) Intel(R)
SRV - [2009-02-05 07:14:56 | 000,237,568 | ---- | M] (Acer Incorporated) [Disabled | Stopped] -- C:\Program Files\Acer\Acer VCM\RS_Service.exe -- (RS_Service)
SRV - [2007-06-05 13:20:32 | 000,177,704 | ---- | M] () [Disabled | Stopped] -- C:\Windows\System32\PSIService.exe -- (ProtexisLicensing)
SRV - [2007-01-04 19:48:50 | 000,112,152 | ---- | M] (InterVideo) [Disabled | Stopped] -- C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe -- (IviRegMgr)


[color=#E56717]========== Driver Services (SafeList) ==========[/color]

DRV - [2012-02-02 14:05:08 | 000,570,160 | ---- | M] (Kaspersky Lab) [File_System | System | Running] -- C:\Windows\System32\drivers\klif.sys -- (KLIF)
DRV - [2011-09-28 04:33:00 | 000,170,080 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\snapman.sys -- (snapman)
DRV - [2011-07-29 12:54:56 | 000,014,216 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\epmntdrv.sys -- (epmntdrv)
DRV - [2011-07-29 12:54:56 | 000,008,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\EuGdiDrv.sys -- (EuGdiDrv)
DRV - [2011-05-22 21:12:51 | 000,218,688 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\System32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2011-05-18 09:12:38 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerfltj.sys -- (UsbserFilt)
DRV - [2011-05-18 09:12:36 | 000,008,192 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usbser_lowerflt.sys -- (upperdev)
DRV - [2011-05-18 09:12:32 | 000,023,168 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmbo.sys -- (nmwcdc)
DRV - [2011-05-18 09:12:28 | 000,018,176 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ccdcmb.sys -- (nmwcd)
DRV - [2011-03-10 18:36:18 | 000,023,856 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\System32\drivers\klim6.sys -- (KLIM6)
DRV - [2011-03-04 13:23:20 | 000,011,352 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\System32\drivers\kl2.sys -- (kl2)
DRV - [2011-03-04 13:23:14 | 000,133,208 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\kl1.sys -- (KL1)
DRV - [2010-08-25 09:41:36 | 000,263,272 | ---- | M] (Realtek										    ) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Rtlh86.sys -- (RTL8169)
DRV - [2009-11-02 20:27:16 | 000,019,984 | ---- | M] (Kaspersky Lab) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\klmouflt.sys -- (klmouflt)
DRV - [2009-07-14 02:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vmbus.sys -- (vmbus)
DRV - [2009-07-14 02:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vmstorfl.sys -- (storflt)
DRV - [2009-07-14 02:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\storvsc.sys -- (storvsc)
DRV - [2009-07-14 00:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\vms3cap.sys -- (s3cap)
DRV - [2009-07-14 00:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\DRIVERS\VMBusHID.sys -- (VMBusHID)
DRV - [2009-07-13 23:02:51 | 004,231,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netw5v32.sys -- (netw5v32) Sterownik karty Intel(R)
DRV - [2009-06-01 07:51:54 | 000,030,088 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\point32k.sys -- (Point32)
DRV - [2009-01-17 22:37:50 | 000,028,208 | ---- | M] (Egistec) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\FPSensor.sys -- (FPSensor) EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys)
DRV - [2008-12-04 19:25:38 | 000,112,640 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\IntcHdmi.sys -- (IntcHdmiAddService) Intel(R)
DRV - [2008-10-01 04:50:50 | 000,010,504 | ---- | M] (Dritek System Inc.) [Kernel | System | Running] -- C:\Program Files\GridVista\DPMemGridVista.sys -- (DPMemGridVista)
DRV - [2008-03-12 12:52:34 | 000,069,632 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\int15.sys -- (int15)
DRV - [2007-07-15 02:37:04 | 000,027,992 | ---- | M] (EnTech Taiwan) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\pstrip.sys -- (PStrip)
DRV - [2007-04-17 20:09:28 | 000,011,032 | ---- | M] (InterVideo) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\regi.sys -- (regi)


[color=#E56717]========== Standard Registry (SafeList) ==========[/color]


[color=#E56717]========== Internet Explorer ==========[/color]

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0415&s=2&o=vz32&d=0109&m=travelmate_8371
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0415&s=2&o=vz32&d=0109&m=travelmate_8371

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://homepage.acer.com/rdr.aspx?b=ACAW&l=0415&s=2&o=vz32&d=0109&m=travelmate_8371
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = http://global.acer.com [binary data]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://www.google.com/ie
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ig?hl=pl
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

[color=#E56717]========== FireFox ==========[/color]

FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.10
FF - prefs.js..extensions.enabledItems: {8061ddcf-3632-4287-8d8a-133e219ae838}:0.9.7
FF - prefs.js..extensions.enabledItems: {317B5128-0B0B-49b2-B2DB-1E7560E16C74}:2.7.8beta
FF - prefs.js..extensions.enabledItems: {A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}:7.3.4.76

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/GoogleTalkPlugin: C:\Users\Acer\AppData\Roaming\Mozilla\plugins\npgoogletalk.dll (Google)
FF - HKCU\Software\MozillaPlugins\@talk.google.com/O3DPlugin: C:\Users\Acer\AppData\Roaming\Mozilla\plugins\npgtpo3dautoplugin.dll ()
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Acer\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Acer\AppData\Local\Google\Update\1.3.21.99\npGoogleUpdate3.dll (Google Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{A27F3FEF-1113-4cfb-A032-8E12D7D8EE70}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Bookmarks Connector\FirefoxExtension\ [2011-08-07 16:59:03 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\linkfilter@kaspersky.ru: C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\FFExt\linkfilter@kaspersky.ru [2012-02-03 13:19:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtualKeyboard@kaspersky.ru: C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\FFExt\virtualKeyboard@kaspersky.ru [2012-02-03 13:19:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: F:\Program Files\Mozilla Firefox\components [2012-01-02 01:58:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: F:\Program Files\Mozilla Firefox\plugins [2012-01-13 18:44:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 11.0\extensions\\Components: F:\Program Files\Mozilla Thunderbird\components [2012-01-13 11:46:08 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 11.0\extensions\\Plugins: F:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Thunderbird\Extensions\\{CCB7D94B-CA92-4E3F-B79D-ADE0F07ADC74}: C:\Program Files\Nokia\Nokia Ovi Suite\Connectors\Thunderbird Connector\ThunderbirdExtension\ [2011-08-07 16:59:03 | 000,000,000 | ---D | M]

[2011-04-29 22:13:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Acer\AppData\Roaming\mozilla\Extensions
[2011-02-21 12:00:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Acer\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012-01-02 11:29:33 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Acer\AppData\Roaming\mozilla\Firefox\Profiles\0tporthj.sss\extensions
[2011-04-29 22:13:58 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Acer\AppData\Roaming\mozilla\Firefox\Profiles\0tporthj.sss\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2012-01-02 11:29:31 | 000,000,000 | ---D | M] (SeoQuake) -- C:\Users\Acer\AppData\Roaming\mozilla\Firefox\Profiles\0tporthj.sss\extensions\{317B5128-0B0B-49b2-B2DB-1E7560E16C74}
[2012-01-28 03:31:56 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Acer\AppData\Roaming\mozilla\Firefox\Profiles\x4tpeede.xxx\extensions
[2012-01-15 03:18:30 | 000,000,000 | ---D | M] (DownloadHelper) -- C:\Users\Acer\AppData\Roaming\mozilla\Firefox\Profiles\x4tpeede.xxx\extensions\{b9db16a4-6edc-47ec-a1f4-b86292ed211d}
[2012-01-31 01:03:55 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Acer\AppData\Roaming\mozilla\Firefox\Profiles\zxju681a.default\extensions
[2012-01-31 01:03:55 | 000,000,000 | ---D | M] (SeoQuake) -- C:\Users\Acer\AppData\Roaming\mozilla\Firefox\Profiles\zxju681a.default\extensions\{317B5128-0B0B-49b2-B2DB-1E7560E16C74}
[2011-04-29 22:14:03 | 000,000,000 | ---D | M] (Live PageRank) -- C:\Users\Acer\AppData\Roaming\mozilla\Firefox\Profiles\zxju681a.default\extensions\{8061ddcf-3632-4287-8d8a-133e219ae838}
() (No name found) -- C:\USERS\ACER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZXJU681A.DEFAULT\EXTENSIONS\{B17C1C5A-04B1-11DB-9804-B622A1EF5492}.XPI
() (No name found) -- C:\USERS\ACER\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ZXJU681A.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI

O1 HOSTS File: ([2006-09-18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1	   localhost
O1 - Hosts: ::1			 localhost
O2 - BHO: (IEVkbdBHO Class) - {59273AB4-E7D3-40F9-A1A8-6FA9CCA1862C} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\ievkbd.dll (Kaspersky Lab ZAO)
O2 - BHO: (IplexToALLPlayer) - {DF925EF3-7A87-44E4-9CAF-8D7B280BF616} - f:\Program Files\ALLPlayer\Iplex\IplexToALLPlayer.dll (ALLCinema Ltd.)
O2 - BHO: (FilterBHO Class) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\klwtbbho.dll (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [Acer ePower Management] C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe (Acer Incorporated)
O4 - HKLM..\Run: [AVP] C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [Copy Handler]  File not found
O4 - HKCU..\Run: []  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 28
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SynchronousMachineGroupPolicy = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SynchronousUserGroupPolicy = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 124
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSMBalloonTip = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: TaskbarNoNotification = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\SearchExtensions: InternetExtensionName = Google Search
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\SearchExtensions: InternetExtensionAction = http://www.google.com/search?q=%w
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - F:\Program Files\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Odeslat obrázek do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Odeslat stránku do zařízení &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O8 - Extra context menu item: WikiKomentáře Google... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found
O8 - Extra context menu item: Wyślij obraz do urządzenia &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Wyślij stronę do urządzenia &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer Bio Protection\PwdBank.exe (Egis Technology Inc.)
O9 - Extra 'Tools' menuitem : Quick-Launch Area - {10954C80-4F0F-11d3-B17C-00C0DFE39736} - C:\Program Files\Acer Bio Protection\PwdBank.exe (Egis Technology Inc.)
O9 - Extra Button: &Virtual Keyboard - {4248FE82-7FCB-46AC-B270-339F08212110} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\ievkbd.dll (Kaspersky Lab ZAO)
O9 - Extra Button: @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra 'Tools' menuitem : @C:\Program Files\WIDCOMM\Bluetooth Software\btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O9 - Extra Button: URLs c&heck - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2012\klwtbbho.dll (Kaspersky Lab ZAO)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 62.21.99.95
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{09841D92-FC9C-45AE-AA72-01E59B88F3C9}: DhcpNameServer = 62.21.99.95
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{49BF3050-D226-490B-823D-55DB5FC5A834}: DhcpNameServer = 62.21.99.95
O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - Winlogon\Notify\klogon: DllName - (C:\Windows\system32\klogon.dll) - C:\Windows\System32\klogon.dll (Kaspersky Lab ZAO)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O24 - Desktop WallPaper:
O24 - Desktop BackupWallPaper:
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009-06-10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{9965a6a3-3da6-11e0-a669-001e331eead3}\Shell - "" = AutoRun
O33 - MountPoints2\{9965a6a3-3da6-11e0-a669-001e331eead3}\Shell\AutoRun\command - "" = D:\SETUP.EXE
O33 - MountPoints2\{9965a6a3-3da6-11e0-a669-001e331eead3}\Shell\configure\command - "" = D:\SETUP.EXE
O33 - MountPoints2\{9965a6a3-3da6-11e0-a669-001e331eead3}\Shell\install\command - "" = D:\SETUP.EXE
O34 - HKLM BootExecute: (autocheck autochk /p \??\G:)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

[color=#E56717]========== Files/Folders - Created Within 30 Days ==========[/color]

[2012-02-03 15:09:15 | 000,000,000 | ---D | C] -- C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VertrigoServ
[2012-02-02 14:08:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Kaspersky Anti-Virus 2012
[2012-02-02 14:05:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Kaspersky Lab
[2012-02-02 14:05:53 | 000,000,000 | ---D | C] -- C:\Program Files\Kaspersky Lab
[2012-02-02 14:05:08 | 000,570,160 | ---- | C] (Kaspersky Lab) -- C:\Windows\System32\drivers\klif.sys
[2012-01-27 16:21:07 | 000,000,000 | ---D | C] -- C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Disk Checker
[2012-01-27 16:21:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Disk Checker
[2012-01-27 16:21:06 | 000,000,000 | ---D | C] -- C:\Program Files\Disk Checker
[2012-01-26 01:22:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Spybot - Search & Destroy
[2012-01-19 19:40:12 | 000,000,000 | ---D | C] -- C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker
[2012-01-19 19:40:12 | 000,000,000 | ---D | C] -- C:\Program Files\Unlocker
[2012-01-19 13:02:20 | 000,000,000 | ---D | C] -- C:\Users\Acer\Doctor Web
[2012-01-19 13:00:18 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Doctor Web
[2012-01-19 12:59:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Doctor Web
[2012-01-19 12:59:18 | 000,000,000 | ---D | C] -- C:\Users\Acer\AppData\Local\Downloaded Installations
[2012-01-19 00:31:00 | 000,000,000 | ---D | C] -- F:\documents\do cytania
[2012-01-15 12:28:08 | 000,000,000 | ---D | C] -- C:\Users\Acer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Wad2ISO
[2012-01-15 12:27:07 | 000,000,000 | ---D | C] -- C:\Program Files\Wad2ISO
[2012-01-15 03:21:42 | 000,000,000 | ---D | C] -- C:\Users\Acer\dwhelper
[2012-01-13 18:17:08 | 000,000,000 | ---D | C] -- C:\!Downloads
[2010-08-25 18:59:08 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2009-06-18 14:59:53 | 000,049,152 | ---- | C] ( ) -- C:\Windows\Interop.IWshRuntimeLibrary.dll
[3 F:\documents\*.tmp files -> F:\documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

[color=#E56717]========== Files - Modified Within 30 Days ==========[/color]

[2012-02-07 13:15:01 | 000,001,054 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4173016670-1870260594-642626157-1003UA.job
[2012-02-07 13:15:01 | 000,001,002 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-4173016670-1870260594-642626157-1003Core.job
[2012-02-07 12:33:23 | 000,011,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012-02-07 12:33:23 | 000,011,248 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012-02-07 12:28:59 | 000,710,380 | ---- | M] () -- C:\Windows\System32\perfh015.dat
[2012-02-07 12:28:59 | 000,616,008 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012-02-07 12:28:59 | 000,139,230 | ---- | M] () -- C:\Windows\System32\perfc015.dat
[2012-02-07 12:28:59 | 000,106,388 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012-02-07 12:24:35 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012-02-07 12:24:30 | 2361,532,416 | -HS- | M] () -- C:\hiberfil.sys
[2012-02-04 13:58:33 | 000,000,023 | ---- | M] () -- C:\Users\Acer\AppData\Roaming\C76AC7.dat
[2012-02-03 15:09:16 | 000,000,792 | ---- | M] () -- C:\Users\Acer\Desktop\VertrigoServ.lnk
[2012-02-03 13:19:25 | 000,115,369 | ---- | M] () -- C:\Windows\System32\drivers\klin.dat
[2012-02-03 13:19:24 | 000,097,961 | ---- | M] () -- C:\Windows\System32\drivers\klick.dat
[2012-02-03 12:36:48 | 000,000,498 | ---- | M] () -- C:\Windows\tasks\One-Click Tweak.job
[2012-02-02 14:11:41 | 000,017,408 | ---- | M] () -- C:\Users\Acer\AppData\Local\WebpageIcons.db
[2012-02-02 14:05:08 | 000,570,160 | ---- | M] (Kaspersky Lab) -- C:\Windows\System32\drivers\klif.sys
[2012-01-26 04:17:31 | 000,007,634 | ---- | M] () -- C:\Users\Acer\AppData\Local\Resmon.ResmonCfg
[2012-01-18 13:27:53 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012-01-17 13:57:32 | 004,567,696 | ---- | M] () -- F:\documents\Przewodnik po konsoli WII.pdf
[2012-01-17 01:51:16 | 000,886,208 | ---- | M] () -- F:\documents\500 punktów za darmo do wykorzystania w sklepie WII.pdf
[2012-01-15 03:50:12 | 000,018,944 | ---- | M] () -- C:\Users\Acer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012-01-13 16:04:13 | 000,047,322 | ---- | M] () -- F:\documents\linki do kiedy.rtf
[2012-01-13 11:46:09 | 000,000,909 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk
[3 F:\documents\*.tmp files -> F:\documents\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]

[color=#E56717]========== Files Created - No Company Name ==========[/color]

[2012-02-03 13:15:33 | 000,000,023 | ---- | C] () -- C:\Users\Acer\AppData\Roaming\C76AC7.dat
[2012-02-02 14:11:40 | 000,017,408 | ---- | C] () -- C:\Users\Acer\AppData\Local\WebpageIcons.db
[2012-02-02 14:08:47 | 000,115,369 | ---- | C] () -- C:\Windows\System32\drivers\klin.dat
[2012-02-02 14:08:47 | 000,097,961 | ---- | C] () -- C:\Windows\System32\drivers\klick.dat
[2012-01-17 01:37:58 | 000,886,208 | ---- | C] () -- F:\documents\500 punktów za darmo do wykorzystania w sklepie WII.pdf
[2011-10-25 03:30:48 | 000,008,146 | ---- | C] () -- C:\Users\Acer\AppData\Roaming\PStrip.bk!
[2011-10-25 03:30:46 | 000,008,018 | ---- | C] () -- C:\Users\Acer\AppData\Roaming\PStrip.bko
[2011-10-16 04:19:36 | 000,008,123 | ---- | C] () -- C:\Users\Acer\AppData\Roaming\PStrip.bak
[2011-10-16 04:09:00 | 000,008,214 | ---- | C] () -- C:\Users\Acer\AppData\Roaming\PStrip.ini
[2011-09-28 08:41:19 | 002,469,760 | ---- | C] () -- C:\Windows\System32\BootMan.exe
[2011-09-28 08:41:19 | 000,086,408 | ---- | C] () -- C:\Windows\System32\setupempdrv03.exe
[2011-09-28 08:41:19 | 000,019,840 | ---- | C] () -- C:\Windows\System32\EuEpmGdi.dll
[2011-09-28 08:41:19 | 000,014,216 | ---- | C] () -- C:\Windows\System32\epmntdrv.sys
[2011-09-28 08:41:19 | 000,008,456 | ---- | C] () -- C:\Windows\System32\EuGdiDrv.sys
[2011-09-05 06:21:51 | 000,007,788 | ---- | C] () -- C:\Windows\Cerberus.ini
[2011-07-05 14:07:49 | 000,014,740 | ---- | C] () -- C:\Windows\MSTMON_N.INI
[2011-07-05 14:07:49 | 000,011,521 | ---- | C] () -- C:\Windows\MSUMLT_N.INI
[2011-05-16 14:21:09 | 000,000,193 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2011-05-02 23:43:15 | 000,007,634 | ---- | C] () -- C:\Users\Acer\AppData\Local\Resmon.ResmonCfg
[2011-05-02 22:34:03 | 000,018,944 | ---- | C] () -- C:\Users\Acer\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011-04-29 22:30:27 | 000,021,560 | ---- | C] () -- C:\Windows\System32\emptyregdb.dat
[2011-04-26 13:27:56 | 000,093,505 | ---- | C] () -- C:\Windows\LookDisk Uninstaller.exe
[2011-03-26 15:26:12 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
[2011-03-11 12:43:54 | 000,029,763 | ---- | C] () -- C:\Windows\System32\drivers\klopp.dat
[2011-03-06 02:34:37 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2011-03-05 09:04:03 | 000,000,564 | ---- | C] () -- C:\Windows\WORDPAD.INI
[2011-02-24 20:48:10 | 000,810,496 | ---- | C] () -- C:\Windows\System32\xvidcore.dll
[2011-02-24 20:48:10 | 000,258,048 | ---- | C] () -- C:\Windows\System32\libFLAC.dll
[2011-02-21 12:09:52 | 000,002,828 | -HS- | C] () -- C:\Windows\System32\KGyGaAvL.sys
[2011-02-21 12:09:52 | 000,000,088 | RHS- | C] () -- C:\Windows\System32\F37BA1F30F.sys
[2011-02-20 05:25:50 | 000,000,697 | ---- | C] () -- C:\Windows\wininit.ini
[2011-02-19 14:52:36 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2011-02-08 21:49:11 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat
[2010-08-25 19:30:02 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2010-08-25 19:30:00 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2010-08-25 19:30:00 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin
[2010-08-25 18:57:00 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2010-08-25 18:52:00 | 000,208,896 | ---- | C] () -- C:\Windows\System32\iglhsip32.dll
[2010-08-25 18:52:00 | 000,143,360 | ---- | C] () -- C:\Windows\System32\iglhcp32.dll
[2009-07-30 08:31:09 | 000,004,608 | ---- | C] () -- C:\Windows\System32\HdmiCoin.dll
[2009-07-30 08:31:08 | 000,134,544 | ---- | C] () -- C:\Windows\System32\igfcg500.bin
[2009-07-14 09:07:57 | 000,710,380 | ---- | C] () -- C:\Windows\System32\perfh015.dat
[2009-07-14 09:07:57 | 000,337,158 | ---- | C] () -- C:\Windows\System32\perfi015.dat
[2009-07-14 09:07:57 | 000,139,230 | ---- | C] () -- C:\Windows\System32\perfc015.dat
[2009-07-14 09:07:57 | 000,038,710 | ---- | C] () -- C:\Windows\System32\perfd015.dat
[2009-07-14 05:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2009-07-14 05:33:53 | 000,418,192 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2009-07-14 03:05:48 | 000,616,008 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2009-07-14 03:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2009-07-14 03:05:48 | 000,106,388 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2009-07-14 03:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2009-07-14 03:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2009-07-14 03:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2009-07-14 01:19:49 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2009-07-14 00:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2009-07-14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll
[2009-07-14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll
[2009-06-18 07:09:16 | 000,123,780 | ---- | C] () -- C:\Windows\System32\drivers\RtConvEQ.DAT
[2009-06-18 07:09:16 | 000,000,728 | ---- | C] () -- C:\Windows\System32\drivers\RtHdatEx.dat
[2009-06-18 07:09:16 | 000,000,712 | ---- | C] () -- C:\Windows\System32\drivers\SamSfPa.dat
[2009-06-18 07:09:16 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX2.dat
[2009-06-18 07:09:16 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX1.dat
[2009-06-18 07:09:16 | 000,000,520 | ---- | C] () -- C:\Windows\System32\drivers\RTEQEX0.dat
[2009-06-18 07:09:16 | 000,000,008 | ---- | C] () -- C:\Windows\System32\drivers\rtkhdaud.dat
[2009-06-10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2009-01-17 22:30:45 | 000,626,688 | ---- | C] () -- C:\Windows\Image.dll
[2009-01-17 22:30:45 | 000,200,704 | ---- | C] () -- C:\Windows\PLFSetI.exe
[2009-01-17 22:30:45 | 000,020,480 | ---- | C] () -- C:\Windows\USB_VIDEO_REG.exe
[2009-01-17 22:30:45 | 000,000,323 | ---- | C] () -- C:\Windows\PidList.ini
[2009-01-17 22:16:22 | 000,001,496 | ---- | C] () -- C:\Windows\System32\drivers\RtkAcerM.dat
[2009-01-04 12:16:16 | 000,045,568 | ---- | C] () -- C:\Windows\System32\chckshll.dll
[2008-09-11 13:01:00 | 000,081,920 | ---- | C] () -- C:\Windows\System32\INT15.dll
[2008-09-09 10:38:48 | 000,097,792 | ---- | C] () -- C:\Windows\System32\INT15_64.dll
[2008-09-09 10:38:48 | 000,015,656 | ---- | C] () -- C:\Windows\System32\drivers\int15_64.sys
[2008-05-21 19:46:08 | 000,118,784 | ---- | C] () -- C:\Windows\System32\VMC3KAPI.dll
[2008-03-12 12:52:34 | 000,069,632 | ---- | C] () -- C:\Windows\System32\drivers\int15.sys
[2008-01-21 07:01:57 | 000,594,340 | ---- | C] () -- C:\Windows\System32\perfh005.dat
[2008-01-21 07:01:57 | 000,286,912 | ---- | C] () -- C:\Windows\System32\perfi005.dat
[2008-01-21 07:01:57 | 000,116,960 | ---- | C] () -- C:\Windows\System32\perfc005.dat
[2008-01-21 07:01:57 | 000,034,724 | ---- | C] () -- C:\Windows\System32\perfd005.dat
[2007-06-05 13:20:32 | 000,177,704 | ---- | C] () -- C:\Windows\System32\PSIService.exe
[2005-05-25 21:06:26 | 000,119,296 | ---- | C] () -- C:\Windows\System32\WnASPI32.dll
< End of report >

Extras:

OTL Extras logfile created on: 2012-02-07 13:44:16 - Run 2
OTL by OldTimer - Version 3.2.31.0	 Folder = F:\pobieranie
Professional  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000415 | Country: Polsko | Language: PLK | Date Format: yyyy-MM-dd

2,93 Gb Total Physical Memory | 1,23 Gb Available Physical Memory | 42,07% Memory free
2,93 Gb Paging File | 1,19 Gb Available in Paging File | 40,62% Paging File free
Paging file location(s):  [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 119,97 Gb Total Space | 78,15 Gb Free Space | 65,14% Space Free | Partition Type: NTFS
Drive F: | 103,51 Gb Total Space | 13,95 Gb Free Space | 13,48% Space Free | Partition Type: NTFS

Computer Name: ACER-PC | User Name: Acer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

[color=#E56717]========== Extra Registry (SafeList) ==========[/color]


[color=#E56717]========== File Associations ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)

[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- F:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[color=#E56717]========== Shell Spawning ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- "F:\Program Files\Microsoft Office\Office12\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "F:\Program Files\Microsoft Office\Office12\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

[color=#E56717]========== Security Center Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0

[color=#E56717]========== Firewall Settings ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1

[color=#E56717]========== Authorized Applications List ==========[/color]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Sierra Wireless Inc\WebUpdater\SwiApiMux.exe" = C:\Program Files\Sierra Wireless Inc\WebUpdater\SwiApiMux.exe:*:Enabled:SwiApiMux


[color=#E56717]========== HKEY_LOCAL_MACHINE Uninstall List ==========[/color]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{047F790A-7A2A-4B6A-AD02-38092BA63DAC}" = Acer VCM
"{07D77970-B205-460C-84E4-263F30455597}" = Nokia Ovi Suite
"{12451AF7-EFF8-4B5B-8255-282D7CC7CAEE}" = OviMPlatform
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = InterVideo WinDVD 8
"{26A24AE4-039D-4CA4-87B4-2F83216026FF}" = Java(TM) 6 Update 26
"{2CC53A53-44F4-4667-8584-2FFC9ACB2242}" = Ovi Desktop Sync Engine
"{2D99A593-C841-43A7-B7C9-D6F3AE70B756}" = Nokia Connectivity Cable Driver
"{30075A70-B5D2-440B-AFA3-FB2021740121}" = Backup Manager Advance
"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3DB0448D-AD82-4923-B305-D001E521A964}" = Acer PowerSmart Manager
"{45E557D6-2271-4F13-8101-C620B4285AB0}" = Kaspersky Anti-Virus 2012
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{6D3245B1-8DB8-4A23-9CD2-2C90F40ABAF6}" = MSVC80_x86_v2
"{7760D94E-B1B5-40A0-9AA0-ABF942108755}" = Acer Crystal Eye Webcam
"{78D80EAF-1ADB-46A8-AF6F-EBB18B6ADBCE}" = ISO Creator 1.0
"{7F811A54-5A09-4579-90E1-C93498E230D9}" = Acer eRecovery Management
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{90120000-0015-0415-0000-0000000FF1CE}" = Microsoft Office Access MUI (Polish) 2007
"{90120000-0016-0415-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Polish) 2007
"{90120000-0018-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Polish) 2007
"{90120000-0019-0415-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Polish) 2007
"{90120000-001A-0415-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Polish) 2007
"{90120000-001B-0415-0000-0000000FF1CE}" = Microsoft Office Word MUI (Polish) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2007
"{90120000-002C-0415-0000-0000000FF1CE}" = Microsoft Office Proofing (Polish) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0415-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Polish) 2007
"{90120000-006E-0415-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Polish) 2007
"{90120000-00A1-0415-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Polish) 2007
"{90120000-00B2-0409-0000-0000000FF1CE}" = Microsoft Save as PDF or XPS Add-in for 2007 Microsoft Office programs
"{90120000-00BA-0415-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Polish) 2007
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{90A40405-6000-11D3-8CFE-0150048383C9}" = Microsoft Office 2003 Web Components
"{95120000-00AF-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (Polish)
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{96E3AED5-3D0B-4BB0-84C2-1EDADB204487}" = FlashFXP v4.0
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9CCC78EF-027E-40E0-9B61-39932C65E3FE}" = Acronis Disk Director Home
"{9CF6A157-F0E8-4216-B229-C0CA8204BE2C}_is1" = Copy Handler 1.32Final
"{9E9D49A4-1DF4-4138-B7DB-5D87A893088E}" = Software Bluetooth WIDCOMM
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC76BA86-7AD7-1033-7B44-AA1000000001}" = Adobe Reader X (10.1.2)
"{AF111648-99A1-453E-81DD-80DBBF6DAD0D}" = MSVC90_x86
"{B2D55EB8-32C5-4B43-9006-9E97DECBA178}" = Epson Easy Photo Print Plug-in for PMB(Picture Motion Browser)
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B440D659-FECA-4BDD-A12B-5C9F05790FF3}" = Snagit 9.1.2
"{CCF13D13-A87B-34E8-B689-1896D0C2DBA2}" = Google Talk Plugin
"{CEA4353C-9A9A-4221-8A3D-215B9378D283}" = Asterisks Password Viewer
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{E09664BB-BB08-45FA-87D1-33EAB0E017F5}" = Fingerprint Solution
"{EF71A531-5B6C-4B20-8D1E-E6379C7FB6D3}" = Microsoft IntelliPoint 7.0
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"3DBoxMaker_is1" = 3D Box Maker Professional
"3DProductBox_is1" = 3DProductBox 2010
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"ALLPlayer_is1" = ALLPlayer V4.X
"asterisk key" = Asterisk Key 10.0
"BFGC" = Big Fish Games: Game Manager
"BitTorrent" = BitTorrent
"Box Shot 3D" = Box Shot 3D
"Camfrog 6.0" = Camfrog Video Chat 6.0
"DAEMON Tools Lite" = DAEMON Tools Lite
"DC++" = DC++ 0.782
"Digital Image Recovery_is1" = Digital Image Recovery 1.47
"Disk Checker" = Disk Checker
"DzSoftPhpEditor_is1" = DzSoft PHP Editor 4.2.6
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 9.1.0 Home Edition
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EPSON Printer and Utilities" = EPSON Printer Software
"Escape Rosecliff Island 1.00" = Escape Rosecliff Island 1.00
"GridVista" = GridVista
"GzegzolkaXP_is1" = Gżegżółka XP 7.1.2.2
"HDMI" = Intel(R) Graphics Media Accelerator Driver
"InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = InterVideo WinDVD 8
"InstallShield_{30075A70-B5D2-440B-AFA3-FB2021740121}" = Acer Backup Manager
"InstallShield_{E09664BB-BB08-45FA-87D1-33EAB0E017F5}" = Acer Bio Protection
"InstallWIX_{45E557D6-2271-4F13-8101-C620B4285AB0}" = Kaspersky Anti-Virus 2012
"Internet Password Recovery Toolbox_is1" = Internet Password Recovery Toolbox 2.1
"<a href="http://www.download.net.pl/219/IrfanView/">IrfanView</a>" = <a href="http://www.download.net.pl/219/IrfanView/">IrfanView</a> (remove only)
"KONICA MINOLTA PagePro 1300W" = KONICA MINOLTA PagePro 1300W
"LManager" = Launch Manager
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 9.0.1 (x86 pl)" = Mozilla Firefox 9.0.1 (x86 pl)
"Mozilla Thunderbird 11.0 (x86 en-US)" = Mozilla Thunderbird 11.0 (x86 en-US)
"Nokia Ovi Suite" = Nokia Ovi Suite
"Notepad++" = Notepad++
"Opera 11.60.1185" = Opera 11.60
"PHP Generator for MySQL Professional_is1" = PHP Generator for MySQL Professional 11.4
"Picasa 3" = Picasa 3
"PowerStrip 3 (remove only)" = PowerStrip 3 (remove only)
"Quick 3D Cover_is1" = Quick 3D Cover 2.0.1
"ResourceHacker_is1" = Resource Hacker Version 3.6.0
"Restorator2007_is1" = Restorator 2007 Trial Update 2
"RSSOwl" = RSSOwl
"SkanerOnline" = Skaner on-line mks_vir
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Unlocker" = Unlocker 1.9.1
"VertrigoServ" = VertrigoServ (remove only)
"VLC media player" = VLC media player 1.1.7
"vLite_is1" = vLite
"Wad2ISO" = Wad2ISO
"Winamp" = Winamp
"WinHTTrack Website Copier_is1" = WinHTTrack Website Copier 3.44-1
"WinRAR archiver" = WinRAR archiver

[color=#E56717]========== HKEY_CURRENT_USER Uninstall List ==========[/color]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"WinSetupFromUSB" = WinSetupFromUSB

[color=#E56717]========== Last 10 Event Log Errors ==========[/color]

Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!

< End of report >

Zapewne może być trochę bałaganu, bo jest to Windows 7 po update z Visty, która w dodatku była czeską wersją

PRC - [2011-08-07 19:46:44 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:Windowsexplorer.exe

Nie sądzę, by ten plik trzeba było podmienić. Data ostatniej modyfikacji jest zbyt odległa.

Tylko kosmetyka:
Uruchom OTL i w oknie Własne opcje skanowania/Script wklej to:

:OTL
[2012-02-03 13:15:33 | 000,000,023 | ---- | C] () -- C:UsersAcerAppDataRoamingC76AC7.dat
O4 - HKLM..Run: [Copy Handler] File not found
O4 - HKCU..Run: [] File not found

:Commands
[emptytemp]

Kliknij w Wykonaj Script.
.

Dobrze, że mogę liczyć na stałych użytkowników forum

Wykonałem powyższą instrukcją. Po ponownym uruchomieniu komputera i wykonaniu czynności jak włączenie przeglądarki znów KAV zareagował. Najpierw komunikat o PDM i dostępie do haseł użytkownika, a później PDM.Invader (loader)



Muszę mieć pewność, że system jest czysty i usunąć KAV, bo zamula mi komputer, który i tak ledwo zipie po włączeniu wielu programów(procesor Core Solo). Jaki jeszcze skan polecasz? Użyłem do tej pory Spybota, dr Web32, MKS Online.

Maku Kasp to się nadaje do ... Symantec NIS 2011 lub 2012 sobie załatw i zniknie Ci w mgnieniu oka ten virus

Użytkownik Wujek Celdur edytował ten post 07 02 2012 - 19:43

Zastąpiłem Kasperskiego NISem. Jestem mile zaskoczony interfejsem tego programu i oceną poszczególnych plików nie tylko z bazy NISa ale raportów użytkowników. Program znalazł jeszcze 11 wirusów i trojanów w różnych plikach. Bardzo dużo opcji ustawień programu, zostawię go jeszcze asekuracyjnie na kilka dni.