Logi-trojan.win32,itp wykryty ,wyłączający się komp

**Posty:** 38 · przez **renik** 30 Sty 2009, 16:06

Witam

Mam następujący problem. Komputer się samoistnie parokrotnie wyłącza przy próbie uruchomienia go,po każdej takiej akcji musze odłączyć jego od prądu i odczekać 10 min :cry:

przypuszczam, że winne są wirusy, które zostały wykryte przez Kasperski online.Proszę o sprawdzenie logów, które załączam z combofixa, HijackThis oraz raport z Kaspersky.
Proszę o pomoc w usunięciu intruzów :oops:

Karspersy:

Kod: Zaznacz wszystko: -------------------------------------------------------------------------------- RAPORT KASPERSKY ONLINE SCANNER 7.0 piątek, 30 styczeń 2009 System operacyjny: Microsoft Windows XP Professional Dodatek Service Pack 2 (build 2600) Wersja Kaspersky Online Scanner: 7.0.26.12 Data ostatniej aktualizacji bazy danych: Friday, January 30, 2009 08:47:06 Liczba wpisów: 1727864 -------------------------------------------------------------------------------- Ustawienia skanowania: Typ bazy danych użytej do skanowania: rozszerzona Skanuj archiwa: tak Skanuj pocztowe bazy danych: tak Obszar skanowania - Mój komputer: A:\ C:\ D:\ E:\ F:\ G:\ I:\ Statystyki skanowania: Przeskanowanych plików: 119362 Nazwa zagrożenia: 8 Zainfekowanych obiektów: 24 Podejrzanych obiektów: 0 Czas skanowania: 02:31:05 Nazwa pliku / Nazwa zagrożenia / Liczba zagrożeń C:\8.bat Zainfekowany: Worm.Win32.AutoRun.yza 1 C:\Documents and Settings\Renia\.housecall6.6\Quarantine\afmain1.dll.bac_a03736 Zainfekowany: Packed.Win32.Krap.g 1 C:\Documents and Settings\Renia\Ustawienia lokalne\Temporary Internet Files\Content.IE5\KTM3S1QJ\help[1].rar Zainfekowany: Trojan.Win32.RaMag.a 1 C:\Documents and Settings\Renia\Ustawienia lokalne\Temporary Internet Files\Content.IE5\KTM3S1QJ\help[3].rar Zainfekowany: Trojan.Win32.RaMag.a 1 C:\Documents and Settings\Renia\Ustawienia lokalne\Temporary Internet Files\Content.IE5\W56RKLUZ\ddr[1].rar Zainfekowany: Trojan.Win32.RaMag.a 1 C:\Documents and Settings\Renia\Ustawienia lokalne\Temporary Internet Files\Content.IE5\W56RKLUZ\help[1].rar Zainfekowany: Trojan.Win32.RaMag.a 1 C:\WINDOWS\system32\afmain1.0ll Zainfekowany: Packed.Win32.Krap.g 1 C:\WINDOWS\system32\gasretyw0.0ll Zainfekowany: Trojan-GameThief.Win32.WOW.dar 1 C:\WINDOWS\system32\olhrwef.exe Zainfekowany: Worm.Win32.AutoRun.yza 1 D:\8.bat Zainfekowany: Worm.Win32.AutoRun.yza 1 D:\gy.exe Zainfekowany: Trojan.Win32.Agent2.sv 1 D:\j60osk9.cmd Zainfekowany: Trojan-Dropper.Win32.Agent.afdh 1 D:\uvsqfgwd.cmd Zainfekowany: Trojan-GameThief.Win32.Magania.audk 1 D:\w98.com Zainfekowany: Trojan-GameThief.Win32.Magania.atzj 1 F:\8.bat Zainfekowany: Worm.Win32.AutoRun.yza 1 F:\gy.exe Zainfekowany: Trojan.Win32.Agent2.sv 1 F:\j60osk9.cmd Zainfekowany: Trojan-Dropper.Win32.Agent.afdh 1 F:\uvsqfgwd.cmd Zainfekowany: Trojan-GameThief.Win32.Magania.audk 1 F:\w98.com Zainfekowany: Trojan-GameThief.Win32.Magania.atzj 1 I:\8.bat Zainfekowany: Worm.Win32.AutoRun.yza 1 I:\gy.exe Zainfekowany: Trojan.Win32.Agent2.sv 1 I:\j60osk9.cmd Zainfekowany: Trojan-Dropper.Win32.Agent.afdh 1 I:\uvsqfgwd.cmd Zainfekowany: Trojan-GameThief.Win32.Magania.audk 1 I:\w98.com Zainfekowany: Trojan-GameThief.Win32.Magania.atzj 1 Wybrany obszar został przeskanowany.

Combofix:

Kod: Zaznacz wszystko: ComboFix 09-01-21.04 - Renia 2009-01-30 14:33:20.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.512.233 [GMT 1:00] Running from: c:\documents and settings\Renia\Pulpit\ComboFix.exe AV: Panda Internet Security 2008 *On-access scanning enabled* (Updated) FW: Panda Internet Security 2008 *enabled* * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . - REDUCED FUNCTIONALITY MODE - . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013 c:\recycler\S-1-5-21-1482476501-1644491937-682003330-1013\Desktop.ini c:\windows\IE4 Error Log.txt . ((((((((((((((((((((((((( Files Created from 2008-12-28 to 2009-01-30 ))))))))))))))))))))))))))))))) . 2009-01-30 11:04 . 2009-01-30 11:04 <DIR> d-------- c:\windows\LastGood 2009-01-29 12:39 . 2009-01-29 12:39 108,861 -r-hs---- C:\8.bat 2009-01-28 15:38 . 2008-06-19 16:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys 2009-01-18 07:48 . 2004-08-03 23:44 70,144 --ah----- c:\windows\AhnRpta.exe 2009-01-18 07:40 . 2009-01-29 12:39 108,861 -r-hs---- c:\windows\system32\olhrwef.exe 2009-01-18 07:40 . 2009-01-29 12:39 95,744 -r-hs---- c:\windows\system32\nmdfgds0.dll 2009-01-14 07:22 . 2009-01-29 12:38 85,504 --a------ c:\windows\system32\gasretyw0.0ll 2009-01-05 19:42 . 2009-01-18 00:43 <DIR> d-------- c:\documents and settings\Renia\Dane aplikacji\Thinstall 2009-01-02 13:42 . 2009-01-02 13:42 <DIR> d-------- c:\documents and settings\Renia\Dane aplikacji\ArcaBit 2009-01-02 11:00 . 2009-01-29 21:28 <DIR> d-------- c:\documents and settings\Renia\.housecall6.6 2008-12-31 12:17 . 2008-12-31 12:17 <DIR> d-------- C:\fsaua.data 2008-12-30 17:19 . 2008-12-30 18:44 <DIR> d-------- c:\program files\EsetOnlineScanner . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-30 13:31 293,524 ----a-w c:\windows\system32\drivers\APPFCONT.DAT.bck 2009-01-30 13:31 293,524 ----a-w c:\windows\system32\drivers\APPFCONT.DAT 2009-01-30 08:32 13,880 ----a-w c:\windows\system32\drivers\COMFiltr.sys 2009-01-30 08:32 1,244 ----a-w c:\windows\system32\drivers\APPFLTR.CFG.bck 2009-01-30 08:32 1,244 ----a-w c:\windows\system32\drivers\APPFLTR.CFG 2009-01-30 08:10 --------- d-----w c:\program files\Gadu-Gadu 2008-12-30 17:47 --------- d-----w c:\program files\Panda Security 2008-12-30 12:29 --------- d-----w c:\documents and settings\Renia\Dane aplikacji\Skype 2008-12-30 12:27 --------- d-----w c:\documents and settings\Renia\Dane aplikacji\skypePM 2008-12-07 20:41 --------- d-----w c:\documents and settings\Renia\Dane aplikacji\uTorrent 2008-03-16 14:43 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584] "VoipDiscount"="d:\voipdiscount.com\VoipDiscount\VoipDiscount.exe" [2007-05-31 7419456] "cdoosoft"="c:\windows\system32\olhrwef.exe" [2009-01-29 108861] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "APVXDWIN"="c:\program files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" [2007-07-23 406832] "SCANINICIO"="c:\program files\Panda Security\Panda Internet Security 2008\Inicio.exe" [2007-07-11 27952] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2007-10-10 36352] "Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 143360] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-05-15 1628208] "InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-05-15 1057328] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048] Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr] 2007-02-15 20:02 50736 c:\windows\system32\avldr.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-03 23:44 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 09:50 155648 c:\windows\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 01:11 132496 c:\program files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Resume copy] --ah----- 2007-11-10 16:43 73728 c:\windows\copyfstq.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "d:\\VoipDiscount.com\\VoipDiscount\\VoipDiscount.exe"= "i:\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-01-28 28544] R1 APPFLT;App Filter Plugin;c:\windows\system32\drivers\APPFLT.SYS [2007-11-10 71736] R1 DSAFLT;DSA Filter Plugin;c:\windows\system32\drivers\dsaflt.sys [2007-11-10 51256] R1 FNETMON;NetMon Filter Plugin;c:\windows\system32\drivers\fnetmon.sys [2007-11-10 22072] R1 IDSFLT;Ids Filter Plugin;c:\windows\system32\drivers\idsflt.sys [2007-11-10 191672] R1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\drivers\NETFLTDI.SYS [2007-11-10 16:28:18 132920] R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\drivers\ShlDrv51.sys [2007-11-10 38968] R1 SMSFLT;SMS Filter Plugin;c:\windows\system32\drivers\smsflt.sys [2007-11-10 37304] R1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\drivers\wnmflt.sys [2007-11-10 30648] R3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys --> c:\windows\system32\drivers\av5flt.sys [?] R3 ComFiltr;Panda Anti-Dialer;c:\windows\system32\drivers\COMFiltr.sys [2008-06-04 13880] R3 NETIMFLT;PANDA NDIS IM Filter Miniport;c:\windows\system32\drivers\netimflt.sys [2007-11-10 142128] R3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys --> c:\windows\system32\PavSRK.sys [?] R3 PavTPK.sys;PavTPK.sys;\??\c:\windows\system32\PavTPK.sys --> c:\windows\system32\PavTPK.sys [?] R4 cpoint;Panda CPoint Driver;c:\windows\system32\drivers\cpoint.sys [2007-11-10 24760] R4 PavProc;Panda Process Protection Driver;c:\windows\system32\drivers\PavProc.sys [2007-11-10 178872] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{18d1931e-b2a5-11dd-9815-000c6e9c5804}] \Shell\AutoRun\command - J:\ij.bat \Shell\explore\Command - J:\ij.bat \Shell\open\Command - J:\ij.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{27eca4f4-000f-11dd-8035-000c6e9c5804}] \Shell\AutoRun\command - E:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4347f632-9555-11dd-97e2-000c6e9c5804}] \Shell\AutoRun\command - H:\gy.exe \Shell\open\Command - H:\gy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4ddc430e-8f9f-11dc-9158-000c6e9c5804}] \Shell\AutoRun\command - J:\USBNB.exe . Contents of the 'Scheduled Tasks' folder 2009-01-30 c:\windows\Tasks\1-Click Maintenance.job - c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [] . - - - - ORPHANS REMOVED - - - - HKCU-Run-vamsoft - c:\windows\system32\vamsoft.exe ShellExecuteHooks-{BB4C402F-882A-4526-8C08-51278EA437C1} - (no file) MSConfigStartUp-Zegarynka - g:\zegarynka\Zegarynka.exe . ------- Supplementary Scan ------- . uStart Page = hxxp://onet.pl/ IE: &Pobierz przez ReGet Deluxe - c:\program files\Common Files\ReGet Shared\CC_Link.htm IE: &Winamp Toolbar Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Pobierz &wszystko przez ReGet Deluxe - c:\program files\Common Files\ReGet Shared\CC_All.htm LSP: c:\program files\Panda Security\Panda Internet Security 2008\pavlsp.dll Trusted Zone: arcabit.com\arcaonline Trusted Zone: com.pl\mks DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab FF - ProfilePath - c:\documents and settings\Renia\Dane aplikacji\Mozilla\Firefox\Profiles\9ehok85w.default\ . . ------- File Associations ------- . JSEFile=c:\progra~1\PANDAS~1\PANDAI~1\PAVSCRIP.EXE "%1" %* VBEFile=c:\progra~1\PANDAS~1\PANDAI~1\PAVSCRIP.EXE "%1" %* VBSFile=c:\progra~1\PANDAS~1\PANDAI~1\PAVSCRIP.EXE "%1" %* . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-30 14:36:40 Windows 5.1.2600 Dodatek Service Pack 2 NTFS detected NTDLL code modification: ZwEnumerateKey, ZwClose, ZwEnumerateValueKey, ZwQueryValueKey, ZwOpenFile scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- - - - - - - - > 'winlogon.exe'(1032) c:\windows\system32\avldr.dll . Completion time: 2009-01-30 14:39:15 ComboFix-quarantined-files.txt 2009-01-30 13:39:11 Pre-Run: 11˙931˙914˙240 bajt˘w wolnych Post-Run: 12,481,564,672 bajt˘w wolnych 162

hijackthis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 14:44:38, on 2009-01-30 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe C:\Program Files\Panda Security\Panda Internet Security 2008\WebProxy.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Panda Security\Panda Internet Security 2008\AVENGINE.EXE C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE C:\Program Files\Winamp\winampa.exe C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe C:\Program Files\Nero\Nero 7\InCD\InCD.exe C:\Program Files\Messenger\msmsgs.exe D:\VoipDiscount.com\VoipDiscount\VoipDiscount.exe C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe C:\Program Files\Panda Security\Panda Internet Security 2008\avciman.exe C:\Program Files\Panda Security\Panda Internet Security 2008\psimreal.exe C:\Program Files\Panda Security\Panda Internet Security 2008\SRVLOAD.EXE C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Panda Security\Panda Internet Security 2008\WebProxy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: ReGet Bar - {17939A30-18E2-471E-9D3A-56DD725F1215} - C:\Program Files\ReGetDx\iebar.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" /s O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [VoipDiscount] "D:\VoipDiscount.com\VoipDiscount\VoipDiscount.exe" -nosplash -minimized O4 - HKCU\..\Run: [cdoosoft] C:\WINDOWS\system32\olhrwef.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O8 - Extra context menu item: &Pobierz przez ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_Link.htm O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz &wszystko przez ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_All.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing) O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://arcaonline.arcabit.com O15 - Trusted Zone: http://mks.com.pl O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1223485856968 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe -- End of file - 9243 bytes

**Posty:** 8001 · przez **Okocza** 31 Sty 2009, 22:27

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 38 · przez **renik** 31 Sty 2009, 23:24

zrobiłam.Zamieszczam logi
report z sdfixa:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.240 [/b] Run by Administrator on 2009-01-31 at 21:50 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: No Trojan Files Found Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-31 21:57:22 Windows 5.1.2600 Dodatek Service Pack 2 NTFS detected NTDLL code modification: ZwEnumerateKey, ZwClose, ZwEnumerateValueKey, ZwQueryValueKey, ZwOpenFile scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg] "s1"=dword:2df9c43f "s2"=dword:110480d0 scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "D:\\VoipDiscount.com\\VoipDiscount\\VoipDiscount.exe"="D:\\VoipDiscount.com\\VoipDiscount\\VoipDiscount.exe:*:Enabled:VoipDiscount" "I:\\uTorrent\\uTorrent.exe"="I:\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: [b]Files with Hidden Attributes [/b]: Tue 3 Aug 2004 70,144 A..H. --- "C:\WINDOWS\AhnRpta.exe" Mon 31 Jul 2006 217,088 A..H. --- "C:\WINDOWS\Alcrmv.exe" Mon 31 Jul 2006 315,392 A..H. --- "C:\WINDOWS\alcupd.exe" Sat 10 Nov 2007 73,728 A..H. --- "C:\WINDOWS\copyfstq.exe" Sat 10 Nov 2007 94,636 A..H. --- "C:\WINDOWS\dropcpyr.dll" Tue 3 Aug 2004 10,752 A..H. --- "C:\WINDOWS\hh.exe" Sat 10 Nov 2007 4,438 A..H. --- "C:\WINDOWS\imsins.BAK" Thu 29 Oct 1998 306,688 A..H. --- "C:\WINDOWS\IsUninst.exe" Tue 3 Aug 2004 70,144 A..H. --- "C:\WINDOWS\NOTEPAD.EXE" Tue 15 May 2007 239,152 A..H. --- "C:\WINDOWS\NuNInst.exe" Tue 3 Aug 2004 149,504 A..H. --- "C:\WINDOWS\regedit.exe" Wed 4 Aug 2004 1,014,483 A..HR --- "C:\WINDOWS\SET3.tmp" Wed 4 Aug 2004 1,086,058 A..HR --- "C:\WINDOWS\SET4.tmp" Wed 4 Aug 2004 14,043 A..HR --- "C:\WINDOWS\SET8.tmp" Fri 17 Nov 2006 577,536 A..H. --- "C:\WINDOWS\SOUNDMAN.EXE" Fri 30 Aug 2002 380,928 A..H. --- "C:\WINDOWS\SynCor.exe" Mon 12 May 2003 978,944 A..H. --- "C:\WINDOWS\SynthCoreA.Dll" Fri 26 Oct 2001 15,360 A..H. --- "C:\WINDOWS\TASKMAN.EXE" Fri 26 Oct 2001 94,832 A..H. --- "C:\WINDOWS\twain.dll" Tue 3 Aug 2004 50,688 A..H. --- "C:\WINDOWS\twain_32.dll" Sun 22 Jul 2001 49,680 A..H. --- "C:\WINDOWS\twunk_16.exe" Fri 26 Oct 2001 25,600 A..H. --- "C:\WINDOWS\twunk_32.exe" Tue 20 Mar 2007 972,336 A..H. --- "C:\WINDOWS\UNNeroBackItUp.exe" Fri 26 Oct 2001 18,944 A..H. --- "C:\WINDOWS\vmmreg32.dll" Fri 26 Oct 2001 257,104 A..H. --- "C:\WINDOWS\winhelp.exe" Tue 3 Aug 2004 285,696 A..H. --- "C:\WINDOWS\winhlp32.exe" Sat 21 Jul 2001 707 A..H. --- "C:\WINDOWS\_default.pif" Tue 3 Aug 2004 2,804,224 ...H. --- "C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msi.dll" Tue 3 Aug 2004 77,312 ...H. --- "C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msiexec.exe" Tue 3 Aug 2004 331,264 ...H. --- "C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msihnd.dll" Tue 3 Aug 2004 884,736 ...H. --- "C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msimsg.dll" Tue 3 Aug 2004 44,032 ...H. --- "C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msisip.dll" Tue 3 Aug 2004 1,852,416 A..H. --- "C:\WINDOWS\AppPatch\AcGenral.dll" Tue 3 Aug 2004 450,048 A..H. --- "C:\WINDOWS\AppPatch\AcLayers.dll" Tue 3 Aug 2004 137,728 A..H. --- "C:\WINDOWS\AppPatch\AcLua.dll" Tue 3 Aug 2004 244,736 A..H. --- "C:\WINDOWS\AppPatch\AcSpecfc.dll" Tue 3 Aug 2004 116,224 A..H. --- "C:\WINDOWS\AppPatch\AcXtrnal.dll" Thu 22 May 2008 45,056 A..H. --- "C:\WINDOWS\BDOSCAN8\avxdisk.dll" Thu 22 May 2008 10,240 A..H. --- "C:\WINDOWS\BDOSCAN8\avxs.dll" Thu 22 May 2008 27,136 A..H. --- "C:\WINDOWS\BDOSCAN8\avxt.dll" Wed 9 Jan 2008 118,784 A..H. --- "C:\WINDOWS\BDOSCAN8\bdupd.dll" Wed 9 Jan 2008 53,248 A..H. --- "C:\WINDOWS\BDOSCAN8\ipsupd.dll" Thu 22 May 2008 142,848 A..H. --- "C:\WINDOWS\BDOSCAN8\libfn.dll" Thu 22 May 2008 86,016 A..H. --- "C:\WINDOWS\BDOSCAN8\librtvr.dll" Wed 27 Feb 2008 290,816 A..H. --- "C:\WINDOWS\Downloaded Program Files\auc_lib.dll" Wed 9 Jan 2008 32 A..H. --- "C:\WINDOWS\Downloaded Program Files\bdcore.dll" Wed 9 Jan 2008 118,784 A..H. --- "C:\WINDOWS\Downloaded Program Files\bdupd.dll" Wed 27 Feb 2008 495,616 A..H. --- "C:\WINDOWS\Downloaded Program Files\daas_s.dll" Wed 27 Feb 2008 262,144 A..H. --- "C:\WINDOWS\Downloaded Program Files\fscax.dll" Wed 27 Feb 2008 588,392 A..H. --- "C:\WINDOWS\Downloaded Program Files\gatelauncher.exe" Sat 5 Mar 2005 113,784 A..H. --- "C:\WINDOWS\Downloaded Program Files\IDropENU.dll" Wed 6 Apr 2005 114,256 A..H. --- "C:\WINDOWS\Downloaded Program Files\IDropPLK.dll" Wed 9 Jan 2008 53,248 A..H. --- "C:\WINDOWS\Downloaded Program Files\ipsupd.dll" Wed 9 Jan 2008 32 A..H. --- "C:\WINDOWS\Downloaded Program Files\libfn.dll" Tue 3 Aug 2004 28,672 A..H. --- "C:\WINDOWS\ehome\custsat.dll" Fri 26 Oct 2001 152,576 A..H. --- "C:\WINDOWS\Help\bnts.dll" Tue 3 Aug 2004 34,816 A..H. --- "C:\WINDOWS\Help\sniffpol.dll" Tue 3 Aug 2004 33,280 A..H. --- "C:\WINDOWS\Help\sstub.dll" Tue 3 Aug 2004 279,040 A..H. --- "C:\WINDOWS\Help\tshoot.dll" Tue 3 Aug 2004 220,160 A..H. --- "C:\WINDOWS\ime\mscandui.dll" Tue 3 Aug 2004 130,048 A..H. --- "C:\WINDOWS\ime\SOFTKBD.DLL" Tue 3 Aug 2004 62,976 A..H. --- "C:\WINDOWS\ime\SPGRMR.dll" Tue 3 Aug 2004 272,384 A..H. --- "C:\WINDOWS\ime\SPTIP.dll" Tue 3 Aug 2004 208,896 A..H. --- "C:\WINDOWS\inf\unregmp2.exe" Mon 12 Nov 2007 286,208 A..H. --- "C:\WINDOWS\Installer\MSI2C.tmp" Mon 12 Nov 2007 174,080 A..H. --- "C:\WINDOWS\Installer\MSI2D.tmp" Mon 12 Nov 2007 174,080 A..H. --- "C:\WINDOWS\Installer\MSI32.tmp" Tue 3 Aug 2004 24,064 A..H. --- "C:\WINDOWS\msagent\agentanm.dll" Tue 3 Aug 2004 214,016 A..H. --- "C:\WINDOWS\msagent\agentctl.dll" Tue 3 Aug 2004 41,984 A..H. --- "C:\WINDOWS\msagent\agentdp2.dll" Tue 3 Aug 2004 58,880 A..H. --- "C:\WINDOWS\msagent\agentdpv.dll" Tue 3 Aug 2004 49,152 A..H. --- "C:\WINDOWS\msagent\agentmpx.dll" Tue 3 Aug 2004 24,064 A..H. --- "C:\WINDOWS\msagent\agentpsh.dll" Tue 3 Aug 2004 44,032 A..H. --- "C:\WINDOWS\msagent\agentsr.dll" Tue 3 Aug 2004 256,512 A..H. --- "C:\WINDOWS\msagent\agentsvr.exe" Tue 3 Aug 2004 24,064 A..H. --- "C:\WINDOWS\msagent\agtintl.dll" Tue 3 Aug 2004 39,936 A..H. --- "C:\WINDOWS\msagent\mslwvtts.dll" Tue 3 Aug 2004 151,552 A..H. --- "C:\WINDOWS\PeerNet\sqldb20.dll" Tue 3 Aug 2004 462,848 A..H. --- "C:\WINDOWS\PeerNet\sqlqp20.dll" Tue 3 Aug 2004 110,592 A..H. --- "C:\WINDOWS\PeerNet\sqlse20.dll" Thu 29 Jan 2009 95,744 ..SHR --- "C:\WINDOWS\system32\nmdfgds0.dll" Thu 29 Jan 2009 108,861 ..SHR --- "C:\WINDOWS\system32\olhrwef.exe" Sun 11 Nov 2007 4,348 A.SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak" Sun 20 Jan 2008 318,976 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL0002.tmp" Thu 24 Jan 2008 530,944 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL0003.tmp" Mon 21 Jan 2008 105,984 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL0136.tmp" Mon 21 Jan 2008 48,640 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL0213.tmp" Tue 22 Jan 2008 140,800 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL0425.tmp" Mon 21 Jan 2008 44,032 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL0651.tmp" Tue 22 Jan 2008 138,240 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL0866.tmp" Mon 21 Jan 2008 118,272 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL1027.tmp" Mon 21 Jan 2008 103,936 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL1207.tmp" Mon 21 Jan 2008 320,512 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL1210.tmp" Mon 21 Jan 2008 68,608 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL1229.tmp" Tue 22 Jan 2008 121,856 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL1348.tmp" Mon 21 Jan 2008 347,648 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL1409.tmp" Mon 21 Jan 2008 77,824 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL1656.tmp" Mon 21 Jan 2008 72,704 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL1954.tmp" Mon 21 Jan 2008 65,024 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL2105.tmp" Tue 22 Jan 2008 121,856 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL2142.tmp" Tue 22 Jan 2008 124,928 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL2400.tmp" Tue 22 Jan 2008 131,584 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL2475.tmp" Tue 22 Jan 2008 130,048 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL2583.tmp" Mon 21 Jan 2008 108,544 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL2605.tmp" Wed 3 Dec 2008 329,728 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL2774.tmp" Mon 21 Jan 2008 47,104 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL2783.tmp" Sun 20 Jan 2008 162,304 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL3062.tmp" Tue 22 Jan 2008 121,856 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL3343.tmp" Mon 21 Jan 2008 347,648 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL3555.tmp" Mon 21 Jan 2008 96,768 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL3714.tmp" Mon 21 Jan 2008 107,520 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL3761.tmp" Tue 22 Jan 2008 138,240 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL3771.tmp" Mon 21 Jan 2008 92,672 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL3860.tmp" Mon 21 Jan 2008 108,544 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL4001.tmp" Sun 20 Jan 2008 259,584 ...H. --- "C:\Documents and Settings\Renia\Pulpit\~WRL4072.tmp" Wed 22 Dec 2004 76,568 ..SHR --- "C:\Program Files\Autodesk\Autodesk DWF Viewer\Setup.exe" Thu 13 Jan 2005 11,360 A.SHR --- "C:\Program Files\Autodesk\Autodesk DWF Viewer\_Setupx.dll" Tue 3 May 2005 212,704 ...H. --- "C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe" Tue 3 May 2005 387,296 ...H. --- "C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\updspapi.dll" Sat 12 Apr 2008 163,328 A..H. --- "C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE" Tue 6 May 2008 65,536 A..HR --- "C:\WINDOWS\Installer\{16578C71-CFAF-42F7-869A-DC3E48D0A7DE}\ARPPRODUCTICON.exe" Tue 6 May 2008 65,536 A..HR --- "C:\WINDOWS\Installer\{16578C71-CFAF-42F7-869A-DC3E48D0A7DE}\IDL32Shortcut5_16578C71CFAF42F7869ADC3E48D0A7DE.exe" Tue 6 May 2008 61,440 A..HR --- "C:\WINDOWS\Installer\{16578C71-CFAF-42F7-869A-DC3E48D0A7DE}\IDL32Shortcut2_AE78F7065BE34757B4BE68791F3A6A43.exe" Tue 6 May 2008 65,536 A..HR --- "C:\WINDOWS\Installer\{16578C71-CFAF-42F7-869A-DC3E48D0A7DE}\IDLHelpShortcut1_16578C71CFAF42F7869ADC3E48D0A7DE.exe" Tue 20 Nov 2007 4,710 A..HR --- "C:\WINDOWS\Installer\{2864C41B-EF2D-4640-95A2-526276524519}\BCB.exe" Sat 10 Nov 2007 166,912 A..HR --- "C:\WINDOWS\Installer\{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}\places.exe" Wed 14 May 2008 8,192 A..HR --- "C:\WINDOWS\Installer\{4C78E7B2-AE8C-492E-8A97-BA6A641C616B}\Icon3DF154B95.exe" Wed 14 May 2008 55,296 A..HR --- "C:\WINDOWS\Installer\{4C78E7B2-AE8C-492E-8A97-BA6A641C616B}\Icon4C78E7B21.exe" Thu 3 Jan 2008 593,920 A..HR --- "C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\accicons.exe" Thu 3 Jan 2008 12,288 A..HR --- "C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\cagicon.exe" Thu 3 Jan 2008 86,016 A..HR --- "C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\inficon.exe" Thu 3 Jan 2008 135,168 A..HR --- "C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\misc.exe" Thu 3 Jan 2008 11,264 A..HR --- "C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\mspicons.exe" Thu 3 Jan 2008 27,136 A..HR --- "C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\oisicon.exe" Thu 3 Jan 2008 4,096 A..HR --- "C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\opwicon.exe" Thu 3 Jan 2008 794,624 A..HR --- "C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\outicon.exe" Thu 3 Jan 2008 249,856 A..HR --- "C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\pptico.exe" Thu 3 Jan 2008 61,440 A..HR --- "C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\pubs.exe" Thu 3 Jan 2008 23,040 A..HR --- "C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\unbndico.exe" Thu 3 Jan 2008 286,720 A..HR --- "C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\wordicon.exe" Thu 3 Jan 2008 409,600 A..HR --- "C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\xlicons.exe" Tue 27 May 2008 25,214 A..HR --- "C:\WINDOWS\Installer\{9B4E6CB9-E54D-47F7-A414-E2D5740E1045}\ARPPRODUCTICON.exe" Sat 10 Nov 2007 295,606 A..HR --- "C:\WINDOWS\Installer\{AC76BA86-7AD7-1045-7B44-A80000000000}\SC_Reader.exe" Thu 20 Feb 2003 57,344 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\NETFXSBS10.exe" Thu 20 Feb 2003 5,120 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\sbscmp10.dll" Tue 14 May 2002 5,120 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\sbs_diasymreader.dll" Tue 14 May 2002 5,120 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\sbs_iehost.dll" Tue 14 May 2002 5,120 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\sbs_microsoft.jscript.dll" Tue 14 May 2002 5,632 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\sbs_microsoft.vsa.vb.codedomprocessor.dll" Tue 14 May 2002 5,120 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\sbs_mscordbi.dll" Tue 14 May 2002 5,120 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\sbs_mscorsec.dll" Fri 19 Jul 2002 5,120 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\sbs_mscorrc.dll" Tue 14 May 2002 5,120 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\sbs_system.configuration.install.dll" Tue 14 May 2002 5,120 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\sbs_system.data.dll" Tue 14 May 2002 5,120 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\sbs_system.enterpriseservices.dll" Thu 27 Jun 2002 5,120 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\sbs_VsaVb7rt.dll" Tue 14 May 2002 5,120 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\sbs_wminet_utils.dll" Fri 26 Oct 2001 19,456 A..H. --- "C:\WINDOWS\msagent\intl\agt0405.dll" Fri 26 Oct 2001 19,456 A..H. --- "C:\WINDOWS\msagent\intl\agt0406.dll" Fri 26 Oct 2001 21,504 A..H. --- "C:\WINDOWS\msagent\intl\agt0407.dll" Fri 26 Oct 2001 22,016 A..H. --- "C:\WINDOWS\msagent\intl\agt0408.dll" Fri 26 Oct 2001 19,456 A..H. --- "C:\WINDOWS\msagent\intl\agt0409.dll" Fri 26 Oct 2001 19,456 A..H. --- "C:\WINDOWS\msagent\intl\agt040b.dll" Fri 26 Oct 2001 21,504 A..H. --- "C:\WINDOWS\msagent\intl\agt040c.dll" Fri 26 Oct 2001 19,968 A..H. --- "C:\WINDOWS\msagent\intl\agt040e.dll" Fri 26 Oct 2001 20,992 A..H. --- "C:\WINDOWS\msagent\intl\agt0410.dll" Fri 26 Oct 2001 20,992 A..H. --- "C:\WINDOWS\msagent\intl\agt0413.dll" Fri 26 Oct 2001 19,456 A..H. --- "C:\WINDOWS\msagent\intl\agt0414.dll" Fri 26 Oct 2001 19,456 A..H. --- "C:\WINDOWS\msagent\intl\agt0415.dll" Fri 26 Oct 2001 20,480 A..H. --- "C:\WINDOWS\msagent\intl\agt0416.dll" Fri 26 Oct 2001 19,456 A..H. --- "C:\WINDOWS\msagent\intl\agt0419.dll" Fri 26 Oct 2001 19,456 A..H. --- "C:\WINDOWS\msagent\intl\agt041d.dll" Fri 26 Oct 2001 19,456 A..H. --- "C:\WINDOWS\msagent\intl\agt041f.dll" Fri 26 Oct 2001 20,992 A..H. --- "C:\WINDOWS\msagent\intl\agt0816.dll" Fri 26 Oct 2001 20,480 A..H. --- "C:\WINDOWS\msagent\intl\agt0c0a.dll" Thu 15 May 2008 2,149,888 ...H. --- "C:\Documents and Settings\Renia\Moje dokumenty\praca licencjacka\~WRL1828.tmp" Thu 15 May 2008 2,133,504 ...H. --- "C:\Documents and Settings\Renia\Moje dokumenty\praca licencjacka\~WRL2155.tmp" Fri 26 Oct 2001 3,374,640 A..H. --- "C:\WINDOWS\Help\Tours\mmTour\tour.exe" Thu 20 Feb 2003 131,072 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll" Fri 21 Feb 2003 7,680 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Accessibility.dll" Fri 21 Feb 2003 98,304 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\alink.dll" Thu 15 Jul 2004 258,048 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_isapi.dll" Thu 15 Jul 2004 32,768 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe" Thu 20 Feb 2003 24,576 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_filter.dll" Thu 15 Jul 2004 32,768 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_wp.exe" Thu 20 Feb 2003 40,960 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_rc.dll" Thu 15 Jul 2004 20,480 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_regiis.exe" Fri 21 Feb 2003 94,208 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CasPol.exe" Fri 21 Feb 2003 49,152 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ConfigWizards.exe" Thu 15 Jul 2004 81,920 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CORPerfMonExt.dll" Thu 15 Jul 2004 49,152 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\csc.exe" Thu 15 Jul 2004 626,688 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\cscomp.dll" Fri 21 Feb 2003 12,288 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\cscompmgd.dll" Fri 21 Feb 2003 33,792 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\CustomMarshalers.dll" Fri 21 Feb 2003 28,672 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\cvtres.exe" Mon 29 Jul 2002 219,136 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\c_g18030.dll" Fri 21 Feb 2003 524,288 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\diasymreader.dll" Thu 20 Feb 2003 798,720 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\EventLogMessages.dll" Thu 15 Jul 2004 282,624 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\fusion.dll" Wed 8 Oct 2003 81,920 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\gacutil.exe" Fri 21 Feb 2003 7,680 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\IEExec.exe" Thu 15 Jul 2004 8,192 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\IEExecRemote.dll" Thu 15 Jul 2004 32,768 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\IEHost.dll" Fri 21 Feb 2003 4,608 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\IIEHost.dll" Thu 15 Jul 2004 196,608 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ilasm.exe" Thu 20 Feb 2003 40,960 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\InstallUtilLib.dll" Fri 21 Feb 2003 15,872 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\InstallUtil.exe" Fri 21 Feb 2003 26,112 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ISymWrapper.dll" Fri 21 Feb 2003 40,960 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\jsc.exe" Thu 15 Jul 2004 299,008 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.dll" Fri 21 Feb 2003 11,264 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.Vsa.Vb.CodeDOMProcessor.dll" Fri 21 Feb 2003 32,768 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.Vsa.dll" Fri 21 Feb 2003 28,672 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualBasic.Vsa.dll" Fri 21 Feb 2003 6,656 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft_VsaVb.dll" Thu 15 Jul 2004 720,896 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.JScript.dll" Fri 21 Feb 2003 6,144 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Microsoft.VisualC.Dll" Thu 15 Jul 2004 49,152 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MigPol.exe" Thu 15 Jul 2004 49,152 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MigPolWin.exe" Fri 21 Feb 2003 1,564,672 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorcfg.dll" Thu 15 Jul 2004 86,016 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscordbc.dll" Thu 15 Jul 2004 233,472 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscordbi.dll" Thu 20 Feb 2003 86,016 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorie.dll" Thu 15 Jul 2004 315,392 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorjit.dll" Thu 15 Jul 2004 102,400 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorld.dll" Thu 15 Jul 2004 2,138,112 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorlib.dll" Thu 20 Feb 2003 131,072 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscormmc.dll" Thu 20 Feb 2003 65,536 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorpe.dll" Thu 15 Jul 2004 143,360 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorrc.dll" Thu 15 Jul 2004 81,920 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsec.dll" Thu 20 Feb 2003 77,824 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsn.dll" Thu 15 Jul 2004 2,510,848 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorsvr.dll" Thu 20 Feb 2003 9,216 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscortim.dll" Thu 15 Jul 2004 2,502,656 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" Fri 21 Feb 2003 348,160 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\msvcr71.dll" Thu 20 Feb 2003 20,480 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\mtxoci8.dll" Tue 10 Aug 2004 106,496 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\netfxupdate.exe" Thu 20 Feb 2003 73,728 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\ngen.exe" Thu 15 Jul 2004 94,208 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\PerfCounter.dll" Fri 21 Feb 2003 28,672 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\RegAsm.exe" Thu 15 Jul 2004 32,768 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\RegCode.dll" Fri 21 Feb 2003 12,288 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\RegSvcs.exe" Thu 20 Feb 2003 253,952 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\shfusion.dll" Thu 20 Feb 2003 122,880 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\shfusres.dll" Thu 15 Jul 2004 319,488 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\SOS.dll" Thu 15 Jul 2004 90,112 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.DirectoryServices.dll" Thu 15 Jul 2004 1,257,472 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.dll" Thu 15 Jul 2004 303,104 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Data.OracleClient.dll" Thu 15 Jul 2004 77,824 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Security.dll" Thu 15 Jul 2004 1,294,336 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Data.dll" Thu 15 Jul 2004 241,664 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.dll" Thu 15 Jul 2004 2,052,096 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Windows.Forms.dll" Thu 15 Jul 2004 241,664 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Messaging.dll" Thu 15 Jul 2004 1,703,936 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Design.dll" Thu 15 Jul 2004 372,736 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Management.dll" Thu 15 Jul 2004 66,560 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.EnterpriseServices.Thunk.dll" Thu 15 Jul 2004 573,440 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.Services.dll" Thu 15 Jul 2004 1,339,392 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.XML.dll" Thu 15 Jul 2004 819,200 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.Mobile.dll" Thu 15 Jul 2004 466,944 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Drawing.dll" Thu 15 Jul 2004 126,976 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.ServiceProcess.dll" Thu 15 Jul 2004 57,344 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Web.RegularExpressions.dll" Thu 15 Jul 2004 1,224,704 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.dll" Fri 21 Feb 2003 77,824 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Configuration.Install.dll" Fri 21 Feb 2003 65,536 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Drawing.Design.dll" Thu 15 Jul 2004 323,584 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Remoting.dll" Thu 15 Jul 2004 131,072 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\System.Runtime.Serialization.Formatters.Soap.dll" Thu 15 Jul 2004 737,280 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\vbc.exe" Thu 15 Jul 2004 1,032,192 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\VsaVb7rt.dll" Thu 15 Jul 2004 31,744 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\WMINet_Utils.dll" Fri 26 Oct 2001 21,504 A..H. --- "C:\WINDOWS\pchealth\helpctr\binaries\brpinfo.dll" Fri 26 Oct 2001 7,680 A..H. --- "C:\WINDOWS\pchealth\helpctr\binaries\HCAppRes.dll" Tue 3 Aug 2004 768,512 A..H. --- "C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe" Fri 26 Oct 2001 99,840 A..H. --- "C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.exe" Tue 3 Aug 2004 743,936 A..H. --- "C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe" Tue 3 Aug 2004 18,944 A..H. --- "C:\WINDOWS\pchealth\helpctr\binaries\HscUpd.exe" Tue 3 Aug 2004 159,744 A..H. --- "C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe" Tue 3 Aug 2004 379,904 A..H. --- "C:\WINDOWS\pchealth\helpctr\binaries\msinfo.dll" Fri 26 Oct 2001 35,328 A..H. --- "C:\WINDOWS\pchealth\helpctr\binaries\notiflag.exe" Tue 3 Aug 2004 102,400 A..H. --- "C:\WINDOWS\pchealth\helpctr\binaries\pchshell.dll" Tue 3 Aug 2004 38,912 A..H. --- "C:\WINDOWS\pchealth\helpctr\binaries\pchsvc.dll" Tue 3 Aug 2004 151,040 A..H. --- "C:\WINDOWS\pchealth\UploadLB\Binaries\UploadM.exe" Fri 7 Mar 2008 7,680 A..H. --- "C:\WINDOWS\assembly\GAC\Accessibility\1.0.5000.0__b03f5f7f11d50a3a\Accessibility.dll" Fri 7 Mar 2008 12,288 A..H. --- "C:\WINDOWS\assembly\GAC\cscompmgd\7.0.5000.0__b03f5f7f11d50a3a\cscompmgd.dll" Fri 7 Mar 2008 33,792 A..H. --- "C:\WINDOWS\assembly\GAC\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a\CustomMarshalers.dll" Fri 7 Mar 2008 8,192 A..H. --- "C:\WINDOWS\assembly\GAC\IEExecRemote\1.0.5000.0__b03f5f7f11d50a3a\IEExecRemote.dll" Fri 7 Mar 2008 32,768 A..H. --- "C:\WINDOWS\assembly\GAC\IEHost\1.0.5000.0__b03f5f7f11d50a3a\IEHost.dll" Fri 7 Mar 2008 4,608 A..H. --- "C:\WINDOWS\assembly\GAC\IIEHost\1.0.5000.0__b03f5f7f11d50a3a\IIEHost.dll" Fri 7 Mar 2008 26,112 A..H. --- "C:\WINDOWS\assembly\GAC\ISymWrapper\1.0.5000.0__b03f5f7f11d50a3a\ISymWrapper.dll" Fri 7 Mar 2008 6,656 A..H. --- "C:\WINDOWS\assembly\GAC\Microsoft_VsaVb\7.0.5000.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll" Fri 7 Mar 2008 11,264 A..H. --- "C:\WINDOWS\assembly\GAC\Microsoft.Vsa.Vb.CodeDOMProcessor\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll" Fri 7 Mar 2008 720,896 A..H. --- "C:\WINDOWS\assembly\GAC\Microsoft.JScript\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.JScript.dll" Fri 7 Mar 2008 45,056 A..H. --- "C:\WINDOWS\assembly\GAC\Microsoft.JScript.resources\7.0.5000.0_pl_b03f5f7f11d50a3a\Microsoft.Jscript.resources.dll" Fri 7 Mar 2008 299,008 A..H. --- "C:\WINDOWS\assembly\GAC\Microsoft.VisualBasic\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" Fri 7 Mar 2008 32,768 A..H. --- "C:\WINDOWS\assembly\GAC\Microsoft.Vsa\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll" Fri 7 Mar 2008 36,864 A..H. --- "C:\WINDOWS\assembly\GAC\Microsoft.VisualBasic.resources\7.0.5000.0_pl_b03f5f7f11d50a3a\Microsoft.VisualBasic.resources.dll" Fri 7 Mar 2008 6,144 A..H. --- "C:\WINDOWS\assembly\GAC\Microsoft.VisualC\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualC.dll" Fri 7 Mar 2008 28,672 A..H. --- "C:\WINDOWS\assembly\GAC\Microsoft.VisualBasic.Vsa\7.0.5000.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll" Fri 7 Mar 2008 1,564,672 A..H. --- "C:\WINDOWS\assembly\GAC\mscorcfg\1.0.5000.0__b03f5f7f11d50a3a\mscorcfg.dll" Fri 7 Mar 2008 724,992 A..H. --- "C:\WINDOWS\assembly\GAC\mscorcfg.resources\1.0.5000.0_pl_b03f5f7f11d50a3a\mscorcfg.resources.dll" Fri 7 Mar 2008 237,568 A..H. --- "C:\WINDOWS\assembly\GAC\mscorlib.resources\1.0.5000.0_pl_b77a5c561934e089\Mscorlib.resources.dll" Fri 7 Mar 2008 32,768 A..H. --- "C:\WINDOWS\assembly\GAC\Regcode\1.0.5000.0__b03f5f7f11d50a3a\RegCode.dll" Fri 7 Mar 2008 10,240 A..H. --- "C:\WINDOWS\assembly\GAC\Regcode.resources\1.0.5000.0_pl_b03f5f7f11d50a3a\RegCode.resources.dll" Fri 7 Mar 2008 122,880 A..H. --- "C:\WINDOWS\assembly\GAC\System.Data.resources\1.0.5000.0_pl_b77a5c561934e089\System.Data.resources.dll" Fri 7 Mar 2008 24,576 A..H. --- "C:\WINDOWS\assembly\GAC\system.management.resources\1.0.5000.0_pl_b03f5f7f11d50a3a\System.Management.resources.dll" Fri 7 Mar 2008 12,288 A..H. --- "C:\WINDOWS\assembly\GAC\System.Runtime.Serialization.Formatters.Soap.resources\1.0.5000.0_pl_b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.resources.dll" Fri 7 Mar 2008 114,688 A..H. --- "C:\WINDOWS\assembly\GAC\System.XML.resources\1.0.5000.0_pl_b77a5c561934e089\System.xml.resources.dll" Fri 7 Mar 2008 126,976 A..H. --- "C:\WINDOWS\assembly\GAC\System.Web.resources\1.0.5000.0_pl_b03f5f7f11d50a3a\System.Web.resources.dll" Fri 7 Mar 2008 24,576 A..H. --- "C:\WINDOWS\assembly\GAC\System.Drawing.resources\1.0.5000.0_pl_b03f5f7f11d50a3a\System.Drawing.resources.dll" Fri 7 Mar 2008 6,144 A..H. --- "C:\WINDOWS\assembly\GAC\System.Drawing.Design.resources\1.0.5000.0_pl_b03f5f7f11d50a3a\System.Drawing.design.resources.dll" Fri 7 Mar 2008 28,672 A..H. --- "C:\WINDOWS\assembly\GAC\System.Runtime.Remoting.resources\1.0.5000.0_pl_b77a5c561934e089\System.runtime.remoting.resources.dll" Fri 7 Mar 2008 81,920 A..H. --- "C:\WINDOWS\assembly\GAC\System.resources\1.0.5000.0_pl_b77a5c561934e089\System.resources.dll" Fri 7 Mar 2008 61,440 A..H. --- "C:\WINDOWS\assembly\GAC\System.Messaging.resources\1.0.5000.0_pl_b03f5f7f11d50a3a\System.Messaging.resources.dll" Fri 7 Mar 2008 61,440 A..H. --- "C:\WINDOWS\assembly\GAC\System.Web.Services.resources\1.0.5000.0_pl_b03f5f7f11d50a3a\System.Web.Services.resources.dll" Fri 7 Mar 2008 77,824 A..H. --- "C:\WINDOWS\assembly\GAC\System.Web.Mobile.resources\1.0.5000.0_pl_b03f5f7f11d50a3a\System.Web.Mobile.resources.dll" Fri 7 Mar 2008 139,264 A..H. --- "C:\WINDOWS\assembly\GAC\System.Design.resources\1.0.5000.0_pl_b03f5f7f11d50a3a\System.Design.resources.dll" Fri 7 Mar 2008 15,872 A..H. --- "C:\WINDOWS\assembly\GAC\System.Configuration.Install.resources\1.0.5000.0_pl_b03f5f7f11d50a3a\System.Configuration.Install.resources.dll" Fri 7 Mar 2008 180,224 A..H. --- "C:\WINDOWS\assembly\GAC\System.Windows.Forms.resources\1.0.5000.0_pl_b77a5c561934e089\System.Windows.Forms.resources.dll" Fri 7 Mar 2008 1,224,704 A..H. --- "C:\WINDOWS\assembly\GAC\System\1.0.5000.0__b77a5c561934e089\System.dll" Fri 7 Mar 2008 1,257,472 A..H. --- "C:\WINDOWS\assembly\GAC\System.Web\1.0.5000.0__b03f5f7f11d50a3a\System.Web.dll" Fri 7 Mar 2008 1,339,392 A..H. --- "C:\WINDOWS\assembly\GAC\System.Xml\1.0.5000.0__b77a5c561934e089\System.XML.dll" Fri 7 Mar 2008 1,294,336 A..H. --- "C:\WINDOWS\assembly\GAC\System.Data\1.0.5000.0__b77a5c561934e089\System.Data.dll" Fri 7 Mar 2008 65,536 A..H. --- "C:\WINDOWS\assembly\GAC\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.Design.dll" Fri 7 Mar 2008 90,112 A..H. --- "C:\WINDOWS\assembly\GAC\System.DirectoryServices\1.0.5000.0__b03f5f7f11d50a3a\System.DirectoryServices.dll" Fri 7 Mar 2008 466,944 A..H. --- "C:\WINDOWS\assembly\GAC\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a\System.Drawing.dll" Fri 7 Mar 2008 241,664 A..H. --- "C:\WINDOWS\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll" Fri 7 Mar 2008 66,560 A..H. --- "C:\WINDOWS\assembly\GAC\System.EnterpriseServices\1.0.5000.0__b03f5f7f11d50a3a\System.EnterpriseServices.Thunk.dll" Fri 7 Mar 2008 2,052,096 A..H. --- "C:\WINDOWS\assembly\GAC\System.Windows.Forms\1.0.5000.0__b77a5c561934e089\System.Windows.Forms.dll" Fri 7 Mar 2008 77,824 A..H. --- "C:\WINDOWS\assembly\GAC\System.Configuration.Install\1.0.5000.0__b03f5f7f11d50a3a\System.Configuration.Install.dll" Fri 7 Mar 2008 372,736 A..H. --- "C:\WINDOWS\assembly\GAC\System.Management\1.0.5000.0__b03f5f7f11d50a3a\System.Management.dll" Fri 7 Mar 2008 241,664 A..H. --- "C:\WINDOWS\assembly\GAC\System.Messaging\1.0.5000.0__b03f5f7f11d50a3a\System.Messaging.dll" Fri 7 Mar 2008 819,200 A..H. --- "C:\WINDOWS\assembly\GAC\System.Web.Mobile\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Mobile.dll" Fri 7 Mar 2008 303,104 A..H. --- "C:\WINDOWS\assembly\GAC\System.Data.OracleClient\1.0.5000.0__b77a5c561934e089\System.Data.OracleClient.dll" Fri 7 Mar 2008 57,344 A..H. --- "C:\WINDOWS\assembly\GAC\System.Web.RegularExpressions\1.0.5000.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll" Fri 7 Mar 2008 323,584 A..H. --- "C:\WINDOWS\assembly\GAC\System.Runtime.Remoting\1.0.5000.0__b77a5c561934e089\System.Runtime.Remoting.dll" Fri 7 Mar 2008 11,264 A..H. --- "C:\WINDOWS\assembly\GAC\System.DirectoryServices.resources\1.0.5000.0_pl_b03f5f7f11d50a3a\System.DirectoryServices.resources.dll" Fri 7 Mar 2008 77,824 A..H. --- "C:\WINDOWS\assembly\GAC\System.Security\1.0.5000.0__b03f5f7f11d50a3a\System.Security.dll" Fri 7 Mar 2008 126,976 A..H. --- "C:\WINDOWS\assembly\GAC\System.ServiceProcess\1.0.5000.0__b03f5f7f11d50a3a\System.ServiceProcess.dll" Fri 7 Mar 2008 131,072 A..H. --- "C:\WINDOWS\assembly\GAC\System.Runtime.Serialization.Formatters.Soap\1.0.5000.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll" Fri 7 Mar 2008 1,703,936 A..H. --- "C:\WINDOWS\assembly\GAC\System.Design\1.0.5000.0__b03f5f7f11d50a3a\System.Design.dll" Fri 7 Mar 2008 7,680 A..H. --- "C:\WINDOWS\assembly\GAC\System.Security.resources\1.0.5000.0_pl_b03f5f7f11d50a3a\System.Security.resources.dll" Fri 7 Mar 2008 573,440 A..H. --- "C:\WINDOWS\assembly\GAC\System.Web.Services\1.0.5000.0__b03f5f7f11d50a3a\System.Web.Services.dll" Fri 7 Mar 2008 32,768 A..H. --- "C:\WINDOWS\assembly\GAC\System.EnterpriseServices.resources\1.0.5000.0_pl_b03f5f7f11d50a3a\System.EnterpriseServices.resources.dll" Fri 7 Mar 2008 40,960 A..H. --- "C:\WINDOWS\assembly\GAC\System.ServiceProcess.resources\1.0.5000.0_pl_b03f5f7f11d50a3a\System.ServiceProcess.resources.dll" Fri 7 Mar 2008 61,440 A..H. --- "C:\WINDOWS\assembly\NativeImages1_v1.1.4322\CustomMarshalers\1.0.5000.0__b03f5f7f11d50a3a_f4487993\CustomMarshalers.dll" Fri 7 Mar 2008 3,379,200 A..H. --- "C:\WINDOWS\assembly\NativeImages1_v1.1.4322\mscorlib\1.0.5000.0__b77a5c561934e089_3eff35ea\mscorlib.dll" Fri 7 Mar 2008 1,953,792 A..H. --- "C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System\1.0.5000.0__b77a5c561934e089_72f7dcd8\System.dll" Fri 7 Mar 2008 2,088,960 A..H. --- "C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Xml\1.0.5000.0__b77a5c561934e089_27202106\System.Xml.dll" Fri 7 Mar 2008 1,466,368 A..H. --- "C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Design\1.0.5000.0__b03f5f7f11d50a3a_4911caae\System.Design.dll" Fri 7 Mar 2008 835,584 A..H. --- "C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Drawing\1.0.5000.0__b03f5f7f11d50a3a_59fff96b\System.Drawing.dll" Fri 7 Mar 2008 3,014,656 A..H. --- "C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Windows.Forms\1.0.5000.0__b77a5c561934e089_23a1e789\System.Windows.Forms.dll" Fri 7 Mar 2008 90,112 A..H. --- "C:\WINDOWS\assembly\NativeImages1_v1.1.4322\System.Drawing.Design\1.0.5000.0__b03f5f7f11d50a3a_5acac2ac\System.Drawing.Design.dll" Fri 21 Feb 2003 16,896 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033\alinkui.dll" Fri 21 Feb 2003 94,208 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033\cscompui.dll" Fri 21 Feb 2003 131,072 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033\vbc7ui.dll" Fri 21 Feb 2003 155,648 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1033\Vsavb7rtUI.dll" Mon 7 Apr 2003 20,992 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1045\alinkui.dll" Mon 7 Apr 2003 114,688 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1045\cscompui.dll" Mon 7 Apr 2003 155,648 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1045\vbc7ui.dll" Mon 7 Apr 2003 180,224 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\1045\Vsavb7rtUI.dll" Mon 7 Apr 2003 45,056 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\aspnet_rc.dll" Mon 7 Apr 2003 40,960 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\caspol.resources.dll" Mon 7 Apr 2003 10,752 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\ConfigWizards.resources.dll" Mon 7 Apr 2003 4,608 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\InstallUtil.resources.dll" Mon 7 Apr 2003 8,192 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\JSC.resources.dll" Mon 7 Apr 2003 45,056 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\Microsoft.JScript.resources.dll" Mon 7 Apr 2003 36,864 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\Microsoft.VisualBasic.resources.dll" Mon 7 Apr 2003 724,992 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\mscorcfg.resources.dll" Mon 7 Apr 2003 237,568 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\mscorlib.resources.dll" Mon 7 Apr 2003 167,936 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\mscorrc.dll" Mon 7 Apr 2003 10,240 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\Regasm.Resources.dll" Mon 7 Apr 2003 10,240 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\RegCode.resources.dll" Mon 7 Apr 2003 122,880 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\ShFusRes.dll" Mon 7 Apr 2003 15,872 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\System.Configuration.Install.resources.dll" Mon 7 Apr 2003 122,880 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\System.Data.resources.dll" Mon 7 Apr 2003 12,288 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\System.Runtime.Serialization.Formatters.Soap.resources.dll" Mon 7 Apr 2003 61,440 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\System.Web.Services.resources.dll" Mon 7 Apr 2003 180,224 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\System.Windows.Forms.resources.dll" Mon 7 Apr 2003 126,976 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\System.Web.resources.dll" Mon 7 Apr 2003 114,688 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\System.xml.resources.dll" Mon 7 Apr 2003 61,440 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\System.Messaging.resources.dll" Mon 7 Apr 2003 6,144 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\System.Drawing.Design.resources.dll" Mon 7 Apr 2003 81,920 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\system.resources.dll" Mon 7 Apr 2003 24,576 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\System.Drawing.resources.dll" Mon 7 Apr 2003 77,824 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\System.Web.Mobile.resources.dll" Mon 7 Apr 2003 139,264 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\System.Design.resources.dll" Mon 7 Apr 2003 24,576 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\System.Management.resources.dll" Mon 7 Apr 2003 28,672 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\System.Runtime.Remoting.resources.dll" Mon 7 Apr 2003 32,768 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\System.EnterpriseServices.resources.dll" Mon 7 Apr 2003 7,680 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\System.Security.resources.dll" Mon 7 Apr 2003 11,264 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\System.DirectoryServices.resources.dll" Mon 7 Apr 2003 40,960 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\pl\System.ServiceProcess.resources.dll" Tue 22 Jun 2004 53,248 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" Tue 30 Sep 2008 215,270 A..H. --- "C:\WINDOWS\pchealth\helpctr\Config\Cache\Professional_32_1045.dat.bak" Thu 20 Feb 2003 22,528 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MUI\0409\mscorsecr.dll" Mon 7 Apr 2003 23,552 A..H. --- "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\MUI\0415\mscorsecr.dll" [b]Finished![/b]

log combofixa:

Kod: Zaznacz wszystko: ComboFix 09-01-31.01 - Renia 2009-01-31 22:08:31.7 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.512.109 [GMT 1:00] Uruchomiony z: c:\documents and settings\Renia\Pulpit\ComboFix.exe AV: Panda Internet Security 2008 *On-access scanning disabled* (Outdated) FW: Panda Internet Security 2008 *disabled* * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\8.bat D:\8.bat D:\j60osk9.cmd D:\uvsqfgwd.cmd F:\8.bat F:\j60osk9.cmd F:\uvsqfgwd.cmd I:\8.bat I:\j60osk9.cmd I:\uvsqfgwd.cmd . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-28 do 2009-01-31 ))))))))))))))))))))))))))))))) . 2009-01-31 21:44 . 2009-01-31 22:09 <DIR> d--h----- c:\documents and settings\Administrator\Ustawienia lokalne 2009-01-31 21:44 . 2007-11-10 16:55 <DIR> d-------- c:\documents and settings\Administrator\Ulubione 2009-01-31 21:44 . 2007-11-10 16:02 <DIR> d--h----- c:\documents and settings\Administrator\Szablony 2009-01-31 21:44 . 2007-11-10 16:55 <DIR> d-------- c:\documents and settings\Administrator\Pulpit 2009-01-31 21:44 . 2007-11-10 16:55 <DIR> d-------- c:\documents and settings\Administrator\Moje dokumenty 2009-01-31 21:44 . 2007-11-10 16:55 <DIR> dr------- c:\documents and settings\Administrator\Menu Start 2009-01-31 21:44 . 2007-11-10 16:55 <DIR> dr-h----- c:\documents and settings\Administrator\Dane aplikacji 2009-01-31 21:44 . 2009-01-31 21:44 <DIR> d-------- c:\documents and settings\Administrator 2009-01-31 21:41 . 2009-01-31 21:58 <DIR> d-------- C:\SDFix 2009-01-28 15:38 . 2008-06-19 16:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys 2009-01-18 07:48 . 2004-08-03 23:44 70,144 --ah----- c:\windows\AhnRpta.exe 2009-01-18 07:40 . 2009-01-29 12:39 108,861 -r-hs---- c:\windows\system32\olhrwef.exe 2009-01-18 07:40 . 2009-01-29 12:39 95,744 -r-hs---- c:\windows\system32\nmdfgds0.dll 2009-01-14 07:22 . 2009-01-29 12:38 85,504 --a------ c:\windows\system32\gasretyw0.0ll 2009-01-05 19:42 . 2009-01-18 00:43 <DIR> d-------- c:\documents and settings\Renia\Dane aplikacji\Thinstall 2009-01-02 13:42 . 2009-01-02 13:42 <DIR> d-------- c:\documents and settings\Renia\Dane aplikacji\ArcaBit 2009-01-02 11:00 . 2009-01-29 21:28 <DIR> d-------- c:\documents and settings\Renia\.housecall6.6 2008-12-31 12:17 . 2008-12-31 12:17 <DIR> d-------- C:\fsaua.data 2008-12-30 17:19 . 2008-12-30 18:44 <DIR> d-------- c:\program files\EsetOnlineScanner . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-31 21:05 291,352 ----a-w c:\windows\system32\drivers\APPFCONT.DAT.bck 2009-01-31 21:05 291,352 ----a-w c:\windows\system32\drivers\APPFCONT.DAT 2009-01-31 21:05 1,244 ----a-w c:\windows\system32\drivers\APPFLTR.CFG.bck 2009-01-31 21:05 1,244 ----a-w c:\windows\system32\drivers\APPFLTR.CFG 2009-01-31 21:00 13,880 ----a-w c:\windows\system32\drivers\COMFiltr.sys 2009-01-30 08:10 --------- d-----w c:\program files\Gadu-Gadu 2008-12-30 17:47 --------- d-----w c:\program files\Panda Security 2008-12-30 12:29 --------- d-----w c:\documents and settings\Renia\Dane aplikacji\Skype 2008-12-30 12:27 --------- d-----w c:\documents and settings\Renia\Dane aplikacji\skypePM 2008-12-07 20:41 --------- d-----w c:\documents and settings\Renia\Dane aplikacji\uTorrent 2008-03-16 14:43 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat . ((((((((((((((((((((((((((((( snapshot@2009-01-30_14.37.37,84 ))))))))))))))))))))))))))))))))))))))))) . - 2008-05-17 00:22:37 163,328 ---ha-w c:\windows\ERUNT\SDFIX\ERDNT.EXE + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE - 2008-05-19 19:06:41 4,509,696 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2009-01-31 20:46:02 372,736 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT - 2008-05-19 19:06:42 237,568 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2009-01-31 20:46:02 8,192 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat - 2000-08-31 07:00:00 161,792 ----a-w c:\windows\SWREG.exe + 2000-08-31 07:00:00 286,720 ----a-w c:\windows\SWREG.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584] "VoipDiscount"="d:\voipdiscount.com\VoipDiscount\VoipDiscount.exe" [2007-05-31 7419456] "cdoosoft"="c:\windows\system32\olhrwef.exe" [2009-01-29 108861] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "APVXDWIN"="c:\program files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" [2007-07-23 406832] "SCANINICIO"="c:\program files\Panda Security\Panda Internet Security 2008\Inicio.exe" [2007-07-11 27952] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2007-10-10 36352] "Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 143360] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-05-15 1628208] "InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-05-15 1057328] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048] Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr] 2007-02-15 20:02 50736 c:\windows\system32\avldr.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-03 23:44 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 09:50 155648 c:\windows\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 01:11 132496 c:\program files\Java\jre1.6.0_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Resume copy] --ah----- 2007-11-10 16:43 73728 c:\windows\copyfstq.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "d:\\VoipDiscount.com\\VoipDiscount\\VoipDiscount.exe"= "i:\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-01-28 28544] R1 APPFLT;App Filter Plugin;c:\windows\system32\drivers\APPFLT.SYS [2007-11-10 71736] R1 DSAFLT;DSA Filter Plugin;c:\windows\system32\drivers\dsaflt.sys [2007-11-10 51256] R1 FNETMON;NetMon Filter Plugin;c:\windows\system32\drivers\fnetmon.sys [2007-11-10 22072] R1 IDSFLT;Ids Filter Plugin;c:\windows\system32\drivers\idsflt.sys [2007-11-10 191672] R1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\drivers\NETFLTDI.SYS [2007-11-10 16:28:18 132920] R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\drivers\ShlDrv51.sys [2007-11-10 38968] R1 SMSFLT;SMS Filter Plugin;c:\windows\system32\drivers\smsflt.sys [2007-11-10 37304] R1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\drivers\wnmflt.sys [2007-11-10 30648] R3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys --> c:\windows\system32\drivers\av5flt.sys [?] R3 NETIMFLT;PANDA NDIS IM Filter Miniport;c:\windows\system32\drivers\netimflt.sys [2007-11-10 142128] R3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys --> c:\windows\system32\PavSRK.sys [?] R3 PavTPK.sys;PavTPK.sys;\??\c:\windows\system32\PavTPK.sys --> c:\windows\system32\PavTPK.sys [?] R4 cpoint;Panda CPoint Driver;c:\windows\system32\drivers\cpoint.sys [2007-11-10 24760] R4 PavProc;Panda Process Protection Driver;c:\windows\system32\drivers\PavProc.sys [2007-11-10 178872] --- Inne Usługi/Sterowniki w Pamięci --- *Deregistered* - ComFiltr [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{18d1931e-b2a5-11dd-9815-000c6e9c5804}] \Shell\AutoRun\command - J:\ij.bat \Shell\explore\Command - J:\ij.bat \Shell\open\Command - J:\ij.bat [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{27eca4f4-000f-11dd-8035-000c6e9c5804}] \Shell\AutoRun\command - E:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4347f632-9555-11dd-97e2-000c6e9c5804}] \Shell\AutoRun\command - H:\gy.exe \Shell\open\Command - H:\gy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4ddc430e-8f9f-11dc-9158-000c6e9c5804}] \Shell\AutoRun\command - J:\USBNB.exe . Zawartość folderu 'Zaplanowane zadania' 2009-01-31 c:\windows\Tasks\1-Click Maintenance.job - c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://onet.pl/ IE: &Pobierz przez ReGet Deluxe - c:\program files\Common Files\ReGet Shared\CC_Link.htm IE: &Winamp Toolbar Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Pobierz &wszystko przez ReGet Deluxe - c:\program files\Common Files\ReGet Shared\CC_All.htm LSP: c:\program files\Panda Security\Panda Internet Security 2008\pavlsp.dll Trusted Zone: arcabit.com\arcaonline Trusted Zone: com.pl\mks DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab FF - ProfilePath - c:\documents and settings\Renia\Dane aplikacji\Mozilla\Firefox\Profiles\9ehok85w.default\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-31 22:10:05 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- - - - - - - - > 'winlogon.exe'(1032) c:\windows\system32\avldr.dll . Czas ukończenia: 2009-01-31 22:13:06 ComboFix-quarantined-files.txt 2009-01-31 21:12:53 ComboFix2.txt 2009-01-30 13:39:19 Przed: 12 433 227 776 bajtów wolnych Po: 12,425,474,048 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 180

**Posty:** 8001 · przez **Okocza** 31 Sty 2009, 23:33

wklej w notatnik:

Kod: Zaznacz wszystko: File:: c:\windows\AhnRpta.exe c:\windows\system32\olhrwef.exe c:\windows\system32\nmdfgds0.dll c:\windows\system32\gasretyw0.0ll c:\windows\system32\avldr.dll c:\windows\copyfstq.exe J:\ij.bat H:\gy.exe Folder:: C:\fsaua.data c:\windows\ERUNT Registry:: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "cdoosoft"=- [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avldr] [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Resume copy] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{18d1931e-b2a5-11dd-9815-000c6e9c5804}] [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4347f632-9555-11dd-97e2-000c6e9c5804}]

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . odczekaj az wygeneruje sie nowy log i go daj na forum

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa

**Posty:** 38 · przez **renik** 01 Lut 2009, 00:11

combofix:

Kod: Zaznacz wszystko: ComboFix 09-01-31.01 - Renia 2009-01-31 22:58:47.9 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.512.151 [GMT 1:00] Uruchomiony z: c:\documents and settings\Renia\Pulpit\ComboFix.exe AV: Panda Internet Security 2008 *On-access scanning enabled* (Updated) FW: Panda Internet Security 2008 *enabled* . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-28 do 2009-01-31 ))))))))))))))))))))))))))))))) . 2009-01-31 21:44 . 2009-01-31 23:01 <DIR> d--h----- c:\documents and settings\Administrator\Ustawienia lokalne 2009-01-31 21:44 . 2007-11-10 16:55 <DIR> d-------- c:\documents and settings\Administrator\Ulubione 2009-01-31 21:44 . 2007-11-10 16:02 <DIR> d--h----- c:\documents and settings\Administrator\Szablony 2009-01-31 21:44 . 2007-11-10 16:55 <DIR> d-------- c:\documents and settings\Administrator\Pulpit 2009-01-31 21:44 . 2007-11-10 16:55 <DIR> d-------- c:\documents and settings\Administrator\Moje dokumenty 2009-01-31 21:44 . 2007-11-10 16:55 <DIR> dr------- c:\documents and settings\Administrator\Menu Start 2009-01-31 21:44 . 2007-11-10 16:55 <DIR> dr-h----- c:\documents and settings\Administrator\Dane aplikacji 2009-01-31 21:44 . 2009-01-31 21:44 <DIR> d-------- c:\documents and settings\Administrator 2009-01-31 21:41 . 2009-01-31 21:58 <DIR> d-------- C:\SDFix 2009-01-28 15:38 . 2008-06-19 16:24 28,544 --a------ c:\windows\system32\drivers\pavboot.sys 2009-01-05 19:42 . 2009-01-18 00:43 <DIR> d-------- c:\documents and settings\Renia\Dane aplikacji\Thinstall 2009-01-02 13:42 . 2009-01-02 13:42 <DIR> d-------- c:\documents and settings\Renia\Dane aplikacji\ArcaBit 2009-01-02 11:00 . 2009-01-29 21:28 <DIR> d-------- c:\documents and settings\Renia\.housecall6.6 2008-12-30 17:19 . 2008-12-30 18:44 <DIR> d-------- c:\program files\EsetOnlineScanner . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-31 21:57 291,352 ----a-w c:\windows\system32\drivers\APPFCONT.DAT.bck 2009-01-31 21:57 291,352 ----a-w c:\windows\system32\drivers\APPFCONT.DAT 2009-01-31 21:57 1,244 ----a-w c:\windows\system32\drivers\APPFLTR.CFG.bck 2009-01-31 21:57 1,244 ----a-w c:\windows\system32\drivers\APPFLTR.CFG 2009-01-31 21:47 13,880 ----a-w c:\windows\system32\drivers\COMFiltr.sys 2009-01-30 08:10 --------- d-----w c:\program files\Gadu-Gadu 2008-12-30 17:47 --------- d-----w c:\program files\Panda Security 2008-12-30 12:29 --------- d-----w c:\documents and settings\Renia\Dane aplikacji\Skype 2008-12-30 12:27 --------- d-----w c:\documents and settings\Renia\Dane aplikacji\skypePM 2008-12-07 20:41 --------- d-----w c:\documents and settings\Renia\Dane aplikacji\uTorrent 2008-03-16 14:43 32 ----a-w c:\documents and settings\All Users\Dane aplikacji\ezsid.dat . ((((((((((((((((((((((((((((( snapshot@2009-01-30_14.37.37,84 ))))))))))))))))))))))))))))))))))))))))) . - 2000-08-31 07:00:00 161,792 ----a-w c:\windows\SWREG.exe + 2000-08-31 07:00:00 286,720 ----a-w c:\windows\SWREG.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-04 1667584] "VoipDiscount"="d:\voipdiscount.com\VoipDiscount\VoipDiscount.exe" [2007-05-31 7419456] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "APVXDWIN"="c:\program files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" [2007-07-23 406832] "SCANINICIO"="c:\program files\Panda Security\Panda Internet Security 2008\Inicio.exe" [2007-07-11 27952] "WinampAgent"="c:\program files\Winamp\winampa.exe" [2007-10-10 36352] "Smapp"="c:\program files\Analog Devices\SoundMAX\SMTray.exe" [2003-05-05 143360] "NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136] "SecurDisc"="c:\program files\Nero\Nero 7\InCD\NBHGui.exe" [2007-05-15 1628208] "InCD"="c:\program files\Nero\Nero 7\InCD\InCD.exe" [2007-05-15 1057328] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 15360] c:\documents and settings\All Users\Menu Start\Programy\Autostart\ Adobe Reader Speed Launch.lnk - c:\program files\Adobe\Reader 8.0\Reader\reader_sl.exe [2006-10-23 40048] Adobe Reader Synchronizer.lnk - c:\program files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe [2006-10-23 734872] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE] --a------ 2004-08-03 23:44 15360 c:\windows\system32\ctfmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2001-07-09 09:50 155648 c:\windows\system32\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2007-09-25 01:11 132496 c:\program files\Java\jre1.6.0_03\bin\jusched.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "d:\\VoipDiscount.com\\VoipDiscount\\VoipDiscount.exe"= "i:\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 pavboot;pavboot;c:\windows\system32\drivers\pavboot.sys [2009-01-28 28544] R1 APPFLT;App Filter Plugin;c:\windows\system32\drivers\APPFLT.SYS [2007-11-10 71736] R1 DSAFLT;DSA Filter Plugin;c:\windows\system32\drivers\dsaflt.sys [2007-11-10 51256] R1 FNETMON;NetMon Filter Plugin;c:\windows\system32\drivers\fnetmon.sys [2007-11-10 22072] R1 IDSFLT;Ids Filter Plugin;c:\windows\system32\drivers\idsflt.sys [2007-11-10 191672] R1 NETFLTDI;Panda Net Driver [TDI Layer];c:\windows\system32\drivers\NETFLTDI.SYS [2007-11-10 16:28:18 132920] R1 ShldDrv;Panda File Shield Driver;c:\windows\system32\drivers\ShlDrv51.sys [2007-11-10 38968] R1 SMSFLT;SMS Filter Plugin;c:\windows\system32\drivers\smsflt.sys [2007-11-10 37304] R1 WNMFLT;Wifi Monitor Filter Plugin;c:\windows\system32\drivers\wnmflt.sys [2007-11-10 30648] R3 AvFlt;Antivirus Filter Driver;c:\windows\system32\drivers\av5flt.sys --> c:\windows\system32\drivers\av5flt.sys [?] R3 NETIMFLT;PANDA NDIS IM Filter Miniport;c:\windows\system32\drivers\netimflt.sys [2007-11-10 142128] R3 PavSRK.sys;PavSRK.sys;\??\c:\windows\system32\PavSRK.sys --> c:\windows\system32\PavSRK.sys [?] R3 PavTPK.sys;PavTPK.sys;\??\c:\windows\system32\PavTPK.sys --> c:\windows\system32\PavTPK.sys [?] R4 cpoint;Panda CPoint Driver;c:\windows\system32\drivers\cpoint.sys [2007-11-10 24760] R4 PavProc;Panda Process Protection Driver;c:\windows\system32\drivers\PavProc.sys [2007-11-10 178872] --- Inne Usługi/Sterowniki w Pamięci --- *NewlyCreated* - COMFILTR *Deregistered* - ComFiltr [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{27eca4f4-000f-11dd-8035-000c6e9c5804}] \Shell\AutoRun\command - E:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4ddc430e-8f9f-11dc-9158-000c6e9c5804}] \Shell\AutoRun\command - J:\USBNB.exe . Zawartość folderu 'Zaplanowane zadania' 2009-01-31 c:\windows\Tasks\1-Click Maintenance.job - c:\program files\TuneUp Utilities 2008\OneClickStarter.exe [] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://onet.pl/ IE: &Pobierz przez ReGet Deluxe - c:\program files\Common Files\ReGet Shared\CC_Link.htm IE: &Winamp Toolbar Search - c:\documents and settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 IE: Pobierz &wszystko przez ReGet Deluxe - c:\program files\Common Files\ReGet Shared\CC_All.htm LSP: c:\program files\Panda Security\Panda Internet Security 2008\pavlsp.dll Trusted Zone: arcabit.com\arcaonline Trusted Zone: com.pl\mks DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab FF - ProfilePath - c:\documents and settings\Renia\Dane aplikacji\Mozilla\Firefox\Profiles\9ehok85w.default\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-31 23:01:43 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2009-01-31 23:03:40 ComboFix-quarantined-files.txt 2009-01-31 22:03:24 ComboFix2.txt 2009-01-31 21:55:06 ComboFix3.txt 2009-01-31 21:13:08 ComboFix4.txt 2009-01-30 13:39:19 Przed: 12,425,732,096 bajtów wolnych Po: 12,415,610,880 bajtów wolnych 135

Dodano 01.02.2009 00:12:20:
hijackthis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:08, on 2009-01-31 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe C:\Program Files\Panda Security\Panda Internet Security 2008\AVENGINE.EXE c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Analog Devices\SoundMAX\SMTray.exe C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe C:\Program Files\Nero\Nero 7\InCD\InCD.exe D:\VoipDiscount.com\VoipDiscount\VoipDiscount.exe C:\Program Files\Panda Security\Panda Internet Security 2008\PavBckPT.exe C:\WINDOWS\system32\notepad.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Panda Security\Panda Internet Security 2008\apvxdwin.exe C:\Program Files\Panda Security\Panda Internet Security 2008\SRVLOAD.EXE C:\Program Files\Panda Security\Panda Internet Security 2008\WebProxy.exe C:\Program Files\Panda Security\Panda Internet Security 2008\psimreal.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://onet.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Winamp Toolbar BHO - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O3 - Toolbar: ReGet Bar - {17939A30-18E2-471E-9D3A-56DD725F1215} - C:\Program Files\ReGetDx\iebar.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Internet Security 2008\APVXDWIN.EXE" /s O4 - HKLM\..\Run: [SCANINICIO] "C:\Program Files\Panda Security\Panda Internet Security 2008\Inicio.exe" O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe O4 - HKLM\..\Run: [SecurDisc] C:\Program Files\Nero\Nero 7\InCD\NBHGui.exe O4 - HKLM\..\Run: [InCD] C:\Program Files\Nero\Nero 7\InCD\InCD.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [VoipDiscount] "D:\VoipDiscount.com\VoipDiscount\VoipDiscount.exe" -nosplash -minimized O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O8 - Extra context menu item: &Pobierz przez ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_Link.htm O8 - Extra context menu item: &Winamp Toolbar Search - C:\Documents and Settings\All Users\Dane aplikacji\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz &wszystko przez ReGet Deluxe - C:\Program Files\Common Files\ReGet Shared\CC_All.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe (file missing) O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O15 - Trusted Zone: http://arcaonline.arcabit.com O15 - Trusted Zone: http://mks.com.pl O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1223485856968 O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-secure.com/ols/fscax.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Nero\Nero 7\InCD\InCDsrv.exe O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsCtrls.exe O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PavFnSvr.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\pavsrv51.exe O23 - Service: Panda Antispam Engine (pmshellsrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\AntiSpam\pskmssvc.exe O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda internet security 2008\firewall\PSHOST.EXE O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\PsImSvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Internet Security 2008\TPSrv.exe -- End of file - 8774 bytes

**Posty:** 8001 · przez **Okocza** 01 Lut 2009, 00:15

Wykonaj to co jest podane w tym temacie

1. tym programem przejdź komputer)
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.
7. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

**Posty:** 38 · przez **renik** 01 Lut 2009, 00:45

screen z zakładki uruchamianie:

**Posty:** 8001 · przez **Okocza** 01 Lut 2009, 00:49

winampa
nerochek
smtray
nbhgui
incd
msmsgs
voipdiscount
adobe obydwa

możesz wyłączyć

**Posty:** 38 · przez **renik** 01 Lut 2009, 00:53

przeskanowalam komp pod względem trojanów przez fixidef i nic nie wykazalo

**Posty:** 8001 · przez **Okocza** 01 Lut 2009, 11:12

renik, w takim razie jest ok

**Posty:** 38 · przez **renik** 01 Lut 2009, 12:59

nie jest ok :cry:

podaje raport z kaspersky,znowu to samo,a wszystko zrobiłam jak mi kazałeś okocza:

Kod: Zaznacz wszystko: -------------------------------------------------------------------------------- RAPORT KASPERSKY ONLINE SCANNER 7.0 niedziela, 1 luty 2009 System operacyjny: Microsoft Windows XP Professional Dodatek Service Pack 2 (build 2600) Wersja Kaspersky Online Scanner: 7.0.26.12 Data ostatniej aktualizacji bazy danych: Saturday, January 31, 2009 20:01:42 Liczba wpisów: 1733252 -------------------------------------------------------------------------------- Ustawienia skanowania: Typ bazy danych użytej do skanowania: rozszerzona Skanuj archiwa: tak Skanuj pocztowe bazy danych: tak Obszar skanowania - Mój komputer: A:\ C:\ D:\ E:\ F:\ G:\ I:\ Statystyki skanowania: Przeskanowanych plików: 116346 Nazwa zagrożenia: 7 Zainfekowanych obiektów: 20 Podejrzanych obiektów: 0 Czas skanowania: 02:02:43 Nazwa pliku / Nazwa zagrożenia / Liczba zagrożeń C:\Documents and Settings\Renia\.housecall6.6\Quarantine\afmain1.dll.bac_a03736 Zainfekowany: Packed.Win32.Krap.g 1 C:\Qoobox\Quarantine\C\8.bat.vir Zainfekowany: Worm.Win32.AutoRun.yza 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\gasretyw0.0ll.vir Zainfekowany: Trojan-GameThief.Win32.WOW.dar 1 C:\Qoobox\Quarantine\C\WINDOWS\system32\olhrwef.exe.vir Zainfekowany: Worm.Win32.AutoRun.yza 1 C:\Qoobox\Quarantine\D\8.bat.vir Zainfekowany: Worm.Win32.AutoRun.yza 1 C:\Qoobox\Quarantine\D\j60osk9.cmd.vir Zainfekowany: Trojan-Dropper.Win32.Agent.afdh 1 C:\Qoobox\Quarantine\D\uvsqfgwd.cmd.vir Zainfekowany: Trojan-GameThief.Win32.Magania.audk 1 C:\Qoobox\Quarantine\F\8.bat.vir Zainfekowany: Worm.Win32.AutoRun.yza 1 C:\Qoobox\Quarantine\F\j60osk9.cmd.vir Zainfekowany: Trojan-Dropper.Win32.Agent.afdh 1 C:\Qoobox\Quarantine\F\uvsqfgwd.cmd.vir Zainfekowany: Trojan-GameThief.Win32.Magania.audk 1 C:\Qoobox\Quarantine\I\8.bat.vir Zainfekowany: Worm.Win32.AutoRun.yza 1 C:\Qoobox\Quarantine\I\j60osk9.cmd.vir Zainfekowany: Trojan-Dropper.Win32.Agent.afdh 1 C:\Qoobox\Quarantine\I\uvsqfgwd.cmd.vir Zainfekowany: Trojan-GameThief.Win32.Magania.audk 1 C:\WINDOWS\system32\afmain1.0ll Zainfekowany: Packed.Win32.Krap.g 1 D:\gy.exe Zainfekowany: Trojan.Win32.Agent2.sv 1 D:\w98.com Zainfekowany: Trojan-GameThief.Win32.Magania.atzj 1 F:\gy.exe Zainfekowany: Trojan.Win32.Agent2.sv 1 F:\w98.com Zainfekowany: Trojan-GameThief.Win32.Magania.atzj 1 I:\gy.exe Zainfekowany: Trojan.Win32.Agent2.sv 1 I:\w98.com Zainfekowany: Trojan-GameThief.Win32.Magania.atzj 1 Wybrany obszar został przeskanowany.

**Posty:** 8001 · przez **Okocza** 01 Lut 2009, 14:40

usuń foldery:

renik napisał(a):C:\Qoobox
C:\Documents and Settings\Renia\.housecall6.6

oraz pliki:

Kod: Zaznacz wszystko: D:\gy.exe D:\w98.com F:\gy.exe F:\w98.com I:\gy.exe I:\w98.com

oraz zainstaluj antywirusa

Panda jest strasznie dziurawa, w BEZPIECZEŃSTWIE jest dużo tematów o antywirusach, polecam lekturę

**Posty:** 38 · przez **renik** 01 Lut 2009, 14:57

usunęłam foldery

Kod: Zaznacz wszystko: C:\Qoobox C:\Documents and Settings\Renia\.housecall6.6

a z plikami wiąże się takie moje głupie pytanie:jak je usunąć jak nie mogę tych plików znaleść :?:

Ok pomyslę nad zmianą Pandy

**Posty:** 8001 · przez **Okocza** 01 Lut 2009, 15:06

Kod: Zaznacz wszystko: File:: D:\gy.exe D:\w98.com F:\gy.exe F:\w98.com I:\gy.exe I:\w98.com

wklej to w notatnik, zapisz jako CFScript.txt i przeciągnij jak wtedy na ikonkę combofixa

renik napisał(a):Ok pomyslę nad zmianą Pandy

IMHO lepiej dołożyć parę groszy, tzn pewnie koło 50 - 60zł i kupić sobie roczną licencję na użytkowanie NOD32 - jeden z najlepszych antywirusów na rynku

**Posty:** 38 · przez **renik** 01 Lut 2009, 21:37

Hmmm...jak by to napisać....pomimo usunięcia wirusów,mój komp nadal świruje

A mianowicie nadal sie samoistnie wyłącza przy probach uruchomienia go

pomocy

**Posty:** 8001 · przez **Okocza** 01 Lut 2009, 21:47

renik, podaj kompletną konfigurację komputera, razem z marką i mocą zasilacza.

**Posty:** 38 · przez **renik** 01 Lut 2009, 22:04

zasilacz:Chieftec GPS-350EB-101A 350W
konfigurację wzięłam z EVERESTa:

Kod: Zaznacz wszystko: --------[ EVEREST Home Edition (c) 2003-2005 Lavalys, Inc. ]------------------------------------------------------------ Wersja EVEREST v2.20.405/pl Strona domowa http://www.lavalys.com/ Typ raportu Kreator raportów Komputer RENIA Generator raportu Renia System operacyjny Microsoft Windows XP Professional 5.1.2600 (WinXP Retail) Data 2009-02-01 Czas 21:02 --------[ Podsumowanie ]------------------------------------------------------------------------------------------------ Komputer: System operacyjny Microsoft Windows XP Professional Dodatek service pack systemu operacyjnego Dodatek Service Pack 2 DirectX 4.09.00.0904 (DirectX 9.0c) Nazwa komputera RENIA Nazwa użytkownika Renia Płyta główna: Typ procesora AMD Athlon XP, 2000 MHz (15 x 133) 2400+ Nazwa płyty głównej Asus A7V8X-X (6 PCI, 1 AGP, 3 DDR DIMM, Audio, LAN) Mikroukład płyty głównej VIA VT8377 Apollo KT400 Pamięć fizyczna 512 MB (PC2700 DDR SDRAM) Typ BIOS'u Award Modular (08/06/03) Port komunikacyjny Port komunikacyjny (COM1) Port komunikacyjny Port drukarki ECP (LPT1) Ekran: Karta wideo RADEON 9200 SE Family (Microsoft Corporation) (64 MB) Karta wideo RADEON 9200 SE Family (Microsoft Corporation) (64 MB) Akcelerator 3D ATI Radeon 9200 SE (RV280) Monitor Samsung SyncMaster 703DF(X)/753DF(X)/783DF(X)/MagicSyncMaster CD173A(T) [17" CRT] (H9KW910983) Multimedia: Karta dźwiękowa VIA AC'97 Enhanced Audio Controller Magazyn: Kontroler IDE Kontroler VIA Bus Master IDE Napęd dyskietek Stacja dyskietek Dysk fizyczny WDC WD800BB-00DKA0 (74 GB, IDE) Napęd dysków optycznych HL-DT-ST DVD-RAM GSA-H55N Napęd dysków optycznych HL-DT-ST DVD-ROM GDR8162B (16x/48x DVD-ROM) Status dysków SMART OK Partycje: C: (NTFS) 35840 MB (11772 MB wolne) D: (NTFS) 20481 MB (7017 MB wolne) F: (NTFS) 5122 MB (4048 MB wolne) I: (NTFS) 4141 MB (2074 MB wolne) Rozmiar całkowity 64.0 GB (24.3 GB wolne) Urządzenia wejściowe: Klawiatura Standardowa klawiatura 101/102 klawisze lub Microsoft Natural Keyboard PS/2 Mysz Mysz Microsoft PS/2 Sieć: Karta sieciowa Karta Fast Ethernet zgodna z VIA (192.168.1.117) Urządzenia zewnętrzne: Drukarka Microsoft Office Document Image Writer Kontroler USB1 VIA VT83C572 PCI-USB Controller Kontroler USB1 VIA VT83C572 PCI-USB Controller Kontroler USB1 VIA VT83C572 PCI-USB Controller Kontroler USB2 VIA USB 2.0 Enhanced Host Controller --------[ Procesor ]---------------------------------------------------------------------------------------------------- Właściwości procesora: Typ procesora AMD Athlon XP, 2000 MHz (15 x 133) 2400+ Nazwa kodowa Thoroughbred-B Seria B0 Zbiór instrukcji x86, MMX, 3DNow!, SSE Pamięć podręczna L1 kodu 64 KB Pamięć podręczna L1 danych 64 KB Pamięć podręczna L2 256 KB (On-Die, Full-Speed) Informacje fizyczne procesora: Typ obudowy 453 Pin PGA Wymiary obudowy 4.95 cm x 4.95 cm Liczba tranzystorów 37.6 milion(ów) Technologia wykonania 6Mi, 0.13 um, CMOS, Cu Rozmiar procesora (Die Size) 84 mm2 Napięcie rdzenia 1.50 - 1.65 V Napięcie We /Wy 1.6 V Typowa moc 44.0 - 64.0 W (zależna od szybkości procesora) Maksymalna moc 48.5 - 74.3 W (zależna od szybkości procesora) Producent procesora: Nazwa firmy Advanced Micro Devices, Inc. Informacje o produkcie http://www.amd.com/us-en/Processors/ProductInformation/0,,30_118,00.html Wykorzystanie procesora: Procesor nr 1 0 % --------[ Płyta główna ]------------------------------------------------------------------------------------------------ Właściwości płyty głównej: ID płyty głównej 08/06/2003-VT8377/VT8235-A7V8X-X Nazwa płyty głównej Asus A7V8X-X Właściwości magistrali FSB: Typ magistrali DEC Alpha EV6 Szerokość magistrali 64-bitowy(a) Rzeczywista częstotliwość taktowania 133 MHz (DDR) Efektywna częstotliwość taktowania 267 MHz Przepustowość 2133 MB/sek Właściwości magistrali pamięci: Typ magistrali DDR SDRAM Szerokość magistrali 64-bitowy(a) Rzeczywista częstotliwość taktowania 167 MHz (DDR) Efektywna częstotliwość taktowania 333 MHz Przepustowość 2667 MB/sek Właściwości magistrali mikroukładu płyty głównej: Typ magistrali VIA V-Link Szerokość magistrali 8-bitowy(a) Rzeczywista częstotliwość taktowania 67 MHz (ODR) Efektywna częstotliwość taktowania 533 MHz Przepustowość 533 MB/sek Informacje fizyczne płyty głównej: Liczba gniazd procesora 1 Socket 462 Liczba gniazd rozszerzeń 6 PCI, 1 AGP Liczba gniazd pamięci 3 DDR DIMM Urządzenia zintegrowane z płytą główną Audio, LAN Współczynnik postaci ATX Rozmiar płyty głównej 240 mm x 300 mm Mikroukład płyty głównej KT400 Dodatkowe własności CPU Overheating Protection, JumperFree, Stepless Freq Selection Producent płyty głównej: Nazwa firmy ASUSTeK Computer Inc. Informacje o produkcie http://www.asus.com/products1.aspx?l1=3 Uaktualnienie BIOS'u http://support.asus.com/download/download.aspx?SLanguage=en-us

**Posty:** 8001 · przez **Okocza** 01 Lut 2009, 22:10

renik, powiedz mi jeszcze taką rzecz, długo masz ten komputer? i w jaki sposób dzieje się to wyłączanie? tzn, uruchamia się do pewnego momentu i wyłącza się? czy musi się 'rozkręcić' i za którymś razem już startuje normalnie?

**Posty:** 38 · przez **renik** 01 Lut 2009, 22:25

prawie 6 lat mam go :roll:

włącza sie cały system,czyli włącza sie do konca komp i wtedy jak pojawi się mi pulpit to ciach i wyłącza się. od razu nie mogę włączyc, musze odłączyć od prądu,odczekać do 10 min i znów mogę próbować uruchomić. Tak jest jeszcze do dwóch razy . :roll:

za drugim lub trzecim razem juz komp normalnie startuje. :-|

**Posty:** 8001 · przez **Okocza** 01 Lut 2009, 23:28

renik, PRAWDOPODOBNIE będzie to wina zasilacza, pożycz od kogoś jakiś markowy zasilacz 350W i sprawdź na nim. Markowe to min Chieftec, Tagan, Amacrox, BeQuiet. I tak BTW - ile czasu już ciągnie ten zasilacz. Wstaw jeszcze screen z zakładki czujnik z programu Everest.