Mbr: \\.\ physicaldrive0 typ: rootkit

**Posty:** 5 · przez **holahola** 26 Paź 2008, 00:27

Witam.

Mam zainstalowanego avasta oraz zone alarm jednak nie udało mi się ustrzec przed wirusem / problemem. Otóż od jakiegoś czasu avast wyświetla mi taki oto komunikat:

"Prawdopodobnie na twoim komputerze zainstalowane jest złośliwe oprogramowanie typu rootkit

plik: MBR: \\.\ PHYSICALDRIVE0
typ: rootkit"

W oknie mam do wyboru "usuń" (nie jestem pewien, czy nie uszkodzi mi systemu) oraz "zignoruj", które klikam. Następnie avast chce zrestartować komputer aby usunąć problem i przeskanować dyski twarde. Raz spróbowałem skanu jednak pojawiło się naprawdę dużo błędów lub "wirusów" - plików których nie dało się naprawić/przemianować/ przenieść (kwarantanna) - usunąć się bałem by nie uszkodzić systemu ponieważ nie mam oryginalnej płyty instalacyjnej (posiadam xpeka).
Oprócz tego od czasu pojawienia się komunikatu z avasta:
1) jeśli chce wygasić ekran (Fn+F7) nie mogę go z powrotem przywrócić
2) jeśli laptop przechodzi w stan wstrzymania (np kiedy nie korzystałem z niego przez jakiś czas) kończy się tylko na ekranie windowsowego "komputer zaraz przejdzie w stan wstrzymania" i zwiecha.

Poniżej zamieszczam logi z combofix i hijackthis.

COMBOFIX

Kod: Zaznacz wszystko: ComboFix 08-10-24.02 - admin 2008-10-25 23:45:02.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1403 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\admin\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Recycled\Recycled . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-25 do 2008-10-25 ))))))))))))))))))))))))))))))) . 2008-10-24 22:53 . 2008-10-24 22:54 <DIR> d-------- C:\Program Files\Common Files\Adobe 2008-10-15 22:59 . 2008-10-25 23:45 <DIR> dr-hs---- C:\Recycled 2008-10-10 23:14 . 2008-10-25 23:48 1,050,656 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat 2008-10-10 23:14 . 2008-10-25 23:20 13,280 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx 2008-10-10 23:12 . 2008-10-10 23:12 <DIR> d-------- C:\Program Files\ZoneAlarmSB 2008-10-10 23:10 . 2008-10-10 23:10 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\MailFrontier 2008-10-10 23:10 . 2008-07-09 09:05 75,248 --a------ C:\WINDOWS\zllsputility.exe 2008-10-10 23:10 . 2004-04-27 04:40 11,264 --a------ C:\WINDOWS\system32\SpOrder.dll 2008-10-10 23:10 . 2008-10-10 23:12 4,212 ---h----- C:\WINDOWS\system32\zllictbl.dat 2008-10-10 23:09 . 2008-10-10 23:10 <DIR> d-------- C:\WINDOWS\system32\ZoneLabs 2008-10-10 23:09 . 2008-07-09 09:05 1,086,952 --a------ C:\WINDOWS\system32\zpeng24.dll 2008-10-10 23:09 . 2008-10-25 23:22 352,918 --a------ C:\WINDOWS\system32\vsconfig.xml 2008-10-10 23:08 . 2008-10-25 23:40 <DIR> d-------- C:\WINDOWS\Internet Logs 2008-10-05 18:27 . 2008-10-05 18:50 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-25 19:53 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\foobar2000 2008-10-24 14:13 47,104 ----a-w C:\WINDOWS\Internet Logs\xDB3.tmp 2008-10-23 20:15 33,792 ----a-w C:\WINDOWS\Internet Logs\xDB2.tmp 2008-10-23 17:36 2,817,536 ----a-w C:\WINDOWS\Internet Logs\xDB1.tmp 2008-10-12 19:52 --------- d-----w C:\Program Files\ASUS 2008-10-09 12:29 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\Skype 2008-10-09 12:14 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\skypePM 2008-09-09 16:49 --------- d-----w C:\Program Files\Wanadoo 2008-09-08 08:26 28,672 ----a-w C:\WINDOWS\gscr.dll 2008-09-08 07:49 --------- d-----w C:\Program Files\Borland 2008-09-04 14:55 --------- d-----w C:\Program Files\NAPI-PROJEKT 2008-09-04 14:45 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\DivX 2008-09-03 21:25 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-09-03 21:17 --------- d-----w C:\Program Files\Common Files\InstallShield 2008-09-03 15:03 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\Apple Computer 2008-09-03 14:56 --------- d-----w C:\Program Files\Apple Software Update 2008-09-03 14:56 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple 2008-09-03 11:38 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Last.fm 2008-09-02 18:51 --------- d-----w C:\Program Files\Real 2008-09-02 18:51 --------- d-----w C:\Program Files\Common Files\Real 2008-09-01 21:17 --------- d-----w C:\Documents and Settings\admin\Dane aplikacji\BESTplayer 2008-08-10 21:00 108,144 ----a-w C:\WINDOWS\system32\CmdLineExt.dll 2008-07-25 08:34 161,096 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe . ((((((((((((((((((((((((((((( snapshot@2008-07-23_17.18.55.04 ))))))))))))))))))))))))))))))))))))))))) . + 2006-11-02 05:22:52 51,680 -c----w C:\WINDOWS\$NtUninstallWdf01005$\spuninst\Kmdfcustom.dll + 2006-10-08 19:51:14 221,488 -c----w C:\WINDOWS\$NtUninstallWdf01005$\spuninst\spuninst.exe + 2006-10-08 19:51:14 379,184 -c----w C:\WINDOWS\$NtUninstallWdf01005$\spuninst\updspapi.dll - 2008-06-24 21:38:28 110,592 ----a-w C:\WINDOWS\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll + 2008-08-05 05:25:01 110,592 ----a-w C:\WINDOWS\assembly\GAC\ADODB\7.0.3300.0__b03f5f7f11d50a3a\adodb.dll + 2008-08-05 05:24:58 65,536 ----a-w C:\WINDOWS\assembly\GAC\dao\10.0.4504.0__31bf3856ad364e35\DAO.DLL + 2008-08-05 05:25:03 4,608 ----a-w C:\WINDOWS\assembly\GAC\Extensibility\7.0.3300.0__b03f5f7f11d50a3a\extensibility.dll + 2008-08-05 05:24:57 1,215,328 ----a-w C:\WINDOWS\assembly\GAC\IACore\1.7.6223.0__31bf3856ad364e35\IACore.dll + 2008-08-05 05:24:57 82,784 ----a-w C:\WINDOWS\assembly\GAC\IALoader\1.7.6223.0__31bf3856ad364e35\IALoader.dll + 2008-08-05 05:24:49 31,560 ----a-w C:\WINDOWS\assembly\GAC\ipdmctrl\11.0.0.0__71e9bce111e9429c\IPDMCTRL.DLL + 2008-09-03 21:25:22 53,248 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll + 2008-09-03 21:25:22 12,800 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll + 2008-09-03 21:25:23 473,600 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll + 2008-09-03 21:25:23 567,296 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-09-03 21:25:23 145,920 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll + 2008-09-03 21:25:23 159,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll + 2008-09-03 21:25:24 364,544 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll + 2008-09-03 21:25:24 178,176 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll + 2008-09-03 21:25:22 223,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll + 2008-08-05 05:24:59 8,007,680 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.mshtml\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.mshtml.dll + 2008-08-05 05:24:49 16,712 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Office.InfoPath.Permission\12.0.0.0__71e9bce111e9429c\Microsoft.Office.InfoPath.Permission.dll + 2008-08-05 05:23:05 80,696 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Access.Dao\12.0.0.0__71e9bce111e9429c\Microsoft.Office.interop.access.dao.dll + 2008-08-05 05:23:54 1,612,592 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Access\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Access.dll + 2008-08-05 05:23:55 1,276,720 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Excel\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Excel.dll + 2008-08-05 05:23:55 150,320 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Graph\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Graph.dll + 2008-08-05 05:24:50 404,296 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.InfoPath.SemiTrust\11.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.InfoPath.SemiTrust.dll + 2008-08-05 05:23:57 88,896 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.InfoPath.Xml\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.InfoPath.Xml.dll + 2008-08-05 05:23:56 146,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.InfoPath\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.InfoPath.dll + 2008-08-05 05:24:34 17,208 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.OneNote\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.OneNote.dll + 2008-08-05 05:23:56 920,376 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Outlook\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Outlook.dll + 2008-08-05 05:23:56 35,648 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.OutlookViewCtl\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.OutlookViewCtl.dll + 2008-08-05 05:23:56 248,632 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.PowerPoint\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.PowerPoint.dll + 2008-08-05 05:23:56 232,248 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Publisher\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Publisher.dll + 2008-08-05 05:23:55 20,280 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.SmartTag\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.SmartTag.dll + 2008-08-05 05:23:56 781,104 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Office.Interop.Word\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Interop.Word.dll + 2008-08-05 05:24:59 13,312 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.StdFormat\7.0.3300.0__b03f5f7f11d50a3a\Microsoft.stdformat.dll + 2008-08-05 05:23:55 371,496 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Vbe.Interop.Forms\11.0.0.0__71e9bce111e9429c\Microsoft.Vbe.Interop.Forms.dll + 2008-08-05 05:23:56 64,288 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.Vbe.Interop\12.0.0.0__71e9bce111e9429c\Microsoft.Vbe.Interop.dll - 2008-06-24 21:38:28 229,376 ----a-w C:\WINDOWS\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\MSCOMCTL.DLL + 2008-08-05 05:24:58 229,376 ----a-w C:\WINDOWS\assembly\GAC\mscomctl\10.0.4504.0__31bf3856ad364e35\MSCOMCTL.DLL - 2008-06-24 21:38:28 4,096 ----a-w C:\WINDOWS\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\msdatasrc.dll + 2008-08-05 05:25:01 4,096 ----a-w C:\WINDOWS\assembly\GAC\MSDATASRC\7.0.3300.0__b03f5f7f11d50a3a\msdatasrc.dll + 2008-08-05 05:23:55 416,544 ----a-w C:\WINDOWS\assembly\GAC\office\12.0.0.0__71e9bce111e9429c\OFFICE.DLL + 2008-08-05 05:23:02 12,104 ----a-w C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Access\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Access.dll + 2008-08-05 05:23:05 12,096 ----a-w C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Excel\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Excel.dll + 2008-08-05 05:24:11 12,096 ----a-w C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Graph\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Graph.dll + 2008-08-05 05:24:50 12,616 ----a-w C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.InfoPath.Xml.dll + 2008-08-05 05:24:50 12,616 ----a-w C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.InfoPath\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.InfoPath.dll + 2008-08-05 05:24:36 12,104 ----a-w C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Outlook\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Outlook.dll + 2008-08-05 05:24:34 12,632 ----a-w C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.OutlookViewCtl.dll + 2008-08-05 05:24:36 12,112 ----a-w C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.PowerPoint\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.PowerPoint.dll + 2008-08-05 05:24:40 12,104 ----a-w C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Publisher\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Publisher.dll + 2008-08-05 05:24:25 12,104 ----a-w C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.SmartTag\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.SmartTag.dll + 2008-08-05 05:24:46 12,096 ----a-w C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Office.Interop.Word\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Office.Interop.Word.dll + 2008-08-05 05:24:27 12,080 ----a-w C:\WINDOWS\assembly\GAC\Policy.11.0.Microsoft.Vbe.Interop\12.0.0.0__71e9bce111e9429c\Policy.11.0.Microsoft.Vbe.Interop.dll + 2008-08-05 05:24:27 11,544 ----a-w C:\WINDOWS\assembly\GAC\Policy.11.0.office\12.0.0.0__71e9bce111e9429c\Policy.11.0.Office.dll - 2008-06-24 21:38:28 16,384 ----a-w C:\WINDOWS\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll + 2008-08-05 05:24:59 16,384 ----a-w C:\WINDOWS\assembly\GAC\stdole\7.0.3300.0__b03f5f7f11d50a3a\stdole.dll + 2008-08-05 05:24:50 118,112 ----a-w C:\WINDOWS\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Infopath.Client.Internal.Host.Interop.dll + 2008-08-05 05:25:11 367,400 ----a-w C:\WINDOWS\assembly\GAC_32\Microsoft.VisualStudio.Tools.Applications.InteropAdapter\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.InteropAdapter.dll + 2008-08-05 05:24:49 609,104 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Client.Internal.Host\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Infopath.Client.Internal.Host.dll + 2008-08-05 05:24:49 43,840 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Office.InfoPath.FormControl\12.0.0.0__71e9bce111e9429c\microsoft.office.infopath.formcontrol.dll + 2008-08-05 05:24:50 39,728 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Office.InfoPath.Vsta\12.0.0.0__71e9bce111e9429c\Microsoft.Office.InfoPath.Vsta.dll + 2008-08-05 05:24:50 60,200 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.Office.InfoPath\12.0.0.0__71e9bce111e9429c\Microsoft.Office.Infopath.dll + 2008-08-05 05:20:19 4,608 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter.resources\8.0.0.0_pl_b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Adapter.resources.dll + 2008-08-05 05:24:57 211,736 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Adapter\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Adapter.dll + 2008-08-05 05:20:19 5,632 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInManager.resources\8.0.0.0_pl_b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.AddInManager.resources.dll + 2008-08-05 05:24:57 105,248 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.AddInManager\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.AddInManager.dll + 2008-08-05 05:24:56 330,520 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Blueprints\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Blueprints.dll + 2008-08-05 05:20:19 4,096 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.resources\8.0.0.0_pl_b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.resources.dll + 2008-08-05 05:24:57 39,712 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.ComRPCChannel.dll + 2008-08-05 05:24:57 39,704 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Contract\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.Contract.dll + 2008-08-05 05:24:56 72,472 ----a-w C:\WINDOWS\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.DesignTime\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Tools.Applications.DesignTime.dll + 2008-08-05 05:24:57 47,832 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.AddIn.Contract\2.0.0.0__b03f5f7f11d50a3a\System.AddIn.Contract.dll + 2008-08-05 05:24:57 39,624 ----a-w C:\WINDOWS\assembly\GAC_MSIL\System.AddIn\2.0.0.0__b03f5f7f11d50a3a\System.AddIn.dll + 2008-09-03 14:56:51 27,136 ----a-r C:\WINDOWS\Installer\{02DFF6B1-1654-411C-8D7B-FD6052EF016F}\AppleSoftwareUpdateIco.exe + 2008-08-05 05:26:54 1,165,584 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe + 2008-08-05 05:26:55 20,240 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe + 2008-08-05 05:26:54 159,504 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe + 2008-08-05 05:26:54 184,080 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe + 2008-08-05 05:26:54 217,864 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe + 2008-08-05 05:26:55 18,704 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe + 2008-08-05 05:26:55 35,088 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe + 2008-08-05 05:26:54 845,584 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe + 2008-08-05 05:26:54 922,384 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe + 2008-08-05 05:26:54 272,648 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe + 2008-08-05 05:26:55 888,080 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe + 2008-08-05 05:26:54 1,172,240 ----a-r C:\WINDOWS\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe + 2008-08-05 05:19:11 217,864 ----a-r C:\WINDOWS\Installer\{90120000-006E-0415-0000-0000000FF1CE}\misc.exe + 2008-10-24 20:55:14 295,606 ----a-r C:\WINDOWS\Installer\{AC76BA86-7AD7-1033-7B44-A81200000003}\SC_Reader.exe + 2005-03-18 15:23:10 53,248 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.AudioVideoPlayback.dll + 2005-03-18 15:23:10 12,800 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Diagnostics.dll + 2005-03-18 15:23:14 473,600 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3D.dll + 2005-03-18 15:23:10 145,920 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectDraw.dll + 2005-03-18 15:23:10 159,232 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectInput.dll + 2005-03-18 15:23:14 364,544 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectPlay.dll + 2005-03-18 15:23:12 178,176 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectSound.dll + 2005-03-18 15:23:14 223,232 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.dll + 2005-03-18 15:23:14 567,296 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2905.0\Microsoft.DirectX.Direct3DX.dll + 2008-07-19 14:43:08 1,163,960 ----a-w C:\WINDOWS\system32\aswBoot.exe + 2008-07-19 14:30:53 94,392 ----a-w C:\WINDOWS\system32\AvastSS.scr + 2008-10-25 21:21:52 16,384 ----atw C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\temp\Perflib_Perfdata_5c4.dat + 2005-03-18 15:19:58 2,337,488 ----a-w C:\WINDOWS\system32\d3dx9_25.dll + 1999-01-20 04:01:00 210,032 ----a-w C:\WINDOWS\system32\DBCLIENT.DLL + 2004-08-03 21:08:44 25,600 ----a-w C:\WINDOWS\system32\DllCache\usbser.sys + 2008-07-19 14:32:15 26,944 ----a-w C:\WINDOWS\system32\drivers\aavmker4.sys + 2008-07-19 14:37:42 20,560 ----a-w C:\WINDOWS\system32\drivers\aswFsBlk.sys + 2008-01-17 16:34:01 93,264 ----a-w C:\WINDOWS\system32\drivers\aswmon.sys + 2008-07-19 14:37:21 94,416 ----a-w C:\WINDOWS\system32\drivers\aswmon2.sys + 2008-07-19 14:33:42 23,152 ----a-w C:\WINDOWS\system32\drivers\aswRdr.sys + 2008-07-19 14:35:18 78,416 ----a-w C:\WINDOWS\system32\drivers\aswSP.sys + 2008-07-19 14:32:36 42,912 ----a-w C:\WINDOWS\system32\drivers\aswTdi.sys + 2008-05-02 08:58:12 17,536 ----a-w C:\WINDOWS\system32\drivers\ccdcmb.sys + 2008-05-02 08:58:14 20,864 ----a-w C:\WINDOWS\system32\drivers\ccdcmbo.sys + 2007-07-19 13:10:28 127,768 ----a-w C:\WINDOWS\system32\drivers\klif.sys + 2008-08-03 21:42:05 717,296 ----a-w C:\WINDOWS\system32\drivers\sptd.sys + 2004-08-03 21:08:44 25,600 ----a-w C:\WINDOWS\system32\drivers\usbser.sys + 2008-05-02 08:58:14 8,064 ----a-w C:\WINDOWS\system32\drivers\usbser_lowerflt.sys + 2008-05-02 08:58:28 8,064 ----a-w C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys + 2006-11-02 05:22:54 492,000 ------w C:\WINDOWS\system32\drivers\wdf01000.sys + 2006-11-02 05:22:52 32,224 ------w C:\WINDOWS\system32\drivers\wdfldr.sys - 2003-08-03 16:56:16 1,146,184 ----a-w C:\WINDOWS\system32\FM20.DLL + 2006-10-26 12:10:08 1,190,688 ----a-w C:\WINDOWS\system32\FM20.DLL - 2003-07-15 04:57:04 32,584 ----a-w C:\WINDOWS\system32\FM20ENU.DLL + 2006-10-26 11:10:06 33,088 ----a-w C:\WINDOWS\system32\FM20ENU.DLL - 2008-06-25 06:32:13 165,120 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT + 2008-08-05 06:32:40 268,600 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT - 2002-08-21 03:10:16 204,800 ----a-w C:\WINDOWS\system32\INKED.DLL + 2006-10-26 11:45:04 207,360 ----a-w C:\WINDOWS\system32\INKED.DLL + 2008-07-09 07:05:08 796,048 ----a-w C:\WINDOWS\system32\libeay32_0.9.6l.dll - 2008-06-22 18:15:04 70,264 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe + 2008-08-03 10:45:22 70,264 ----a-w C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe + 2003-08-02 07:50:34 356,352 ----a-w C:\WINDOWS\system32\mkxds.dll + 2006-10-26 17:56:10 32,592 ----a-w C:\WINDOWS\system32\msonpmon.dll + 2008-05-02 08:58:16 90,624 ----a-w C:\WINDOWS\system32\nmwcdcls.dll + 2008-05-02 08:58:24 733,696 ----a-w C:\WINDOWS\system32\nmwcdcocls.dll + 2008-05-02 08:58:24 148,992 ----a-w C:\WINDOWS\system32\nsesetup.dll + 2002-10-04 22:04:18 45,056 ----a-w C:\WINDOWS\system32\ogg.dll + 2002-10-06 17:42:58 237,568 ----a-w C:\WINDOWS\system32\OggDS.dll - 2008-07-23 10:33:22 58,930 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-08-14 11:36:18 59,774 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-07-23 10:33:23 74,648 ----a-w C:\WINDOWS\system32\perfc015.dat + 2008-08-14 11:36:18 75,904 ----a-w C:\WINDOWS\system32\perfc015.dat - 2008-07-23 10:33:23 392,630 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-08-14 11:36:18 395,534 ----a-w C:\WINDOWS\system32\perfh009.dat - 2008-07-23 10:33:23 448,586 ----a-w C:\WINDOWS\system32\perfh015.dat + 2008-08-14 11:36:18 451,934 ----a-w C:\WINDOWS\system32\perfh015.dat - 2008-06-03 03:00:00 278,528 ----a-w C:\WINDOWS\system32\pncrt.dll + 2007-12-21 01:00:00 278,528 ----a-w C:\WINDOWS\system32\pncrt.dll - 2008-06-03 03:00:00 6,656 ----a-w C:\WINDOWS\system32\pndx5016.dll + 2007-12-21 01:00:00 6,656 ----a-w C:\WINDOWS\system32\pndx5016.dll - 2008-06-03 03:00:00 5,632 ----a-w C:\WINDOWS\system32\pndx5032.dll + 2007-12-21 01:00:00 5,632 ----a-w C:\WINDOWS\system32\pndx5032.dll - 2008-06-03 03:00:00 185,944 ----a-w C:\WINDOWS\system32\rmoc3260.dll + 2007-12-21 01:00:00 185,688 ----a-w C:\WINDOWS\system32\rmoc3260.dll - 1998-03-24 19:54:08 15,872 ----a-w C:\WINDOWS\system32\SCP32.DLL + 2006-07-24 08:50:40 39,728 ----a-w C:\WINDOWS\system32\SCP32.DLL + 2006-10-26 17:56:16 864,080 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\msonpdrv.dll + 2006-10-26 17:56:14 67,408 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\3\msonpui.dll + 2006-10-26 17:56:16 864,080 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\msonpdrv.dll + 2006-10-26 17:56:14 67,408 ----a-w C:\WINDOWS\system32\spool\drivers\w32x86\msonpui.dll + 2006-10-26 17:56:12 33,104 ----a-w C:\WINDOWS\system32\spool\prtprocs\w32x86\msonpppr.dll - 2005-06-28 08:21:34 22,752 ----a-w C:\WINDOWS\system32\spupdsvc.exe + 2006-10-08 19:51:14 23,856 ----a-w C:\WINDOWS\system32\spupdsvc.exe - 1999-11-24 16:40:50 40,960 ----a-w C:\WINDOWS\system32\VBAME.DLL + 2006-07-24 08:50:40 47,920 ----a-w C:\WINDOWS\system32\VBAME.DLL + 2002-10-04 22:04:26 188,416 ----a-w C:\WINDOWS\system32\vorbis.dll + 2002-10-04 22:04:26 921,600 ----a-w C:\WINDOWS\system32\VorbisEnc.dll + 2008-07-09 07:05:10 83,432 ----a-w C:\WINDOWS\system32\vsdata.dll + 2008-07-09 07:05:22 394,952 ----a-w C:\WINDOWS\system32\vsdatant.sys + 2008-07-09 07:05:10 157,160 ----a-w C:\WINDOWS\system32\vsinit.dll + 2008-07-09 07:05:10 103,912 ----a-w C:\WINDOWS\system32\vsmonapi.dll + 2008-07-09 07:05:10 275,944 ----a-w C:\WINDOWS\system32\vspubapi.dll + 2008-07-09 07:05:10 71,144 ----a-w C:\WINDOWS\system32\vsregexp.dll + 2008-07-09 07:05:12 472,552 ----a-w C:\WINDOWS\system32\vsutil.dll + 2008-07-09 07:05:12 46,568 ----a-w C:\WINDOWS\system32\vswmi.dll + 2008-07-09 07:05:12 99,816 ----a-w C:\WINDOWS\system32\vsxml.dll + 2008-05-02 08:59:36 1,419,232 ----a-w C:\WINDOWS\system32\wdfcoinstaller01005.dll - 2002-08-21 03:13:12 189,952 ----a-w C:\WINDOWS\system32\WISPTIS.EXE + 2006-10-26 11:45:04 293,376 ----a-w C:\WINDOWS\system32\WISPTIS.EXE + 2008-07-09 07:05:12 83,432 ----a-w C:\WINDOWS\system32\zlcomm.dll + 2008-07-09 07:05:12 71,144 ----a-w C:\WINDOWS\system32\zlcommdb.dll + 2008-07-09 07:05:06 370,208 ----a-w C:\WINDOWS\system32\ZoneLabs\av.dll + 2007-05-30 22:03:30 65,248 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\aphish.dat + 2006-06-30 12:47:36 21,568 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\avcmhk4.dll + 2007-05-30 22:03:30 1,628 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\bases\pdmkl.dat + 2007-05-30 22:03:16 77,824 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\CKAHComm.dll + 2007-05-30 22:03:16 110,592 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\CKAHrule.dll + 2007-05-30 22:03:16 331,776 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\CKAHUM.dll + 2007-05-30 22:03:16 38,400 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\FSSync.dll + 2006-09-19 21:12:14 208,960 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\inv.dll + 2007-12-03 12:53:58 282,624 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\kave.dll + 2006-12-19 16:13:52 1,093,632 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\libeay32.dll + 2007-05-30 22:03:20 548,864 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\msvcp80.dll + 2007-05-30 22:03:20 626,688 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\msvcr80.dll + 2007-05-30 22:03:18 184,320 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\prloader.dll + 2007-05-30 22:03:22 90,112 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\prremote.dll + 2007-12-03 12:53:58 139,264 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe + 2006-12-19 16:13:52 200,704 ----a-w C:\WINDOWS\system32\ZoneLabs\avsys\ssleay32.dll + 2008-07-09 07:05:06 99,816 ----a-w C:\WINDOWS\system32\ZoneLabs\camupd.dll + 2004-01-30 10:35:08 813,568 ----a-w C:\WINDOWS\system32\ZoneLabs\dbghelp.dll + 2008-07-09 07:05:08 128,480 ----a-w C:\WINDOWS\system32\ZoneLabs\fbl.dll + 2008-07-09 07:05:08 38,376 ----a-w C:\WINDOWS\system32\ZoneLabs\featuremap.dll + 2008-07-09 07:05:08 321,016 ----a-w C:\WINDOWS\system32\ZoneLabs\imsecure.dll + 2008-07-09 07:05:24 288,144 ----a-w C:\WINDOWS\system32\ZoneLabs\lib\ConfigWizard.zip.dll + 2008-10-11 13:02:05 152,976 ----a-w C:\WINDOWS\system32\ZoneLabs\lib\licenseui.zip.dll + 2008-07-09 07:05:24 26,000 ----a-w C:\WINDOWS\system32\ZoneLabs\lib\zlsvc.zip.dll + 2008-07-09 07:05:24 1,361,296 ----a-w C:\WINDOWS\system32\ZoneLabs\lib\zpy.zip.dll + 2008-07-09 07:05:24 71,056 ----a-w C:\WINDOWS\system32\ZoneLabs\lib\zui.zip.dll + 2008-07-09 07:06:26 30,184 ----a-w C:\WINDOWS\system32\ZoneLabs\plugins\rpc_server\rpc_server.dll + 2008-07-09 07:06:26 30,216 ----a-w C:\WINDOWS\system32\ZoneLabs\plugins\vsmon_plugin\vsmon_plugin.dll + 2008-02-27 01:10:26 714,208 ----a-w C:\WINDOWS\system32\ZoneLabs\qrbase.dll + 2008-02-27 01:10:28 792,032 ----a-w C:\WINDOWS\system32\ZoneLabs\qrsrecl.dll + 2008-07-09 07:05:08 173,544 ----a-w C:\WINDOWS\system32\ZoneLabs\scheduler.dll + 2008-01-21 06:34:36 7,603,688 ----a-w C:\WINDOWS\system32\ZoneLabs\spyware.dat + 2008-02-27 01:10:32 1,504,736 ----a-w C:\WINDOWS\system32\ZoneLabs\srescan.dll + 2008-02-27 01:10:44 51,176 ----a-w C:\WINDOWS\system32\ZoneLabs\srescan.sys + 2008-07-09 07:05:10 456,168 ----a-w C:\WINDOWS\system32\ZoneLabs\ssleay32.dll + 2008-07-09 07:06:26 214,528 ----a-w C:\WINDOWS\system32\ZoneLabs\streamapi\httpblocker\httpblocker.dll + 2008-07-09 07:06:30 3,266,040 ----a-w C:\WINDOWS\system32\ZoneLabs\streamapi\imslsp\imslsp.dll + 2006-09-04 18:59:14 503,875 ----a-w C:\WINDOWS\system32\ZoneLabs\upd_core.dll + 2007-10-11 14:50:32 832,984 ----a-w C:\WINDOWS\system32\ZoneLabs\updating.dll + 2008-07-09 07:05:18 144,936 ----a-w C:\WINDOWS\system32\ZoneLabs\updclient.exe + 2007-01-11 15:31:06 286,787 ----a-w C:\WINDOWS\system32\ZoneLabs\updtrsdk.dll + 2008-07-09 07:05:10 108,008 ----a-w C:\WINDOWS\system32\ZoneLabs\vsavpro.dll + 2008-07-09 07:05:10 83,432 ----a-w C:\WINDOWS\system32\ZoneLabs\vsdb.dll + 2008-07-09 07:05:18 75,304 ----a-w C:\WINDOWS\system32\ZoneLabs\vsmon.exe + 2008-07-09 07:05:10 2,029,032 ----a-w C:\WINDOWS\system32\ZoneLabs\vsmondll.dll + 2008-07-09 07:05:12 1,361,384 ----a-w C:\WINDOWS\system32\ZoneLabs\vsruledb.dll + 2008-07-09 07:05:12 239,080 ----a-w C:\WINDOWS\system32\ZoneLabs\vsvault.dll + 2008-01-21 06:34:36 7,603,688 ----a-w C:\WINDOWS\system32\ZoneLabs\zlasdbup.dat + 2008-07-09 07:05:12 177,640 ----a-w C:\WINDOWS\system32\ZoneLabs\zlparser.dll + 2008-07-09 07:05:12 79,344 ----a-w C:\WINDOWS\system32\ZoneLabs\zlquarantine.dll + 2008-07-09 07:05:14 382,440 ----a-w C:\WINDOWS\system32\ZoneLabs\zlsre.dll + 2008-07-09 07:05:14 120,296 ----a-w C:\WINDOWS\system32\ZoneLabs\zlupdate.dll + 2006-10-26 11:40:34 95,744 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841\ATL80.dll + 2006-10-26 11:40:36 1,093,632 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfc80.dll + 2006-10-26 11:40:36 1,079,808 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfc80u.dll + 2006-10-26 11:40:36 69,632 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfcm80.dll + 2006-10-26 11:40:36 57,344 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfcm80u.dll + 2006-10-26 11:40:36 40,960 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80CHS.dll + 2006-10-26 11:40:36 45,056 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80CHT.dll + 2006-10-26 11:40:36 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80DEU.dll + 2006-10-26 11:40:36 57,344 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ENU.dll + 2006-10-26 11:40:36 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ESP.dll + 2006-10-26 11:40:36 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80FRA.dll + 2006-10-26 11:40:36 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ITA.dll + 2006-10-26 11:40:36 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80JPN.dll + 2006-10-26 11:40:36 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80KOR.dll . -- Migawka wyzerowana -- . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15360] "StartCCC"="C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2006-11-10 90112] "MultiFrame"="C:\Program Files\ASUS\Asus MultiFrame\MultiFrame.exe" [2007-06-21 999792] "LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-06-20 451872] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 1694208] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ATKHOTKEY"="C:\Program Files\ATK Hotkey\Hcontrol.exe" [2007-07-12 225280] "ATKOSD2"="C:\Program Files\ATKOSD2\ATKOSD2.exe" [2007-10-17 7737344] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-05-25 786521] "Wireless Console 2"="C:\Program Files\Wireless Console 2\wcourier.exe" [2007-07-05 1040384] "ACU"="C:\Program Files\Atheros\ACU.exe" [2007-10-23 376921] "ATKMEDIA"="C:\Program Files\ASUS\ATK Media\DMEDIA.EXE" [2006-11-02 61440] "ASUS Live Update"="C:\Program Files\ASUS\ASUS Live Update\ALU.exe" [2007-11-30 51768] "ASUSTPE"="C:\WINDOWS\system32\ASUSTPE.exe" [2007-01-16 106496] "Power_Gear"="C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe" [2006-07-26 90112] "ACMON"="C:\Program Files\ASUS\Splendid\ACMON.exe" [2007-07-10 851968] "ASUS Camera ScreenSaver"="C:\WINDOWS\ASScrProlog.exe" [2008-06-19 37232] "ASUS Screen Saver Protector"="C:\WINDOWS\ASScrPro.exe" [2008-06-19 33136] "SMSERIAL"="C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-11-22 630784] "WOOWATCH"="C:\PROGRA~1\Wanadoo\Watch.exe" [2002-12-09 20480] "WOOTASKBARICON"="C:\PROGRA~1\Wanadoo\TaskbarIcon.exe" [2002-12-09 45056] "NvGraphicsInterface"="C:\winhet.exe" [2008-07-22 30792] "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 583048] "avast!"="C:\Programy\Avast4\ashDisp.exe" [2008-07-19 78008] "ZoneAlarm Client"="C:\Programy\ZoneAlarm\zlclient.exe" [2008-07-09 919016] "RTHDCPL"="RTHDCPL.EXE" [2006-10-30 C:\WINDOWS\RTHDCPL.EXE] "SkyTel"="SkyTel.EXE" [2006-05-16 C:\WINDOWS\SkyTel.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 15360] C:\Documents and Settings\admin\Menu Start\Programy\Autostart\ CCC.lnk - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe [2006-09-29 49152] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\ DSLMON.lnk - C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe [2008-07-09 962667] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "DisableStatusMessages"= 0 (0x0) [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Reader Synchronizer.lnk] path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Adobe Reader Synchronizer.lnk backup=C:\WINDOWS\pss\Adobe Reader Synchronizer.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-01-11 22:16 39792 C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a------ 2006-10-27 00:47 31016 C:\Programy\Microsoft Office\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] --a------ 2007-06-01 10:05 1057328 C:\Programy\Nero\Nero 7\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LanguageShortcut] --a------ 2006-12-05 22:55 54832 C:\Program Files\CyberLink\PowerDVD\Language\Language.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck] --a------ 2007-03-01 15:57 153136 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --------- 2006-11-23 15:10 56928 C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SecurDisc] --a------ 2007-06-01 10:06 1629744 C:\Programy\Nero\Nero 7\InCD\NBHGui.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "ose"=3 (0x3) "LiveUpdate"=3 (0x3) "InCDsrv"=2 (0x2) "Automatic LiveUpdate Scheduler"=2 (0x2) "RichVideo"=2 (0x2) "LiveUpdate Notice Service"=2 (0x2) "LiveUpdate Notice Ex"=2 (0x2) "odserv"=3 (0x3) "Microsoft Office Groove Audit Service"=3 (0x3) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\winhet.exe"= C:\\winhet.exe "C:\\Programy\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "C:\\Programy\\Microsoft Office\\Office12\\GROOVE.EXE"= "C:\\Programy\\Microsoft Office\\Office12\\ONENOTE.EXE"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-07-19 78416] R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560] R2 StkSSrv;Syntek AVStream USB2.0 WebCam Service;C:\WINDOWS\System32\StkCSrv.exe [2007-04-19 24576] R3 AtcL002;NDIS Miniport Driver for Atheros L2 Fast Ethernet Controller;C:\WINDOWS\system32\DRIVERS\l251x86.sys [2007-08-21 30208] R3 MEMSWEEP2;MEMSWEEP2;C:\WINDOWS\system32\3.tmp [ ] R3 RTSTOR;USB Mass Stroage Device;C:\WINDOWS\system32\drivers\RTSTOR.SYS [2006-06-10 27520] R3 StkCMini;Syntek AVStream USB2.0 1.3M WebCam;C:\WINDOWS\system32\Drivers\StkCMini.sys [2007-06-06 1260672] R3 WSIMD;wsimd Service;C:\WINDOWS\system32\DRIVERS\wsimd.sys [2007-07-03 57344] S3 {DEF85C80-216A-43ab-AF70-1665EDBE2780};{DEF85C80-216A-43ab-AF70-1665EDBE2780};C:\WINDOWS\system32\config\SYSTEM~1\USTAWI~1\Temp\60.tmp [ ] S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 15104] S3 usbstor;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{a734c858-444e-11dd-be42-0015af9e0146}] \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Recycled\ctfmon.exe \Shell\Open(&0)\command - Recycled\ctfmon.exe *Newly Created Service* - MEMSWEEP2 [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\ccc-core-static] msiexec /fums {857D4360-762B-978B-76AD-491AA719E47A} /qb [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . Zawartość folderu 'Zaplanowane zadania' 2008-09-03 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57] . - - - - USUNIĘTO PUSTE WPISY - - - - HKU-Default-RunOnce-<NO NAME> - (no file) . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\admin\Dane aplikacji\Mozilla\Firefox\Profiles\5s195z67.default\ FF -: plugin - C:\Program Files\JavaSoft\JRE\1.3.1_03\bin\NPJava11.dll FF -: plugin - C:\Program Files\JavaSoft\JRE\1.3.1_03\bin\NPJava12.dll FF -: plugin - C:\Program Files\JavaSoft\JRE\1.3.1_03\bin\NPJava131_03.dll FF -: plugin - C:\Program Files\JavaSoft\JRE\1.3.1_03\bin\NPJava32.dll FF -: plugin - C:\Program Files\JavaSoft\JRE\1.3.1_03\bin\NPOJI600.dll FF -: plugin - C:\Programy\DivX\DivX Player\npDivxPlayerPlugin.dll FF -: plugin - C:\Programy\DivX\DivX Web Player\npdivx32.dll FF -: plugin - C:\Programy\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF -: plugin - C:\Programy\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF -: plugin - C:\Programy\Mozilla Firefox\plugins\NPJava11.dll FF -: plugin - C:\Programy\Mozilla Firefox\plugins\NPJava12.dll FF -: plugin - C:\Programy\Mozilla Firefox\plugins\NPJava131_03.dll FF -: plugin - C:\Programy\Mozilla Firefox\plugins\NPJava32.dll FF -: plugin - C:\Programy\Mozilla Firefox\plugins\npnul32.dll FF -: plugin - C:\Programy\Mozilla Firefox\plugins\NPOFF12.DLL FF -: plugin - C:\Programy\Mozilla Firefox\plugins\NPOJI600.dll FF -: plugin - C:\Programy\Mozilla Firefox\plugins\nppdf32.dll FF -: plugin - C:\Programy\Mozilla Firefox\plugins\nppl3260.dll FF -: plugin - C:\Programy\Mozilla Firefox\plugins\nprpjplug.dll FF -: plugin - C:\Programy\Mozilla Firefox\plugins\NPZoneSB.dll FF -: plugin - C:\Programy\QuickTime\Plugins\npqtplugin.dll FF -: plugin - C:\Programy\QuickTime\Plugins\npqtplugin2.dll FF -: plugin - C:\Programy\QuickTime\Plugins\npqtplugin3.dll FF -: plugin - C:\Programy\QuickTime\Plugins\npqtplugin4.dll FF -: plugin - C:\Programy\QuickTime\Plugins\npqtplugin5.dll FF -: plugin - C:\Programy\QuickTime\Plugins\npqtplugin6.dll FF -: plugin - C:\Programy\QuickTime\Plugins\npqtplugin7.dll FF -: plugin - C:\Programy\Real Alternative\browser\plugins\nppl3260.dll FF -: plugin - C:\Programy\Real Alternative\browser\plugins\nprpjplug.dll . . ------- Skojarzenia plików ------- . inifile=%SystemRoot%\System32\NOTEPAD.EXE %1" . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-25 23:47:47 Windows 5.1.2600 Dodatek Service Pack 2 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\MEMSWEEP2] "ImagePath"="\??\C:\WINDOWS\system32\3.tmp" [HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{DEF85C80-216A-43ab-AF70-1665EDBE2780}] "ImagePath"="\??\C:\WINDOWS\system32\config\SYSTEM~1\USTAWI~1\Temp\60.tmp" . --------------------- Pliki DLL ładowane pod uruchomionymi procesami --------------------- PROCES: C:\WINDOWS\explorer.exe -> C:\Program Files\ASUS\Asus MultiFrame\HookTitle.dll . Czas ukończenia: 2008-10-25 23:49:24 ComboFix-quarantined-files.txt 2008-10-25 21:49:16 Przed: 62 647 279 616 bajtów wolnych Po: 62,702,141,440 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 492 --- E O F --- 2008-07-09 08:20:40

HiJackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:00:21, on 2008-10-26 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe C:\WINDOWS\Explorer.EXE C:\Programy\Avast4\aswUpdSv.exe C:\Programy\Avast4\ashServ.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\acs.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\StkCSrv.exe C:\Programy\Avast4\ashMaiSv.exe C:\Programy\Avast4\ashWebSv.exe C:\Program Files\ATK Hotkey\Hcontrol.exe C:\Program Files\ATKOSD2\ATKOSD2.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Wireless Console 2\wcourier.exe C:\Program Files\Atheros\ACU.exe C:\Program Files\ASUS\ATK Media\DMEDIA.EXE C:\Program Files\ASUS\ASUS Live Update\ALU.exe C:\WINDOWS\system32\ASUSTPE.exe C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe C:\Program Files\ASUS\Splendid\ACMON.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\ATK Hotkey\ATKOSD.exe C:\WINDOWS\ASScrPro.exe C:\WINDOWS\RTHDCPL.EXE C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe C:\PROGRA~1\Wanadoo\TaskbarIcon.exe C:\WINDOWS\system32\ACEngSvr.exe C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe C:\Programy\Avast4\ashDisp.exe C:\Programy\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\ASUS\Asus MultiFrame\MultiFrame.exe C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files\ATK Hotkey\KBFiltr.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE C:\Program Files\ATK Hotkey\WDC.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Programy\Mozilla Firefox\firefox.exe C:\Programy\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Programy\MICROS~1\Office12\GRA8E1~1.DLL O2 - BHO: ZoneAlarm Spy Blocker BHO - {F0D4B231-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL O3 - Toolbar: ZoneAlarm Spy Blocker - {F0D4B239-DA4B-4daf-81E4-DFEE4931A4AA} - C:\Program Files\ZoneAlarmSB\bar\1.bin\SPYBLOCK.DLL O4 - HKLM\..\Run: [ATKHOTKEY] "C:\Program Files\ATK Hotkey\Hcontrol.exe" O4 - HKLM\..\Run: [ATKOSD2] "C:\Program Files\ATKOSD2\ATKOSD2.exe" O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Wireless Console 2] "C:\Program Files\Wireless Console 2\wcourier.exe" O4 - HKLM\..\Run: [ACU] "C:\Program Files\Atheros\ACU.exe" -nogui O4 - HKLM\..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE O4 - HKLM\..\Run: [ASUS Live Update] C:\Program Files\ASUS\ASUS Live Update\ALU.exe O4 - HKLM\..\Run: [ASUSTPE] C:\WINDOWS\system32\ASUSTPE.exe O4 - HKLM\..\Run: [Power_Gear] C:\Program Files\ASUS\Power4 Gear\BatteryLife.exe 1 O4 - HKLM\..\Run: [ACMON] "C:\Program Files\ASUS\Splendid\ACMON.exe" O4 - HKLM\..\Run: [ASUS Camera ScreenSaver] C:\WINDOWS\ASScrProlog.exe O4 - HKLM\..\Run: [ASUS Screen Saver Protector] C:\WINDOWS\ASScrPro.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\Wanadoo\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\Wanadoo\TaskbarIcon.exe O4 - HKLM\..\Run: [NvGraphicsInterface] C:\winhet.exe O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll" O4 - HKLM\..\Run: [avast!] C:\Programy\Avast4\ashDisp.exe O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Programy\ZoneAlarm\zlclient.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe O4 - HKCU\..\Run: [MultiFrame] C:\Program Files\ASUS\Asus MultiFrame\MultiFrame.exe O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Ustawienia lokalne\Temp" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] cmd.exe /c md "%SystemRoot%\System32\dllcache" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_04] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_05] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [] (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Ustawienia lokalne\Temp" (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [] (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [] (User 'Default user') O4 - Startup: CCC.lnk = ? O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\Programy\MICROS~1\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\Programy\MICROS~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programy\MICROS~1\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programy\MICROS~1\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programy\MICROS~1\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Programy\MICROS~1\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: Usługa konfiguracji Atheros (ACS) - Atheros - C:\WINDOWS\system32\acs.exe O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programy\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: avast! Antivirus - ALWIL Software - C:\Programy\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Programy\Avast4\ashMaiSv.exe O23 - Service: avast! Web Scanner - ALWIL Software - C:\Programy\Avast4\ashWebSv.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe O23 - Service: spmgr - Unknown owner - C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe O23 - Service: Syntek AVStream USB2.0 WebCam Service (StkSSrv) - Syntek America Inc. - C:\WINDOWS\System32\StkCSrv.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 9263 bytes

Dziękuję za wszelkie sugestie i pomoc.

ps.
Zapomniałem dodać, że mam ten sam problem co Avelyn:

gdy wpisuję fixmbr, pisze mi tak -
"Nazwa "fixmbr" nie jest rozpoznawana jako polecenie wewnętrzne lub zewnętrzne, program wykonywalny lub plik wsadowy"

ale jak już mówiłem nie mam płytki instalacyjnej, więc nie mogę zastosować się do rady Hashi

"Zastosuj się do Opisu konsoli odzyskiwania. Musisz włożyć płyte z systemem do napędu i postepować zgodnie z instrukcajmi."

**Posty:** 8001 · przez **Okocza** 26 Paź 2008, 13:54

holahola,

1. Wykonaj skan Dr. Web CureIt
2. Robisz loga z mbr.exe
3. dajesz loga z combofixa

Przenieś program mbr.exe bezpośrednio na C:\
nastepnie przejdz do trybu awaryjnego z z obsługą linii komend
w linii komend wpisz polecenie C:\mbr.exe -f (tam jest spacja między mbr.exe a -f) i ENTER
Reset komputera do trybu normalnego i robisz nowy log z mbr.exe

Autor postu otrzymał pochwałę

**Posty:** 5 · przez **holahola** 04 Lis 2008, 09:54

Witam.

Po pierwsze dziękuję za tak szybką reakcję i pomoc.
Po drugie przepraszam, że tak długo nie odpisywałem - miałem trochę problemów ze ściągnięciem Dr Web CureIt'a...
Zrobiłem pełne skanowanie, ale kiedy próbuje uruchomić mbr.exe wyskakuje mi takie coś:

C:\...\pulpit\mbr.exe nie jest prawidłową aplikacją systemu WIn32.

**Posty:** 8001 · przez **Okocza** 04 Lis 2008, 10:15

holahola napisał(a):C:\...\pulpit\mbr.exe

Okocza napisał(a):Przenieś program mbr.exe bezpośrednio na C:\

ma być bezpośrednio na C:

**Posty:** 5 · przez **holahola** 04 Lis 2008, 21:22

Byłem niedokładny. mbr wsadziłem i na dysk C (gdzie jest zainstlowany xp) i D i nic to nie dało

**Posty:** 7956 · przez **Magik** 04 Lis 2008, 21:26

holahola napisał(a):Mam zainstalowanego avasta jednak nie udało mi się ustrzec przed wirusem

uzywajac ten badziew na co Ty liczysz??

praktycznie kazdy topic w tym dziale dot. kompa gdzie ejst Avast-->po prostu solidny soft buhahahahahahahahahah

nie odpalisz konsoli, nie uzyjesz fix mbr i fixboot//mbr Gmera tez nie wchodzi

rewelka czyli wyzeruj stan partycji//zgraj wazne dane na plytke a nastepnie wyzeruj stan partycji, postaw je na nowo, sformatuj i zainstaluj system albo zalatwiaj plytke

Pozdrawiam

**Posty:** 5 · przez **holahola** 05 Lis 2008, 00:09

Rozumiem zatem, że polecisz mi jakiś DARMOWY super-hiper-antywirus na później, żebym zrozumiał swój błąd...
Rozumiem też, że zatem nie da się nic zrobić POZA reinstalką systemu?

**Posty:** 7956 · przez **Magik** 05 Lis 2008, 00:16

holahola napisał(a):Rozumiem też, że zatem nie da się nic zrobić POZA reinstalką systemu?

albo skombinujesz płytkę od XP albo wszystkie partycje lecą w eter i stawiasz je na nowo

holahola napisał(a):Rozumiem zatem, że polecisz mi jakiś DARMOWY super-hiper-antywirus na później, żebym zrozumiał swój błąd...

z czystym sumeiniem nie polecę żadnego darmowego antywirusa, bo każdy czyt, Avira czy BitDefender to tylko mniejsze zło...Od biedy Avira, ale ja tego nie mówię--->Kaspersku albo NoD

**Posty:** 5 · przez **holahola** 05 Lis 2008, 00:29

Czyli syf bo nie mam 150 zeta na antywirusa. Wole już kupić winde oryginalną i liczyć, że problem nie wróci...

**Posty:** 7956 · przez **Magik** 05 Lis 2008, 00:31

holahola napisał(a):Czyli syf bo nie mam 150 zeta na antywirusa. Wole już kupić winde oryginalną i liczyć, że problem nie wróci...

to choc do kompletu uzywaj Adaware i czasem skanuj kompa Kasperskym on-line

Pozdrawiam