Powolny system prosze o sprawdzenie logów

**Posty:** 3475 · przez **Dementor** 17 Lut 2009, 01:46

Witam pare dni temu przeinstalowałem system i odczuwam iz działa gorzej niż przed formatem.Nie moge normalnie odtworzyć pliku tekstowego tylko otwieram go przez total commander---Podgląd

Hjackthis

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 00:41, on 2009-02-17 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\_qttask.exe C:\Program Files\cFosSpeed\cFosSpeed.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\_ctfmon.exe C:\Program Files\cFosSpeed\spd.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Opera\opera.exe C:\totalcmd\TOTALCMD.EXE C:\totalcmd\_TOTALCMD.EXE E:\rozne\Programy\Loga\HijackThis.exe C:\WINDOWS\system32\rundll32.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://users.iptelecom.net.ua/~codecs/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\_qttask.exe" -atboottime O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing) O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - C:\Program Files\cFosSpeed\spd.exe" -service (file missing) O23 - Service: NetMeeting Remote Desktop Sharing (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe O23 - Service: Instalator Windows (MSIServer) - Unknown owner - C:\WINDOWS\system32\msiexec.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

Prosze o pomoc

**Posty:** 8001 · przez **Okocza** 17 Lut 2009, 10:30

Dementor, daj log z combofixa

**Posty:** 3475 · przez **Dementor** 17 Lut 2009, 11:17

A i zapomnialem dodac ze nie moge odpalic combofix

**Posty:** 8001 · przez **Okocza** 17 Lut 2009, 11:40

To daj log z RSiT

**Posty:** 3475 · przez **Dementor** 17 Lut 2009, 11:53

Mam taki problem RSiT.otworzył 2 okienka notatnika a tam nic niema.Nie widac zawartosci

Ok udało mi sie odnaleść Log z RSiT

Kod: Zaznacz wszystko: Logfile of random's system information tool 1.05 (written by random/random) Run by Dementor at 2009-02-17 10:54:00 Microsoft Windows XP Home Edition Dodatek Service Pack 3 System drive C: has 12 GB (59%) free of 20 GB Total RAM: 2046 MB (74% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:54, on 2009-02-17 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\_qttask.exe C:\Program Files\cFosSpeed\cFosSpeed.exe C:\Program Files\Gadu-Gadu\gg.exe C:\WINDOWS\system32\_ctfmon.exe C:\Program Files\cFosSpeed\spd.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Opera\opera.exe C:\Program Files\UltraVNC\vncviewer.exe C:\totalcmd\TOTALCMD.EXE C:\totalcmd\_TOTALCMD.EXE C:\Program Files\Winamp\Winamp.exe C:\WINDOWS\system32\NOTEPAD.EXE C:\WINDOWS\system32\NOTEPAD.EXE C:\Documents and Settings\Dementor\Pulpit\RSIT.exe C:\Program Files\trend micro\Dementor.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://users.iptelecom.net.ua/~codecs/ R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\JM\JMInsIDE.exe O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\JMRaidSetup.exe boot O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\system32\_qttask.exe" -atboottime O4 - HKLM\..\Run: [P17Helper] Rundll32 P17.dll,P17Helper O4 - HKLM\..\Run: [cFosSpeed] C:\Program Files\cFosSpeed\cFosSpeed.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: cFosSpeed System Service (cFosSpeedS) - cFos Software GmbH - C:\Program Files\cFosSpeed\spd.exe O23 - Service: NetMeeting Remote Desktop Sharing (mnmsrvc) - Unknown owner - C:\WINDOWS\system32\mnmsrvc.exe O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe O23 - Service: Instalator Windows (MSIServer) - Unknown owner - C:\WINDOWS\system32\msiexec.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 3681 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "JMB36X IDE Setup"=C:\WINDOWS\JM\JMInsIDE.exe [2006-10-31 36864] "36X Raid Configurer"=C:\WINDOWS\system32\JMRaidSetup.exe [2006-11-17 1953792] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-01-15 13680640] "nwiz"=nwiz.exe /install [] "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-01-15 86016] "Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2007-10-10 39792] "QuickTime Task"=C:\WINDOWS\system32\_qttask.exe [2009-02-15 98304] "P17Helper"=Rundll32 P17.dll [] "cFosSpeed"=C:\Program Files\cFosSpeed\cFosSpeed.exe [2007-03-13 834776] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2009-02-15 1304064] "Gadu-Gadu"=C:\Program Files\Gadu-Gadu\gg.exe [2007-07-09 2119104] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PSEXESVC] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\Program Files\Gadu-Gadu\gg.exe"="C:\Program Files\Gadu-Gadu\gg.exe:*:Enabled:Gadu-Gadu - program główny" "C:\Program Files\UltraVNC\vncviewer.exe"="C:\Program Files\UltraVNC\vncviewer.exe:*:Enabled:vncviewer.exe" "C:\totalcmd\TOTALCMD.EXE"="C:\totalcmd\TOTALCMD.EXE:*:Enabled:Total Commander 32 bit international version, file manager replacement for Windows" "C:\totalcmd\_TOTALCMD.EXE"="C:\totalcmd\_TOTALCMD.EXE:*:Disabled:Total Commander 32 bit international version, file manager replacement for Windows" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3ad5d18d-faa3-11dd-a7f2-806d6172696f}] shell\AutoRun\command - G:\Run.exe ======List of files/folders created in the last 1 months====== 2009-02-17 10:50:52 ----D---- C:\rsit 2009-02-17 10:50:52 ----D---- C:\Program Files\trend micro 2009-02-17 10:38:03 ----A---- C:\WINDOWS\system32\CF16185.exe 2009-02-17 10:37:56 ----D---- C:\32788R22FWJFW 2009-02-17 10:23:12 ----A---- C:\WINDOWS\system32\CF13272.exe 2009-02-17 10:23:04 ----D---- C:\32788R22FWJFW.2.tmp 2009-02-17 10:18:40 ----A---- C:\WINDOWS\system32\CF12390.exe 2009-02-17 10:18:34 ----D---- C:\32788R22FWJFW.1.tmp 2009-02-17 10:17:11 ----A---- C:\WINDOWS\system32\CF12093.exe 2009-02-17 02:21:00 ----D---- C:\Program Files\IrfanView 2009-02-17 00:46:14 ----A---- C:\WINDOWS\system32\CF31303.exe 2009-02-17 00:36:40 ----A---- C:\WINDOWS\system32\CF29392.exe 2009-02-17 00:36:29 ----A---- C:\Bug.txt 2009-02-17 00:36:27 ----A---- C:\WINDOWS\system32\cmd.execf 2009-02-17 00:36:21 ----D---- C:\32788R22FWJFW.0.tmp 2009-02-17 00:32:59 ----D---- C:\WINDOWS\temp 2009-02-17 00:31:57 ----A---- C:\Boot.bak 2009-02-17 00:29:53 ----RASHD---- C:\cmdcons 2009-02-17 00:29:47 ----ASH---- C:\WINDOWS\system32\_rundll32.exe 2009-02-17 00:29:06 ----A---- C:\WINDOWS\zip.exe 2009-02-17 00:29:06 ----A---- C:\WINDOWS\VFIND.exe 2009-02-17 00:29:06 ----A---- C:\WINDOWS\SWXCACLS.exe 2009-02-17 00:29:06 ----A---- C:\WINDOWS\SWSC.exe 2009-02-17 00:29:06 ----A---- C:\WINDOWS\SWREG.exe 2009-02-17 00:29:06 ----A---- C:\WINDOWS\sed.exe 2009-02-17 00:29:06 ----A---- C:\WINDOWS\NIRCMD.exe 2009-02-17 00:29:06 ----A---- C:\WINDOWS\grep.exe 2009-02-17 00:29:06 ----A---- C:\WINDOWS\fdsv.exe 2009-02-17 00:28:59 ----D---- C:\WINDOWS\ERDNT 2009-02-17 00:28:59 ----D---- C:\Qoobox 2009-02-17 00:28:58 ----D---- C:\ComboFix 2009-02-17 00:28:57 ----A---- C:\WINDOWS\system32\CF27900.exe 2009-02-16 16:41:09 ----ASH---- C:\WINDOWS\system32\_mspaint.exe 2009-02-16 11:28:00 ----D---- C:\Program Files\cFosSpeed 2009-02-16 11:28:00 ----A---- C:\WINDOWS\system32\cfosspeed.dll 2009-02-16 11:27:38 ----A---- C:\WINDOWS\cFosSpeed_Setup_Log.txt 2009-02-16 00:37:01 ----ASH---- C:\WINDOWS\system32\_NOTEPAD.EXE 2009-02-15 23:11:31 ----D---- C:\Program Files\Image Grabber II 2009-02-15 11:53:01 ----ASH---- C:\WINDOWS\system32\_msiexec.exe 2009-02-15 11:52:32 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Installations 2009-02-15 10:22:05 ----ASH---- C:\WINDOWS\system32\_qttask.exe 2009-02-15 10:22:05 ----ASH---- C:\WINDOWS\system32\_nwiz.exe 2009-02-15 10:22:05 ----ASH---- C:\WINDOWS\system32\_ctfmon.exe 2009-02-15 10:22:05 ----ASH---- C:\WINDOWS\_P17Def.Exe 2009-02-15 10:20:00 ----ASH---- C:\WINDOWS\system32\_wpabaln.exe 2009-02-14 19:36:32 ----ASH---- C:\WINDOWS\system32\_taskmgr.exe 2009-02-14 19:26:33 ----D---- C:\Program Files\WinRAR 2009-02-14 15:57:42 ----A---- C:\WINDOWS\wcx_ftp.ini 2009-02-14 15:52:31 ----A---- C:\WINDOWS\system32\h323log.txt 2009-02-14 15:51:08 ----A---- C:\WINDOWS\system32\hidserv.dll 2009-02-14 15:50:40 ----D---- C:\Program Files\UltraVNC 2009-02-14 15:49:57 ----A---- C:\WINDOWS\system32\usbui.dll 2009-02-14 15:49:22 ----A---- C:\WINDOWS\imsins.BAK 2009-02-14 15:49:20 ----SHD---- C:\WINDOWS\Installer 2009-02-14 15:49:20 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2009-02-14 15:49:19 ----D---- C:\Program Files\Common Files\ODBC 2009-02-14 15:49:19 ----A---- C:\WINDOWS\ODBCINST.INI 2009-02-14 15:49:16 ----D---- C:\Program Files\Common Files\SpeechEngines 2009-02-14 15:49:15 ----RD---- C:\Program Files 2009-02-14 15:49:15 ----D---- C:\Program Files\Common Files\Microsoft Shared 2009-02-14 15:49:15 ----D---- C:\Program Files\Common Files 2009-02-14 15:49:13 ----RA---- C:\WINDOWS\system32\kbdazel.dll 2009-02-14 15:49:12 ----RA---- C:\WINDOWS\system32\kbdtuq.dll 2009-02-14 15:49:12 ----RA---- C:\WINDOWS\system32\kbdtuf.dll 2009-02-14 15:49:11 ----RA---- C:\WINDOWS\system32\kbdtat.dll 2009-02-14 15:49:11 ----RA---- C:\WINDOWS\system32\kbdmon.dll 2009-02-14 15:49:11 ----RA---- C:\WINDOWS\system32\kbdkyr.dll 2009-02-14 15:49:10 ----RA---- C:\WINDOWS\system32\kbdycc.dll 2009-02-14 15:49:10 ----RA---- C:\WINDOWS\system32\kbduzb.dll 2009-02-14 15:49:10 ----RA---- C:\WINDOWS\system32\kbdur.dll 2009-02-14 15:49:10 ----RA---- C:\WINDOWS\system32\kbdru1.dll 2009-02-14 15:49:10 ----RA---- C:\WINDOWS\system32\kbdru.dll 2009-02-14 15:49:10 ----RA---- C:\WINDOWS\system32\kbdkaz.dll 2009-02-14 15:49:10 ----RA---- C:\WINDOWS\system32\kbdbu.dll 2009-02-14 15:49:10 ----RA---- C:\WINDOWS\system32\kbdblr.dll 2009-02-14 15:49:10 ----RA---- C:\WINDOWS\system32\kbdaze.dll 2009-02-14 15:49:08 ----RA---- C:\WINDOWS\system32\kbdhept.dll 2009-02-14 15:49:08 ----RA---- C:\WINDOWS\system32\kbdhela3.dll 2009-02-14 15:49:08 ----RA---- C:\WINDOWS\system32\kbdhela2.dll 2009-02-14 15:49:08 ----RA---- C:\WINDOWS\system32\kbdhe319.dll 2009-02-14 15:49:08 ----RA---- C:\WINDOWS\system32\kbdhe220.dll 2009-02-14 15:49:08 ----RA---- C:\WINDOWS\system32\kbdhe.dll 2009-02-14 15:49:08 ----RA---- C:\WINDOWS\system32\kbdgkl.dll 2009-02-14 15:49:07 ----RA---- C:\WINDOWS\system32\kbdlv1.dll 2009-02-14 15:49:07 ----RA---- C:\WINDOWS\system32\kbdlv.dll 2009-02-14 15:49:07 ----RA---- C:\WINDOWS\system32\kbdlt1.dll 2009-02-14 15:49:07 ----RA---- C:\WINDOWS\system32\kbdlt.dll 2009-02-14 15:49:07 ----RA---- C:\WINDOWS\system32\kbdest.dll 2009-02-14 15:49:03 ----A---- C:\WINDOWS\system32\kbdycl.dll 2009-02-14 15:49:03 ----A---- C:\WINDOWS\system32\kbdsl1.dll 2009-02-14 15:49:03 ----A---- C:\WINDOWS\system32\kbdsl.dll 2009-02-14 15:49:03 ----A---- C:\WINDOWS\system32\kbdro.dll 2009-02-14 15:49:03 ----A---- C:\WINDOWS\system32\kbdhu1.dll 2009-02-14 15:49:03 ----A---- C:\WINDOWS\system32\kbdhu.dll 2009-02-14 15:49:03 ----A---- C:\WINDOWS\system32\kbdcz2.dll 2009-02-14 15:49:03 ----A---- C:\WINDOWS\system32\kbdcz1.dll 2009-02-14 15:49:03 ----A---- C:\WINDOWS\system32\kbdcz.dll 2009-02-14 15:49:03 ----A---- C:\WINDOWS\system32\kbdcr.dll 2009-02-14 15:49:03 ----A---- C:\WINDOWS\system32\KBDAL.DLL 2009-02-14 15:49:01 ----A---- C:\WINDOWS\system32\spxcoins.dll 2009-02-14 15:49:01 ----A---- C:\WINDOWS\system32\irclass.dll 2009-02-14 15:49:01 ----A---- C:\WINDOWS\system32\EqnClass.Dll 2009-02-14 15:49:01 ----A---- C:\WINDOWS\system32\dgsetup.dll 2009-02-14 15:49:01 ----A---- C:\WINDOWS\system32\dgrpsetu.dll 2009-02-14 15:48:59 ----N---- C:\WINDOWS\system32\CONFIG.TMP 2009-02-14 15:48:59 ----A---- C:\WINDOWS\TASKMAN.EXE 2009-02-14 15:48:58 ----A---- C:\WINDOWS\system32\notepad.exe 2009-02-14 15:48:58 ----A---- C:\WINDOWS\system32\batt.dll 2009-02-14 15:48:58 ----A---- C:\WINDOWS\notepad.exe 2009-02-14 15:48:57 ----A---- C:\WINDOWS\system32\storprop.dll 2009-02-14 15:48:52 ----ASH---- C:\Documents and Settings\All Users\Dane aplikacji\desktop.ini 2009-02-14 15:47:41 ----RA---- C:\WINDOWS\SET21.tmp 2009-02-14 15:47:10 ----RA---- C:\WINDOWS\SET8.tmp 2009-02-14 15:47:08 ----RA---- C:\WINDOWS\SET4.tmp 2009-02-14 15:47:06 ----RA---- C:\WINDOWS\SET3.tmp 2009-02-14 15:47:02 ----D---- C:\WINDOWS\system32\CatRoot2 2009-02-14 15:47:02 ----D---- C:\WINDOWS\system32\CatRoot 2009-02-14 15:46:57 ----SD---- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft 2009-02-14 15:46:35 ----A---- C:\WINDOWS\setuplog.txt 2009-02-14 15:46:32 ----D---- C:\Documents and Settings 2009-02-14 15:45:36 ----RASH---- C:\boot.ini 2009-02-14 15:42:17 ----D---- C:\Documents and Settings\Dementor\Dane aplikacji\BESTplayer 2009-02-14 15:41:30 ----SHD---- C:\System Volume Information 2009-02-14 15:41:02 ----D---- C:\Documents and Settings\Dementor\Dane aplikacji\Gadu-Gadu 2009-02-14 15:38:32 ----RSHDC---- C:\WINDOWS\system32\dllcache 2009-02-14 15:38:32 ----RSD---- C:\WINDOWS\Fonts 2009-02-14 15:38:32 ----RD---- C:\WINDOWS\Web 2009-02-14 15:38:32 ----HD---- C:\WINDOWS\inf 2009-02-14 15:38:32 ----D---- C:\WINDOWS\WinSxS 2009-02-14 15:38:32 ----D---- C:\WINDOWS\twain_32 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\wins 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\wbem 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\usmt 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\spool 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\ShellExt 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\Setup 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\ras 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\oobe 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\npp 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\mui 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\inetsrv 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\IME 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\icsxml 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\ias 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\export 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\drivers 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\dhcp 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\config 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\3com_dmi 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\3076 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\2052 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\1054 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\1045 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\1042 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\1041 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\1037 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\1033 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\1031 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\1028 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32\1025 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system32 2009-02-14 15:38:32 ----D---- C:\WINDOWS\system 2009-02-14 15:38:32 ----D---- C:\WINDOWS\security 2009-02-14 15:38:32 ----D---- C:\WINDOWS\Resources 2009-02-14 15:38:32 ----D---- C:\WINDOWS\repair 2009-02-14 15:38:32 ----D---- C:\WINDOWS\Provisioning 2009-02-14 15:38:32 ----D---- C:\WINDOWS\PeerNet 2009-02-14 15:38:32 ----D---- C:\WINDOWS\pchealth 2009-02-14 15:38:32 ----D---- C:\WINDOWS\mui 2009-02-14 15:38:32 ----D---- C:\WINDOWS\msapps 2009-02-14 15:38:32 ----D---- C:\WINDOWS\msagent 2009-02-14 15:38:32 ----D---- C:\WINDOWS\Media 2009-02-14 15:38:32 ----D---- C:\WINDOWS\java 2009-02-14 15:38:32 ----D---- C:\WINDOWS\ime 2009-02-14 15:38:32 ----D---- C:\WINDOWS\Help 2009-02-14 15:38:32 ----D---- C:\WINDOWS\Driver Cache 2009-02-14 15:38:32 ----D---- C:\WINDOWS\Debug 2009-02-14 15:38:32 ----D---- C:\WINDOWS\Cursors 2009-02-14 15:38:32 ----D---- C:\WINDOWS\Connection Wizard 2009-02-14 15:38:32 ----D---- C:\WINDOWS\Config 2009-02-14 15:38:32 ----D---- C:\WINDOWS\AppPatch 2009-02-14 15:38:32 ----D---- C:\WINDOWS\addins 2009-02-14 15:38:32 ----D---- C:\WINDOWS 2009-02-14 15:38:23 ----N---- C:\WINDOWS\system32\pxinsi64.exe 2009-02-14 15:38:23 ----N---- C:\WINDOWS\system32\pxinsa64.exe 2009-02-14 15:38:23 ----N---- C:\WINDOWS\system32\pxhpinst.exe 2009-02-14 15:38:23 ----N---- C:\WINDOWS\system32\pxcpyi64.exe 2009-02-14 15:38:23 ----N---- C:\WINDOWS\system32\pxcpya64.exe 2009-02-14 15:38:22 ----N---- C:\WINDOWS\system32\vxblock.dll 2009-02-14 15:38:22 ----N---- C:\WINDOWS\system32\pxwma.dll 2009-02-14 15:38:22 ----N---- C:\WINDOWS\system32\pxwave.dll 2009-02-14 15:38:22 ----N---- C:\WINDOWS\system32\pxmas.dll 2009-02-14 15:38:22 ----N---- C:\WINDOWS\system32\pxdrv.dll 2009-02-14 15:38:22 ----N---- C:\WINDOWS\system32\px.dll 2009-02-14 15:38:18 ----D---- C:\Program Files\Winamp 2009-02-14 15:38:18 ----A---- C:\WINDOWS\winamp.ini 2009-02-14 15:37:20 ----A---- C:\WINDOWS\system32\wrap_oal.dll 2009-02-14 15:37:20 ----A---- C:\WINDOWS\system32\OpenAL32.dll 2009-02-14 15:37:06 ----A---- C:\WINDOWS\system32\ksuser.dll 2009-02-14 15:37:00 ----ASH---- C:\WINDOWS\_REGEDIT.EXE 2009-02-14 15:36:59 ----D---- C:\WINDOWS\system32\Data 2009-02-14 15:36:59 ----A---- C:\WINDOWS\system32\ludap17.ini 2009-02-14 15:36:59 ----A---- C:\WINDOWS\system32\ctzapxx.ini 2009-02-14 15:36:59 ----A---- C:\WINDOWS\INRES.DLL 2009-02-14 15:36:58 ----D---- C:\Program Files\Creative 2009-02-14 15:36:17 ----D---- C:\Program Files\NAPI-PROJEKT 2009-02-14 15:35:44 ----D---- C:\Program Files\Gadu-Gadu 2009-02-14 15:35:14 ----A---- C:\WINDOWS\system32\qttask.exe 2009-02-14 15:34:38 ----D---- C:\WINDOWS\system32\QuickTime 2009-02-14 15:34:38 ----A---- C:\WINDOWS\system32\MSVCR71.dll 2009-02-14 15:34:37 ----A---- C:\WINDOWS\mmtvmj.ini 2009-02-14 15:34:37 ----A---- C:\WINDOWS\m3jp2k.ini 2009-02-14 15:34:36 ----A---- C:\WINDOWS\m3jpeg.ini 2009-02-14 15:34:34 ----A---- C:\WINDOWS\system32\mplvw7.dll 2009-02-14 15:34:34 ----A---- C:\WINDOWS\system32\mplvpx.dll 2009-02-14 15:34:34 ----A---- C:\WINDOWS\system32\mplvm6.dll 2009-02-14 15:34:34 ----A---- C:\WINDOWS\system32\mplva6.dll 2009-02-14 15:34:34 ----A---- C:\WINDOWS\system32\mplaw7.dll 2009-02-14 15:34:34 ----A---- C:\WINDOWS\system32\mplapx.dll 2009-02-14 15:34:34 ----A---- C:\WINDOWS\system32\mplam6.dll 2009-02-14 15:34:34 ----A---- C:\WINDOWS\system32\mplaa6.dll 2009-02-14 15:34:34 ----A---- C:\WINDOWS\system32\cpuinf32.dll 2009-02-14 15:34:32 ----A---- C:\WINDOWS\system32\unrar.dll 2009-02-14 15:34:31 ----A---- C:\WINDOWS\system32\xvidcore.dll 2009-02-14 15:34:29 ----D---- C:\Program Files\ACE Mega CoDecS Pack 2009-02-14 15:32:27 ----RSD---- C:\WINDOWS\assembly 2009-02-14 15:32:24 ----D---- C:\Program Files\Real Alternative 2009-02-14 15:32:24 ----D---- C:\Program Files\Media Player Classic 2009-02-14 15:32:24 ----D---- C:\Documents and Settings\Dementor\Dane aplikacji\Real 2009-02-14 15:32:24 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Real 2009-02-14 15:32:24 ----A---- C:\WINDOWS\system32\rmoc3260.dll 2009-02-14 15:32:24 ----A---- C:\WINDOWS\system32\pndx5032.dll 2009-02-14 15:32:24 ----A---- C:\WINDOWS\system32\pndx5016.dll 2009-02-14 15:32:24 ----A---- C:\WINDOWS\system32\pncrt.dll 2009-02-14 15:32:07 ----D---- C:\WINDOWS\Microsoft.NET 2009-02-14 15:30:46 ----D---- C:\Program Files\Combined Community Codec Pack 2009-02-14 15:30:14 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Adobe 2009-02-14 15:30:10 ----D---- C:\Program Files\Common Files\Adobe 2009-02-14 15:30:10 ----D---- C:\Program Files\Adobe 2009-02-14 15:25:01 ----ASH---- C:\WINDOWS\system32\_mshta.exe 2009-02-14 15:21:47 ----D---- C:\WINDOWS\Prefetch 2009-02-14 15:20:11 ----D---- C:\WINDOWS\nview 2009-02-14 15:20:11 ----A---- C:\WINDOWS\system32\nvudisp.exe 2009-02-14 15:20:01 ----A---- C:\WINDOWS\system32\NVUNINST.EXE 2009-02-14 15:19:46 ----D---- C:\NVIDIA 2009-02-14 15:19:29 ----D---- C:\totalcmd 2009-02-14 15:19:29 ----A---- C:\WINDOWS\wincmd.ini 2009-02-14 15:16:47 ----N---- C:\WINDOWS\system32\msxml6r.dll 2009-02-14 15:16:47 ----N---- C:\WINDOWS\system32\msxml6.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\eapsvc.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\eapqec.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\eappprxy.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\eapphost.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\eappgnui.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\eappcfg.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\eapp3hst.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\eapolqec.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\dot3ui.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\dot3svc.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\dot3msm.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\dot3dlg.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\dot3cfg.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\dot3api.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\dimsroam.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\dimsntfy.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\dhcpqec.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\credssp.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\bitsprx4.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\azroles.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\ativvaxx.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\ativtmxx.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\ati3duag.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\ati3d1ag.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\ati2dvag.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\ati2dvaa.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\ati2cqag.dll 2009-02-14 15:16:40 ----N---- C:\WINDOWS\system32\aaclient.dll 2009-02-14 15:16:39 ----N---- C:\WINDOWS\system32\mdmxsdk.dll 2009-02-14 15:16:39 ----N---- C:\WINDOWS\system32\l2gpstore.dll 2009-02-14 15:16:39 ----N---- C:\WINDOWS\system32\kmsvc.dll 2009-02-14 15:16:39 ----N---- C:\WINDOWS\system32\kbdpash.dll 2009-02-14 15:16:39 ----N---- C:\WINDOWS\system32\kbdnepr.dll 2009-02-14 15:16:39 ----N---- C:\WINDOWS\system32\kbdiultn.dll 2009-02-14 15:16:39 ----N---- C:\WINDOWS\system32\kbdbhc.dll 2009-02-14 15:16:39 ----N---- C:\WINDOWS\system32\hsfcisp2.dll 2009-02-14 15:16:38 ----N---- C:\WINDOWS\system32\qagentrt.dll 2009-02-14 15:16:38 ----N---- C:\WINDOWS\system32\qagent.dll 2009-02-14 15:16:38 ----N---- C:\WINDOWS\system32\photometadatahandler.dll 2009-02-14 15:16:38 ----N---- C:\WINDOWS\system32\onex.dll 2009-02-14 15:16:38 ----N---- C:\WINDOWS\system32\napmontr.dll 2009-02-14 15:16:38 ----N---- C:\WINDOWS\system32\napipsec.dll 2009-02-14 15:16:38 ----N---- C:\WINDOWS\system32\mtxparhd.dll 2009-02-14 15:16:38 ----N---- C:\WINDOWS\system32\msshavmsg.dll 2009-02-14 15:16:38 ----N---- C:\WINDOWS\system32\mssha.dll 2009-02-14 15:16:38 ----N---- C:\WINDOWS\system32\mmcperf.exe 2009-02-14 15:16:38 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll 2009-02-14 15:16:38 ----N---- C:\WINDOWS\system32\mmcex.dll 2009-02-14 15:16:38 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll 2009-02-14 15:16:38 ----A---- C:\WINDOWS\system32\nv4_disp.dll 2009-02-14 15:16:38 ----A---- C:\WINDOWS\system32\napstat.exe 2009-02-14 15:16:37 ----N---- C:\WINDOWS\system32\verclsid.exe 2009-02-14 15:16:37 ----N---- C:\WINDOWS\system32\tzchange.exe 2009-02-14 15:16:37 ----N---- C:\WINDOWS\system32\tspkg.dll 2009-02-14 15:16:37 ----N---- C:\WINDOWS\system32\tsgqec.dll 2009-02-14 15:16:37 ----N---- C:\WINDOWS\system32\slserv.exe 2009-02-14 15:16:37 ----N---- C:\WINDOWS\system32\slrundll.exe 2009-02-14 15:16:37 ----N---- C:\WINDOWS\system32\slgen.dll 2009-02-14 15:16:37 ----N---- C:\WINDOWS\system32\slextspk.dll 2009-02-14 15:16:37 ----N---- C:\WINDOWS\system32\slcoinst.dll 2009-02-14 15:16:37 ----N---- C:\WINDOWS\system32\s3gnb.dll 2009-02-14 15:16:37 ----N---- C:\WINDOWS\system32\rhttpaa.dll 2009-02-14 15:16:37 ----N---- C:\WINDOWS\system32\rasqec.dll 2009-02-14 15:16:37 ----N---- C:\WINDOWS\system32\qutil.dll 2009-02-14 15:16:37 ----N---- C:\WINDOWS\system32\qcliprov.dll 2009-02-14 15:16:37 ----A---- C:\WINDOWS\system32\setupn.exe 2009-02-14 15:16:36 ----N---- C:\WINDOWS\system32\xmllite.dll 2009-02-14 15:16:36 ----N---- C:\WINDOWS\system32\wmphoto.dll 2009-02-14 15:16:36 ----N---- C:\WINDOWS\system32\wlanapi.dll 2009-02-14 15:16:36 ----N---- C:\WINDOWS\system32\windowscodecsext.dll 2009-02-14 15:16:36 ----N---- C:\WINDOWS\system32\windowscodecs.dll 2009-02-14 15:16:36 ----N---- C:\WINDOWS\slrundll.exe 2009-02-14 15:16:36 ----D---- C:\WINDOWS\system32\pl-pl 2009-02-14 15:16:35 ----D---- C:\WINDOWS\system32\pl 2009-02-14 15:16:35 ----D---- C:\WINDOWS\system32\bits 2009-02-14 15:16:35 ----D---- C:\WINDOWS\l2schemas 2009-02-14 15:15:30 ----SHD---- C:\RECYCLER 2009-02-14 15:15:21 ----D---- C:\WINDOWS\ServicePackFiles 2009-02-14 15:14:37 ----D---- C:\Documents and Settings\Dementor\Dane aplikacji\Opera 2009-02-14 15:14:27 ----D---- C:\Program Files\Opera 2009-02-14 15:13:43 ----D---- C:\WINDOWS\network diagnostic 2009-02-14 15:12:57 ----A---- C:\WINDOWS\002552_.tmp 2009-02-14 15:12:54 ----D---- C:\Documents and Settings\Dementor\Dane aplikacji\Adobe 2009-02-14 15:12:47 ----A---- C:\WINDOWS\system32\spupdsvc.exe 2009-02-14 15:12:35 ----D---- C:\Documents and Settings\Dementor\Dane aplikacji\Macromedia 2009-02-14 15:11:52 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$ 2009-02-14 15:11:52 ----D---- C:\WINDOWS\EHome 2009-02-14 15:07:37 ----D---- C:\Program Files\TC UP 2009-02-14 15:05:30 ----D---- C:\WINDOWS\system32\SoftwareDistribution 2009-02-14 15:05:26 ----HD---- C:\Program Files\InstallShield Installation Information 2009-02-14 15:05:26 ----D---- C:\JM 2009-02-14 15:05:24 ----R---- C:\WINDOWS\system32\JMRaidSetup.exe 2009-02-14 15:05:24 ----R---- C:\WINDOWS\system32\JMRaidAPI.dll 2009-02-14 15:05:20 ----D---- C:\WINDOWS\JM 2009-02-14 15:04:37 ----D---- C:\Program Files\Marvell 2009-02-14 15:04:34 ----D---- C:\Program Files\Common Files\InstallShield 2009-02-14 15:02:38 ----D---- C:\WINDOWS\system32\ReinstallBackups 2009-02-14 15:02:37 ----D---- C:\Program Files\Intel 2009-02-14 15:00:27 ----D---- C:\Documents and Settings\Dementor\Dane aplikacji\Identities 2009-02-14 15:00:26 ----HD---- C:\Program Files\Uninstall Information 2009-02-14 15:00:11 ----ASH---- C:\Documents and Settings\Dementor\Dane aplikacji\desktop.ini 2009-02-14 15:00:10 ----SD---- C:\Documents and Settings\Dementor\Dane aplikacji\Microsoft 2009-02-14 14:59:40 ----D---- C:\WINDOWS\SoftwareDistribution 2009-02-14 14:59:38 ----SD---- C:\WINDOWS\system32\Microsoft 2009-02-14 14:59:38 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-02-14 14:57:12 ----D---- C:\WINDOWS\system32\xircom 2009-02-14 14:57:12 ----D---- C:\Program Files\xerox 2009-02-14 14:57:12 ----D---- C:\Program Files\microsoft frontpage 2009-02-14 14:57:03 ----N---- C:\WINDOWS\system32\spmsg.dll 2009-02-14 14:57:02 ----HD---- C:\WINDOWS\$hf_mig$ 2009-02-14 14:56:54 ----A---- C:\WINDOWS\control.ini 2009-02-14 14:56:54 ----A---- C:\AUTOEXEC.BAT 2009-02-14 14:56:46 ----A---- C:\WINDOWS\OEWABLog.txt 2009-02-14 14:56:43 ----A---- C:\WINDOWS\system32\mapi32.dll 2009-02-14 14:56:12 ----SD---- C:\WINDOWS\Downloaded Program Files 2009-02-14 14:56:12 ----RD---- C:\WINDOWS\Offline Web Pages 2009-02-14 14:56:12 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest 2009-02-14 14:56:07 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest 2009-02-14 14:56:04 ----HD---- C:\Program Files\WindowsUpdate 2009-02-14 14:56:02 ----D---- C:\Program Files\Usługi online 2009-02-14 14:55:48 ----D---- C:\WINDOWS\system32\DirectX 2009-02-14 14:55:26 ----A---- C:\WINDOWS\system32\atrace.dll 2009-02-14 14:55:22 ----A---- C:\WINDOWS\system32\desktop.ini 2009-02-14 14:55:22 ----A---- C:\WINDOWS\desktop.ini 2009-02-14 14:55:15 ----A---- C:\WINDOWS\system32\nmevtmsg.dll 2009-02-14 14:55:14 ----A---- C:\WINDOWS\system32\acctres.dll 2009-02-14 14:55:13 ----D---- C:\Program Files\Common Files\Services 2009-02-14 14:55:10 ----SD---- C:\WINDOWS\Tasks 2009-02-14 14:55:10 ----A---- C:\WINDOWS\system32\icfgnt5.dll 2009-02-14 14:55:09 ----D---- C:\Program Files\Common Files\MSSoap 2009-02-14 14:55:04 ----D---- C:\WINDOWS\srchasst 2009-02-14 14:55:03 ----D---- C:\WINDOWS\system32\Macromed 2009-02-14 14:55:00 ----A---- C:\WINDOWS\system32\wuweb.dll 2009-02-14 14:55:00 ----A---- C:\WINDOWS\system32\wucltui.dll 2009-02-14 14:55:00 ----A---- C:\WINDOWS\system32\wuauserv.dll 2009-02-14 14:55:00 ----A---- C:\WINDOWS\system32\wuaueng1.dll 2009-02-14 14:55:00 ----A---- C:\WINDOWS\system32\wuaueng.dll 2009-02-14 14:54:59 ----A---- C:\WINDOWS\system32\wups.dll 2009-02-14 14:54:59 ----A---- C:\WINDOWS\system32\wuauclt1.exe 2009-02-14 14:54:59 ----A---- C:\WINDOWS\system32\wuauclt.exe 2009-02-14 14:54:59 ----A---- C:\WINDOWS\system32\wuapi.dll 2009-02-14 14:54:59 ----A---- C:\WINDOWS\system32\qmgrprxy.dll 2009-02-14 14:54:59 ----A---- C:\WINDOWS\system32\bitsprx3.dll 2009-02-14 14:54:59 ----A---- C:\WINDOWS\system32\bitsprx2.dll 2009-02-14 14:54:58 ----A---- C:\WINDOWS\system32\qmgr.dll 2009-02-14 14:54:54 ----D---- C:\Program Files\Movie Maker 2009-02-14 14:54:50 ----A---- C:\WINDOWS\system32\safrslv.dll 2009-02-14 14:54:50 ----A---- C:\WINDOWS\system32\safrdm.dll 2009-02-14 14:54:50 ----A---- C:\WINDOWS\system32\safrcdlg.dll 2009-02-14 14:54:49 ----A---- C:\WINDOWS\system32\racpldlg.dll 2009-02-14 14:54:45 ----A---- C:\WINDOWS\system32\fltmc.exe 2009-02-14 14:54:45 ----A---- C:\WINDOWS\system32\fltlib.dll 2009-02-14 14:54:44 ----D---- C:\WINDOWS\system32\Restore 2009-02-14 14:54:44 ----A---- C:\WINDOWS\system32\srsvc.dll 2009-02-14 14:54:44 ----A---- C:\WINDOWS\system32\srrstr.dll 2009-02-14 14:54:44 ----A---- C:\WINDOWS\system32\srclient.dll 2009-02-14 14:54:43 ----A---- C:\WINDOWS\system32\nmmkcert.dll 2009-02-14 14:54:43 ----A---- C:\WINDOWS\system32\msconf.dll 2009-02-14 14:54:43 ----A---- C:\WINDOWS\system32\mnmsrvc.exe 2009-02-14 14:54:43 ----A---- C:\WINDOWS\system32\mnmdd.dll 2009-02-14 14:54:43 ----A---- C:\WINDOWS\system32\isrdbg32.dll 2009-02-14 14:54:43 ----A---- C:\WINDOWS\system32\ils.dll 2009-02-14 14:54:40 ----D---- C:\Program Files\NetMeeting 2009-02-14 14:54:40 ----A---- C:\WINDOWS\system32\msoert2.dll 2009-02-14 14:54:39 ----A---- C:\WINDOWS\system32\msoeacct.dll 2009-02-14 14:54:38 ----A---- C:\WINDOWS\system32\inetres.dll 2009-02-14 14:54:38 ----A---- C:\WINDOWS\system32\inetcomm.dll 2009-02-14 14:54:36 ----D---- C:\Program Files\Outlook Express 2009-02-14 14:54:36 ----A---- C:\WINDOWS\system32\schedsvc.dll 2009-02-14 14:54:35 ----A---- C:\WINDOWS\system32\mstinit.exe 2009-02-14 14:54:35 ----A---- C:\WINDOWS\system32\mstask.dll 2009-02-14 14:54:35 ----A---- C:\WINDOWS\system32\isign32.dll 2009-02-14 14:54:35 ----A---- C:\WINDOWS\system32\icwphbk.dll 2009-02-14 14:54:35 ----A---- C:\WINDOWS\system32\icwdial.dll 2009-02-14 14:54:34 ----A---- C:\WINDOWS\system32\inetcfg.dll 2009-02-14 14:54:28 ----D---- C:\Program Files\Common Files\System 2009-02-14 14:54:27 ----D---- C:\Program Files\Internet Explorer 2009-02-14 14:54:19 ----D---- C:\Program Files\ComPlus Applications 2009-02-14 14:54:18 ----A---- C:\WINDOWS\vbaddin.ini 2009-02-14 14:54:18 ----A---- C:\WINDOWS\vb.ini 2009-02-14 14:54:14 ----D---- C:\WINDOWS\Registration 2009-02-14 14:53:56 ----D---- C:\Program Files\Windows Media Player 2009-02-14 14:53:52 ----D---- C:\Program Files\Messenger 2009-02-14 14:53:48 ----D---- C:\Program Files\MSN Gaming Zone 2009-02-14 14:53:48 ----A---- C:\WINDOWS\system32\write.exe 2009-02-14 14:53:39 ----A---- C:\WINDOWS\system32\sndvol32.exe 2009-02-14 14:53:39 ----A---- C:\WINDOWS\system32\hticons.dll 2009-02-14 14:53:38 ----A---- C:\WINDOWS\system32\winchat.exe 2009-02-14 14:53:38 ----A---- C:\WINDOWS\system32\avwav.dll 2009-02-14 14:53:38 ----A---- C:\WINDOWS\system32\avtapi.dll 2009-02-14 14:53:38 ----A---- C:\WINDOWS\system32\avmeter.dll 2009-02-14 14:53:31 ----A---- C:\WINDOWS\system32\getuname.dll 2009-02-14 14:53:30 ----A---- C:\WINDOWS\system32\winmine.exe 2009-02-14 14:53:30 ----A---- C:\WINDOWS\system32\sol.exe 2009-02-14 14:53:30 ----A---- C:\WINDOWS\system32\charmap.exe 2009-02-14 14:53:30 ----A---- C:\WINDOWS\system32\calc.exe 2009-02-14 14:53:29 ----A---- C:\WINDOWS\system32\usrlogon.cmd 2009-02-14 14:53:29 ----A---- C:\WINDOWS\system32\tsshutdn.exe 2009-02-14 14:53:29 ----A---- C:\WINDOWS\system32\tslabels.ini 2009-02-14 14:53:29 ----A---- C:\WINDOWS\system32\tskill.exe 2009-02-14 14:53:29 ----A---- C:\WINDOWS\system32\tsdiscon.exe 2009-02-14 14:53:29 ----A---- C:\WINDOWS\system32\tscon.exe 2009-02-14 14:53:29 ----A---- C:\WINDOWS\system32\reset.exe 2009-02-14 14:53:29 ----A---- C:\WINDOWS\system32\mshearts.exe 2009-02-14 14:53:29 ----A---- C:\WINDOWS\system32\freecell.exe 2009-02-14 14:53:28 ----A---- C:\WINDOWS\system32\shadow.exe 2009-02-14 14:53:28 ----A---- C:\WINDOWS\system32\rwinsta.exe 2009-02-14 14:53:28 ----A---- C:\WINDOWS\system32\regini.exe 2009-02-14 14:53:28 ----A---- C:\WINDOWS\system32\rdpcfgex.dll 2009-02-14 14:53:28 ----A---- C:\WINDOWS\system32\qwinsta.exe 2009-02-14 14:53:28 ----A---- C:\WINDOWS\system32\qappsrv.exe 2009-02-14 14:53:28 ----A---- C:\WINDOWS\system32\msg.exe 2009-02-14 14:53:28 ----A---- C:\WINDOWS\system32\logoff.exe 2009-02-14 14:53:28 ----A---- C:\WINDOWS\system32\cdmodem.dll 2009-02-14 14:53:27 ----A---- C:\WINDOWS\system32\mtxlegih.dll 2009-02-14 14:53:27 ----A---- C:\WINDOWS\system32\mtxex.dll 2009-02-14 14:53:27 ----A---- C:\WINDOWS\system32\mtxdm.dll 2009-02-14 14:53:27 ----A---- C:\WINDOWS\system32\msdtcprf.ini 2009-02-14 14:53:27 ----A---- C:\WINDOWS\system32\dcomcnfg.exe 2009-02-14 14:53:26 ----A---- C:\WINDOWS\system32\stclient.dll 2009-02-14 14:53:26 ----A---- C:\WINDOWS\system32\comsnap.dll 2009-02-14 14:53:26 ----A---- C:\WINDOWS\system32\comrepl.dll 2009-02-14 14:53:26 ----A---- C:\WINDOWS\system32\comaddin.dll 2009-02-14 14:53:21 ----A---- C:\WINDOWS\system32\wmimgmt.msc 2009-02-14 14:53:20 ----A---- C:\WINDOWS\system32\sndrec32.exe 2009-02-14 14:53:20 ----A---- C:\WINDOWS\system32\mplay32.exe 2009-02-14 14:53:20 ----A---- C:\WINDOWS\system32\hypertrm.dll 2009-02-14 14:53:20 ----A---- C:\WINDOWS\system32\accwiz.exe 2009-02-14 14:53:19 ----D---- C:\Program Files\Windows NT 2009-02-14 14:53:19 ----A---- C:\WINDOWS\system32\mspaint.exe 2009-02-14 14:53:19 ----A---- C:\WINDOWS\system32\clipbrd.exe 2009-02-14 14:53:18 ----A---- C:\WINDOWS\system32\tscfgwmi.dll 2009-02-14 14:53:18 ----A---- C:\WINDOWS\system32\spider.exe 2009-02-14 14:53:17 ----A---- C:\WINDOWS\system32\tscupgrd.exe 2009-02-14 14:53:17 ----A---- C:\WINDOWS\system32\sessmgr.exe 2009-02-14 14:53:17 ----A---- C:\WINDOWS\system32\remotepg.dll 2009-02-14 14:53:17 ----A---- C:\WINDOWS\system32\rdshost.exe 2009-02-14 14:53:17 ----A---- C:\WINDOWS\system32\rdsaddin.exe 2009-02-14 14:53:17 ----A---- C:\WINDOWS\system32\rdchost.dll 2009-02-14 14:53:17 ----A---- C:\WINDOWS\system32\mstscax.dll 2009-02-14 14:53:17 ----A---- C:\WINDOWS\system32\mstsc.exe 2009-02-14 14:53:16 ----D---- C:\WINDOWS\system32\MsDtc 2009-02-14 14:53:16 ----A---- C:\WINDOWS\system32\termsrv.dll 2009-02-14 14:53:16 ----A---- C:\WINDOWS\system32\rdpwsx.dll 2009-02-14 14:53:16 ----A---- C:\WINDOWS\system32\rdpsnd.dll 2009-02-14 14:53:16 ----A---- C:\WINDOWS\system32\rdpclip.exe 2009-02-14 14:53:16 ----A---- C:\WINDOWS\system32\qprocess.exe 2009-02-14 14:53:16 ----A---- C:\WINDOWS\system32\msdtcuiu.dll 2009-02-14 14:53:16 ----A---- C:\WINDOWS\system32\icaapi.dll 2009-02-14 14:53:16 ----A---- C:\WINDOWS\system32\cfgbkend.dll 2009-02-14 14:53:15 ----A---- C:\WINDOWS\system32\xolehlp.dll 2009-02-14 14:53:15 ----A---- C:\WINDOWS\system32\mtxoci.dll 2009-02-14 14:53:15 ----A---- C:\WINDOWS\system32\msdtctm.dll 2009-02-14 14:53:15 ----A---- C:\WINDOWS\system32\msdtcprx.dll 2009-02-14 14:53:14 ----A---- C:\WINDOWS\system32\msdtclog.dll 2009-02-14 14:53:14 ----A---- C:\WINDOWS\system32\msdtc.exe 2009-02-14 14:53:13 ----D---- C:\WINDOWS\system32\Com 2009-02-14 14:53:13 ----A---- C:\WINDOWS\system32\colbact.dll 2009-02-14 14:53:13 ----A---- C:\WINDOWS\system32\clbcatex.dll 2009-02-14 14:53:13 ----A---- C:\WINDOWS\system32\catsrvut.dll 2009-02-14 14:53:13 ----A---- C:\WINDOWS\system32\catsrvps.dll 2009-02-14 14:53:13 ----A---- C:\WINDOWS\system32\catsrv.dll 2009-02-14 14:53:12 ----A---- C:\WINDOWS\system32\comuid.dll 2009-02-14 14:53:12 ----A---- C:\WINDOWS\system32\comsvcs.dll 2009-02-14 14:53:11 ----A---- C:\WINDOWS\system32\clbcatq.dll 2009-02-14 14:53:05 ----A---- C:\WINDOWS\system32\servdeps.dll 2009-02-14 14:53:05 ----A---- C:\WINDOWS\system32\mmfutil.dll 2009-02-14 14:53:05 ----A---- C:\WINDOWS\system32\licwmi.dll 2009-02-14 14:53:05 ----A---- C:\WINDOWS\system32\cmprops.dll ======List of files/folders modified in the last 1 months====== 2009-02-17 00:28:59 ----A---- C:\WINDOWS\twunk_32.exe 2009-02-17 00:28:59 ----A---- C:\WINDOWS\system32\wupdmgr.exe 2009-02-17 00:28:57 ----A---- C:\WINDOWS\system32\winhlp32.exe 2009-02-17 00:28:55 ----A---- C:\WINDOWS\system32\syskey.exe 2009-02-17 00:28:55 ----A---- C:\WINDOWS\system32\syncapp.exe 2009-02-15 10:04:34 ----A---- C:\WINDOWS\system32\rundll32.exe 2009-02-15 10:04:28 ----A---- C:\WINDOWS\system32\ctfmon.exe 2009-02-14 22:19:49 ----A---- C:\WINDOWS\system32\wpabaln.exe 2009-02-14 15:37:58 ----A---- C:\WINDOWS\P17DEF.EXE 2009-02-14 15:37:58 ----A---- C:\WINDOWS\OALInst.exe 2009-02-14 15:35:41 ----A---- C:\WINDOWS\system32\msiexec.exe 2009-02-14 15:35:17 ----A---- C:\WINDOWS\system.ini 2009-02-14 15:25:27 ----A---- C:\WINDOWS\system32\wiaacmgr.exe 2009-02-14 15:25:26 ----A---- C:\WINDOWS\system32\wextract.exe 2009-02-14 15:25:24 ----A---- C:\WINDOWS\system32\utilman.exe 2009-02-14 15:25:21 ----A---- C:\WINDOWS\system32\taskmgr.exe 2009-02-14 15:25:20 ----A---- C:\WINDOWS\system32\sysocmgr.exe 2009-02-14 15:25:19 ----A---- C:\WINDOWS\system32\stimon.exe 2009-02-14 15:25:17 ----A---- C:\WINDOWS\system32\sigverif.exe 2009-02-14 15:25:16 ----A---- C:\WINDOWS\system32\shrpubw.exe 2009-02-14 15:25:15 ----A---- C:\WINDOWS\system32\setup.exe 2009-02-14 15:25:14 ----A---- C:\WINDOWS\system32\rtcshare.exe 2009-02-14 15:25:11 ----A---- C:\WINDOWS\system32\rcimlby.exe 2009-02-14 15:25:11 ----A---- C:\WINDOWS\system32\rasphone.exe 2009-02-14 15:25:10 ----A---- C:\WINDOWS\system32\proquota.exe 2009-02-14 15:25:10 ----A---- C:\WINDOWS\system32\progman.exe 2009-02-14 15:25:09 ----A---- C:\WINDOWS\system32\perfmon.exe 2009-02-14 15:25:09 ----A---- C:\WINDOWS\system32\packager.exe 2009-02-14 15:25:06 ----A---- C:\WINDOWS\system32\odbcad32.exe 2009-02-14 15:25:06 ----A---- C:\WINDOWS\system32\nwiz.exe 2009-02-14 15:25:05 ----A---- C:\WINDOWS\system32\nvdspsch.exe 2009-02-14 15:25:05 ----A---- C:\WINDOWS\system32\nvcplui.exe 2009-02-14 15:25:04 ----A---- C:\WINDOWS\system32\nvcolor.exe 2009-02-14 15:25:03 ----A---- C:\WINDOWS\system32\nvappbar.exe 2009-02-14 15:25:01 ----A---- C:\WINDOWS\system32\narrator.exe 2009-02-14 15:24:58 ----A---- C:\WINDOWS\system32\mshta.exe 2009-02-14 15:24:56 ----A---- C:\WINDOWS\system32\mobsync.exe 2009-02-14 15:24:55 ----A---- C:\WINDOWS\system32\magnify.exe 2009-02-14 15:24:54 ----A---- C:\WINDOWS\system32\keystone.exe 2009-02-14 15:24:54 ----A---- C:\WINDOWS\system32\iexpress.exe 2009-02-14 15:24:52 ----A---- C:\WINDOWS\system32\dxdiag.exe 2009-02-14 15:24:50 ----A---- C:\WINDOWS\system32\dpvsetup.exe 2009-02-14 15:24:49 ----A---- C:\WINDOWS\system32\ddeshare.exe 2009-02-14 15:24:49 ----A---- C:\WINDOWS\system32\conime.exe 2009-02-14 15:24:48 ----A---- C:\WINDOWS\system32\cmstp.exe 2009-02-14 15:24:48 ----A---- C:\WINDOWS\system32\cmmon32.exe 2009-02-14 15:24:48 ----A---- C:\WINDOWS\system32\cmdl32.exe 2009-02-14 15:24:48 ----A---- C:\WINDOWS\system32\clipsrv.exe 2009-02-14 15:24:47 ----A---- C:\WINDOWS\system32\cliconfg.exe 2009-02-14 15:24:47 ----A---- C:\WINDOWS\system32\ahui.exe 2009-02-14 15:24:16 ----A---- C:\WINDOWS\hh.exe 2009-02-14 15:11:31 ----A---- C:\WINDOWS\regedit.exe 2009-02-14 15:11:30 ----A---- C:\WINDOWS\system32\netsetup.exe 2009-02-14 15:07:49 ----A---- C:\WINDOWS\system32\migpwd.exe 2009-02-14 14:56:53 ----A---- C:\WINDOWS\win.ini ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 intelppm;Sterownik procesora Intel; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40448] R1 kbdhid;Sterownik klawiatury HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720] R3 cFosSpeed;cFosSpeed Miniport; C:\WINDOWS\system32\DRIVERS\cfosspeed.sys [2007-03-13 649432] R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\system32\DRIVERS\ctsfm2k.sys [2005-01-10 138752] R3 HDAudBus;Sterownik magistrali Microsoft UAA dla High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384] R3 hidusb;Sterownik Microsoft klasy HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-01-15 6301248] R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\DRIVERS\ctoss2k.sys [2005-01-10 106496] R3 P17;SB Live! 24-bit; C:\WINDOWS\system32\drivers\P17.sys [2007-06-15 1127936] R3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128] R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208] R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520] R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608] R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2006-11-22 250496] S3 catchme;catchme; \??\C:\ComboFix\catchme.sys [] S3 gdrv;gdrv; \??\C:\WINDOWS\gdrv.sys [] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 cFosSpeedS;cFosSpeed System Service; C:\Program Files\cFosSpeed\spd.exe [2007-03-13 302296] R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-01-15 163908] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240] -----------------EOF-----------------

**Posty:** 8001 · przez **Okocza** 17 Lut 2009, 12:39

Wklej w notatnik:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\CF16185.exe C:\WINDOWS\system32\CF13272.exe C:\WINDOWS\system32\CF12390.exe C:\WINDOWS\system32\CF12093.exe C:\WINDOWS\system32\CF31303.exe C:\WINDOWS\system32\CF29392.exe C:\Bug.txt C:\WINDOWS\system32\cmd.execf C:\WINDOWS\zip.exe C:\WINDOWS\VFIND.exe C:\WINDOWS\SWXCACLS.exe C:\WINDOWS\SWSC.exe C:\WINDOWS\SWREG.exe C:\WINDOWS\sed.exe C:\WINDOWS\NIRCMD.exe C:\WINDOWS\grep.exe C:\WINDOWS\fdsv.exe C:\WINDOWS\system32\CF27900.exe C:\WINDOWS\SET21.tmp C:\WINDOWS\SET8.tmp C:\WINDOWS\SET4.tmp C:\WINDOWS\SET3.tmp Folder:: C:\rsit C:\32788R22FWJFW C:\32788R22FWJFW.2.tmp C:\32788R22FWJFW.1.tmp C:\32788R22FWJFW.0.tmp C:\Qoobox C:\ComboFix

zapisz jako CFScript.txt i przeciągnij na combofix.exe

daj log jaki się wygeneruje

przeskanuj na http://www.virustotal.com

C:\WINDOWS\system32\_mspaint.exe

**Posty:** 3475 · przez **Dementor** 17 Lut 2009, 12:53

Okocza napisał(a):zapisz jako CFScript.txt i przeciągnij na combofix.exe

pisałem wyzej ze combofix mi sie nie odpala

wynik z http://www.virustotal.com

**Posty:** 8001 · przez **Okocza** 17 Lut 2009, 13:33

Dementor, usuń ten plik

Pobierz i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Kod: Zaznacz wszystko: Files to delete: C:\WINDOWS\system32\CF16185.exe C:\WINDOWS\system32\CF13272.exe C:\WINDOWS\system32\CF12390.exe C:\WINDOWS\system32\CF12093.exe C:\WINDOWS\system32\CF31303.exe C:\WINDOWS\system32\CF29392.exe C:\Bug.txt C:\WINDOWS\system32\cmd.execf C:\WINDOWS\zip.exe C:\WINDOWS\VFIND.exe C:\WINDOWS\SWXCACLS.exe C:\WINDOWS\SWSC.exe C:\WINDOWS\SWREG.exe C:\WINDOWS\sed.exe C:\WINDOWS\NIRCMD.exe C:\WINDOWS\grep.exe C:\WINDOWS\fdsv.exe C:\WINDOWS\system32\CF27900.exe C:\WINDOWS\SET21.tmp C:\WINDOWS\SET8.tmp C:\WINDOWS\SET4.tmp C:\WINDOWS\SET3.tmp Folders to delete: C:\rsit C:\32788R22FWJFW C:\32788R22FWJFW.2.tmp C:\32788R22FWJFW.1.tmp C:\32788R22FWJFW.0.tmp C:\Qoobox C:\ComboFix

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt

**Posty:** 3475 · przez **Dementor** 17 Lut 2009, 13:47

Nie moge tego wykonac z programem The Avenger

Error Invalid Script.A valid scipt must begin with a command directive.Aborting exucution

**Posty:** 8001 · przez **Okocza** 17 Lut 2009, 13:53

Dementor, http://www.instalki.pl/programy/download/narzedzia_dyskowe/OTMoveIt2.php pobierz to i wykonaj zalecenia z:

narzedzia-do-usuwania-plikow-vt96629.html co do otmove it

powinno pójść, jeśli nie, czeka Cię żmudna praca kasowania ręcznie...

**Posty:** 3475 · przez **Dementor** 17 Lut 2009, 14:28

no niby wykonane i co dalej??

**Posty:** 8001 · przez **Okocza** 17 Lut 2009, 14:35

Wykonaj to co jest podane w tym temacie

1. tym programem przejdź komputer)
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.
7. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

**Posty:** 3475 · przez **Dementor** 17 Lut 2009, 14:58

Okocza napisał(a):1. tym programem przejdź komputer)

wykonane

Okocza napisał(a):2. wykonaj optymalizację windowsa

wykonane

Okocza napisał(a):3.sciagnij ATF_Cleanerzaznacz Windows Temp All users TempTemporary internet filesRecycle Bini wcisnij EMPTY SELECTED

wykonane

Okocza napisał(a):4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

nie moge uruchomic własciwosci mojego komputera

Okocza napisał(a):6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd.

Okocza napisał(a):7. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

Nie moge zainstalowac javy by przejsc do skanowania online

**Posty:** 8001 · przez **Okocza** 17 Lut 2009, 15:01

Dementor napisał(a):nie moge uruchomic własciwosci mojego komputera

jaki błąd wyskakuje?

**Posty:** 3475 · przez **Dementor** 17 Lut 2009, 15:02

Nic nie wyskakuje zero reakcji

**Posty:** 8001 · przez **Okocza** 17 Lut 2009, 15:04

Dementor, okej, no to chyba będzie na tyle, jeszcze chodzi wolno czy już jest trochę lepiej?

Autor postu otrzymał pochwałę

**Posty:** 3475 · przez **Dementor** 17 Lut 2009, 15:07

Okocza napisał(a):jeszcze chodzi wolno czy już jest trochę lepiej

co do pracy sytemu to troche lepiej ale dalej nie moge otwierac plikow txt,doc

**Posty:** 8001 · przez **Okocza** 17 Lut 2009, 15:11

Dementor napisał(a):dalej nie moge otwierac plikow txt,doc

zgłoś się do Windowsa

**Posty:** 3475 · przez **Dementor** 17 Lut 2009, 20:27

Może ktos by pomogł cos z tym zrobic ze niemam normalnego podglądu w pliki doc,txt,rtf

**Posty:** 5637 · przez **kahoona** 17 Lut 2009, 20:58

A to, że pominąłeś troszkę syfku i trzeba zacząć zabawę od nowa. Przeskanuj te pliki:

Kod: Zaznacz wszystko: G:\Run.exe C:\WINDOWS\system32\_qttask.exe C:\WINDOWS\system32\_ctfmon.exe C:\totalcmd\_TOTALCMD.EXE

Skany jeszcze raz.