Elektroda.pl
Elektroda.pl
X
Please add exception to AdBlock for elektroda.pl.
If you watch the ads, you support portal and users.

Logi z OTL - Analiza logów z programu OTL

MrDoimer 07 Jul 2014 21:18 2136 6
  • #1
    MrDoimer
    Level 38  
    Witam,

    Proszę o przejrzenie logów.
    Używałem ADW, CCleaner i MBAN.
    Problemem jest to iż Avast informuje na każdej stronie o zagrożeniu typu "Url:Mal" gdzie niby zainfekowanym plikiem jest firefox.exe.

    Logi z OTL - Analiza logów z programu OTL
  • #3
    MrDoimer
    Level 38  
    FRST :
    Spoiler:
    Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:09-07-2014
    Ran by Bastien (administrator) on BASTIEN-PC on 10-07-2014 12:53:33
    Running from C:\Users\Bastien\Downloads
    Platform: Microsoft Windows 7 Ultimate Service Pack 1 (X86) OS Language: Inglese (Stati Uniti)
    Internet Explorer Version 11
    Boot Mode: Normal

    The only official download link for FRST:
    Download link for 32-Bit version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/
    Download link for 64-Bit Version: http://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/
    Download link from any site other than Bleeping Computer is unpermitted or outdated.
    See tutorial for FRST: http://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

    ==================== Processes (Whitelisted) =================

    (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
    (Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI.exe
    (AVAST Software) C:\Program Files\AVAST Software\Avast\AvastUI.exe
    (Intel Corporation) C:\Windows\System32\igfxtray.exe
    (Intel Corporation) C:\Windows\System32\hkcmd.exe
    (Intel Corporation) C:\Windows\System32\igfxpers.exe
    (Redefine Sp z o.o.) C:\Program Files\ipla\ipla.exe
    (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
    (Microsoft Corporation) C:\Windows\System32\audiodg.exe
    (Skype Technologies S.A.) C:\Program Files\Skype\Phone\Skype.exe
    (TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer.exe
    (TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\tv_w32.exe
    (TeamViewer GmbH) C:\Program Files\TeamViewer\Version8\TeamViewer_Desktop.exe
    (Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe


    ==================== Registry (Whitelisted) ==================

    HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI.exe [5995152 2012-10-29] (Realtek Semiconductor)
    HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [3764024 2013-12-20] (AVAST Software)
    HKU\S-1-5-21-200418395-281070509-1038489136-1000\...\Run: [IPLA!] => C:\Program Files\ipla\ipla.exe [21360736 2014-06-17] (Redefine Sp z o.o.)
    HKU\S-1-5-21-200418395-281070509-1038489136-1000\...\Run: [File] => "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Bastien\AppData\Local\Temp\File3264700417001660616.jar" <===== ATTENTION
    ShellIconOverlayIdentifiers: 00avast -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll (AVAST Software)

    ==================== Internet (Whitelisted) ====================

    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://it.msn.com/?ocid=iehp
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0xE39B31405931CE01
    HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = it
    URLSearchHook: HKLM - Default Value = {CCC7B159-1D8C-11E3-B2AD-F3EF3D58318D}
    SearchScopes: HKLM - DefaultScope value is missing.
    SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://search.iminent.com/?appId=6418038D-6944-4310-B243-53F620BD63EA&ref=toolbox&q={searchTerms}
    BHO: Java(tm) Plug-I12:55 10/07/2014n SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
    BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
    BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
    Toolbar: HKLM - avast! Online Security - {CC1A175A-E45B-41ED-A30C-C9B1D7A0C02F} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
    Tcpip\Parameters: [DhcpNameServer] 192.168.0.1

    FireFox:
    ========
    FF ProfilePath: C:\Users\Bastien\AppData\Roaming\Mozilla\Firefox\Profiles\lmwyhvm1.default
    FF Homepage: hxxp://www.google.pl
    FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF32_14_0_0_145.dll ()
    FF Plugin: @docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf - C:\Program Files\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products (Canada) Ltd.)
    FF Plugin: @google.com/GoogleEarthPlugin - C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
    FF Plugin: @java.com/DTPlugin,version=10.17.2 - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
    FF Plugin: @java.com/JavaPlugin,version=10.17.2 - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    FF Plugin: @Microsoft.com/GENUINE - disabled No File
    FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
    FF Plugin: @TOOLS.google.com/Google Update;version=3 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin: @TOOLS.google.com/Google Update;version=9 - C:\Program Files\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.)
    FF Plugin: @videolan.org/vlc,version=2.0.5 - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
    FF Plugin HKCU: @Skype Limited.com/Facebook Video Calling Plugin - C:\Users\Bastien\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
    FF Extension: Site Matcher - C:\Users\Bastien\AppData\Roaming\Mozilla\Firefox\Profiles\lmwyhvm1.default\Extensions\sitematcher@sitematcher.com [2014-06-02]
    FF Extension: Adblock Plus - C:\Users\Bastien\AppData\Roaming\Mozilla\Firefox\Profiles\lmwyhvm1.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-04-29]
    FF HKLM\...\Firefox\Extensions: [wrc@avast.com] - C:\Program Files\AVAST Software\Avast\WebRep\FF
    FF Extension: avast! Online Security - C:\Program Files\AVAST Software\Avast\WebRep\FF [2013-04-04]

    Chrome:
    =======
    CHR HomePage: hxxp://www.google.com/
    CHR DefaultNewTabURL:
    CHR Plugin: (Shockwave Flash) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\PepperFlash\pepflashplayer.dll ()
    CHR Plugin: (Chrome Remote Desktop Viewer) - internal-remoting-viewer
    CHR Plugin: (Native Client) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\ppGoogleNaClPluginChrome.dll ()
    CHR Plugin: (Chrome PDF Viewer) - C:\Program Files\Google\Chrome\Application\35.0.1916.153\pdf.dll ()
    CHR Plugin: (Google Update) - C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll No File
    CHR Plugin: (Java(TM) Platform SE 7 U17) - C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
    CHR Plugin: (VLC Web Plugin) - C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN)
    CHR Plugin: (Facebook Video Calling Plugin) - C:\Users\Bastien\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
    CHR Plugin: (Shockwave Flash) - C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_224.dll No File
    CHR Plugin: (Java Deployment Toolkit 7.0.170.2) - C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
    CHR Extension: (avast! Online Security) - C:\Users\Bastien\AppData\Local\Google\Chrome\User Data\Default\Extensions\gomekmidlodglbbmalcneegieacbdmki [2014-06-02]
    CHR Extension: (Google Wallet) - C:\Users\Bastien\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-12-25]
    CHR HKLM\...\Chrome\Extension: [gomekmidlodglbbmalcneegieacbdmki] - C:\Program Files\AVAST Software\Avast\WebRep\Chrome\aswWebRepChrome.crx [2013-12-20]

    ========================== Services (Whitelisted) =================

    R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [50344 2013-12-20] (AVAST Software)
    S3 cphs; C:\Windows\system32\IntelCpHeciSvc.exe [277616 2012-12-14] (Intel Corporation)

    ==================== Drivers (Whitelisted) ====================

    R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [67824 2013-12-20] (AVAST Software)
    R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [79720 2013-12-20] (AVAST Software)
    R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [49944 2013-12-20] ()
    R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [775952 2013-12-20] (AVAST Software)
    R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [410528 2013-12-20] (AVAST Software)
    R3 aswStm; C:\Windows\system32\drivers\aswStm.sys [64168 2013-12-20] (AVAST Software)
    R1 aswTdi; C:\Windows\system32\Drivers\aswTdi.sys [56080 2013-12-19] (AVAST Software)
    R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [180248 2013-12-20] ()
    R3 KMWDFILTERx86; C:\Windows\System32\DRIVERS\KMWDFILTER.sys [25088 2009-04-29] (Windows (R) Codename Longhorn DDK provider)
    R3 MEI; C:\Windows\System32\DRIVERS\HECI.sys [55104 2012-07-17] (Intel Corporation)
    S3 yukonw7; C:\Windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] ()
    S3 VGPU; System32\drivers\rdvgkmd.sys [X]

    ==================== NetSvcs (Whitelisted) ===================


    ==================== One Month Created Files and Folders ========

    2014-07-10 12:53 - 2014-07-10 12:53 - 01074688 _____ (Farbar) C:\Users\Bastien\Downloads\FRST.exe
    2014-07-10 12:53 - 2014-07-10 12:53 - 00009051 _____ () C:\Users\Bastien\Downloads\FRST.txt
    2014-07-10 12:53 - 2014-07-10 12:53 - 00000000 ____D () C:\FRST
    2014-07-10 12:52 - 2014-07-10 12:53 - 02084352 _____ (Farbar) C:\Users\Bastien\Downloads\FRST64.exe
    2014-07-08 10:06 - 2014-07-10 09:48 - 00000280 _____ () C:\Windows\setupact.log
    2014-07-08 10:06 - 2014-07-08 10:06 - 00000000 _____ () C:\Windows\setuperr.log
    2014-07-08 10:05 - 2014-07-08 10:05 - 00000570 _____ () C:\Windows\PFRO.log
    2014-07-07 21:02 - 2014-07-07 21:10 - 00000000 ____D () C:\Users\Bastien\Desktop\OTL Logi
    2014-07-07 21:00 - 2014-07-07 21:00 - 00602112 _____ (OldTimer Tools) C:\Users\Bastien\Downloads\OTL(1).exe
    2014-07-07 20:42 - 2010-08-30 08:34 - 00536576 _____ (SQLite Development Team) C:\Windows\system32\sqlite3.dll
    2014-07-07 20:41 - 2014-07-07 20:41 - 01346519 _____ () C:\Users\Bastien\Downloads\adwcleaner_3.214_www.INSTALKI.pl.exe
    2014-07-06 19:11 - 2014-06-09 17:34 - 06886008 ____N () C:\Users\Bastien\Desktop\VID-20140609-WA0000.mp4
    2014-07-06 14:29 - 2014-07-06 14:29 - 00000000 ____D () C:\Users\Bastien\Samsung Link
    2014-07-06 14:29 - 2014-07-06 14:29 - 00000000 ____D () C:\Users\Bastien\AppData\Roaming\SAMSUNG
    2014-07-06 14:29 - 2014-07-06 14:29 - 00000000 ____D () C:\Users\Bastien\.swt
    2014-07-06 14:29 - 2014-07-06 14:29 - 00000000 ____D () C:\Upload
    2014-07-06 14:29 - 2014-07-06 14:29 - 00000000 ____D () C:\Samsung Link
    2014-07-06 14:29 - 2014-07-06 14:29 - 00000000 ____D () C:\ProgramData\SAMSUNG
    2014-07-06 14:26 - 2014-07-06 14:28 - 86530912 _____ (Copyright 2013 SAMSUNG) C:\Users\Bastien\Downloads\SamsungLink_Installer32.exe
    2014-06-12 00:01 - 2014-06-12 00:01 - 00000000 ____D () C:\Temp

    ==================== One Month Modified Files and Folders =======

    2014-07-10 12:53 - 2014-07-10 12:53 - 01074688 _____ (Farbar) C:\Users\Bastien\Downloads\FRST.exe
    2014-07-10 12:53 - 2014-07-10 12:53 - 00009051 _____ () C:\Users\Bastien\Downloads\FRST.txt
    2014-07-10 12:53 - 2014-07-10 12:53 - 00000000 ____D () C:\FRST
    2014-07-10 12:53 - 2014-07-10 12:52 - 02084352 _____ (Farbar) C:\Users\Bastien\Downloads\FRST64.exe
    2014-07-10 12:53 - 2013-04-04 19:36 - 00000000 ____D () C:\Users\Bastien\AppData\Roaming\Skype
    2014-07-10 12:25 - 2013-04-04 22:30 - 00000978 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
    2014-07-10 11:56 - 2013-04-07 14:05 - 00001140 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
    2014-07-10 10:35 - 2013-07-17 10:30 - 00000936 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-200418395-281070509-1038489136-1000UA.job
    2014-07-10 10:35 - 2013-07-17 10:30 - 00000914 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-200418395-281070509-1038489136-1000Core.job
    2014-07-10 09:56 - 2013-04-07 14:05 - 00001136 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
    2014-07-10 09:52 - 2013-04-04 19:00 - 01210958 _____ () C:\Windows\WindowsUpdate.log
    2014-07-10 09:49 - 2013-04-19 12:10 - 00000000 ____D () C:\Users\Bastien\AppData\Roaming\ipla
    2014-07-10 09:48 - 2014-07-08 10:06 - 00000280 _____ () C:\Windows\setupact.log
    2014-07-10 09:48 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
    2014-07-08 22:25 - 2013-04-04 22:30 - 00699056 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
    2014-07-08 22:25 - 2013-04-04 22:30 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
    2014-07-08 10:06 - 2014-07-08 10:06 - 00000000 _____ () C:\Windows\setuperr.log
    2014-07-08 10:05 - 2014-07-08 10:05 - 00000570 _____ () C:\Windows\PFRO.log
    2014-07-07 21:10 - 2014-07-07 21:02 - 00000000 ____D () C:\Users\Bastien\Desktop\OTL Logi
    2014-07-07 21:02 - 2013-05-14 20:28 - 00049152 ___SH () C:\Users\Bastien\Thumbs.db
    2014-07-07 21:00 - 2014-07-07 21:00 - 00602112 _____ (OldTimer Tools) C:\Users\Bastien\Downloads\OTL(1).exe
    2014-07-07 20:57 - 2013-04-05 04:55 - 00000000 ____D () C:\Windows\Panther
    2014-07-07 20:45 - 2013-04-04 19:28 - 00000000 ____D () C:\Program Files\Mozilla Maintenance Service
    2014-07-07 20:44 - 2009-07-14 06:34 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
    2014-07-07 20:44 - 2009-07-14 06:34 - 00021072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
    2014-07-07 20:43 - 2014-01-12 18:35 - 00000000 ____D () C:\AdwCleaner
    2014-07-07 20:41 - 2014-07-07 20:41 - 01346519 _____ () C:\Users\Bastien\Downloads\adwcleaner_3.214_www.INSTALKI.pl.exe
    2014-07-07 20:40 - 2013-04-11 21:48 - 00000000 ____D () C:\Program Files\Mozilla Firefox
    2014-07-06 21:03 - 2013-04-19 12:10 - 00000000 ____D () C:\ProgramData\ipla
    2014-07-06 21:03 - 2013-04-04 19:39 - 00000000 ____D () C:\Program Files\ipla
    2014-07-06 14:29 - 2014-07-06 14:29 - 00000000 ____D () C:\Users\Bastien\Samsung Link
    2014-07-06 14:29 - 2014-07-06 14:29 - 00000000 ____D () C:\Users\Bastien\AppData\Roaming\SAMSUNG
    2014-07-06 14:29 - 2014-07-06 14:29 - 00000000 ____D () C:\Users\Bastien\.swt
    2014-07-06 14:29 - 2014-07-06 14:29 - 00000000 ____D () C:\Upload
    2014-07-06 14:29 - 2014-07-06 14:29 - 00000000 ____D () C:\Samsung Link
    2014-07-06 14:29 - 2014-07-06 14:29 - 00000000 ____D () C:\ProgramData\SAMSUNG
    2014-07-06 14:28 - 2014-07-06 14:26 - 86530912 _____ (Copyright 2013 SAMSUNG) C:\Users\Bastien\Downloads\SamsungLink_Installer32.exe
    2014-06-25 21:12 - 2014-06-02 23:11 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Call of Duty Single Player Demo
    2014-06-25 21:11 - 2013-12-20 20:20 - 00000000 ___HD () C:\Program Files\InstallShield Installation Information
    2014-06-25 21:11 - 2013-12-20 20:20 - 00000000 ____D () C:\Program Files\Common Files\InstallShield
    2014-06-22 02:09 - 2013-04-04 20:34 - 00739366 _____ () C:\Windows\system32\perfh010.dat
    2014-06-22 02:09 - 2013-04-04 20:34 - 00146226 _____ () C:\Windows\system32\perfc010.dat
    2014-06-22 02:09 - 2010-11-20 23:01 - 01658888 _____ () C:\Windows\system32\PerfStringBackup.INI
    2014-06-12 21:52 - 2013-04-07 14:06 - 00002129 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
    2014-06-12 00:01 - 2014-06-12 00:01 - 00000000 ____D () C:\Temp

    Some content of TEMP:
    ====================
    C:\Users\Bastien\AppData\Local\Temp\ipl90BA.tmp.exe


    ==================== Bamital & volsnap Check =================

    C:\Windows\explorer.exe => File is digitally signed
    C:\Windows\system32\winlogon.exe => File is digitally signed
    C:\Windows\system32\wininit.exe => File is digitally signed
    C:\Windows\system32\svchost.exe => File is digitally signed
    C:\Windows\system32\services.exe => File is digitally signed
    C:\Windows\system32\User32.dll => MD5 is legit
    C:\Windows\system32\userinit.exe => File is digitally signed
    C:\Windows\system32\rpcss.dll => File is digitally signed
    C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


    LastRegBack: 2014-07-08 13:33

    ==================== End Of Log ============================


    Addition :
    Spoiler:
    Additional scan result of Farbar Recovery Scan Tool (x86) Version:09-07-2014
    Ran by Bastien at 2014-07-10 12:54:05
    Running from C:\Users\Bastien\Downloads
    Boot Mode: Normal
    ==========================================================


    ==================== Security Center ========================

    AV: avast! Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
    AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
    AS: avast! Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}

    ==================== Installed Programs ======================

    Adobe Flash Player 14 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 14.0.0.145 - Adobe Systems Incorporated)
    Adobe Flash Player 14 Plugin (HKLM\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
    Ares 2.2.4 (HKLM\...\Ares) (Version: 2.2.4-Build#3048 - Ares Development Group)
    Audacity 2.0.3 (HKLM\...\Audacity_is1) (Version: 2.0.3 - Audacity Team)
    avast! Free Antivirus (HKLM\...\avast) (Version: 9.0.2011 - Avast Software)
    CCleaner (HKLM\...\CCleaner) (Version: 4.00 - Piriform)
    CrystalDiskInfo 5.6.2 (HKLM\...\CrystalDiskInfo_is1) (Version: 5.6.2 - Crystal Dew World)
    Facebook Video Calling 2.0.0.447 (HKLM\...\{8DF41A9F-FE13-43E8-A003-5F9B55A011EE}) (Version: 2.0.447 - Skype Limited)
    Free Easy Burner V 5.1 (HKLM\...\Free Easy Burner_is1) (Version: 5.1.0.0 - Koyote soft)
    Google Chrome (HKLM\...\Google Chrome) (Version: 35.0.1916.153 - Google Inc.)
    Google Earth Plug-in (HKLM\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
    Google Update Helper (Version: 1.3.24.15 - Google Inc.) Hidden
    Intel(R) Processor Graphics (HKLM\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2932 - Intel Corporation)
    Intel(R) SDK for OpenCL - CPU Only Runtime Package (HKLM\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version: 2.0.0.37149 - Intel Corporation)
    ipla 2.8 (HKLM\...\ipla) (Version: 2.8 - Redefine Sp z o.o.)
    Java 7 Update 17 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83217017FF}) (Version: 7.0.170 - Oracle)
    Java Auto Updater (Version: 2.1.9.0 - Sun Microsystems, Inc.) Hidden
    K-Lite Codec Pack 6.2.0 (Basic) (HKLM\...\KLiteCodecPack_is1) (Version: 6.2.0 - )
    Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
    Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
    Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.1.10329.0 - Microsoft Corporation)
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
    Mozilla Firefox 30.0 (x86 pl) (HKLM\...\Mozilla Firefox 30.0 (x86 pl)) (Version: 30.0 - Mozilla)
    Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
    Nokia Connectivity Cable Driver (HKLM\...\{BC4AE628-81A4-4FC6-863A-7A9BA2E2531F}) (Version: 7.1.32.69 - )
    OpenOffice 4.0.1 (HKLM\...\{DA0106A3-216E-48DE-9CF6-655DA8FC1D22}) (Version: 4.01.9714 - Apache Software Foundation)
    PDF-XChange Viewer (HKLM\...\{3A6F4A31-8CFD-46B4-8385-E1F384DB121E}) (Version: 2.5.212.0 - Tracker Software Products (Canada) Ltd.)
    Realtek Ethernet Controller Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.67.1226.2012 - Realtek)
    Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6767 - Realtek Semiconductor Corp.)
    Skype™ 6.14 (HKLM\...\{7A3C7E05-EE37-47D6-99E1-2EB05A3DA3F7}) (Version: 6.14.104 - Skype Technologies S.A.)
    TeamViewer 8 (HKLM\...\TeamViewer 8) (Version: 8.0.17396 - TeamViewer)
    VLC media player 2.0.5 (HKLM\...\VLC media player) (Version: 2.0.5 - VideoLAN)
    WinRAR 4.20 (32-bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)

    ==================== Restore Points =========================

    25-03-2013 11:25:29 Windows Update
    29-03-2013 09:00:33 Windows Update
    29-03-2013 19:07:52 Removed Skype™ 6.1
    30-03-2013 07:22:14 Removed Skype™ 6.1
    30-03-2013 07:25:08 Removed Skype Toolbars
    01-04-2013 12:40:54 Windows Update
    04-04-2013 14:12:16 Windows Update
    25-05-2014 19:42:22 Operazione di ripristino
    25-05-2014 19:45:22 avast! antivirus system restore point
    02-06-2014 08:50:57 Scheduled Checkpoint
    02-06-2014 13:01:03 Installed Max Payne Demo
    07-06-2014 02:56:55 Windows Update
    14-06-2014 13:38:22 Scheduled Checkpoint
    21-06-2014 23:20:08 Scheduled Checkpoint
    25-06-2014 19:11:35 Removed Max Payne Demo
    03-07-2014 14:24:28 Scheduled Checkpoint
    07-07-2014 18:54:42 Removed PlayReady PC Runtime x86

    ==================== Hosts content: ==========================

    2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

    ==================== Scheduled Tasks (whitelisted) =============

    Task: {47F5C5D1-9DAA-43AA-B313-09ABD7E75B17} - System32\Tasks\{D89247DE-6302-4796-9508-C9A125FAFBDB} => Firefox.exe http://ui.skype.com/ui/0/6.6.0.106/pl/abandoninstall?page=tsBing
    Task: {9B88D339-C1D8-4CFD-B906-DA8A477AD3CD} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-200418395-281070509-1038489136-1000UA => C:\Users\Bastien\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-07-17] (Facebook Inc.)
    Task: {A009A605-E253-4DEB-B50A-D7D66B58F5C4} - System32\Tasks\{EEF7BC19-E8DA-41FA-9A9F-48552C9D3377} => Firefox.exe http://ui.skype.com/ui/0/6.16.59.105/pl/abandoninstall?page=tsProgressBar
    Task: {A145A072-52D6-4392-9263-B7C6225F65ED} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-04-07] (Google Inc.)
    Task: {A25E4AAA-8A00-44DE-A8F8-F6C5AE98FAF7} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2014-07-08] (Adobe Systems Incorporated)
    Task: {C1FC8EB5-F1E1-4F41-AE28-0D18E0F4AB96} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-200418395-281070509-1038489136-1000Core => C:\Users\Bastien\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-07-17] (Facebook Inc.)
    Task: {D5C1DA02-9361-4434-844F-68F140585853} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2013-04-07] (Google Inc.)
    Task: {EF16136A-DA6C-46E8-9243-6A1EB252D5BF} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2013-12-20] (AVAST Software)
    Task: {F99C46A8-6A64-4399-A896-36CE06827974} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-03-25] (Piriform Ltd)
    Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
    Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-200418395-281070509-1038489136-1000Core.job => C:\Users\Bastien\AppData\Local\Facebook\Update\FacebookUpdate.exe
    Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-200418395-281070509-1038489136-1000UA.job => C:\Users\Bastien\AppData\Local\Facebook\Update\FacebookUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
    Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

    ==================== Loaded Modules (whitelisted) =============

    2014-07-09 10:39 - 2014-07-09 10:03 - 02789888 _____ () C:\Program Files\AVAST Software\Avast\defs\14070900\algo.dll
    2014-07-10 09:49 - 2014-07-10 08:50 - 02789888 _____ () C:\Program Files\AVAST Software\Avast\defs\14071000\algo.dll
    2013-12-20 20:36 - 2013-12-20 20:36 - 19336120 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
    2013-12-20 20:22 - 2012-11-12 07:34 - 00094208 _____ () C:\Windows\System32\IccLibDll.dll
    2014-06-17 13:26 - 2014-06-17 13:26 - 00068104 _____ () C:\Program Files\ipla\ziplib.dll
    2014-06-17 13:26 - 2014-06-17 13:26 - 00299528 _____ () C:\Program Files\ipla\MediaFileScanner.dll
    2014-06-02 15:25 - 2014-06-02 15:25 - 37022328 _____ () C:\Program Files\ipla\libcef.dll
    2014-06-17 13:26 - 2014-06-17 13:26 - 00392200 _____ () C:\Program Files\ipla\jabberoo.dll
    2013-04-11 21:48 - 2014-07-07 20:40 - 03852912 _____ () C:\Program Files\Mozilla Firefox\mozjs.dll

    ==================== Alternate Data Streams (whitelisted) =========


    ==================== Safe Mode (whitelisted) ===================


    ==================== EXE Association (whitelisted) =============


    ==================== MSCONFIG/TASK MANAGER disabled items =========

    MSCONFIG\Services: gupdate => 2
    MSCONFIG\Services: gupdatem => 3
    MSCONFIG\Services: MozillaMaintenance => 3
    MSCONFIG\Services: SkypeUpdate => 2
    MSCONFIG\Services: TeamViewer8 => 2
    MSCONFIG\startupreg: ares => "C:\Program Files\Ares\Ares.exe" -h
    MSCONFIG\startupreg: Facebook Update => "C:\Users\Bastien\AppData\Local\Facebook\Update\FacebookUpdate.exe" /c /nocrashserver
    MSCONFIG\startupreg: IPLA! => C:\Program Files\ipla\ipla.exe /autorun
    MSCONFIG\startupreg: Skype => "C:\Program Files\Skype\Phone\Skype.exe" /minimized /regrun
    MSCONFIG\startupreg: SunJavaUpdateSched => "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

    ==================== Faulty Device Manager Devices =============

    Name: Controller USB ( Universal Serial Bus)
    Description: Controller USB ( Universal Serial Bus)
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

    Name: SAMSUNG Mobile Modem
    Description: SAMSUNG Mobile Modem
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.

    Name: SAMSUNG Mobile Modem
    Description: SAMSUNG Mobile Modem
    Class Guid:
    Manufacturer:
    Service:
    Problem: : The drivers for this device are not installed. (Code 28)
    Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


    ==================== Event log errors: =========================

    Application errors:
    ==================
    Error: (07/10/2014 09:50:11 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (07/09/2014 07:02:05 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (07/09/2014 09:39:03 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (07/08/2014 11:28:27 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (07/08/2014 10:07:39 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (07/07/2014 08:47:14 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (07/07/2014 02:23:54 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (07/07/2014 00:34:33 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (07/07/2014 06:53:27 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (07/06/2014 09:00:28 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


    System errors:
    =============
    Error: (07/07/2014 08:26:08 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: Arresto imprevista del servizio AllShare Framework DMS. Questo evento si è già verificato 1 volta(e).

    Error: (07/07/2014 08:26:05 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
    Description: Arresto imprevista del servizio Samsung Link Service. Questo evento si è già verificato 1 volta(e).

    Error: (07/07/2014 02:22:16 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: Il servizio Update Jump Flip non è stato avviato per il seguente errore:
    %%2

    Error: (07/07/2014 00:32:59 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: Il servizio Update Jump Flip non è stato avviato per il seguente errore:
    %%2

    Error: (07/07/2014 06:51:55 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: Il servizio Update Jump Flip non è stato avviato per il seguente errore:
    %%2

    Error: (07/06/2014 08:58:51 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: Il servizio Update Jump Flip non è stato avviato per il seguente errore:
    %%2

    Error: (07/06/2014 09:29:03 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: Il servizio Update Jump Flip non è stato avviato per il seguente errore:
    %%2

    Error: (07/05/2014 06:21:04 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: Il servizio Update Jump Flip non è stato avviato per il seguente errore:
    %%2

    Error: (07/05/2014 07:33:04 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: Il servizio Update Jump Flip non è stato avviato per il seguente errore:
    %%2

    Error: (07/04/2014 08:10:25 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
    Description: Il servizio Update Jump Flip non è stato avviato per il seguente errore:
    %%2


    Microsoft Office Sessions:
    =========================
    Error: (07/10/2014 09:50:11 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (07/09/2014 07:02:05 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (07/09/2014 09:39:03 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (07/08/2014 11:28:27 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (07/08/2014 10:07:39 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (07/07/2014 08:47:14 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (07/07/2014 02:23:54 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (07/07/2014 00:34:33 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (07/07/2014 06:53:27 AM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

    Error: (07/06/2014 09:00:28 PM) (Source: WinMgmt) (EventID: 10) (User: )
    Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


    ==================== Memory info ===========================

    Percentage of memory in use: 46%
    Total physical RAM: 3238.27 MB
    Available physical RAM: 1716.99 MB
    Total Pagefile: 6474.84 MB
    Available Pagefile: 4825.1 MB
    Total Virtual: 2047.88 MB
    Available Virtual: 1890.11 MB

    ==================== Drives ================================

    Drive c: () (Fixed) (Total:232.88 GB) (Free:174.06 GB) NTFS
    Drive d: () (Fixed) (Total:232.79 GB) (Free:149.01 GB) NTFS

    ==================== MBR & Partition Table ==================

    ========================================================
    Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 3466DEF7)
    Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
    Partition 2: (Not Active) - (Size=233 GB) - (Type=07 NTFS)

    ========================================================
    Disk: 1 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: 558FDE6D)
    Partition 1: (Not Active) - (Size=233 GB) - (Type=07 NTFS)

    ==================== End Of Log ============================
  • Helpful post
    #4
    Acorus 20
    Level 43  
    Otwórz Notatnik i wklej:

    Quote:
    Task: {9B88D339-C1D8-4CFD-B906-DA8A477AD3CD} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-200418395-281070509-1038489136-1000UA => C:\Users\Bastien\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-07-17] (Facebook Inc.)
    Task: {C1FC8EB5-F1E1-4F41-AE28-0D18E0F4AB96} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-200418395-281070509-1038489136-1000Core => C:\Users\Bastien\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-07-17] (Facebook Inc.)
    Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-200418395-281070509-1038489136-1000Core.job => C:\Users\Bastien\AppData\Local\Facebook\Update\FacebookUpdate.exe
    Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-200418395-281070509-1038489136-1000UA.job => C:\Users\Bastien\AppData\Local\Facebook\Update\FacebookUpdate.exe
    HKU\S-1-5-21-200418395-281070509-1038489136-1000\...\Run: [File] => "C:\Program Files\Java\jre7\bin\javaw.exe" -jar "C:\Users\Bastien\AppData\Local\Temp\File3264700417001660616.jar" <===== ATTENTION
    SearchScopes: HKLM - DefaultScope value is missing.
    SearchScopes: HKCU - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = http://search.iminent.com/?appId=6418038D-6944-4310-B243-53F620BD63EA&ref=toolbox&q={searchTerms}
    FF Extension: Site Matcher - C:\Users\Bastien\AppData\Roaming\Mozilla\Firefox\Profiles\lmwyhvm1.default\Extensions\sitematcher@sitematcher.com [2014-06-02]
    S3 VGPU; System32\drivers\rdvgkmd.sys [X]
    2014-07-07 20:43 - 2014-01-12 18:35 - 00000000 ____D () C:\AdwCleaner
    C:\Users\Bastien\AppData\Local\Temp\ipl90BA.tmp.exe


    Plik zapisz pod nazwą fixlist.txt i umieść obok FRST w tym samym folderze.
    Uruchom FRST i kliknij w Fix
  • #5
    MrDoimer
    Level 38  
    Zrobione.
    Wszystko ?
  • #6
    Kolobos
    IT specialist
    Usun katalog C:\FRST i to wszystko.
  • #7
    MrDoimer
    Level 38  
    Zrobione, problem rozwiązany.
    Wielkie dzięki :)