Menadżer zadań-brak,nie ruszają exe, nie moge wejsc na c:

**Posty:** 47 · przez **rzyletka** 06 Lut 2009, 13:21

witam
wczoraj jeszcze calkiem bylo ale dzisiaj to jakas katastrofa
przy starcie juz jak sie system (Windows SBS 2003) wlacza to sie cuda dzieja, okienka wyskakuja
1) C:/WINDOWS/system32/wins.exe
2)Adobe Reader Speed Launch
3)Server Manager
4)Zarządzanie serwerem
i one są dosowskie, tzn. takie jak wiersz poleceń
nie ruszaja zadne exe, menadzer zadan nie wlacza sie, okienko wyskakuje ze wylaczony przez administratora, no ale ja nic takiego nie zrobilam
na kompie dawno nie bylo zadnego antywira
ja go przejelam niedawno, to szkolny serwer, nauczyciele mieli nad nim "piecze"

czytalam wczesniejsze wpisy, co radzicie, zeby pobrac hijacka albo combofix'a tylko ze one mi nie ruszaja wogole , mygnie tylko okienko wiersza polecenia i to wszytko
udało mi się przeskanować go w mks online
skaner znalazł:
- Trojan.Downloader.VB.bbl
- Spyware.Small.B
- Trojan.Pakes.bgg
- Trojan.Downloader.Vb.bbl (x2)
- Heur.W32 (x3)
- Trojan.Agent.rbs
- Heur.Win32
- Trojan.Downloader.Obfuscated.be
juz nie wiem sama co mam robic, nie znam sie na robakach, wiec moze wy mi cos pomożecie
z gory dzieki
cmokasynki

**Posty:** 8001 · przez **Okocza** 06 Lut 2009, 13:34

rzyletka, wstaw log z combofixa i hijacka

**Posty:** 47 · przez **rzyletka** 06 Lut 2009, 13:54

nie moge odpalic ani combofixa ani hijacka
sciagalam juz wczoraj ale ruszyc nie chcialy
tak samo dzisiaj
mygnie na sekunde czare okienko i koniec

**Posty:** 8001 · przez **Okocza** 06 Lut 2009, 14:00

rzyletka, w takim razie log z RSITa

**Posty:** 47 · przez **rzyletka** 06 Lut 2009, 14:10

tak samo jest z tym RSIT
system żadnych plików exe ni9e łyka a w takim formacie one właśnie są te programy i lipa ;(

**Posty:** 8001 · przez **Okocza** 06 Lut 2009, 14:11

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

**Posty:** 47 · przez **rzyletka** 06 Lut 2009, 14:41

skan z kasperskiego bede mogla doppiero w poniedzialek wrzucic bo nie bede jutro w pracy przeciez
sorka
do pon

Dodano Dzisiaj, 13:41:
skan z kasperskiego bede mogla doppiero w poniedzialek wrzucic bo nie bede jutro w pracy przeciez
sorka
do pon

**Posty:** 18165 · przez **wojtas** 06 Lut 2009, 20:15

sciagnij to

Ściągnąć plik na dysk (Firefox / Opera: klik prawym na link i opcja Zapisz, inaczej plik INF otworzy się w nowej zakładce). Po ściągnięciu z prawokliku wybrać opcję Instaluj.

i wtedy odpal combofixa i hijacka .. lub reset i sprobuj odpalic

Autor postu otrzymał pochwałę

**Posty:** 47 · przez **rzyletka** 09 Lut 2009, 13:13

po dwóch i pół godzinie skanu przez kaspersky wyłączyło mi IE, wkurzyłam sie
nie dolacze raportu ze skanowania

Dodano Dzisiaj, 12:16:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:18:03, on 2009-02-09 Platform: Windows 2003 Dodatek SP2 (WinNT 5.02.3790) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Dfssvc.exe C:\WINDOWS\System32\dns.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\grovel.exe C:\WINDOWS\System32\ismserv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Microsoft SQL Server\MSSQL$SBSMONITORING\Binn\sqlservr.exe C:\PROGRA~1\MICROS~3\MSSQL\binn\sqlservr.exe C:\Program Files\Microsoft Analysis Services\Bin\msmdsrv.exe C:\WINDOWS\system32\ntfrs.exe C:\Program Files\Microsoft SQL Server\MSSQL$SBSMONITORING\Binn\sqlagent.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\tftpd.exe C:\WINDOWS\System32\wins.exe C:\WINDOWS\system32\tcpsvcs.exe C:\Program Files\Exchsrvr\bin\exmgmt.exe C:\Program Files\Exchsrvr\bin\mad.exe C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe C:\PROGRA~1\MICROS~3\MSSQL\binn\sqlagent.exe C:\Program Files\Exchsrvr\bin\store.exe C:\PROGRA~1\Microsoft ISA Server\mspadmin.exe C:\PROGRA~1\Microsoft ISA Server\wspsrv.exe C:\PROGRA~1\Microsoft ISA Server\w3proxy.exe C:\PROGRA~1\Microsoft ISA Server\W3Prefch.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Administrator\Pulpit\HiJackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/hardAdmin.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = SBS2004:800 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [DWPersistentQueuedReporting] C:\PROGRA~1\COMMON~1\MICROS~1\DW\DWTRIG20.EXE -a O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user') O4 - Startup: Zarządzanie serwerem.lnk = ? O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O14 - IERESET.INF: START_PAGE_URL=http://companyweb O15 - ESC Trusted Zone: http://sbs.oeiizk.edu.pl O15 - ESC Trusted Zone: http://www.cke.edu.pl O15 - ESC Trusted Zone: http://www.modn.elk.edu.pl O15 - ESC Trusted Zone: http://www.uwm.edu.pl O15 - ESC Trusted Zone: http://www.gat.pl O15 - ESC Trusted Zone: http://www.men.gov.pl O15 - ESC Trusted Zone: http://www.kuradomowa.com O15 - ESC Trusted Zone: http://oke.lomza.com O15 - ESC Trusted Zone: http://www.oke.lomza.com O15 - ESC Trusted Zone: http://www.miastodzieci.pl O15 - ESC Trusted Zone: http://runonce.msn.com O15 - ESC Trusted Zone: http://www.ko.olsztyn.pl O15 - ESC Trusted Zone: http://www.wmodn.olsztyn.pl O15 - ESC Trusted Zone: http://poczta.onet.pl O15 - ESC Trusted Zone: http://www.profesor.pl O15 - ESC Trusted Zone: http://pliki.republika.pl O15 - ESC Trusted Zone: http://www.superkid.pl O15 - ESC Trusted Zone: http://www.lo4.szczecin.pl O15 - ESC Trusted Zone: http://mail10.tlen.pl O15 - ESC Trusted Zone: http://pl.trendmicro-europe.com O15 - ESC Trusted Zone: http://logo.oeiizk.waw.pl O15 - ESC Trusted Zone: http://www.oeiizk.waw.pl O15 - ESC Trusted Zone: http://*.windowsupdate.com O15 - ESC Trusted Zone: http://*.www.wp.pl O15 - ESC Trusted Zone: http://*.windowsupdate.com (HKLM) O15 - ESC Trusted IP range: http://80.240.166.114 O15 - ESC Trusted IP range: http://213.73.3.2 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sbsmenis.edu.pl O17 - HKLM\Software\..\Telephony: DomainName = sbsmenis.edu.pl O17 - HKLM\System\CCS\Services\Tcpip\..\{39529935-CD3C-43A2-A062-584EBEE5A357}: NameServer = 192.168.18.1 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sbsmenis.edu.pl O23 - Service: Microsoft H.323 Gatekeeper (GKSVC) - Unknown owner - svchost.exe (file missing) O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE -- End of file - 7013 bytes

Dodano Dzisiaj, 12:19:
to jest z Hijacka bo combofix mi nie chciał ruszyć, bo niekompatybilny jest na 2003 nie pojdzie

**Posty:** 300 · przez **sgsman** 09 Lut 2009, 13:29

To daj loga z RSITa i wszystkie logi obejmij w tagi code. I postaraj się jeszcze raz wykonać skan Kasprem.

**Posty:** 47 · przez **rzyletka** 09 Lut 2009, 13:39

Kod: Zaznacz wszystko: [quote]Logfile of random's system information tool 1.05 (written by random/random) Run by administrator at 2009-02-09 12:36:12 Microsoft(R) Windows(R) Server 2003 for Small Business Server Dodatek Service Pack 2 System drive C: has 2 GB (16%) free of 15 GB Total RAM: 503 MB (49% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 12:36:14, on 2009-02-09 Platform: Windows 2003 Dodatek SP2 (WinNT 5.02.3790) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Dfssvc.exe C:\WINDOWS\System32\dns.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\grovel.exe C:\WINDOWS\System32\ismserv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Microsoft SQL Server\MSSQL$SBSMONITORING\Binn\sqlservr.exe C:\PROGRA~1\MICROS~3\MSSQL\binn\sqlservr.exe C:\Program Files\Microsoft Analysis Services\Bin\msmdsrv.exe C:\WINDOWS\system32\ntfrs.exe C:\Program Files\Microsoft SQL Server\MSSQL$SBSMONITORING\Binn\sqlagent.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\tftpd.exe C:\WINDOWS\System32\wins.exe C:\WINDOWS\system32\tcpsvcs.exe C:\Program Files\Exchsrvr\bin\exmgmt.exe C:\Program Files\Exchsrvr\bin\mad.exe C:\Program Files\Common Files\System\MSSearch\Bin\mssearch.exe C:\PROGRA~1\MICROS~3\MSSQL\binn\sqlagent.exe C:\Program Files\Exchsrvr\bin\store.exe C:\PROGRA~1\Microsoft ISA Server\mspadmin.exe C:\PROGRA~1\Microsoft ISA Server\wspsrv.exe C:\PROGRA~1\Microsoft ISA Server\w3proxy.exe C:\PROGRA~1\Microsoft ISA Server\W3Prefch.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Documents and Settings\Administrator\Pulpit\rsit\RSIT.exe C:\Program Files\trend micro\administrator.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = res://shdoclc.dll/hardAdmin.htm R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = SBS2004:800 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [DWPersistentQueuedReporting] C:\PROGRA~1\COMMON~1\MICROS~1\DW\DWTRIG20.EXE -a O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-20\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'Default user') O4 - Startup: Zarządzanie serwerem.lnk = ? O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll O14 - IERESET.INF: START_PAGE_URL=http://companyweb O15 - ESC Trusted Zone: http://sbs.oeiizk.edu.pl O15 - ESC Trusted Zone: http://www.cke.edu.pl O15 - ESC Trusted Zone: http://www.modn.elk.edu.pl O15 - ESC Trusted Zone: http://www.uwm.edu.pl O15 - ESC Trusted Zone: http://www.gat.pl O15 - ESC Trusted Zone: http://www.men.gov.pl O15 - ESC Trusted Zone: http://www.kuradomowa.com O15 - ESC Trusted Zone: http://oke.lomza.com O15 - ESC Trusted Zone: http://www.oke.lomza.com O15 - ESC Trusted Zone: http://www.miastodzieci.pl O15 - ESC Trusted Zone: http://runonce.msn.com O15 - ESC Trusted Zone: http://www.ko.olsztyn.pl O15 - ESC Trusted Zone: http://www.wmodn.olsztyn.pl O15 - ESC Trusted Zone: http://poczta.onet.pl O15 - ESC Trusted Zone: http://www.profesor.pl O15 - ESC Trusted Zone: http://pliki.republika.pl O15 - ESC Trusted Zone: http://www.superkid.pl O15 - ESC Trusted Zone: http://www.lo4.szczecin.pl O15 - ESC Trusted Zone: http://mail10.tlen.pl O15 - ESC Trusted Zone: http://pl.trendmicro-europe.com O15 - ESC Trusted Zone: http://logo.oeiizk.waw.pl O15 - ESC Trusted Zone: http://www.oeiizk.waw.pl O15 - ESC Trusted Zone: http://*.windowsupdate.com O15 - ESC Trusted Zone: http://*.www.wp.pl O15 - ESC Trusted Zone: http://*.windowsupdate.com (HKLM) O15 - ESC Trusted IP range: http://80.240.166.114 O15 - ESC Trusted IP range: http://213.73.3.2 O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sbsmenis.edu.pl O17 - HKLM\Software\..\Telephony: DomainName = sbsmenis.edu.pl O17 - HKLM\System\CCS\Services\Tcpip\..\{39529935-CD3C-43A2-A062-584EBEE5A357}: NameServer = 192.168.18.1 O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sbsmenis.edu.pl O23 - Service: Microsoft H.323 Gatekeeper (GKSVC) - Unknown owner - svchost.exe (file missing) O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE -- End of file - 7060 bytes ======Scheduled tasks folder====== C:\WINDOWS\tasks\IsaDailySummary.job C:\WINDOWS\tasks\ReportGenerator.job C:\WINDOWS\tasks\ShadowCopyVolume{d54b66ec-0cb0-11d9-bd15-806e6f6e6963}.job ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] AcroIEHlprObj Class - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 63136] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-11-24 320920] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-11-24 34816] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-11-24 73728] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2004-02-26 65024] "DWPersistentQueuedReporting"=C:\PROGRA~1\COMMON~1\MICROS~1\DW\DWTRIG20.EXE [2007-03-22 39264] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-11-24 136600] "UserFaultCheck"=C:\WINDOWS\system32\dumprep 0 -u [] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2007-02-17 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe C:\Documents and Settings\Administrator\Menu Start\Programy\Autostart Zarządzanie serwerem.lnk - C:\Program Files\Microsoft Windows Small Business Server\Administration\LaunchConsole.exe [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain] C:\WINDOWS\system32\crypt32.dll [2007-02-17 599552] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet] C:\WINDOWS\system32\cryptnet.dll [2007-02-17 62464] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll] C:\WINDOWS\system32\cscdll.dll [2007-02-17 102400] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\dimsntfy] C:\WINDOWS\system32\dimsntfy.dll [2007-02-17 19456] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp] C:\WINDOWS\system32\wlnotify.dll [2007-02-17 97280] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule] C:\WINDOWS\system32\wlnotify.dll [2007-02-17 97280] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy] C:\WINDOWS\system32\sclgntfy.dll [2003-12-10 21504] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn] C:\WINDOWS\system32\WlNotify.dll [2007-02-17 97280] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv] C:\WINDOWS\system32\wlnotify.dll [2007-02-17 97280] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon] C:\WINDOWS\system32\wlnotify.dll [2007-02-17 97280] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] PostBootReminder - {7849596a-48ea-486e-8937-a2a3009f31a9} - C:\WINDOWS\system32\SHELL32.dll [2007-11-07 8389120] CDBurn - {fbeb8a05-beee-4442-804e-409d6c4515e9} - C:\WINDOWS\system32\SHELL32.dll [2007-11-07 8389120] WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - C:\WINDOWS\system32\webcheck.dll [2008-10-16 233472] SysTray - {35CEC8A3-2BE6-11D2-8773-92E220524153} - C:\WINDOWS\system32\stobject.dll [2007-02-17 122880] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\SharedTaskScheduler] Moduł wstępnego ładowania interfejsu Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll [2008-08-20 1033216] Demon buforu kategorii składników - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll [2008-08-20 1033216] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=C:\WINDOWS\system32\shell32.dll [2007-11-07 8389120] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "notification packages"=RASSFM KDCSVC WDIGEST scecli dsrestor [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"=msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll, pwdssp.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AppMgmt] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Base] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot Bus Extender] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Boot file system] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\CryptSvc] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\DcomLaunch] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmadmin] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmboot.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmio.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmload.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\dmserver] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\EventLog] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\File system] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Filter] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\HelpSvc] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Netlogon] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PCI Configuration] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PlugPlay] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PNP Filter] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Primary disk] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\RpcSs] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sacsvr] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SBCore] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SCSI Class] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sermouse.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\System Bus Extender] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vga.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vgasave.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\wd.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinMgmt] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{36FC9E60-C465-11CF-8056-444553540000}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E965-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E967-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E969-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96A-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96B-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E96F-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E977-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97B-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E97D-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{4D36E980-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{71A27CDD-812A-11D0-BEC7-08002BE2092F}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AFD] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\AppMgmt] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Base] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Boot Bus Extender] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Boot file system] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Browser] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\CryptSvc] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\DcomLaunch] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Dhcp] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dmadmin] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dmboot.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dmio.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dmload.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\dmserver] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\DnsCache] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\EventLog] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\File system] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Filter] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\HelpSvc] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ip6fw.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\ipnat.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LanmanServer] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LanmanWorkstation] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\LmHosts] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Messenger] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NDIS] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NDIS Wrapper] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Ndisuio] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetBIOS] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetBIOSGroup] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetBT] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetDDEGroup] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Netlogon] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetMan] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Network] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NetworkProvider] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\nm.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\NtLmSsp] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PCI Configuration] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PlugPlay] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PNP Filter] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PNP_TDI] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Primary disk] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdpcdd.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdpdd.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdpwd.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\rdsessmgr] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\RpcSs] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sacsvr] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SBCore] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SCSI Class] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sermouse.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sharedaccess] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Streams Drivers] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\System Bus Extender] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Tcpip] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\TDI] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\tdpipe.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\tdtcp.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\termservice] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\UploadMgr] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vds] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vga.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\vgasave.sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WinMgmt] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WZCSVC] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{36FC9E60-C465-11CF-8056-444553540000}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E965-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E967-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E969-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96A-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96B-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E96F-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E972-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E973-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E974-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E975-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E977-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E97B-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E97D-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{4D36E980-E325-11CE-BFC1-08002BE10318}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{533C5B84-EC70-11D2-9505-00C04F79DEAF}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{71A27CDD-812A-11D0-BEC7-08002BE2092F}] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{745A17A0-74D3-11D0-B6FE-00A0C90F57DA}] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "disabletaskmgr"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "disablecad"=0 "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=0 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=149 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "ShowSuperHidden"= "NoWelcomeScreen"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{afc2ec8c-f35b-11dd-8603-0011092cd97c}] shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfa24172-81fc-11dc-baec-0011092cd97c}] shell\AutoRun\command - E:\LaunchU3.exe -a [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cfa24173-81fc-11dc-baec-0011092cd97c}] shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL copy.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d54b66ec-0cb0-11d9-bd15-806e6f6e6963}] shell\AutoRun\command - C:\WINDOWS\Spolis.exe shell\explore\command - C:\WINDOWS\Spolis.exe shell\open\command - C:\WINDOWS\Spolis.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e87426b1-c751-11dd-b05e-0011092cd97c}] shell\AutoRun\command - E:\-.exe shell\explore\command - E:\-.exe shell\open\command - E:\-.exe ======File associations====== .scr - open - "%1" %* ======List of files/folders created in the last 1 months====== 2009-02-09 12:35:35 ----D---- C:\Program Files\trend micro 2009-02-09 12:35:07 ----D---- C:\rsit 2009-02-09 12:17:38 ----A---- C:\Bug.txt 2009-02-09 12:17:36 ----A---- C:\WINDOWS\system32\cmd.execf 2009-02-09 12:17:29 ----D---- C:\32788R22FWJFW 2009-02-04 13:58:28 ----D---- C:\Program Files\SkanerOnline 2009-02-04 12:28:00 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\PlayFirst 2009-02-04 12:28:00 ----D---- C:\Documents and Settings\Administrator\Dane aplikacji\PlayFirst 2009-02-03 14:24:55 ----SHD---- C:\Config.Msi 2009-02-03 14:05:25 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Zylom 2009-01-26 08:07:09 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$ 2009-01-21 17:11:48 ----A---- C:\WINDOWS\system32\SkanerOnline.dll 2009-01-13 09:45:41 ----HDC---- C:\WINDOWS\$NtUninstallKB952069$ 2009-01-13 09:38:41 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$ 2009-01-13 09:25:47 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$ 2009-01-13 09:18:28 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$ ======List of files/folders modified in the last 1 months====== 2009-02-09 12:35:49 ----D---- C:\WINDOWS\system32\inetsrv 2009-02-09 12:35:35 ----RD---- C:\Program Files 2009-02-09 12:17:36 ----D---- C:\WINDOWS\system32 2009-02-09 11:58:20 ----D---- C:\WINDOWS\system32\dhcp 2009-02-09 09:05:40 ----D---- C:\WINDOWS\security 2009-02-09 09:00:17 ----D---- C:\WINDOWS\Temp 2009-02-09 08:59:01 ----D---- C:\WINDOWS\system32\ias 2009-02-09 08:57:41 ----D---- C:\WINDOWS\system32\wins 2009-02-09 08:57:31 ----D---- C:\WINDOWS\Debug 2009-02-09 08:57:27 ----D---- C:\Program Files\Microsoft ISA Server 2009-02-09 08:55:57 ----D---- C:\WINDOWS\ntds 2009-02-06 14:12:59 ----SD---- C:\WINDOWS\Downloaded Program Files 2009-02-06 14:10:29 ----SD---- C:\WINDOWS\Tasks 2009-02-06 14:10:28 ----SHD---- C:\System Volume Information 2009-02-05 12:25:46 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$ 2009-02-05 12:07:50 ----D---- C:\WINDOWS 2009-02-05 11:22:58 ----D---- C:\WINDOWS\system32\catroot2 2009-02-04 09:07:59 ----SHD---- C:\WINDOWS\Installer 2009-02-03 14:25:29 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2009-02-03 13:12:28 ----D---- C:\temp 2009-01-27 09:53:44 ----D---- C:\WINDOWS\inf 2009-01-26 08:07:20 ----RSHDC---- C:\WINDOWS\system32\dllcache 2009-01-26 08:07:20 ----D---- C:\WINDOWS\system32\drivers 2009-01-26 08:06:03 ----HD---- C:\WINDOWS\$hf_mig$ 2009-01-13 10:03:42 ----A---- C:\WINDOWS\imsins.BAK 2009-01-13 10:00:00 ----D---- C:\WINDOWS\ie7updates 2009-01-13 09:51:29 ----D---- C:\Program Files\Internet Explorer 2009-01-13 09:30:31 ----D---- C:\WINDOWS\system32\CatRoot 2009-01-13 09:18:41 ----D---- C:\WINDOWS\Registration 2009-01-10 02:35:28 ----A---- C:\WINDOWS\system32\MRT.exe[/quote][code][/code]

Dodano Dzisiaj, 12:42:
taki log mi sie utworzył w folderze rsit pomimo ze mi jakis błąd line-1 wyskakiwał a konkretnie "Error: Variable used without being declared"

**Posty:** 18165 · przez **wojtas** 09 Lut 2009, 14:00

ok a sprobuj dac loga z combofixa.. albo ze zwyklego albo z awaryjnego.. jesli nie pomoze zmien jego nazwe i odpal...

**Posty:** 47 · przez **rzyletka** 09 Lut 2009, 14:05

no ale pisałam ze u mnie na kompie nie pojdzie combofix, bo jest niekompatybilny, rusza tylko na win 2000 i xp, ja mam winSBS 2003

Dodano Dzisiaj, 13:22:
ale tym kasperskim skanowanie bedzie trwalo wiecznosc, chodzi juz ponad pol godziny i dopiero jeden procent a ja nic na kompie nie robie

Dodano Dzisiaj, 08:44:
dobra słuchajcie ludzie
jeszcze tylko na C:/ nie moge wejsc normalnie przez dwuklik lewym
musze np wejsc na inny dysk O: lub R: i wtedy przez pasek adresu tylko moge wejsc
co jest nie tak>??????

**Posty:** 8001 · przez **Okocza** 10 Lut 2009, 13:48

rzyletka, daj log z RSITa

Kto jest na forum