dysk twardy - zewnętrzny - utracone dane?

**Posty:** 6403 · przez **Robert** 26 Lis 2008, 23:41

AVG mam, Avasta bym nie tknął.
no ale z laptopa na zewn, przenosilem dane po sieci.

lapa i mojego PC przeskanuje za pomocą ewido.

kahoona napisał(a):. W viście najprawdopodobniej wyskoczyłaby informacja o błędach w partycji i oferta naprawy.

zacial sie, i reset tylko. Na nic nie reagował. zrobilo sie to podczas przenoszenia danych z pendrajv na dysk. zazwyczaj jest tak ze zatnie sie 1 rzecz np, Tottal Commander którego używam do przenoszenia danych, A tu poleciało wszystko łącznie z explorerem.
Nawet ctrl+alt+delete nie działał.

No to tak:
logi z laptopa i mojego PC dać ,żeby sprawdzil je ktoś? z jakich progsów? A może co innego.

**Posty:** 5637 · przez **kahoona** 27 Lis 2008, 00:05

Dawaj logi - nie zaszkodzi. Według opisu - co zadziała.
Dasz radę sprawdzić uruchomione usługi/procesy w XP? Chociażby programem "Services And Devices" - pserv.cpl
http://p-nand-q.com/download/pserv_cpl.html

Na razie odepnij przenośny dysk i pendrive. Skan po kolei - jak wcześniej napisałem.

**Posty:** 6403 · przez **Robert** 27 Lis 2008, 16:17

Robi to jakąś różnice czy logi wygeneruje przy podpiętym zepsutym dysku do XP czy bez?

Logi laptopa:

CF

Kod: Zaznacz wszystko: ComboFix 08-11-27.01 - Laptop 2008-11-27 17:06:43.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.699 [GMT 1:00] * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf c:\documents and settings\Laptop\Ustawienia lokalne\Dane aplikacji\Microsoft\Windows Media\10.0\WMSDKNSD.XML c:\program files\Mozilla Firefox\components\iamfamous.dll C:\resycled c:\resycled\boot.com c:\windows\system32\kdctj.exe E:\Autorun.inf E:\resycled e:\resycled\boot.com . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-27 do 2008-11-27 ))))))))))))))))))))))))))))))) . 2008-11-16 00:32 . 2008-11-16 00:32 20 --a------ c:\windows\naglos.INI 2008-11-13 14:12 . 2008-11-13 14:12 27,904 --a------ c:\windows\system32\drivers\ndisprot.sys 2008-11-12 12:02 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-12 12:01 . 2008-09-04 18:17 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll 2008-11-07 20:56 . 2008-11-07 20:56 <DIR> d-------- c:\program files\Auslogics 2008-11-07 20:56 . 2008-11-07 20:56 <DIR> d-------- c:\documents and settings\Laptop\Dane aplikacji\Auslogics . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-27 11:56 --------- d-----w c:\documents and settings\Laptop\Dane aplikacji\AVG7 2008-11-26 22:11 --------- d-----w c:\documents and settings\Laptop\Dane aplikacji\uTorrent 2008-11-07 22:16 --------- d-----w c:\program files\UltraVNC 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-21 16:13 --------- d-----w c:\documents and settings\Laptop\Dane aplikacji\Tibia 2008-09-30 05:39 --------- d-----w c:\program files\MGrenda 2008-09-30 04:37 --------- d-----w c:\program files\FlashGet 2008-09-28 17:11 --------- d-----w c:\program files\Tibia3 . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-01-30 1716224] "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-04-16 1079808] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-11-28 98304] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-11-28 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-11-28 118784] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-12-17 761945] "THotkey"="c:\program files\Toshiba\Toshiba Applet\thotkey.exe" [2006-01-05 352256] "Tvs"="c:\program files\TOSHIBA\Tvs\TvsTray.exe" [2005-11-30 73728] "SmoothView"="c:\program files\TOSHIBA\Program narzędziowy TOSHIBA Zooming Utility\SmoothView.exe" [2005-05-13 118784] "DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-10-06 122940] "IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-05 667718] "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 602182] "AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2008-10-17 590848] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "RTHDCPL"="RTHDCPL.EXE" [2005-12-09 c:\windows\RTHDCPL.exe] "AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 c:\windows\agrsmmsg.exe] "TPSMain"="TPSMain.exe" [2005-08-04 c:\windows\system32\TPSMain.exe] "NDSTray.exe"="NDSTray.exe" [BU] "TFncKy"="TFncKy.exe" [BU] "TDispVol"="TDispVol.exe" [2005-09-16 c:\windows\system32\TDispVol.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] "AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2008-06-23 219136] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\FlashGet\\flashget.exe"= "c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Team17\\Worms 2\\frontend.exe"= "c:\\Program Files\\Team17\\Worms 2\\Binaries\\landgen.exe"= "c:\\Program Files\\Team17\\Worms 2\\worms2.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Java\\jre1.5.0_04\\launch4j-tmp\\JDownloader.exe"= "c:\\WINDOWS\\system32\\java.exe"= "c:\\Documents and Settings\\Laptop\\Pulpit\\szymon\\yur ots\\ots\\YurOTS.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\UltraVNC\\vncviewer.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "5900:TCP"= 5900:TCP:vnc5900 "5800:TCP"= 5800:TCP:vnc5800 S3 Ndisprot;ArcNet NDIS Protocol Driver;\??\c:\windows\system32\drivers\Ndisprot.sys [2008-11-13 27904] . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-c:\windows\system32\kdctj.exe - c:\windows\system32\kdctj.exe . ------- Skan uzupełniający ------- . FireFox -: Profile - c:\documents and settings\Laptop\Dane aplikacji\Mozilla\Firefox\Profiles\pwe2zl9g.default\ FF -: plugin - c:\program files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll FF -: plugin - c:\program files\Java\jre1.5.0_04\bin\NPJava11.dll FF -: plugin - c:\program files\Java\jre1.5.0_04\bin\NPJava12.dll FF -: plugin - c:\program files\Java\jre1.5.0_04\bin\NPJava13.dll FF -: plugin - c:\program files\Java\jre1.5.0_04\bin\NPJava14.dll FF -: plugin - c:\program files\Java\jre1.5.0_04\bin\NPJava32.dll FF -: plugin - c:\program files\Java\jre1.5.0_04\bin\NPJPI150_04.dll FF -: plugin - c:\program files\Java\jre1.5.0_04\bin\NPOJI610.dll FF -: plugin - c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF -: plugin - c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF -: plugin - c:\program files\Mozilla Firefox\plugins\npganymedenet.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-27 17:09:07 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1064) c:\windows\system32\Ati2evxx.dll . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Intel\Wireless\Bin\EvtEng.exe c:\program files\Intel\Wireless\Bin\S24EvMon.exe c:\progra~1\Grisoft\AVG7\avgamsvr.exe c:\progra~1\Grisoft\AVG7\avgupsvc.exe c:\progra~1\Grisoft\AVG7\avgemc.exe c:\program files\Toshiba\ConfigFree\CFSvcs.exe c:\program files\Toshiba\ConfigFree\NDSTray.exe c:\program files\Toshiba\Program narzc:\program files\Synaptics\SynTP\Toshiba.exe c:\program files\Intel\Wireless\Bin\RegSrvc.exe c:\windows\system32\TPSBattM.exe c:\program files\Toshiba\TOSHIBA Applet\TAPPSRV.exe c:\program files\PC Connectivity Solution\ServiceLayer.exe c:\progra~1\Intel\Wireless\Bin\Dot1XCfg.exe c:\program files\PC Connectivity Solution\Transports\NclUSBSrv.exe c:\program files\PC Connectivity Solution\Transports\NclRSSrv.exe . ************************************************************************** . Czas ukończenia: 2008-11-27 17:10:25 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-11-27 16:10:22 Przed: 8,679,759,872 bajtów wolnych Po: 9,565,835,264 bajtów wolnych 149 --- E O F --- 2008-11-12 11:28:20

HJ:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:24:09, on 2008-11-27 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\WINDOWS\system32\igfxtray.exe C:\WINDOWS\system32\hkcmd.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\RTHDCPL.EXE C:\PROGRA~1\Grisoft\AVG7\avgemc.exe C:\WINDOWS\AGRSMMSG.exe C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe C:\WINDOWS\system32\TPSMain.exe C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe C:\Program Files\TOSHIBA\Tvs\TvsTray.exe C:\Program Files\TOSHIBA\Program narzędziowy TOSHIBA Zooming Utility\SmoothView.exe C:\Program Files\Synaptics\SynTP\Toshiba.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\TDispVol.exe C:\WINDOWS\System32\DLA\DLACTRLW.EXE C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\WINDOWS\system32\TPSBattM.exe C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\WINDOWS\explorer.exe C:\Program Files\Mozilla Firefox\firefox.exe E:\Marta\HiJackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe O4 - HKLM\..\Run: [TPSMain] TPSMain.exe O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe O4 - HKLM\..\Run: [Tvs] C:\Program Files\TOSHIBA\Tvs\TvsTray.exe O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\Program narzędziowy TOSHIBA Zooming Utility\SmoothView.exe O4 - HKLM\..\Run: [TFncKy] TFncKy.exe O4 - HKLM\..\Run: [TDispVol] TDispVol.exe O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O8 - Extra context menu item: &Download All with FlashGet - C:\PROGRA~1\FlashGet\jc_all.htm O8 - Extra context menu item: &Download with FlashGet - C:\PROGRA~1\FlashGet\jc_link.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\Toshiba\TOSHIBA Applet\TAPPSRV.exe -- End of file - 7361 bytes

RSIT:

Kod: Zaznacz wszystko: info.txt logfile of random's system information tool 1.04 2008-11-27 17:25:16 ======Uninstall list====== -->C:\Program Files\Nero\Nero 7\\nero\uninstall\UNNERO.exe /UNINSTALL -->C:\WINDOWS\system32\\MSIEXEC.EXE /x {1206EF92-2E83-4859-ACCB-2048C3CB7DA6} -->C:\WINDOWS\system32\\MSIEXEC.EXE /x {9541FED0-327F-4df0-8B96-EF57EF622F19} -->C:\WINDOWS\UNNeroBackItUp.exe /UNINSTALL -->C:\WINDOWS\UNNeroMediaHome.exe /UNINSTALL -->C:\WINDOWS\UNNeroShowTime.exe /UNINSTALL -->C:\WINDOWS\UNNeroVision.exe /UNINSTALL -->C:\WINDOWS\UNRecode.exe /UNINSTALL -->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf Adobe Flash Player Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe Adobe Reader 7.0 - Polish-->MsiExec.exe /I{AC76BA86-7AD7-1045-7B44-A70000000000} Aktualizacja dla systemu Windows XP (KB942763)-->"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe" Aktualizacja dla systemu Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe" Aktualizacja dla systemu Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla programu Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla programu Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB950759)-->"C:\WINDOWS\$NtUninstallKB950759$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla systemu Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe" Aktualizacja zabezpieczeń dla Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe" Alien Nations-->E:\ALIENN~1\UNWISE.EXE E:\ALIENN~1\INSTALL.LOG Archiwizator WinRAR-->C:\Program Files\WinRAR\uninstall.exe AusLogics Disk Defrag-->"C:\Program Files\Auslogics\AusLogics Disk Defrag\unins000.exe" AVG 7.5-->C:\Program Files\Grisoft\AVG7\setup.exe /UNINSTALL Bluetooth Stack for Windows by Toshiba-->MsiExec.exe /X{CEBB6BFB-D708-4F99-A633-BC2600E01EF6} English Translator 3 Demo-->C:\Program Files\English Translator 3 Demo\setup.exe -uninstall EVEREST Home Edition v2.20-->"C:\Program Files\Lavalys\EVEREST Home Edition\unins000.exe" FileZilla Client 3.0.10-->C:\Program Files\FileZilla FTP Client\uninstall.exe FlashGet 1.9.6.1073-->C:\Program Files\FlashGet\uninst.exe foobar2000 v0.9.5.1-->"C:\Program Files\foobar2000\uninstall.exe" Gadu-Gadu 7.6-->C:\Program Files\Gadu-Gadu\Setup.exe GameDesire-Pool & Snooker-->C:\Program Files\Ganymede\billiards_uninstall.exe Harry Potter(TM) i więzień Azkabanu-->E:\harry potter\EAUninstall.exe High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe" HijackThis 2.0.2-->"E:\Marta\HijackThis.exe" /uninstall Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe" Icy Tower v1.3.1-->"c:\games\icytower1.3\unins000.exe" Incoming Forces-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{177A96DB-3028-4A3F-BED4-852153269F06}\setup.exe" -l0x9 Intel(R) Graphics Media Accelerator Driver-->RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx2ID PCI\VEN_8086&DEV_27A6 PCI\VEN_8086&DEV_27A2 Intel(R) PRO Network Connections Drivers-->Prounstl.exe InterVideo WinDVD Creator 2-->"C:\Program Files\InstallShield Installation Information\{2FCE4FC5-6930-40E7-A4F1-F862207424EF}\setup.exe" REMOVEALL InterVideo WinDVD for TOSHIBA-->"C:\Program Files\InstallShield Installation Information\{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}\setup.exe" REMOVEALL J2SE Runtime Environment 5.0 Update 4-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150040} K-Lite Mega Codec Pack 3.8.5-->"C:\Program Files\K-Lite Codec Pack\unins000.exe" Macromedia Flash Player-->MsiExec.exe /X{0456ebd7-5f67-4ab6-852e-63781e3f389c} mCore-->MsiExec.exe /I{E81667C6-2856-46D6-ABEA-6A2F42166779} mDrWiFi-->MsiExec.exe /I{F6090A17-0967-4A8A-B3C3-422A1B514D49} mHelp-->MsiExec.exe /I{8C6BB412-D3A8-4AAE-A01B-35B681789D68} Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp" Microsoft .NET Framework 1.1 Polish Language Pack-->MsiExec.exe /X{64CB2553-C109-4132-AA51-1F421B515FD1} Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} Microsoft .NET Framework 2.0 — pakiet języka polskiego-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - PLK\install.exe Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe Microsoft .NET Framework 3.0 Polish Language Pack-->MsiExec.exe /X{FD593DE6-C3A0-4722-8E86-9DEEF0A93290} Microsoft .NET Framework 3.0-->C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setup.exe Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe" Microsoft Kernel-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe" Microsoft User-Mode Driver Framework Feature Pack 1.5-->"C:\WINDOWS\$NtUninstallWudf01005$\spuninst\spuninst.exe" mIWA-->MsiExec.exe /I{3E9D596A-61D4-4239-BD19-2DB984D2A16F} MKVtoolnix 2.1.0-->C:\Program Files\MKVtoolnix\uninst.exe mLogView-->MsiExec.exe /I{0E2B0B41-7E08-4F9F-B21F-41C4133F43B7} mMHouse-->MsiExec.exe /I{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5} Mozilla Firefox (3.0.4)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe mPfMgr-->MsiExec.exe /I{8B928BA1-EDEC-4227-A2DA-DD83026C36F5} mPfWiz-->MsiExec.exe /I{90B0D222-8C21-4B35-9262-53B042F18AF9} mProSafe-->MsiExec.exe /I{23FB368F-1399-4EAC-817C-4B83ECBE3D83} MSVC80_x86-->MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27} MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF} MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71} MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E} mWlsSafe-->MsiExec.exe /I{FCA651F3-5BDA-4DDA-9E4A-5D87D6914CC4} mXML-->MsiExec.exe /I{9CC89556-3578-48DD-8408-04E66EBEF401} mZConfig-->MsiExec.exe /I{94658027-9F16-4509-BBD7-A59FE57C3023} Nero 7 Premium-->MsiExec.exe /X{91C0B95B-B83A-4828-A775-BBE2DD421045} neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B} Nokia Connectivity Cable Driver-->MsiExec.exe /X{4F1DCA42-2030-437C-A94E-736692A499C1} Nokia PC Suite-->C:\Documents and Settings\All Users\Dane aplikacji\Installations\{9C05FA75-0337-4523-AA57-9D3511018887}\Nokia_PC_Suite_rel_6_86_9_3_pol_web.exe Nokia PC Suite-->MsiExec.exe /I{9C05FA75-0337-4523-AA57-9D3511018887} NSIS Example2-->"C:\Program Files\Tibia Auto\uninstall.exe" Oprogramowanie Intel(R) PROSet/Wireless-->C:\WINDOWS\Installer\iProInst.exe Pakiet języka polskiego dla systemu Microsoft .NET Framework 3.0-->C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 Polish Language Pack\setup.exe Pakiet sterowników systemu Windows - Nokia Modem (03/05/2008 3.7)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokia_blue_635B28EFCFA9395123BB1C251595CB16129E2560\nokia_bluetooth.inf Pakiet sterowników systemu Windows - Nokia Modem (03/13/2008 6.86.0.1)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_28F2EAC406838DA65AFF6C6886FE9FE96AEF5186\nokbtmdm.inf Pakiet sterowników systemu Windows - Nokia pccsmcfd (10/12/2007 6.85.4.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccsmcfd_4A1E30386F4D0DEC8F5DF262CFBD8845EEBAB175\pccsmcfd.inf PC Connectivity Solution-->MsiExec.exe /I{AC599724-5755-48C1-ABE7-ABB857652930} Podreczniki TOSHIBA-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3EB6332B-AF02-457C-A31C-835458C5B48B}\setup.exe" -l0x15 -removeonly Poprawka dla programu Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe" Poprawka dla systemu Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe" Program firmy TOSHIBA do oszczędzania energii-->C:\WINDOWS\IsUn0415.exe -f"C:\Program Files\TOSHIBA\Power Saver\Uninst.isu" -c"C:\WINDOWS\system32\TPSDel.dll" Program narzędziowy TOSHIBA Zooming Utility-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{64212898-097F-4F3F-AECA-6D34A7EF82DF}\setup.exe" Program TOSHIBA PC Narzędzie diagnostyczne-->C:\WINDOWS\IsUn0415.exe -f"C:\Program Files\TOSHIBA\PCDiag\Uninst.isu" Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x15 -removeonly Rzeźnik MPEGów 1.1.99-->"C:\Program Files\MGrenda\Rzeznik\unins000.exe" Skype™ 3.8-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82} Sonic DLA-->MsiExec.exe /I{1206EF92-2E83-4859-ACCB-2048C3CB7DA6} Sonic RecordNow!-->MsiExec.exe /I{9541FED0-327F-4DF0-8B96-EF57EF622F19} Synaptics Pointing Device Driver-->rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall Texas Instruments PCIxx21/x515/xx12 drivers.-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{4497AFF6-98C4-4F49-B073-F48F42BCBF9E} /l1033 Tibia 7.6-->"C:\Program Files\Tibia3\unins000.exe" Tibia MULTI-ip changer-->C:\Program Files\Asprate\Tibia Multi IP Changer\UNinstaller.exe TOSHIBA Assist-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{12B3A009-A080-4619-9A2A-C6DB151D8D67}\Setup.exe" -l0x15 TOSHIBA ConfigFree-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{BDD83DC9-BEE9-4654-A5DA-CC46C250088D}\setup.exe" -l0x15 UNINSTALL TOSHIBA Controls-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A6690C0E-B96E-4F0F-A8EB-D5B332454AC6}\Setup.exe" -l0x15 UNINSTALL TOSHIBA Hotkey Utility-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{64DD71BC-3109-4C88-9AD3-D5422644B722}\setup.exe" -l0x15 TOSHIBA SD Memory Card Format-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{48CF9A66-5F03-4025-ABD0-B3A3FA095A59}\Setup.exe" -l0x15 TOSHIBA Software Modem-->Tosmreg -U TOSHIBA TouchPad ON/Off Utility-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{69BE47C2-36FE-4397-8199-85D8EAE69982}\setup.exe" -l0x15 TOSHIBA Utilities-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{78C68CB9-3DF5-44F3-AB9D-FA305C5EB85C}\setup.exe" -l0x15 TOSHIBA Virtual Sound-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{8B12BA86-ADAC-4BA6-B441-FFC591087252}\Setup.exe" /uninstall Total Commander (Remove or Repair)-->c:\totalcmd\tcuninst.exe UltraVNC 1.0.4-->"C:\Program Files\UltraVNC\unins000.exe" Windows Communication Foundation-->MsiExec.exe /X{491DD792-AD81-429C-9EB4-86DD3D22E333} Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe" Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe" Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe" Windows Presentation Foundation Language Pack (PLK)-->MsiExec.exe /X{2D43FD89-B225-4334-B4AA-0983400BE61B} Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840} Windows Workflow Foundation PL Language Pack-->MsiExec.exe /I{DB76863D-D4D9-4AB3-AFDC-26717BA1E11C} Windows Workflow Foundation-->MsiExec.exe /I{7D1B85BD-AA07-48B8-808D-67A4067FC6BD} Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe" Worms 2-->C:\PROGRA~1\Team17\WORMS2~1\UNWISE.EXE C:\PROGRA~1\Team17\WORMS2~1\INSTALL.LOG Wyciszacz napędu CD/DVD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{9FE35071-CAB2-4E79-93E7-BFC6A2DC5C5D}\Setup.exe" -l0x15 XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe" ======Environment variables====== "ComSpec"=%SystemRoot%\system32\cmd.exe "Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Program Files\PC Connectivity Solution "windir"=%SystemRoot% "FP_NO_HOST_CHECK"=NO "OS"=Windows_NT "PROCESSOR_ARCHITECTURE"=x86 "PROCESSOR_LEVEL"=6 "PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 6, GenuineIntel "PROCESSOR_REVISION"=0f06 "NUMBER_OF_PROCESSORS"=2 "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH "TEMP"=%SystemRoot%\TEMP "TMP"=%SystemRoot%\TEMP -----------------EOF-----------------

aha, CF znalazl na poczatku rootkita, kazał reset zrobić, zrobił sobie. I lap odpalił się normalnie. Bez potrzeby wciskania F8

**Posty:** 18165 · przez **wojtas** 27 Lis 2008, 18:42

widze ze jest infekcja z pendriva lub na dysku przenosnym...

użyj Perlovga Removal Tool lub
Flash Disinfector
lub format pendriva.

Otworz notatnik i wklej w nim to:

File::
D:\autorun.inf

Folder::
D:\resycled

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania. or

Autor postu otrzymał pochwałę

**Posty:** 8001 · przez **Okocza** 27 Lis 2008, 18:43

Robert napisał(a):CF znalazl na poczatku rootkita, kazał reset zrobić, zrobił sobie

GMER na pewno znalazł i usunął, logi są czyste.

Wykonaj to co jest podane w tym temacie

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

(ewentualnie tym programem przejdź komputer)
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.

**Posty:** 6403 · przez **Robert** 27 Lis 2008, 19:02

Nowy log z kombosa. To co podał oczaki robi się

Kod: Zaznacz wszystko: ComboFix 08-11-27.01 - Laptop 2008-11-27 17:55:29.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.565 [GMT 1:00] Uruchomiony z: e:\marta\ComboFix.exe Użyto następujących komend :: e:\marta\CFScript.txt * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] FILE :: D:\autorun.inf . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-27 do 2008-11-27 ))))))))))))))))))))))))))))))) . 2008-11-27 17:25 . 2008-11-27 17:25 <DIR> d-------- C:\rsit 2008-11-16 00:32 . 2008-11-16 00:32 20 --a------ c:\windows\naglos.INI 2008-11-13 14:12 . 2008-11-13 14:12 27,904 --a------ c:\windows\system32\drivers\ndisprot.sys 2008-11-12 12:02 . 2008-10-24 12:21 455,296 -----c--- c:\windows\system32\dllcache\mrxsmb.sys 2008-11-12 12:01 . 2008-09-04 18:17 1,106,944 -----c--- c:\windows\system32\dllcache\msxml3.dll 2008-11-07 20:56 . 2008-11-07 20:56 <DIR> d-------- c:\program files\Auslogics 2008-11-07 20:56 . 2008-11-07 20:56 <DIR> d-------- c:\documents and settings\Laptop\Dane aplikacji\Auslogics . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-27 11:56 --------- d-----w c:\documents and settings\Laptop\Dane aplikacji\AVG7 2008-11-26 22:11 --------- d-----w c:\documents and settings\Laptop\Dane aplikacji\uTorrent 2008-11-07 22:16 --------- d-----w c:\program files\UltraVNC 2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys 2008-10-21 16:13 --------- d-----w c:\documents and settings\Laptop\Dane aplikacji\Tibia 2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll 2008-09-30 05:39 --------- d-----w c:\program files\MGrenda 2008-09-30 04:37 --------- d-----w c:\program files\FlashGet 2008-09-28 17:11 --------- d-----w c:\program files\Tibia3 2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys 2008-09-10 01:15 1,307,648 ----a-w c:\windows\system32\msxml6.dll 2008-09-04 17:17 1,106,944 ----a-w c:\windows\system32\msxml3.dll 2008-08-28 19:30 171,520 ----a-w c:\windows\system32\cncs32.dll . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"="c:\program files\Gadu-Gadu\gg.exe" [2007-01-30 1716224] "PC Suite Tray"="c:\program files\Nokia\Nokia PC Suite 6\PCSuite.exe" [2008-04-16 1079808] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igfxtray"="c:\windows\system32\igfxtray.exe" [2005-11-28 98304] "igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-11-28 77824] "igfxpers"="c:\windows\system32\igfxpers.exe" [2005-11-28 118784] "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2005-12-17 761945] "THotkey"="c:\program files\Toshiba\Toshiba Applet\thotkey.exe" [2006-01-05 352256] "Tvs"="c:\program files\TOSHIBA\Tvs\TvsTray.exe" [2005-11-30 73728] "SmoothView"="c:\program files\TOSHIBA\Program narzędziowy TOSHIBA Zooming Utility\SmoothView.exe" [2005-05-13 118784] "DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2005-10-06 122940] "IntelZeroConfig"="c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-12-05 667718] "IntelWireless"="c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-11-28 602182] "AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2008-10-17 590848] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "RTHDCPL"="RTHDCPL.EXE" [2005-12-09 c:\windows\RTHDCPL.exe] "AGRSMMSG"="AGRSMMSG.exe" [2005-10-15 c:\windows\agrsmmsg.exe] "TPSMain"="TPSMain.exe" [2005-08-04 c:\windows\system32\TPSMain.exe] "NDSTray.exe"="NDSTray.exe" [BU] "TFncKy"="TFncKy.exe" [BU] "TDispVol"="TDispVol.exe" [2005-09-16 c:\windows\system32\TDispVol.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] "AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2008-06-23 219136] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 29696] [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\FlashGet\\flashget.exe"= "c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "c:\\Program Files\\Gadu-Gadu\\gg.exe"= "c:\\Program Files\\Team17\\Worms 2\\frontend.exe"= "c:\\Program Files\\Team17\\Worms 2\\Binaries\\landgen.exe"= "c:\\Program Files\\Team17\\Worms 2\\worms2.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= "c:\\Program Files\\Java\\jre1.5.0_04\\launch4j-tmp\\JDownloader.exe"= "c:\\WINDOWS\\system32\\java.exe"= "c:\\Documents and Settings\\Laptop\\Pulpit\\szymon\\yur ots\\ots\\YurOTS.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "c:\\Program Files\\UltraVNC\\vncviewer.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "5900:TCP"= 5900:TCP:vnc5900 "5800:TCP"= 5800:TCP:vnc5800 S3 Ndisprot;ArcNet NDIS Protocol Driver;\??\c:\windows\system32\drivers\Ndisprot.sys [2008-11-13 27904] . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-27 17:56:18 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1064) c:\windows\system32\Ati2evxx.dll . Czas ukończenia: 2008-11-27 17:56:46 ComboFix-quarantined-files.txt 2008-11-27 16:56:33 ComboFix2.txt 2008-11-27 16:10:27 Przed: 9 553 899 520 bajtów wolnych Po: 9,538,744,320 bajtów wolnych 110 --- E O F --- 2008-11-12 11:28:20

**Posty:** 8001 · przez **Okocza** 27 Lis 2008, 19:03

usuń C:\QooBox z dysku i daj log jeszcze z FixIEDef

**Posty:** 6403 · przez **Robert** 27 Lis 2008, 19:13

jest

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.20.6825 * * * ******************************************************************************** Created at 18:11:36 on Thursday, November 27, 2008 Time Zone : Logged On User : Laptop Operating System : Microsoft Windows XP Home Edition Dodatek Service Pack 3 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 Intel(R) Core(TM)2 CPU T7200 @ 2.00GHz System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System System Drive Size : 20 GB System Drive Free : 9.06 GB Total Physical Memory: 1014 MB Free Physical Memory : 599 MB Total Page File : 1014 MB Free Page File : 2139 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1974 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

Vista:

Kod: Zaznacz wszystko: Logfile of random's system information tool 1.04 (written by random/random) Run by Robert at 2008-11-27 17:41:40 Microsoft® Windows Vista™ Ultimate Service Pack 1 System drive C: has 4 GB (12%) free of 31 GB Total RAM: 4094 MB (63% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:41:41, on 2008-11-27 Platform: Windows Vista SP1 (WinNT 6.00.1905) MSIE: Internet Explorer v7.00 (7.00.6001.18000) Boot mode: Normal Running processes: G:\DAEMON Tools Lite\daemon.exe C:\Users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe C:\Windows\bootminder.exe C:\Program Files (x86)\Grisoft\AVG7\avgcc.exe C:\Program Files (x86)\Java\jre1.6.0_07\bin\jusched.exe G:\FLASH\ADOBEF~2\Flash.exe G:\firefox\firefox.exe C:\Program Files (x86)\Kadu\kadu.exe G:\sciagane\RSIT.exe G:\HJ\Robert.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = F2 - REG:system.ini: UserInit=userinit.exe O1 - Hosts: ::1 localhost O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - C:\Program Files (x86)\HP\Smart Web Printing\hpswp_framework.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files (x86)\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {0F3B27FC-EB8C-470C-B233-E8E61B3F6256} - C:\Windows\SysWow64\AuxiliaryDisplayAp.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files (x86)\FlashGet\jccatch.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files (x86)\FlashGet\getflash.dll O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~2\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin O4 - HKCU\..\Run: [DAEMON Tools Lite] "G:\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe" O4 - HKCU\..\Run: [ehTray.exe] C:\Windows\ehome\ehTray.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [Google Update] "C:\Users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe" /c O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~2\Grisoft\AVG7\avgw.exe /RUNONCE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~2\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~2\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: Adobe Gamma.lnk = C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Startup: Bootminder 2.lnk = C:\Windows\bootminder.exe O4 - Global Startup: Microsoft Office.lnk = G:\Office\Office\OSA9.EXE O8 - Extra context menu item: &Ściągnij przy pomocy FlashGet'a - C:\Program Files (x86)\FlashGet\jc_link.htm O8 - Extra context menu item: &Ściągnij wszystko przy pomocy FlashGet'a - C:\Program Files (x86)\FlashGet\jc_all.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~2\Java\JRE16~2.0_0\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~2\Java\JRE16~2.0_0\bin\ssv.dll O9 - Extra button: Kolekcja wycinków HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - C:\Program Files (x86)\HP\Smart Web Printing\hpswp_extensions.dll O9 - Extra button: Zaznaczanie HP Smart - {700259D7-1666-479a-93B1-3250410481E8} - C:\Program Files (x86)\HP\Smart Web Printing\hpswp_extensions.dll O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files (x86)\FlashGet\FlashGet.exe O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files (x86)\FlashGet\FlashGet.exe O13 - Gopher Prefix: O17 - HKLM\System\CCS\Services\Tcpip\..\{0A38A6E4-AEE9-48FD-ABFE-D715585E6EC8}: NameServer = 192.168.2.1 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Acronis OS Selector Reinstall Service (AcronisOSSReinstallSvc) - Unknown owner - C:\Program Files (x86)\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing) O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVG7\avgupsvc.exe O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVG7\avgrssvc.exe O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~2\Grisoft\AVG7\avgemc.exe O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files (x86)\Bonjour\mDNSResponder.exe O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing) O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing) O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: FLEXnet Licensing Service 64 - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing) O23 - Service: NBService - Nero AG - G:\Nero 7\Nero 7\Nero BackItUp\NBService.exe O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: NMIndexingService - Nero AG - C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing) O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe O23 - Service: PnkBstrB - Unknown owner - C:\Windows\system32\PnkBstrB.exe O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing) O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing) O23 - Service: ServiceLayer - Nokia. - C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing) O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing) O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing) O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing) O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing) O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing) O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing) O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing) O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing) -- End of file - 9938 bytes ======Scheduled tasks folder====== C:\Windows\tasks\GoogleUpdateTaskUser.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{053F9267-DC04-4294-A72C-58F732D338C0}] HP Print Clips - C:\Program Files (x86)\HP\Smart Web Printing\hpswp_framework.dll [2007-03-02 177768] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] AcroIEHlprObj Class - C:\Program Files (x86)\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll [2003-11-03 54248] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0F3B27FC-EB8C-470C-B233-E8E61B3F6256}] C:\Windows\SysWow64\AuxiliaryDisplayAp.dll [2008-11-13 116480] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}] Skype add-on (mastermind) - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2008-02-06 1372160] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2F364306-AA45-47B5-9F9D-39A8B94E7EF7}] FGCatchUrl - C:\Program Files (x86)\FlashGet\jccatch.dll [2007-08-06 94308] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] SSVHelper Class - C:\Program Files (x86)\Java\jre1.6.0_07\bin\ssv.dll [2008-06-10 509328] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F156768E-81EF-470C-9057-481BA8380DBA}] FlashGet GetFlash Class - C:\Program Files (x86)\FlashGet\getflash.dll [2007-05-18 163840] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "AVG7_CC"=C:\PROGRA~2\Grisoft\AVG7\avgcc.exe [2008-06-28 580096] "SunJavaUpdateSched"=C:\Program Files (x86)\Java\jre1.6.0_07\bin\jusched.exe [2008-06-10 144784] "AdobeCS4ServiceManager"=C:\Program Files (x86)\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "DAEMON Tools Lite"=G:\DAEMON Tools Lite\daemon.exe [2008-04-01 486856] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe [] "ehTray.exe"=C:\Windows\ehome\ehTray.exe [2008-01-19 138240] "Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2008-01-19 1555968] "Google Update"=C:\Users\Robert\AppData\Local\Google\Update\GoogleUpdate.exe [2008-09-02 133104] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup Microsoft Office.lnk - G:\Office\Office\OSA9.EXE C:\Users\Robert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup Adobe Gamma.lnk - C:\Program Files (x86)\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe Bootminder 2.lnk - C:\Windows\bootminder.exe [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "EnableLUA"=0 "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "EnableUIADesktopToggle"=0 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoActiveDesktop"= "NoActiveDesktopChanges"= "ForceActiveDesktopOn"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c586ea7b-088f-11dd-b8c3-0019dbf418f8}] shell\AutoRun\command - E:\Autorun.exe ======List of files/folders created in the last 1 months====== 2008-11-27 17:41:40 ----D---- C:\rsit 2008-11-27 08:52:05 ----D---- C:\Program Files (x86)\Bonjour 2008-11-26 22:18:09 ----A---- C:\Windows\system32\NPSWF32_FlashUtil.exe 2008-11-26 22:18:09 ----A---- C:\Windows\system32\NPSWF32.dll 2008-11-26 20:11:17 ----A---- C:\Windows\ntbtlog.txt 2008-11-26 20:04:18 ----A---- C:\Windows\bootminder.exe 2008-11-26 19:51:52 ----A---- C:\mbr.exe 2008-11-25 22:33:46 ----D---- C:\Program Files (x86)\HDD Regenerator 2008-11-25 19:54:43 ----D---- C:\Program Files (x86)\SoftLogica 2008-11-25 17:37:52 ----D---- C:\Windows\Crack 2008-11-25 17:16:05 ----A---- C:\menu_lst.bak 2008-11-23 17:15:19 ----D---- C:\Program Files (x86)\Ontrack 2008-11-21 22:39:46 ----D---- C:\Program Files (x86)\Active Data Recovery Services 2008-11-21 16:22:03 ----A---- C:\Windows\system32\XAudio2_1.dll 2008-11-21 16:22:03 ----A---- C:\Windows\system32\XAPOFX1_0.dll 2008-11-21 16:22:03 ----A---- C:\Windows\system32\xactengine3_1.dll 2008-11-21 16:22:02 ----A---- C:\Windows\system32\X3DAudio1_4.dll 2008-11-19 18:29:24 ----D---- C:\Users\Robert\AppData\Roaming\Leadertech 2008-11-12 14:19:01 ----A---- C:\Windows\system32\msxml3.dll 2008-11-12 14:18:57 ----A---- C:\Windows\system32\msxml6.dll 2008-11-08 21:35:03 ----D---- C:\ProgramData\Acronis 2008-11-08 21:20:48 ----D---- C:\Program Files (x86)\Common Files\Acronis 2008-11-06 21:04:50 ----D---- C:\Users\Robert\AppData\Roaming\Auslogics 2008-11-02 22:54:25 ----A---- C:\Windows\system32\msshooks.dll 2008-11-02 22:54:25 ----A---- C:\Windows\system32\msscb.dll 2008-11-02 22:54:25 ----A---- C:\Windows\system32\mimefilt.dll 2008-11-02 22:54:21 ----A---- C:\Windows\system32\SearchFilterHost.exe 2008-11-02 22:54:21 ----A---- C:\Windows\system32\propdefs.dll 2008-11-02 22:54:21 ----A---- C:\Windows\system32\msstrc.dll 2008-11-02 22:54:21 ----A---- C:\Windows\system32\mssitlb.dll 2008-11-02 22:54:21 ----A---- C:\Windows\system32\chsbrkr.dll 2008-11-02 22:54:20 ----A---- C:\Windows\system32\xmlfilter.dll 2008-11-02 22:54:20 ----A---- C:\Windows\system32\thawbrkr.dll 2008-11-02 22:54:20 ----A---- C:\Windows\system32\SearchProtocolHost.exe 2008-11-02 22:54:20 ----A---- C:\Windows\system32\rtffilt.dll 2008-11-02 22:54:20 ----A---- C:\Windows\system32\propsys.dll 2008-11-02 22:54:20 ----A---- C:\Windows\system32\offfilt.dll 2008-11-02 22:54:20 ----A---- C:\Windows\system32\nlhtml.dll 2008-11-02 22:54:20 ----A---- C:\Windows\system32\mssprxy.dll 2008-11-02 22:54:20 ----A---- C:\Windows\system32\mssphtb.dll 2008-11-02 22:54:20 ----A---- C:\Windows\system32\mssph.dll 2008-11-02 22:54:20 ----A---- C:\Windows\system32\msshsq.dll 2008-11-02 22:54:20 ----A---- C:\Windows\system32\msscntrs.dll 2008-11-02 22:54:20 ----A---- C:\Windows\system32\korwbrkr.dll 2008-11-02 22:54:20 ----A---- C:\Windows\system32\chtbrkr.dll 2008-11-02 22:54:19 ----A---- C:\Windows\system32\tquery.dll 2008-11-02 22:54:19 ----A---- C:\Windows\system32\SearchIndexer.exe 2008-11-02 22:54:19 ----A---- C:\Windows\system32\mssvp.dll 2008-11-02 22:54:19 ----A---- C:\Windows\system32\mssrch.dll 2008-11-02 17:38:44 ----A---- C:\Windows\system32\psisdecd.dll 2008-11-02 17:38:44 ----A---- C:\Windows\system32\EncDec.dll 2008-10-30 22:08:32 ----D---- C:\Users\Robert\AppData\Roaming\Red Alert 3 2008-10-30 21:59:53 ----A---- C:\Windows\system32\d3dx10_38.dll 2008-10-30 21:59:53 ----A---- C:\Windows\system32\D3DCompiler_38.dll 2008-10-30 21:59:51 ----A---- C:\Windows\system32\D3DX9_38.dll 2008-10-29 06:10:22 ----A---- C:\Windows\system32\win32spl.dll 2008-10-29 06:10:20 ----A---- C:\Windows\system32\Faultrep.dll ======List of files/folders modified in the last 1 months====== 2008-11-27 17:41:41 ----D---- C:\Windows\Prefetch 2008-11-27 17:38:16 ----D---- C:\Windows\Temp 2008-11-27 17:18:17 ----D---- C:\Users\Robert\AppData\Roaming\Kadu 2008-11-27 16:41:43 ----D---- C:\Windows\System32 2008-11-27 16:41:43 ----D---- C:\Windows\inf 2008-11-27 16:06:53 ----SHD---- C:\System Volume Information 2008-11-27 15:00:13 ----D---- C:\Users\Robert\AppData\Roaming\AVG7 2008-11-27 09:54:46 ----D---- C:\ProgramData\Adobe 2008-11-27 09:08:56 ----D---- C:\Users\Robert\AppData\Roaming\Adobe 2008-11-27 08:55:29 ----SHD---- C:\Windows\Installer 2008-11-27 08:52:06 ----D---- C:\Windows\SysWOW64 2008-11-27 08:52:05 ----RD---- C:\Program Files (x86) 2008-11-27 08:52:03 ----D---- C:\Program Files (x86)\Common Files\Adobe 2008-11-27 08:51:17 ----D---- C:\Program Files (x86)\Adobe 2008-11-27 08:45:38 ----D---- C:\Windows\winsxs 2008-11-26 20:11:17 ----D---- C:\Windows 2008-11-26 18:26:42 ----D---- C:\Users\Robert\AppData\Roaming\foobar2000 2008-11-26 18:10:46 ----AD---- C:\ProgramData\TEMP 2008-11-26 15:22:28 ----A---- C:\Windows\system32\PnkBstrB.exe 2008-11-25 22:31:50 ----RD---- C:\Program Files 2008-11-25 17:15:47 ----D---- C:\Windows\addins 2008-11-25 16:02:56 ----D---- C:\Users\Robert\AppData\Roaming\uTorrent 2008-11-23 17:52:13 ----HD---- C:\Program Files (x86)\InstallShield Installation Information 2008-11-23 17:06:47 ----D---- C:\Users\Robert\AppData\Roaming\App Launcher Gadget 2008-11-21 22:45:17 ----RHD---- C:\$VAULT$.AVG 2008-11-21 16:22:55 ----HD---- C:\ProgramData 2008-11-21 16:21:43 ----RSD---- C:\Windows\assembly 2008-11-21 16:19:53 ----A---- C:\Windows\system32\PnkBstrA.exe 2008-11-21 16:19:53 ----A---- C:\Windows\system32\pbsvc.exe 2008-11-21 08:04:47 ----D---- C:\Program Files (x86)\UltraVNC 2008-11-19 21:36:35 ----D---- C:\Windows\Tasks 2008-11-13 19:51:34 ----A---- C:\Windows\system32\AuxiliaryDisplayAp.dll 2008-11-13 18:40:45 ----A---- C:\Windows\NeroDigital.ini 2008-11-09 22:26:06 ----D---- C:\Users\Robert\AppData\Roaming\Hamachi 2008-11-09 13:44:49 ----D---- C:\Windows\Minidump 2008-11-08 21:25:22 ----D---- C:\Windows\system32\drivers 2008-11-08 21:20:48 ----AD---- C:\Program Files (x86)\Common Files 2008-11-03 07:37:59 ----D---- C:\Windows\rescache 2008-11-03 07:21:10 ----D---- C:\Windows\system32\pl-PL 2008-11-03 07:21:08 ----D---- C:\Windows\PolicyDefinitions 2008-11-02 22:55:12 ----D---- C:\Windows\Microsoft.NET 2008-11-02 22:54:13 ----D---- C:\Windows\ehome 2008-11-01 21:54:56 ----D---- C:\Users\Robert\AppData\Roaming\Xfire 2008-11-01 18:43:10 ----D---- C:\ProgramData\Xfire ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 AvgCln64;AVG7 Clean Driver (x64); C:\Windows\System32\Drivers\avgcln64.sys [] R1 AvgMfx64;AVG Minifilter x64 Resident Driver; C:\Windows\System32\Drivers\avgmfx64.sys [] R1 CSC;Offline Files Driver; C:\Windows\system32\drivers\csc.sys [] R2 adfs;adfs; C:\Windows\system32\drivers\adfs.sys [2008-08-14 74720] R2 atksgt;atksgt; C:\Windows\system32\DRIVERS\atksgt.sys [] R2 lirsgt;lirsgt; C:\Windows\system32\DRIVERS\lirsgt.sys [] R3 AvgWFPx64;AVG7 Firewall Driver x64; C:\Windows\System32\Drivers\avgwfpx64.sys [] R3 hamachi;Hamachi Network Interface; C:\Windows\system32\DRIVERS\hamachi.sys [] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys [] R3 ksthunk;Kernel Streaming Thunks; C:\Windows\system32\drivers\ksthunk.sys [] R3 LHidFilt;Logitech SetPoint KMDF HID Filter Driver; C:\Windows\system32\DRIVERS\LHidFilt.Sys [] R3 LMouFilt;Logitech SetPoint KMDF Mouse Filter Driver; C:\Windows\system32\DRIVERS\LMouFilt.Sys [] R3 LUsbFilt;Logitech SetPoint KMDF USB Filter; C:\Windows\System32\Drivers\LUsbFilt.Sys [] R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [] R3 pcouffin;VSO Software pcouffin; C:\Windows\System32\Drivers\pcouffin.sys [] R3 RTL8169;Realtek 8169 NT Driver; C:\Windows\system32\DRIVERS\Rtlh64.sys [] R3 WmBEnum;Logitech Virtual Bus Enumerator Driver; C:\Windows\system32\drivers\WmBEnum.sys [] R3 WmFilter;Logitech Gaming HID Filter Driver; C:\Windows\system32\drivers\WmFilter.sys [] R3 WmHidLo;Logitech Gaming USB Filter Driver; C:\Windows\system32\drivers\WmHidLo.sys [] R3 WmVirHid;Logitech Virtual Hid Device Driver; C:\Windows\system32\drivers\WmVirHid.sys [] R3 WmXlCore;Logitech Translation Layer Driver; C:\Windows\system32\drivers\WmXlCore.sys [] S3 al417bwv;al417bwv; C:\Windows\system32\drivers\al417bwv.sys [] S3 Dot4;Sterownik MS IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4.sys [] S3 Dot4Print;Sterownik klasy drukowania dla IEEE-1284.4; C:\Windows\system32\DRIVERS\Dot4Prt.sys [] S3 dot4usb;MS Dot4USB Filter Dot4USB Filter; C:\Windows\system32\DRIVERS\dot4usb.sys [] S3 drmkaud;Microsoft Kernel DRM Audio Descrambler; C:\Windows\system32\drivers\drmkaud.sys [] S3 ENTECH64;ENTECH64; \??\C:\Windows\system32\DRIVERS\ENTECH64.sys [2004-06-22 5632] S3 GMSIPCI;GMSIPCI; \??\D:\INSTALL\GMSIPCI.SYS [] S3 HdAudAddService;Sterownik funkcji Microsoft 1.1 UAA dla usługi standardu High Definition Audio; C:\Windows\system32\drivers\HdAudio.sys [] S3 L8042Kbd;SetPoint Keyboard Driver; C:\Windows\system32\DRIVERS\L8042Kbd.sys [] S3 L8042mou;SetPoint PS/2 Mouse Filter Driver; C:\Windows\system32\DRIVERS\L8042mou.Sys [] S3 LMouKE;SetPoint Mouse Filter Driver; C:\Windows\system32\DRIVERS\LMouKE.Sys [] S3 LVcKap64;Logitech AEC Driver; C:\Windows\system32\DRIVERS\LVcKap64.sys [] S3 mbr;mbr; \??\C:\Users\Robert\AppData\Local\Temp\mbr.sys [] S3 MSKSSRV;Serwer proxy usługi Microsoft Streaming; C:\Windows\system32\drivers\MSKSSRV.sys [] S3 MSPCLOCK;Serwer proxy zegara Microsoft Streaming; C:\Windows\system32\drivers\MSPCLOCK.sys [] S3 MSPQM;Serwer proxy menedżera jakości Microsoft Streaming; C:\Windows\system32\drivers\MSPQM.sys [] S3 MSTEE;Konwerter strumieni Tee/Sink-to-Sink Microsoft Streaming; C:\Windows\system32\drivers\MSTEE.sys [] S3 nmwcdcx64;Nokia USB Generic; C:\Windows\system32\drivers\ccdcmbox64.sys [] S3 nmwcdx64;Nokia USB Phone Parent; C:\Windows\system32\drivers\ccdcmbx64.sys [] S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\Windows\system32\DRIVERS\pccsmcfdx64.sys [] S3 RivaTuner64;RivaTuner64; \??\C:\Program Files (x86)\RivaTuner v2.08\RivaTuner64.sys [2008-04-23 19952] S3 TCCrystalCpuInfo;TCCrystalCpuInfo; \??\C:\Users\Robert\AppData\Local\Temp\TCCpuInfo64.sys [] S3 upperdev;upperdev; C:\Windows\system32\DRIVERS\usbser_lowerfltx64.sys [] S3 usbscan;Sterownik skanera USB; C:\Windows\system32\DRIVERS\usbscan.sys [] S3 usbser;Nokia USB Serial Port; C:\Windows\system32\DRIVERS\usbser.sys [] S3 UsbserFilt;UsbserFilt; C:\Windows\system32\DRIVERS\usbser_lowerfltx64j.sys [] S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [] S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 Avg7Alrt;AVG7 Alert Manager Server; C:\PROGRA~2\Grisoft\AVG7\avgamsvr.exe [2008-04-12 418816] R2 Avg7UpdSvc;AVG7 Update Service; C:\PROGRA~2\Grisoft\AVG7\avgupsvc.exe [2008-04-12 49664] R2 AvgCoreSvc;AVG7 Resident Shield Service; C:\PROGRA~2\Grisoft\AVG7\avgrssvc.exe [2008-04-12 192512] R2 AVGEMS;AVG E-mail Scanner; C:\PROGRA~2\Grisoft\AVG7\avgemc.exe [2008-04-12 406528] R2 Bonjour Service;##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762##; C:\Program Files (x86)\Bonjour\mDNSResponder.exe [2006-02-28 229376] R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2008-01-19 21504] R2 hpqddsvc;Usługa HP CUE DeviceDiscovery; C:\Windows\system32\svchost.exe [2008-01-19 21504] R2 Net Driver HPZ12;Net Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504] R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [] R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\Windows\System32\svchost.exe [2008-01-19 21504] R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2008-11-21 66872] R2 PnkBstrB;PnkBstrB; C:\Windows\system32\PnkBstrB.exe [2008-11-26 202040] R3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2008-10-24 655624] R3 hpqcxs08;hpqcxs08; C:\Windows\system32\svchost.exe [2008-01-19 21504] S2 AcronisOSSReinstallSvc;Acronis OS Selector Reinstall Service; C:\Program Files (x86)\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe [2007-03-09 2232177] S3 Adobe LM Service;Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2008-04-12 72704] S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2008-01-19 21504] S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2008-01-05 93696] S3 Fax;@%systemroot%\system32\fxsresm.dll,-118; C:\Windows\system32\fxssvc.exe [] S3 FLEXnet Licensing Service 64;FLEXnet Licensing Service 64; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService64.exe [2008-10-24 1038088] S3 IDriverT;InstallDriver Table Manager; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-03 69632] S3 NBService;NBService; G:\Nero 7\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040] S3 NMIndexingService;NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848] S3 PerfHost;@%systemroot%\sysWow64\perfhost.exe,-2; C:\Windows\SysWow64\perfhost.exe [2008-01-19 19968] S3 ServiceLayer;ServiceLayer; C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe [2008-04-07 430592] S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2008-01-19 21504] S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe [] -----------------EOF-----------------

Kod: Zaznacz wszystko: info.txt logfile of random's system information tool 1.04 2008-11-27 17:41:42 ======Uninstall list====== -->C:\Windows\UNNeroBackItUp.exe /UNINSTALL -->C:\Windows\UNNeroMediaHome.exe /UNINSTALL -->C:\Windows\UNNeroShowTime.exe /UNINSTALL -->C:\Windows\UNNeroVision.exe /UNINSTALL -->C:\Windows\UNRecode.exe /UNINSTALL -->G:\Nero 7\Nero 7\\nero\uninstall\UNNERO.exe /UNINSTALL -->MsiExec /X{A7E07C2B-2220-4415-87E3-784D5814BC93} Acronis Disk Director Suite-->MsiExec.exe /X{2300EE96-0A41-4FAB-BD03-989EC44577A0} Active@ File Recovery 7.3-->"C:\Program Files (x86)\Active Data Recovery Services\Active File Recovery\UNWISE.EXE" "C:\Program Files (x86)\Active Data Recovery Services\Active File Recovery\INSTALL.LOG" Adobe AIR-->C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall Adobe AIR-->MsiExec.exe /I{197A3012-8C85-4FD3-AB66-9EC7E13DB92E} Adobe Anchor Service CS3-->MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95} Adobe Anchor Service CS4-->MsiExec.exe /I{1618734A-3957-4ADD-8199-F973763109A8} Adobe Asset Services CS3-->MsiExec.exe /I{6D12B99F-EAAA-49D8-8E2F-74FA7459CCB2} Adobe Bridge 1.0-->MsiExec.exe /I{B74D4E10-1033-0000-0000-000000000001} Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394} Adobe Bridge CS4-->MsiExec.exe /I{83877DB1-8B77-45BC-AB43-2BAC22E093E0} Adobe Bridge Start Meeting-->MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23} Adobe Camera Raw 4.0-->MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C} Adobe CMaps CS4-->MsiExec.exe /I{94D398EB-D2FD-4FD1-B8C4-592635E8A191} Adobe Color - Photoshop Specific CS4-->MsiExec.exe /I{3D2C9DE6-9ADE-4252-A241-E43723B0CE02} Adobe Color EU Extra Settings CS4-->MsiExec.exe /I{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4} Adobe Color EU Recommended Settings-->MsiExec.exe /I{BD087F50-46B2-43E4-BD73-5DB3DC20B47C} Adobe Color JA Extra Settings CS4-->MsiExec.exe /I{0D6013AB-A0C7-41DC-973C-E93129C9A29F} Adobe Color NA Extra Settings-->MsiExec.exe /I{6179A7D2-A668-4F1D-BC9A-DCC6A10C7871} Adobe Color NA Recommended Settings CS4-->MsiExec.exe /I{00ADFB20-AE75-46F4-AD2C-F48B15AC3100} Adobe Color Video Profiles CS CS4-->MsiExec.exe /I{63C24A08-70F3-4C8E-B9FB-9F21A903801D} Adobe Common File Installer-->MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5B39} Adobe CSI CS4-->MsiExec.exe /I{0F723FC1-7606-4867-866C-CE80AD292DAF} Adobe Default Language CS4-->MsiExec.exe /I{C52E3EC1-048C-45E1-8D53-10B0C6509683} Adobe Device Central CS3-->MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD} Adobe Device Central CS4-->MsiExec.exe /I{67F0E67A-8E93-4C2C-B29D-47C48262738A} Adobe Drive CS4-->MsiExec.exe /I{16E16F01-2E2D-4248-A42F-76261C147B6C} Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{C2D69781-F392-4118-A5A7-C7E9C38DBFC2} Adobe ExtendScript Toolkit CS4-->MsiExec.exe /I{F8EF2B3F-C345-4F20-8FE4-791A20333CD5} Adobe Extension Manager CS4-->MsiExec.exe /I{054EFA56-2AC1-48F4-A883-0AB89874B972} Adobe Flash CS3 Professional-->C:\Program Files (x86)\Common Files\Adobe\Installers\71a8bf4cec3050e55425a301eec8315\Setup.exe Adobe Flash CS3-->MsiExec.exe /I{036EB57A-C65F-4EB8-9E85-30E2E9B01EEB} Adobe Flash Player 9 ActiveX-->MsiExec.exe /X{BC4F8E84-5E29-49EC-B4E7-E6F9CB50986C} Adobe Flash Player 9 Plugin-->MsiExec.exe /X{88D422DB-E9C7-4E16-9D80-2999F4FD6AD9} Adobe Flash Player ActiveX-->C:\Windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe Adobe Flash Video Encoder-->MsiExec.exe /I{BC281424-2BA0-43A6-99CF-A458B5450FCF} Adobe Fonts All-->MsiExec.exe /I{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794} Adobe Help Center 1.0-->MsiExec.exe /I{E9787678-1033-0000-8E67-000000000001} Adobe Help Viewer CS3-->MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245} Adobe Linguistics CS3-->MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078} Adobe Linguistics CS4-->MsiExec.exe /I{931AB7EA-3656-4BB7-864D-022B09E3DD67} Adobe Media Player-->msiexec /qb /x {39F6E2B4-CFE8-C30A-66E8-489651F0F34C} Adobe Media Player-->MsiExec.exe /I{39F6E2B4-CFE8-C30A-66E8-489651F0F34C} Adobe Output Module-->MsiExec.exe /I{BB4E33EC-8181-4685-96F7-8554293DEC6A} Adobe PDF Library Files CS4-->MsiExec.exe /I{F93C84A6-0DC6-42AF-89FA-776F7C377353} Adobe Photoshop CS2-->msiexec /I {236BB7C4-4419-42FD-0409-1E257A25E34D} Adobe Photoshop CS4 Support-->MsiExec.exe /I{63E5CDBF-8214-4F03-84F8-CD3CE48639AD} Adobe Photoshop CS4-->C:\Program Files (x86)\Common Files\Adobe\Installers\faf656ef605427ee2f42989c3ad31b8\Setup.exe --uninstall=1 Adobe Photoshop CS4-->MsiExec.exe /I{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494} Adobe Photoshop CS4-->MsiExec.exe /I{E4848436-0345-47E2-B648-8B522FCDA623} Adobe Reader 6.0.2 CE-->MsiExec.exe /I{AC76BA86-7AD7-1038-7B44-CEA000000001} Adobe Search for Help-->MsiExec.exe /I{F0E64E2E-3A60-40D8-A55D-92F6831875DA} Adobe Service Manager Extension-->MsiExec.exe /I{4943EFF5-229F-435D-BEA9-BE3CAEA783A7} Adobe Setup-->MsiExec.exe /I{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23} Adobe Setup-->MsiExec.exe /I{75324DDC-D7D8-4CA1-9E10-85C439948516} Adobe Shockwave Player-->C:\Windows\System32\Adobe\SHOCKW~1\UNWISE.EXE C:\Windows\System32\Adobe\SHOCKW~1\Install.log Adobe Stock Photos 1.0-->MsiExec.exe /I{786C5747-1033-0000-B58E-000000000001} Adobe Type Support CS4-->MsiExec.exe /I{820D3F45-F6EE-4AAF-81EF-CE21FF21D230} Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8} Adobe Update Manager CS4-->MsiExec.exe /I{05308C4E-7285-4066-BAE3-6B50DA6ED755} Adobe Version Cue CS3 Client-->MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5} Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6} Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF} Adobe XMP Panels CS4-->MsiExec.exe /I{3A4E8896-C2E7-4084-A4A4-B8FD1894E739} AdobeColorCommonSetCMYK-->MsiExec.exe /I{68243FF8-83CA-466B-B2B8-9F99DA5479C4} AdobeColorCommonSetRGB-->MsiExec.exe /I{16E6D2C1-7C90-4309-8EC4-D2212690AAA4} Age of Empires III - The Asian Dynasties-->C:\Program Files (x86)\InstallShield Installation Information\{C43C1415-3DFC-4089-9A32-0BECF28A6046}\setup.exe -runfromtemp -l0x0409 Age of Empires III - The WarChiefs-->C:\Program Files (x86)\InstallShield Installation Information\{1C08A24C-B168-407E-A826-68FAF5F20710}\setup.exe -runfromtemp -l0x0415 Age of Empires III-->C:\PROGRA~2\COMMON~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97} Apple Software Update-->MsiExec.exe /I{02DFF6B1-1654-411C-8D7B-FD6052EF016F} Archiwizator WinRAR-->C:\Program Files (x86)\WinRAR\uninstall.exe Aspi Installer-->C:\Temp\UNWISE.EXE C:\Temp\INSTALL.LOG Assassin's Creed-->C:\Program Files (x86)\InstallShield Installation Information\{8CFA9151-6404-409A-AF22-4632D04582FD}\setup.exe -runfromtemp -l0x0009 -removeonly AusLogics Disk Defrag-->"G:\AusLogics Disk Defrag\unins000.exe" AVG 7.5-->C:\Program Files (x86)\Grisoft\AVG7\setup.exe /UNINSTALL Brothers in Arms: Hell's Highway-->G:\GRY\BIA\Binaries\uninst.exe Call of Duty(R) - World at War(TM)-->C:\Program Files (x86)\InstallShield Installation Information\{D80A6A73-E58A-4673-AFF5-F12D7110661F}\setup.exe -runfromtemp -l0x0409 Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch-->C:\Program Files (x86)\InstallShield Installation Information\{3BD633E0-4BF8-4499-9149-88F0767D449C}\setup.exe -runfromtemp -l0x0409 Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Multiplayer Patch-->C:\Program Files (x86)\InstallShield Installation Information\{8503C901-85D7-4262-88D2-8D8B2A7B08B8}\setup.exe -runfromtemp -l0x0409 Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch-->C:\Program Files (x86)\InstallShield Installation Information\{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}\setup.exe -runfromtemp -l0x0409 Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch-->C:\Program Files (x86)\InstallShield Installation Information\{931C37FC-594D-43A9-B10F-A2F2B1F03498}\setup.exe -runfromtemp -l0x0409 Call of Duty(R) 4 - Modern Warfare(TM)-->C:\Program Files (x86)\InstallShield Installation Information\{E48469CC-635E-4FD5-A122-1497C286D217}\setup.exe -runfromtemp -l0x0415 CCleaner (remove only)-->"G:\CC\CCleaner\uninst.exe" CloneDVD 4.1.0.23-->"C:\Program Files (x86)\CloneDVD\unins000.exe" Command & Conquer 3-->MsiExec.exe /I{B0C30E93-D3D9-4F04-A2AC-54749B573275} Command & Conquer™ 3: Gniew Kane'a-->MsiExec.exe /I{CC2422C9-F7B5-4175-B295-5EC2283AA674} Command & Conquer™ Red Alert™ 3-->MsiExec.exe /X{296D8550-CB06-48E4-9A8B-E5034FB64715} Connect-->MsiExec.exe /I{B29AD377-CC12-490A-A480-1452337C618D} Crysis(R)-->MsiExec.exe /I{000E79B7-E725-4F01-870A-C12942B7F8E4} DiRT-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{57B89E30-0BBA-4F20-9F2C-8E8CDE1CEDB6}\setup.exe" -l0x9 -removeonly Euro Truck Simulator 1.00-->G:\Euro Truck Simulator\uninst.exe Far Cry 2-->"C:\Program Files (x86)\InstallShield Installation Information\{F2835483-37F2-4123-B4FE-0E77D58447F2}\setup.exe" -runfromtemp -l0x0015 -removeonly FlashGet 1.9.6.1073-->C:\Program Files (x86)\FlashGet\uninst.exe foobar2000 v0.9.5.1-->"G:\foobar2000\uninstall.exe" Gadu-Gadu 7.7-->C:\Program Files (x86)\Gadu-Gadu\Setup.exe GRID-->"C:\Program Files (x86)\InstallShield Installation Information\{5A0B7BA5-4682-4273-81C2-69B17E649103}\setup.exe" -runfromtemp -l0x0009 -removeonly Hamachi 1.0.3.0-->C:\Program Files (x86)\Hamachi\uninstall.exe Handy Recovery 4.0-->C:\PROGRA~2\SOFTLO~1\HANDYR~1\UNWISE.EXE C:\PROGRA~2\SOFTLO~1\HANDYR~1\INSTALL.LOG HDD Regenerator-->MsiExec.exe /X{9064B17E-9FC9-439D-A4A0-668EC6AAFDEC} HijackThis 2.0.2-->"G:\HJ\HijackThis.exe" /uninstall HP Smart Web Printing-->MsiExec.exe /X{415CDA53-9100-476F-A7B2-476691E117C7} HP Update-->MsiExec.exe /X{AB40272D-92AB-4F30-B36B-22EDE16F8FE5} HPSSupply-->MsiExec.exe /X{487B0B9B-DCD4-440D-89A0-A6EDE1A545A3} Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050} Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070} Kadu 0.6.5-rc1-->MsiExec.exe /I{72671469-D341-4F23-AA99-405D41A785B8} K-Lite Mega Codec Pack 3.8.5-->"G:\K-Lite Codec Pack\unins000.exe" kuler-->MsiExec.exe /I{098727E1-775A-4450-B573-3F441F1CA243} MediaInfo 0.7.6.4-->C:\Program Files (x86)\MediaInfo\uninst.exe Microsoft Office 2000 Premium-->MsiExec.exe /I{00000415-78E1-11D2-B60F-006097C998E7} Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d} Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7} MKVtoolnix 2.3.0-->G:\MKVTNix\MKVtoolnix\uninst.exe Mozilla Firefox (2.0.0.18)-->G:\firefox\uninstall\helper.exe MSVC80_x86-->MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27} MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF} MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF} MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71} Need for Speed™ Most Wanted-->G:\GRY\Most Wanted\EAUninstall.exe Need for Speed™ ProStreet-->MsiExec.exe /X{CC419DDC-E0F0-4013-B25A-6FA036516F0D} Need for Speed™ Undercover-->MsiExec.exe /X{E6D22FE1-AB5F-42CA-9480-6F70B96DDD88} Nero 7 Premium-->MsiExec.exe /X{91C0B95B-B83A-4828-A775-BBE2DD421045} neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B} Nokia Connectivity Cable Driver-->MsiExec.exe /X{4F1DCA42-2030-437C-A94E-736692A499C1} Nokia PC Suite-->C:\ProgramData\Installations\{9C05FA75-0337-4523-AA57-9D3511018887}\Nokia_PC_Suite_rel_6_86_9_3_pol_web.exe Nokia PC Suite-->MsiExec.exe /I{9C05FA75-0337-4523-AA57-9D3511018887} NVIDIA PhysX v8.09.04-->MsiExec.exe /X{A7E07C2B-2220-4415-87E3-784D5814BC93} OpenAL-->"C:\Program Files (x86)\OpenAL\OalinstGridRelease.exe" /U PC Connectivity Solution-->MsiExec.exe /I{AC599724-5755-48C1-ABE7-ABB857652930} PDF Settings CS4-->MsiExec.exe /I{35D94F92-1D3A-43C5-8605-EA268B1A7BD9} Photoshop Camera Raw-->MsiExec.exe /I{CC75AB5C-2110-4A7F-AF52-708680D22FE8} Prime95-->"C:\Program Files (x86)\Prime95\Uninstall.exe" "C:\Program Files (x86)\Prime95\install.log" PTDD Partition Table Doctor 3.5-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{A35F88E5-A813-400C-AB99-09F5F5CDD2EC}\setup.exe" -l0x9 -removeonly PunkBuster Services-->C:\Windows\system32\pbsvc.exe -u Pure-->C:\Program Files (x86)\InstallShield Installation Information\{FF3C203A-2F19-43A2-9C7C-EC1B5A0FC873}\setup.exe -runfromtemp -l0x0009 Pure -removeonly QuickTime-->MsiExec.exe /I{08CA9554-B5FE-4313-938F-D4A417B81175} Realtek 8169 PCI, 8168 and 8101E PCIe Ethernet Network Card Driver for Windows Vista-->C:\Program Files (x86)\InstallShield Installation Information\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}\setup.exe -runfromtemp -l0x0015 -removeonly Realtek High Definition Audio Driver-->RtlUpd64.exe -r -m RivaTuner v2.08-->"C:\Program Files (x86)\RivaTuner v2.08\uninstall.exe" Safari-->MsiExec.exe /I{C9D96682-5A4D-45FA-BA3E-DDCB2B0CB868} Shockwave-->C:\Windows\System32\Macromed\SHOCKW~2\UNWISE.EXE C:\Windows\System32\Macromed\SHOCKW~2\INSTALL.LOG Skype™ 3.6-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82} SpeedFan (remove only)-->"C:\Program Files (x86)\SpeedFan\uninstall.exe" Suite Shared Configuration CS4-->MsiExec.exe /I{842B4B72-9E8F-4962-B3C1-1C422A5C4434} TG Editor-->G:\GRY\TRANSP~1\\UNWISE.EXE G:\GRY\TRANSP~1\\INSTALL.LOG THE SETTLERS - Narodziny Imperium-->"C:\Program Files (x86)\InstallShield Installation Information\{D3F80A98-05AB-4D8C-9272-766CCFA6A48D}\setup.exe" -runfromtemp -l0x0015 -removeonly Tibia MULTI-ip changer-->C:\Program Files (x86)\Asprate\Tibia Multi IP Changer\UNinstaller.exe Tibia-->"C:\Program Files (x86)\Tibia\unins000.exe" Tom Clancy's Rainbow Six Vegas 2-->"C:\Program Files (x86)\InstallShield Installation Information\{FD416706-875C-4B0B-A23A-9E740DAE029E}\setup.exe" -runfromtemp -l0x0009 -removeonly Total Commander (Remove or Repair)-->G:\totalcmd\tcuninst.exe Transport Giant GOLD-->MsiExec.exe /I{A248972D-94ED-43EB-9BEF-284C9921FE2B} UltraVNC 1.0.4-->"H:\UltraVNC\unins000.exe" WapSter AQQ-->G:\AQQ\uninstall.exe Win AVI HelixSDK-->"C:\Program Files (x86)\WinAVI Video Converter 9.0\HelixSDK\unins000.exe" WinAVI Video Converter 9.0-->"C:\Windows\WinAVI Video Converter 9.0\uninstall.exe" "/U:C:\Program Files (x86)\WinAVI Video Converter 9.0\Uninstall\uninstall.xml" Windows Installer Clean Up-->MsiExec.exe /X{121634B0-2F4B-11D3-ADA3-00C04F52DD52} Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4} Xfire (remove only)-->"G:\Xfire\uninst.exe" ======Hosts File====== 127.0.0.1 activate.adobe.com ======Security center information====== AV: AVG 7.5.526 (outdated) AS: Windows Defender ======Environment variables====== "ComSpec"=%SystemRoot%\system32\cmd.exe "FP_NO_HOST_CHECK"=NO "OS"=Windows_NT "Path"=C:\Program Files (x86)\PC Connectivity Solution\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files (x86)\Common Files\Adobe\AGL;C:\Program Files (x86)\QuickTime\QTSystem\ "PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC "PROCESSOR_ARCHITECTURE"=AMD64 "TEMP"=%SystemRoot%\TEMP "TMP"=%SystemRoot%\TEMP "USERNAME"=SYSTEM "windir"=%SystemRoot% "PROCESSOR_LEVEL"=6 "PROCESSOR_IDENTIFIER"=Intel64 Family 6 Model 23 Stepping 6, GenuineIntel "PROCESSOR_REVISION"=1706 "NUMBER_OF_PROCESSORS"=2 "CLASSPATH"=.;C:\Program Files (x86)\Java\jre1.6.0_07\lib\ext\QTJava.zip "QTJAVA"=C:\Program Files (x86)\Java\jre1.6.0_07\lib\ext\QTJava.zip -----------------EOF-----------------

**Posty:** 8001 · przez **Okocza** 27 Lis 2008, 19:32

okej jest. wykonaj to co prosilem w poprzednim poście.

**Posty:** 6403 · przez **Robert** 27 Lis 2008, 20:01

Skany z XP + dysk z popsutym mbr/mft/boot sector

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.20.6825 * * * ******************************************************************************** Created at 19:00:21 on Thursday, November 27, 2008 Time Zone : Logged On User : Radek Operating System : Microsoft Windows XP Home Edition Dodatek Service Pack 3 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 Intel(R) Pentium(R) 4 CPU 3.00GHz System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 15.05 GB System Drive Free : 5.28 GB Total Physical Memory: 2046 MB Free Physical Memory : 1579 MB Total Page File : 2046 MB Free Page File : 3573 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1973 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

CF

Kod: Zaznacz wszystko: ComboFix 08-11-27.01 - Radek 2008-11-27 18:40:39.1 - NTFSx86 * Utworzono nowy punkt przywracania [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\autorun.inf c:\documents and settings\LocalService\Dane aplikacji\wsnpoem c:\documents and settings\LocalService\Dane aplikacji\wsnpoem\audio.dll c:\documents and settings\NetworkService\Dane aplikacji\wsnpoem c:\documents and settings\NetworkService\Dane aplikacji\wsnpoem\audio.dll c:\documents and settings\Radek\Dane aplikacji\ShoppingReport c:\documents and settings\Radek\Dane aplikacji\ShoppingReport\cs\Config.xml c:\documents and settings\Radek\Dane aplikacji\ShoppingReport\cs\db\Aliases.dbs c:\documents and settings\Radek\Dane aplikacji\ShoppingReport\cs\db\Sites.dbs c:\documents and settings\Radek\Dane aplikacji\ShoppingReport\cs\dwld\WhiteList.xip c:\documents and settings\Radek\Dane aplikacji\ShoppingReport\cs\report\aggr_storage.xml c:\documents and settings\Radek\Dane aplikacji\ShoppingReport\cs\report\send_storage.xml c:\documents and settings\Radek\Dane aplikacji\ShoppingReport\cs\res1\WhiteList.dbs c:\program files\Mozilla Firefox\components\iamfamous.dll c:\program files\ShoppingReport c:\program files\ShoppingReport\Bin\2.5.0\ShoppingReport.dll c:\program files\ShoppingReport\Uninst.exe C:\resycled c:\resycled\boot.com c:\windows\system32\kdxty.exe c:\windows\system32\ntos.exe c:\windows\system32\wsnpoem c:\windows\system32\wsnpoem\audio.dll c:\windows\system32\wsnpoem\video.dll D:\Autorun.inf D:\resycled d:\resycled\boot.com E:\Autorun.inf E:\resycled e:\resycled\boot.com . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-27 do 2008-11-27 ))))))))))))))))))))))))))))))) . 2008-11-27 18:25 . 2008-11-27 18:26 <DIR> d-------- c:\program files\HDCleaner 2008-11-26 23:09 . 2008-11-26 23:09 <DIR> d-------- c:\program files\SoftLogica 2008-11-25 18:21 . 2008-11-25 18:22 <DIR> d-------- c:\documents and settings\Radek\Dane aplikacji\???????sAppData 2008-11-25 18:20 . 2008-11-25 18:20 391 --a------ c:\windows\COVERE~1.INI 2008-11-21 16:46 . 2008-05-30 14:19 507,400 --a------ c:\windows\system32\XAudio2_1.dll 2008-11-21 16:46 . 2008-05-30 14:18 238,088 --a------ c:\windows\system32\xactengine3_1.dll 2008-11-21 16:46 . 2008-05-30 14:17 65,032 --a------ c:\windows\system32\XAPOFX1_0.dll 2008-11-21 16:46 . 2008-05-30 14:17 25,608 --a------ c:\windows\system32\X3DAudio1_4.dll 2008-11-19 19:38 . 2008-11-19 19:38 <DIR> d-------- c:\documents and settings\Radek\Dane aplikacji\Leadertech 2008-11-17 20:08 . 2008-11-17 20:08 <DIR> d-------- c:\program files\PTDD Group 2008-11-17 20:00 . 2008-11-17 20:00 <DIR> d-------- c:\program files\Common Files\Acronis 2008-11-17 20:00 . 2008-11-17 20:00 <DIR> d-------- c:\program files\Acronis 2008-11-17 20:00 . 2008-11-17 20:00 114,048 --a------ c:\windows\system32\drivers\snapman.sys 2008-11-11 11:23 . 2008-11-11 11:23 27,904 --a------ c:\windows\system32\drivers\ndisprot.sys 2008-11-09 14:41 . 2008-11-09 14:41 <DIR> d-------- c:\program files\Auslogics 2008-11-09 14:41 . 2008-11-09 14:41 <DIR> d-------- c:\documents and settings\Radek\Dane aplikacji\Auslogics 2008-11-01 17:13 . 2008-11-21 16:44 2,250,024 --a------ c:\windows\system32\pbsvc.exe 2008-11-01 14:23 . 2008-11-01 14:39 <DIR> d-------- c:\documents and settings\Radek\Dane aplikacji\Red Alert 3 2008-11-01 14:04 . 2008-05-30 14:11 3,850,760 --a------ c:\windows\system32\D3DX9_38.dll 2008-11-01 14:04 . 2008-05-30 14:11 1,491,992 --a------ c:\windows\system32\D3DCompiler_38.dll 2008-11-01 14:04 . 2008-05-30 14:11 467,984 --a------ c:\windows\system32\d3dx10_38.dll 2008-11-01 14:02 . 2008-11-01 14:02 <DIR> d-------- c:\windows\Logs 2008-10-31 17:57 . 2008-10-31 17:57 <DIR> dr-h----- c:\documents and settings\Radek\Dane aplikacji\SecuROM 2008-10-31 17:51 . 2008-03-05 15:56 3,786,760 --a------ c:\windows\system32\D3DX9_37.dll 2008-10-31 17:51 . 2007-07-19 18:14 3,727,720 --a------ c:\windows\system32\d3dx9_35.dll 2008-10-31 17:51 . 2008-03-05 15:56 1,420,824 --a------ c:\windows\system32\D3DCompiler_37.dll 2008-10-31 17:51 . 2007-07-19 18:14 1,358,192 --a------ c:\windows\system32\D3DCompiler_35.dll 2008-10-31 17:51 . 2008-03-05 16:03 479,752 --a------ c:\windows\system32\XAudio2_0.dll 2008-10-31 17:51 . 2008-02-05 23:07 462,864 --a------ c:\windows\system32\d3dx10_37.dll 2008-10-31 17:51 . 2007-07-19 18:14 444,776 --a------ c:\windows\system32\d3dx10_35.dll 2008-10-31 17:51 . 2007-07-20 00:57 267,112 --a------ c:\windows\system32\xactengine2_9.dll 2008-10-31 17:51 . 2008-03-05 16:03 238,088 --a------ c:\windows\system32\xactengine3_0.dll 2008-10-31 17:51 . 2008-03-05 16:00 25,608 --a------ c:\windows\system32\X3DAudio1_3.dll 2008-10-31 17:50 . 2008-10-31 17:50 <DIR> d----c--- c:\windows\system32\DRVSTORE 2008-10-31 17:50 . 2008-10-31 17:50 <DIR> d-------- c:\windows\system32\AGEIA 2008-10-31 17:50 . 2008-10-31 17:50 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-10-31 17:50 . 2008-10-31 17:50 <DIR> d-------- c:\program files\AGEIA Technologies 2008-10-29 15:28 . 2008-10-29 15:28 <DIR> d-------- c:\windows\system32\pl-pl 2008-10-29 15:28 . 2008-10-29 15:28 <DIR> d-------- c:\windows\system32\pl 2008-10-29 15:28 . 2008-10-29 15:28 <DIR> d-------- c:\windows\system32\bits 2008-10-29 15:28 . 2008-10-29 15:28 <DIR> d-------- c:\windows\l2schemas 2008-10-29 15:27 . 2008-10-29 15:27 <DIR> d-------- c:\windows\ServicePackFiles 2008-10-29 15:19 . 2008-10-29 15:19 <DIR> d-------- c:\windows\EHome . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-27 17:26 --------- d-----w c:\program files\Xfire 2008-11-27 07:36 --------- d-----w c:\documents and settings\Radek\Dane aplikacji\AVG7 2008-11-26 17:52 --------- d-----w c:\documents and settings\Radek\Dane aplikacji\foobar2000 2008-11-22 21:05 183,112 ----a-w c:\windows\system32\PnkBstrB.exe 2008-11-22 21:05 138,184 ----a-w c:\windows\system32\drivers\PnkBstrK.sys 2008-11-21 21:47 --------- d-----w c:\documents and settings\Radek\Dane aplikacji\Skype 2008-11-21 17:14 --------- d-----w c:\documents and settings\Radek\Dane aplikacji\skypePM 2008-11-21 15:45 22,328 ----a-w c:\documents and settings\Radek\Dane aplikacji\PnkBstrK.sys 2008-11-21 15:44 66,872 ----a-w c:\windows\system32\PnkBstrA.exe 2008-11-21 15:39 --------- d--h--w c:\program files\InstallShield Installation Information 2008-11-20 18:04 --------- d-----w c:\program files\OpenOffice.org1.1.0 2008-11-01 17:40 --------- d-----w c:\documents and settings\Radek\Dane aplikacji\Xfire 2008-10-31 17:01 --------- d-----w c:\documents and settings\Radek\Dane aplikacji\Hamachi 2008-10-31 16:57 107,888 ----a-w c:\windows\system32\CmdLineExt.dll 2008-10-21 19:10 --------- d-----w c:\documents and settings\Radek\Dane aplikacji\Tibia 2008-10-21 12:40 --------- d-----w c:\program files\Prime95 2008-10-12 18:56 --------- d-----w c:\program files\Tibia4 2008-10-09 00:47 42,320 ----a-w c:\windows\system32\xfcodec.dll 2008-10-05 14:20 --------- d-----w c:\program files\Java 2008-09-30 17:47 77,898 ----a-w c:\windows\uinst001.exe 2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "DAEMON Tools Lite"="c:\program files\DAEMON Tools Lite\daemon.exe" [2008-04-01 486856] "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 152872] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2008-04-14 1695232] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112] "AVG7_CC"="c:\progra~1\Grisoft\AVG7\avgcc.exe" [2008-05-06 579584] "ANIWZCS2Service"="c:\program files\ANI\ANIWZCS2 Service\WZCSLDR2.exe" [2004-12-16 49152] "D-Link AirPlus G"="c:\program files\D-Link\AirPlus G\AirGCFG.exe" [2005-07-22 1519616] "LVCOMSX"="c:\windows\system32\LVCOMSX.EXE" [2005-07-19 221184] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "OSSelectorReinstall"="c:\program files\Common Files\Acronis\Acronis Disk Director\oss_reinstall.exe" [2007-03-09 2223985] "Skrót do strony właściwości High Definition Audio"="HDAudPropShortcut.exe" [2004-03-17 c:\windows\system32\Hdaudpropshortcut.exe] "SoundMan"="SOUNDMAN.EXE" [2004-09-24 c:\windows\SOUNDMAN.EXE] "AlcWzrd"="ALCWZRD.EXE" [2004-09-25 c:\windows\ALCWZRD.EXE] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] "AVG7_Run"="c:\progra~1\Grisoft\AVG7\avgw.exe" [2008-04-05 219136] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "VIDC.XFR1"= xfcodec.dll [HKLM\~\startupfolder\C:^Documents and Settings^Radek^Menu Start^Programy^Autostart^hamachi.lnk] path=c:\documents and settings\Radek\Menu Start\Programy\Autostart\hamachi.lnk backup=c:\windows\pss\hamachi.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Radek^Menu Start^Programy^Autostart^OpenOffice.org 1.1.0.lnk] path=c:\documents and settings\Radek\Menu Start\Programy\Autostart\OpenOffice.org 1.1.0.lnk backup=c:\windows\pss\OpenOffice.org 1.1.0.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Radek^Menu Start^Programy^Autostart^Xfire.lnk] path=c:\documents and settings\Radek\Menu Start\Programy\Autostart\Xfire.lnk backup=c:\windows\pss\Xfire.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 21:16 39792 c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2008-03-20 11:04 2127296 c:\program files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel] --a------ 2008-03-17 16:59 2289664 c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-01 14:57 153136 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-04-30 16:17 22058792 c:\program files\Skype\Phone\Skype.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\WINDOWS\\system32\\PnkBstrA.exe"= "c:\\WINDOWS\\system32\\PnkBstrB.exe"= "c:\\Program Files\\Grisoft\\AVG7\\avginet.exe"= "c:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe"= "c:\\Program Files\\Grisoft\\AVG7\\avgcc.exe"= "c:\\Program Files\\Grisoft\\AVG7\\avgemc.exe"= "c:\\Program Files\\Xfire\\xfire.exe"= "e:\\C&C Tiberium Wars\\RetailExe\\1.0\\cnc3game.dat"= "e:\\C&C Kane wrath\\RetailExe\\1.0\\cnc3ep1.dat"= "e:\\real war rogue states\\rwx.exe"= "c:\\WINDOWS\\system32\\dplaysvr.exe"= "e:\\Most Wanted\\speed.exe"= "e:\\Age of Empires III\\age3.exe"= "d:\\Zaintsalowane Gry\\the settlers\\base\\bin\\Settlers6.exe"= "e:\\call of duty 2\\CoD2MP_s.exe"= "e:\\Age of Empires III\\age3x.exe"= "c:\\Program Files\\UltraVNC\\vncviewer.exe"= "e:\\COD4\\iw3mp.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "d:\\RA3\\RED ALERT 3\\RA3.exe"= "d:\\COD5 SINGLE\\CoDWaWmp.exe"= "d:\\COD5 SINGLE\\CoDWaW.exe"= "d:\\far cry2\\Far Cry 2\\bin\\FarCry2.exe"= "d:\\far cry2\\Far Cry 2\\bin\\FC2Launcher.exe"= "d:\\far cry2\\Far Cry 2\\bin\\FC2Editor.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "5900:TCP"= 5900:TCP:vnc5900 "5800:TCP"= 5800:TCP:vnc5800 R1 UserPort;UserPort;\??\c:\windows\system32\Drivers\UserPort.sys [2008-05-01 4256] S3 Ndisprot;ArcNet NDIS Protocol Driver;\??\c:\windows\system32\drivers\Ndisprot.sys [2008-11-11 27904] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e96d84a-3967-11dd-900f-001cf01a901d}] \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL resycled\boot.com f: \Shell\Open\command - h:\resycled\boot.com f: *Newly Created Service* - PROCEXP90 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "c:\program files\Common Files\LightScribe\LSRunOnce.exe" . - - - - USUNIĘTO PUSTE WPISY - - - - HKLM-Run-c:\windows\system32\kdxty.exe - c:\windows\system32\kdxty.exe MSConfigStartUp-AQQ - c:\progra~1\WapSter\AQQ\AQQ.exe . ------- Skan uzupełniający ------- . FireFox -: Profile - c:\documents and settings\Radek\Dane aplikacji\Mozilla\Firefox\Profiles\85yjldlp.default\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-27 18:41:51 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(736) c:\windows\system32\Ati2evxx.dll . Czas ukończenia: 2008-11-27 18:42:28 ComboFix-quarantined-files.txt 2008-11-27 17:42:22 Przed: 5,466,865,664 bajtów wolnych Po: 5,547,642,880 bajtów wolnych 221 --- E O F --- 2008-10-30 17:53:15

kahoona co do twego ytania to dam rade, tylko powiedz z którego kompa.

**Posty:** 5637 · przez **kahoona** 27 Lis 2008, 20:52

Nie ma to już uzasadnienia. Nawiasem mówiąc - wyłącz autostart dla urządzeń zewnętrznych (pendrive, dysk przenośny) i zmień AVG na coś sensownego ( jak się okazuje...).

**Posty:** 6403 · przez **Robert** 27 Lis 2008, 20:58

kahoona napisał(a):i zmień AVG na coś sensownego ( jak się okazuje...).

ciagle o tym mysle, tylko na co wlasnie nie wiem :S

kahoona napisał(a):wyłącz autostart dla urządzeń zewnętrznych (pendrive, dysk przenośny)

tak jest

A jakoś naprawić tę tabele w dysku skoro syfu już nie ma da rade? Albo odzyskac dane z RAW -> zewnetrzny potem format -> z powortem na 500 wewnetrzne?

**Posty:** 18165 · przez **wojtas** 27 Lis 2008, 22:59

wklej do notatnika

Windows Registry Editor Version 5.00

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e96d84a-3967-11dd-900f-001cf01a901d}]

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

**Posty:** 8001 · przez **Okocza** 27 Lis 2008, 23:01

Robert napisał(a):ciagle o tym mysle, tylko na co wlasnie nie wiem :S

NOD32 albo Kaspersky

**Posty:** 6403 · przez **Robert** 28 Lis 2008, 22:54

Nie wytrzymałem, po robieniu x rzeczy za pomoca googli nic nie zadziaało, dałem format. Zabieram się za odzysk i latanie po kumplach. Jak moge zabezpieczyc na przyzłośc taką partycje? aby miec ja z czego odzyskiwać?

**Posty:** 1 · przez **jacekteles** 05 Gru 2008, 17:40

Witam
jestem nowy więc jeśli cos kiedys było o tym mówione.to Sorki że powtarzam temat...
Konkretnie chodzi o to że posaidam dysk zewnętrzny 250gb 2,5' zasilany z USB i dzis pojawił się pewien problem...dysk podinam w różnych miejsach i do różnych pctów...zgrywam i dogrywam do niego pliki..i najwyraźniej musiałem gdzieś załapac wirusa;/
Sprawa wygląda teraz tak...podpinam dysk do PCta pojawia sie w mój komputer lecz kiedy chce sie dostac do tego co na nim jest na dysku gaśnie światełko jakby go odpinało a mój komputer się wiesza.....robiłem to 100 razy i ciagle ten sam problem...nie moge nawet wybrac opcji własciwości..;/..myslałem że to wina kabelka...sprawdziłem to na 6 inncyh kablach i ciągle jest ten sam problem;/;;/
próbowałem przeskanowac dysk programem antywirusowym: NOD32 ale ten nie może tak naprawdę zacząć skanowania bo wyswietla komunikat że dysk odpięty;/
Czy to wogóle da się jeszcze cos z tym zrobić?smile.gif..tzw. czy jest ktos aż tak uzdolniony że jest w stanie to naprawić?smile.gif
Prosze o pomoc;)
Ps. wiem że cały teamat o tym jest...tylko że mój problem toche inaczej wygląda

Co zrobić??:)

dysk twardy - zewnętrzny - utracone dane?

Dysk twardy - zewnętrzny - utracone dane?

Dysk twardy - zewnętrzny - utracone dane?

Dysk twardy - zewnętrzny - utracone dane?

Dysk twardy - zewnętrzny - utracone dane?

Dysk twardy - zewnętrzny - utracone dane?

Dysk twardy - zewnętrzny - utracone dane?

Dysk twardy - zewnętrzny - utracone dane?

Dysk twardy - zewnętrzny - utracone dane?

Dysk twardy - zewnętrzny - utracone dane?

Re: dysk twardy - zewnętrzny - utracone dane?

Dysk twardy - zewnętrzny - utracone dane?

Dysk twardy - zewnętrzny - utracone dane?

Dysk twardy - zewnętrzny - utracone dane?

Dysk twardy - zewnętrzny - utracone dane?

Dysk twardy - zewnętrzny - utracone dane?

Re: dysk twardy - zewnętrzny - utracone dane?

Kto jest na forum