W jaki sposób mogę usunąć trojana? pomóżcie:(

**Posty:** 4 · przez **impressive19** 28 Paź 2008, 20:23

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 18:43:42, on 2008-10-28 Platform: Windows Vista (WinNT 6.00.1904) MSIE: Internet Explorer v7.00 (7.00.6000.16757) Boot mode: Normal Running processes: C:\Windows\system32\Dwm.exe C:\Windows\Explorer.EXE C:\Windows\system32\taskeng.exe C:\Windows\SMINST\scheduler.exe C:\Program Files\Windows Defender\MSASCui.exe C:\Windows\System32\hkcmd.exe C:\Windows\System32\igfxpers.exe C:\Program Files\Analog Devices\Core\smax4pnp.exe C:\Program Files\PDF Complete\pdfsty.exe C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\pthosttr.exe C:\Windows\system32\igfxsrvc.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe C:\Program Files\AVG\AVG8\avgtray.exe C:\Program Files\Winamp\winampa.exe C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\APVXDWIN.EXE C:\Program Files\Windows Sidebar\sidebar.exe C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe C:\Program Files\VoipCheapCom\VoipCheapCom.exe C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\WebProxy.exe C:\Program Files\Hp\HP Software Update\hpwuSchd2.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\Ares\Ares.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www2.iesearch.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=PL_PL&c=74&bd=smb&pf=laptop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=PL_PL&c=74&bd=smb&pf=laptop R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: Winamp Search Class - {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll O1 - Hosts: ::1 localhost O2 - BHO: Winamp Toolbar Loader - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O3 - Toolbar: Winamp Toolbar - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide O4 - HKLM\..\Run: [IgfxTray] C:\Windows\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\Windows\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\Windows\system32\igfxpers.exe O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe O4 - HKLM\..\Run: [PDF Complete] "C:\Program Files\PDF Complete\pdfsty.exe" O4 - HKLM\..\Run: [PTHOSTTR] C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE /Start O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe O4 - HKLM\..\Run: [HP Health Check Scheduler] c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe" O4 - HKLM\..\Run: [APVXDWIN] "C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\APVXDWIN.EXE" /s O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\RunOnce: [ST Recovery Launcher] %WINDIR%\SMINST\launcher.exe O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun O4 - HKCU\..\Run: [LightScribe Control Panel] C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe -hidden O4 - HKCU\..\Run: [Orb] "C:\Program Files\Winamp Remote\bin\OrbTray.exe" /background O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares.exe" -h O4 - HKCU\..\Run: [VoipCheapCom] "C:\Program Files\VoipCheapCom\VoipCheapCom.exe" -nosplash -minimized O4 - HKCU\..\Run: [batgpl] "C:\ProgramData\lies memo memo.spvki1" O4 - HKCU\..\Run: [fast city ping help] "C:\ProgramData\Dupe bike heck.l6acy3f" O4 - HKCU\..\RunOnce: [HPSoftwareUpdate] C:\Program Files\Hp\HP Software Update\HPWUCli.exe O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'USŁUGA SIECIOWA') O4 - Startup: Rejestracja .lnk = C:\Users\Aleksandra\AppData\Local\Temp\7zOE8CA.tmp\EAregister.exe O4 - Global Startup: BTTray.lnk = ? O4 - Global Startup: DVD Check.lnk = C:\Program Files\InterVideo\DVD Check\DVDCheck.exe O8 - Extra context menu item: &Winamp Search - C:\ProgramData\Winamp Toolbar\ieToolbar\resources\en-US\local\search.html O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Wyślij obraz do urządzenia &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm O8 - Extra context menu item: Wyślij stronę do urządzenia &Bluetooth... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_04\bin\ssv.dll O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm O13 - Gopher Prefix: O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O20 - Winlogon Notify: DeviceNP - C:\Windows\SYSTEM32\DeviceNP.dll O23 - Service: Andrea ADI Filters Service (AEADIFilters) - Andrea Electronics Corporation - C:\Windows\system32\AEADISRV.EXE O23 - Service: Agere Modem Call Progress Audio (AgereModemAudio) - Agere Systems - C:\Windows\system32\agrsmsvc.exe O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Com4Qlb - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4Qlb.exe O23 - Service: HP ProtectTools Device Locking / Auditing (FLCDLOCK) - Hewlett-Packard Ltd - C:\Windows\system32\flcdlock.exe O23 - Service: HP Health Check Service - Hewlett-Packard - c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: IviRegMgr - InterVideo - C:\Program Files\Common Files\InterVideo\RegMgr\iviRegMgr.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Panda Software Controller - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsCtrls.exe O23 - Service: Panda Function Service (PAVFNSVR) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PavFnSvr.exe O23 - Service: Panda Process Protection Service (PavPrSrv) - Panda Software - C:\Program Files\Common Files\Panda Software\PavShld\pavprsrv.exe O23 - Service: Panda anti-virus service (PAVSRV) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\pavsrvx86.exe O23 - Service: PDF Document Manager (pdfcDispatcher) - PDF Complete Inc - C:\Program Files\PDF Complete\pdfsvc.exe O23 - Service: Panda Host Service (PSHost) - Panda Software International - c:\program files\panda security\panda antivirus + firewall 2008\firewall\PSHOST.EXE O23 - Service: Panda IManager Service (PSIMSVC) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PsImSvc.exe O23 - Service: Panda PSK service (PskSvcRetail) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\PskSvc.exe O23 - Service: RoxMediaDB9 - Sonic Solutions - c:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe O23 - Service: stllssvr - MicroVision Development, Inc. - c:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: Panda TPSrv (TPSrv) - Panda Software International - C:\Program Files\Panda Security\Panda Antivirus + Firewall 2008\TPSrv.exe -- End of file - 10866 bytes

**Posty:** 7956 · przez **Magik** 28 Paź 2008, 20:34

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa

**Posty:** 4 · przez **impressive19** 28 Paź 2008, 21:16

Dzieki za pomoc, ale nie moge uruchomic tego SDFix'a - jest napisane, ze nie mam uprawnien...

**Posty:** 7956 · przez **Magik** 28 Paź 2008, 21:17

impressive19 napisał(a):Dzieki za pomoc, ale nie moge uruchomic tego SDFix'a - jest napisane, ze nie mam uprawnien...

to wrzuc na razie log z combofix'a//

**Posty:** 4 · przez **impressive19** 28 Paź 2008, 21:34

Kod: Zaznacz wszystko: ComboFix 08-10-28.01 - Aleksandra 2008-10-28 20:24:02.1 - NTFSx86 Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1250.1.1045.18.960 [GMT 1:00] Uruchomiony z: C:\Users\Aleksandra\Downloads\ComboFix.exe * Utworzono nowy punkt przywracania .

<br>
<br>
jest tylko cos takiego. Ja sie kompletnie na tym nie znam. Pierwszy log byl z programu - HijackThis

**Posty:** 7956 · przez **Magik** 28 Paź 2008, 21:46

impressive19 napisał(a):jest tylko cos takiego.

...............

http://forum.programosy.pl/jak-generujemy-logi-z-combofixa-oraz-dssa-vt95026.html

i wklej jeszcze raz

**Posty:** 4 · przez **impressive19** 28 Paź 2008, 22:19

Kod: Zaznacz wszystko: ComboFix 08-10-28.01 - Aleksandra 2008-10-28 20:55:57.2 - NTFSx86 Microsoft® Windows Vista™ Home Basic 6.0.6000.0.1250.1.1045.18.1065 [GMT 1:00] Uruchomiony z: C:\Users\Aleksandra\Downloads\ComboFix.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat C:\Windows\system32\x64 . ---- Previous Run ------- . F:\Autorun.inf ----- BITS: Możliwe zainfekowane strony ----- hxxp://ftp.hp.com . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-28 do 2008-10-28 ))))))))))))))))))))))))))))))) . 2008-10-28 18:40 . 2008-10-28 18:40 <DIR> d-------- C:\Program Files\Trend Micro 2008-10-26 13:56 . 2008-10-26 13:56 <DIR> d-------- C:\Users\All Users\sentinel 2008-10-26 13:56 . 2008-10-26 13:56 <DIR> d-------- C:\ProgramData\sentinel 2008-10-26 13:50 . 2008-10-26 13:50 <DIR> d-------- C:\Program Files\Panda Security 2008-10-26 13:36 . 2008-10-28 20:48 <DIR> d-------- C:\Program Files\Common Files\Panda Software 2008-10-26 13:07 . 2008-10-26 13:07 <DIR> d-------- C:\Users\All Users\long extra fast city 2008-10-26 13:07 . 2008-10-26 13:07 <DIR> d-------- C:\ProgramData\long extra fast city 2008-10-26 13:06 . 2008-10-26 13:07 <DIR> d-------- C:\Users\All Users\style dead 2008-10-26 13:06 . 2008-10-26 13:07 <DIR> d-------- C:\ProgramData\style dead 2008-10-26 13:06 . 2008-10-26 13:06 <DIR> d-------- C:\Program Files\GalaPlayer 2008-10-21 03:05 . 2008-10-21 03:05 4,237,911 --a------ C:\#1kopii zapasowej.2.fbw 2008-10-21 03:05 . 2008-10-21 03:05 2,961,448 --a------ C:\#1kopii zapasowej.1.exe 2008-10-20 21:18 . 2008-10-20 21:18 <DIR> d-------- C:\Windows\CheckSur 2008-10-20 20:15 . 2008-10-20 20:16 <DIR> d-------- C:\Program Files\DaemonTools_WhenUSave_Installer 2008-10-20 17:11 . 2008-10-28 18:23 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-10-20 17:02 . 2008-10-20 17:02 611,064 --a------ C:\Windows\System32\drivers\sptd.sys 2008-10-20 17:02 . 2008-10-20 17:02 140,392 --a------ C:\Windows\System32\drivers\sptddrv1.sys 2008-10-20 17:00 . 2008-10-20 17:00 <DIR> d-------- C:\Users\Aleksandra\AppData\Roaming\Sports Interactive 2008-10-20 16:50 . 2008-10-20 16:50 <DIR> d-------- C:\Program Files\Nowy folder 2008-10-20 16:43 . 2008-10-20 16:43 <DIR> d-------- C:\Users\Aleksandra\AppData\Roaming\Leadertech 2008-10-16 17:05 . 2008-10-17 16:58 <DIR> d-------- C:\Users\Aleksandra\AppData\Roaming\VoipCheapCom 2008-10-16 16:56 . 2008-10-16 16:56 <DIR> d-------- C:\Program Files\VoipCheapCom 2008-10-15 16:39 . 2008-09-18 03:03 2,027,520 --a------ C:\Windows\System32\win32k.sys 2008-10-15 16:39 . 2008-08-26 02:12 290,304 --a------ C:\Windows\System32\drivers\srv.sys 2008-10-11 20:59 . 2008-10-11 20:59 268,800 --a------ C:\Windows\System32\es.dll 2008-10-10 20:03 . 2008-10-10 20:03 <DIR> d-------- C:\Users\Aleksandra\AppData\Roaming\GanymedeNet 2008-10-10 13:31 . 2008-10-10 13:32 <DIR> d-------- C:\Program Files\Ares 2008-10-10 10:08 . 2008-10-10 10:08 361,984 --a------ C:\Windows\System32\IPSECSVC.DLL 2008-10-10 10:08 . 2008-10-10 10:08 272,896 --a------ C:\Windows\System32\polstore.dll 2008-10-10 10:08 . 2008-10-10 10:08 61,440 --a------ C:\Windows\System32\winipsec.dll 2008-10-10 10:08 . 2008-10-10 10:08 28,672 --a------ C:\Windows\System32\FwRemoteSvr.dll 2008-10-10 10:06 . 2008-10-10 10:06 4,247,552 --a------ C:\Windows\System32\GameUXLegacyGDFs.dll 2008-10-10 10:06 . 2008-10-10 10:06 1,686,528 --a------ C:\Windows\System32\gameux.dll 2008-10-10 10:06 . 2008-10-10 10:06 28,160 --a------ C:\Windows\System32\Apphlpdm.dll 2008-10-10 10:05 . 2008-10-10 10:05 704,000 --a------ C:\Windows\System32\PhotoScreensaver.scr 2008-10-10 10:03 . 2008-10-10 10:03 194,560 --a------ C:\Windows\System32\WebClnt.dll 2008-10-10 10:03 . 2008-10-10 10:03 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys 2008-10-10 10:00 . 2008-10-10 10:00 1,060,920 --a------ C:\Windows\System32\drivers\ntfs.sys 2008-10-10 10:00 . 2008-10-10 10:00 41,984 --a------ C:\Windows\System32\drivers\monitor.sys 2008-10-10 10:00 . 2008-10-10 10:00 2,048 --a------ C:\Windows\System32\tzres.dll 2008-10-10 09:59 . 2008-10-10 09:59 8,147,968 --a------ C:\Windows\System32\wmploc.DLL 2008-10-10 09:59 . 2008-10-10 09:59 356,864 --a------ C:\Windows\System32\MediaMetadataHandler.dll 2008-10-10 09:59 . 2008-10-10 09:59 303,616 --a------ C:\Windows\System32\wmpeffects.dll 2008-10-10 09:59 . 2008-10-10 09:59 7,680 --a------ C:\Windows\System32\spwmp.dll 2008-10-10 09:59 . 2008-10-10 09:59 4,096 --a------ C:\Windows\System32\msdxm.ocx 2008-10-10 09:59 . 2008-10-10 09:59 4,096 --a------ C:\Windows\System32\dxmasf.dll 2008-10-10 09:58 . 2008-10-10 09:58 211,000 --a------ C:\Windows\System32\drivers\volsnap.sys 2008-10-10 09:58 . 2008-10-10 09:58 154,624 --a------ C:\Windows\System32\drivers\nwifi.sys 2008-10-10 09:58 . 2008-10-10 09:58 109,624 --a------ C:\Windows\System32\drivers\ataport.sys 2008-10-10 09:58 . 2008-10-10 09:58 45,112 --a------ C:\Windows\System32\drivers\pciidex.sys 2008-10-10 09:58 . 2008-10-10 09:58 21,560 --a------ C:\Windows\System32\drivers\atapi.sys 2008-10-10 09:58 . 2008-10-10 09:58 15,928 --a------ C:\Windows\System32\drivers\pciide.sys 2008-10-10 09:56 . 2008-10-10 09:56 12,240,896 --a------ C:\Windows\System32\NlsLexicons0007.dll 2008-10-10 09:52 . 2008-10-10 09:52 1,585,664 --a------ C:\Windows\System32\setupapi.dll 2008-10-10 09:52 . 2008-10-10 09:52 220,160 --a------ C:\Windows\System32\drivers\bthport.sys 2008-10-10 09:52 . 2008-10-10 09:52 181,760 --a------ C:\Windows\System32\fsquirt.exe 2008-10-10 09:52 . 2008-10-10 09:52 29,184 --a------ C:\Windows\System32\drivers\BTHUSB.SYS 2008-10-10 09:52 . 2008-10-10 09:52 19,456 --a------ C:\Windows\System32\drivers\bthenum.sys 2008-10-10 09:50 . 2008-10-10 09:50 296,448 --a------ C:\Windows\System32\gdi32.dll 2008-10-10 09:50 . 2008-10-10 09:50 223,232 --a------ C:\Windows\System32\WMASF.DLL 2008-10-10 09:50 . 2008-10-10 09:50 9,728 --a------ C:\Windows\System32\LAPRXY.DLL 2008-10-10 09:50 . 2008-10-10 09:50 2,048 --a------ C:\Windows\System32\asferror.dll 2008-10-10 09:49 . 2008-10-10 09:49 113,664 --a------ C:\Windows\System32\drivers\rmcast.sys 2008-10-10 09:49 . 2008-10-10 09:49 14,848 --a------ C:\Windows\System32\wshrm.dll 2008-10-10 09:48 . 2008-10-10 09:48 1,327,104 --a------ C:\Windows\System32\quartz.dll 2008-10-10 09:48 . 2008-10-10 09:48 788,992 --a------ C:\Windows\System32\rpcrt4.dll 2008-10-10 09:48 . 2008-10-10 09:48 737,792 --a------ C:\Windows\System32\inetcomm.dll 2008-10-10 09:48 . 2008-10-10 09:48 130,048 --a------ C:\Windows\System32\drivers\srv2.sys 2008-10-10 09:48 . 2008-10-10 09:48 101,888 --a------ C:\Windows\System32\drivers\mrxsmb.sys 2008-10-10 09:48 . 2008-10-10 09:48 84,992 --a------ C:\Windows\System32\drivers\srvnet.sys 2008-10-10 09:48 . 2008-10-10 09:48 84,480 --a------ C:\Windows\System32\INETRES.dll 2008-10-10 09:48 . 2008-10-10 09:48 83,968 --a------ C:\Windows\System32\dnsrslvr.dll 2008-10-10 09:48 . 2008-10-10 09:48 58,368 --a------ C:\Windows\System32\drivers\mrxsmb20.sys 2008-10-10 09:48 . 2008-10-10 09:48 24,576 --a------ C:\Windows\System32\dnscacheugc.exe 2008-10-10 09:48 . 2008-10-10 09:48 11,776 --a------ C:\Windows\System32\sbunattend.exe 2008-10-10 09:47 . 2008-10-10 09:47 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-10-10 08:56 . 2008-10-10 08:56 1,712,984 --a------ C:\Windows\System32\wuaueng.dll 2008-10-10 08:56 . 2008-10-10 08:56 1,524,224 --a------ C:\Windows\System32\wucltux.dll 2008-10-10 08:56 . 2008-10-10 08:56 53,080 --a------ C:\Windows\System32\wuauclt.exe 2008-10-10 08:56 . 2008-10-10 08:56 43,352 --a------ C:\Windows\System32\wups2.dll 2008-10-10 08:55 . 2008-10-10 08:55 549,720 --a------ C:\Windows\System32\wuapi.dll 2008-10-10 08:55 . 2008-10-10 08:55 163,000 --a------ C:\Windows\System32\wuwebv.dll 2008-10-10 08:55 . 2008-10-10 08:55 80,896 --a------ C:\Windows\System32\wudriver.dll 2008-10-10 08:55 . 2008-10-10 08:55 33,624 --a------ C:\Windows\System32\wups.dll 2008-10-10 08:55 . 2008-10-10 08:55 31,232 --a------ C:\Windows\System32\wuapp.exe 2008-10-09 11:27 . 2008-10-09 11:27 <DIR> d-------- C:\Program Files\NAPI-PROJEKT 2008-10-09 11:27 . 2008-10-09 11:27 <DIR> d-------- C:\Program Files\ALLPlayer 2008-10-08 17:36 . 2008-10-08 17:36 <DIR> d-------- C:\Users\Aleksandra\AppData\Roaming\SampleView 2008-10-08 14:07 . 2008-10-08 14:07 <DIR> d-------- C:\Temp 2008-10-07 17:04 . 2008-10-07 17:04 <DIR> d-------- C:\Users\Aleksandra\AppData\Roaming\Gadu-Gadu 2008-10-07 17:03 . 2008-10-07 17:04 <DIR> d-------- C:\Users\Aleksandra\Gadu-Gadu 2008-10-07 17:03 . 2008-10-07 17:03 <DIR> d-------- C:\Program Files\Gadu-Gadu 2008-10-07 16:53 . 2008-10-07 16:53 <DIR> d-------- C:\Users\All Users\Winamp Toolbar 2008-10-07 16:53 . 2008-10-07 16:55 <DIR> d-------- C:\Users\All Users\OrbNetworks 2008-10-07 16:53 . 2008-10-07 16:53 <DIR> d-------- C:\ProgramData\Winamp Toolbar 2008-10-07 16:53 . 2008-10-07 16:55 <DIR> d-------- C:\ProgramData\OrbNetworks 2008-10-07 16:53 . 2008-10-07 16:53 <DIR> d-------- C:\Program Files\Winamp Toolbar 2008-10-07 16:53 . 2008-10-07 16:53 <DIR> d-------- C:\Program Files\Winamp Remote 2008-10-07 16:50 . 2008-10-09 10:05 <DIR> d-------- C:\Users\Aleksandra\AppData\Roaming\BearShare 2008-10-07 16:50 . 2008-10-07 16:50 <DIR> d-------- C:\Program Files\BearShare Applications 2008-10-07 16:50 . 2008-10-07 16:50 <DIR> d-------- C:\My Downloads 2008-10-07 16:50 . 2007-11-22 15:00 483,328 --a------ C:\Windows\System32\actskn45.ocx 2008-10-07 16:49 . 2008-10-07 16:57 <DIR> d-------- C:\Users\Aleksandra\AppData\Roaming\Winamp 2008-10-07 16:49 . 2008-10-07 16:53 <DIR> d-------- C:\Program Files\Winamp 2008-10-07 16:49 . 2007-03-08 00:51 129,784 --------- C:\Windows\System32\pxafs.dll 2008-10-07 14:40 . 2008-10-07 14:40 <DIR> d-------- C:\Users\Aleksandra\AppData\Roaming\InterVideo 2008-10-01 07:42 . 2008-10-01 07:43 <DIR> d-------- C:\Program Files\OpenOffice.org 2.4 2008-10-01 07:35 . 2008-10-01 07:35 <DIR> d-------- C:\Program Files\Foxit Software 2008-10-01 07:33 . 2008-10-01 07:33 <DIR> d-------- C:\Users\All Users\Real 2008-10-01 07:33 . 2008-10-01 07:33 <DIR> d-------- C:\Program Files\K-Lite Codec Pack 2008-10-01 07:32 . 2008-10-01 07:32 69,128 --a------ C:\Windows\System32\drivers\avgwfpx.sys 2008-10-01 07:32 . 2008-10-01 07:32 10,520 --a------ C:\Windows\System32\avgrsstx.dll 2008-10-01 07:31 . 2008-10-28 16:58 <DIR> d-------- C:\Windows\System32\drivers\Avg 2008-10-01 07:31 . 2008-10-01 07:31 <DIR> d-------- C:\Users\All Users\avg8 2008-10-01 07:31 . 2008-10-01 07:31 <DIR> d-------- C:\ProgramData\avg8 2008-10-01 07:31 . 2008-10-01 07:31 <DIR> d-------- C:\Program Files\AVG 2008-10-01 07:31 . 2008-10-07 18:11 97,928 --a------ C:\Windows\System32\drivers\avgldx86.sys 2008-10-01 07:29 . 2008-10-01 07:29 <DIR> d-------- C:\Program Files\7-Zip 2008-10-01 06:44 . 2008-10-01 06:44 16 --a------ C:\Windows\System32\coh.cache 2008-09-28 09:25 . 2008-09-28 09:25 418 --a------ C:\Windows\ODBC.INI 2008-09-28 09:25 . 2008-10-01 06:49 13 --a------ C:\Windows\vbaddin.ini 2008-09-28 09:23 . 2008-09-28 09:23 <DIR> d-------- C:\Program Files\Microsoft FrontPage 2008-09-28 09:21 . 2008-09-28 09:21 <DIR> d-------- C:\Users\Aleksandra\AppData\Roaming\Microsoft Web Folders . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-28 19:48 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-10-28 16:07 --------- d-----w C:\Program Files\Hp 2008-10-16 15:16 --------- d-----w C:\Program Files\Windows Mail 2008-10-10 09:15 174 --sha-w C:\Program Files\desktop.ini 2008-10-10 09:11 --------- d-----w C:\Program Files\Windows Sidebar 2008-10-10 09:06 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll 2008-10-10 09:06 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll 2008-10-10 09:06 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll 2008-10-10 09:06 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll 2008-10-10 09:06 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll 2008-10-10 09:04 28,344 ----a-w C:\Windows\system32\drivers\battc.sys 2008-10-10 09:04 258,232 ----a-w C:\Windows\system32\drivers\acpi.sys 2008-10-10 09:04 20,920 ----a-w C:\Windows\system32\drivers\compbatt.sys 2008-10-10 09:04 2,923,520 ----a-w C:\Windows\explorer.exe 2008-10-10 09:04 14,208 ----a-w C:\Windows\system32\drivers\CmBatt.sys 2008-10-10 09:04 11,264 ----a-w C:\Windows\system32\drivers\wmiacpi.sys 2008-10-10 08:57 806,400 ----a-w C:\Windows\system32\drivers\tcpip.sys 2008-10-10 08:57 217,144 ----a-w C:\Windows\system32\drivers\netio.sys 2008-10-10 08:51 54,784 ----a-w C:\Windows\system32\drivers\i8042prt.sys 2008-10-10 08:51 495,160 ----a-w C:\Windows\system32\drivers\Wdf01000.sys 2008-10-10 08:51 35,384 ----a-w C:\Windows\system32\drivers\WdfLdr.sys 2008-10-10 08:51 35,384 ----a-w C:\Windows\system32\drivers\kbdclass.sys 2008-10-10 08:51 34,360 ----a-w C:\Windows\system32\drivers\mouclass.sys 2008-10-10 08:51 19,968 ----a-w C:\Windows\system32\drivers\sermouse.sys 2008-10-10 08:51 15,872 ----a-w C:\Windows\system32\drivers\mouhid.sys 2008-10-10 08:51 15,872 ----a-w C:\Windows\system32\drivers\kbdhid.sys 2008-10-02 03:49 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll 2008-10-01 08:57 --------- d-----w C:\ProgramData\Sonic 2008-10-01 08:57 --------- d-----w C:\Program Files\Common Files\Sonic Shared 2008-10-01 06:42 --------- d-----w C:\Program Files\Java 2008-10-01 06:40 --------- d-----w C:\ProgramData\Microsoft Help 2008-10-01 06:40 --------- d-----w C:\Program Files\Microsoft.NET 2008-10-01 05:56 --------- d-----w C:\ProgramData\Symantec 2008-10-01 05:47 --------- d-----w C:\Program Files\Common Files\Symantec Shared 2008-09-26 14:54 --------- d-----w C:\Users\Aleksandra\AppData\Roaming\Hewlett-Packard 2008-09-26 14:54 --------- d-----w C:\ProgramData\Hewlett-Packard 2008-09-26 14:51 --------- d-----w C:\Program Files\WIDCOMM 2008-09-26 14:48 --------- d-----w C:\Program Files\Hewlett-Packard 2008-09-26 14:46 1,044,472 ----a-w C:\Windows\system32\drivers\BCMWL6.SYS 2008-09-26 14:46 --------- d-----w C:\Users\Aleksandra\AppData\Roaming\Hewlett Packard 2008-09-26 14:46 --------- d-----w C:\Program Files\Broadcom 2008-09-26 14:45 --------- d-----w C:\Program Files\Macrovision Corp 2008-09-26 14:45 --------- d-----w C:\Program Files\InterVideo 2008-09-26 14:43 0 --sha-r C:\Windows\system32\drivers\103C_HP_bNB_6720s_Y5336AN_0U_QCNU8122M7J_E452408-244_4A_I30D8_SHP_V83.0E_68MDU F.09_T080110_WV2-0_L415_M2039_J250_7Intel_86FD_91.73_#071212_N808610C4_(KE160ES#AKD)_XMOBILE_CN10_Z_2F.09_G80862A12;80862A13.MRK 2008-09-26 14:43 --------- d-----w C:\Users\Aleksandra\AppData\Roaming\InstallShield 2008-09-26 14:43 --------- d-----w C:\Program Files\Common Files\InterVideo 2008-09-26 14:43 --------- d-----w C:\Program Files\Common Files\InstallShield . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks] "{57BCA5FA-5DBB-45a2-B558-1755C3F6253B}"= "C:\Program Files\Winamp Toolbar\winamptb.dll" [2008-07-16 1266992] [HKEY_CLASSES_ROOT\clsid\{57bca5fa-5dbb-45a2-b558-1755c3f6253b}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch.1] [HKEY_CLASSES_ROOT\TypeLib\{538CD77C-BFDD-49b0-9562-77419CAB89D1}] [HKEY_CLASSES_ROOT\WINAMPTB.AOLTBSearch] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "batgpl"="C:\ProgramData\lies memo memo.spvki1" [X] "fast city ping help"="C:\ProgramData\Dupe bike heck.l6acy3f" [X] "Sidebar"="C:\Program Files\Windows Sidebar\sidebar.exe" [2008-10-10 1232896] "LightScribe Control Panel"="C:\Program Files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-04-19 484904] "Orb"="C:\Program Files\Winamp Remote\bin\OrbTray.exe" [2008-04-01 507904] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2008-03-20 2127296] "ares"="C:\Program Files\Ares\Ares.exe" [2008-08-21 888832] "VoipCheapCom"="C:\Program Files\VoipCheapCom\VoipCheapCom.exe" [2008-09-08 9218872] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="C:\Windows\system32\igfxtray.exe" [2007-09-24 141848] "HotKeysCmds"="C:\Windows\system32\hkcmd.exe" [2007-09-24 154136] "Persistence"="C:\Windows\system32\igfxpers.exe" [2007-09-24 129560] "SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2007-02-21 1183744] "PDF Complete"="C:\Program Files\PDF Complete\pdfsty.exe" [2007-05-08 331552] "PTHOSTTR"="C:\Program Files\Hewlett-Packard\HP ProtectTools Security Manager\PTHOSTTR.EXE" [2007-01-09 145184] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2007-06-07 833072] "hpWirelessAssistant"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe" [2007-05-11 472632] "WAWifiMessage"="C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe" [2007-01-10 317128] "HP Health Check Scheduler"="c:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe" [2007-06-05 71176] "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 144784] "QlbCtrl"="C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2007-11-06 177456] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-10-07 1234712] "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-08-04 36352] "HP Software Update"="C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce] "ST Recovery Launcher"="C:\Windows\SMINST\launcher.exe" [2007-06-06 44168] C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe [2007-03-29 719664] DVD Check.lnk - C:\Program Files\InterVideo\DVD Check\DVDCheck.exe [2008-09-26 192512] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\DeviceNP] 2007-06-08 09:04 49152 C:\Windows\System32\DeviceNP.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.l3fhg"= mp3fhg.acm "msacm.divxa32"= divxa32.acm "VIDC.X264"= x264vfw.dll "VIDC.HFYU"= huffyuv.dll "vidc.i263"= i263_32.drv [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys] @="Driver" [HKEY_LOCAL_MACHINE\software\microsoft\security center] "UacDisableNotify"=dword:00000001 "InternetSettingsDisableNotify"=dword:00000001 "AutoUpdateDisableNotify"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus] "DisableMonitoring"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules] "{0054BF4C-47D9-4DDC-96E9-CAE4A32C8AB4}"= C:\Program Files\AVG\AVG8\avgemc.exe:avgemc.exe "{E39A6D64-770A-42D4-92CD-CA88B6CE7D0E}"= C:\Program Files\AVG\AVG8\avgupd.exe:avgupd.exe "{CFDEC593-06C1-4222-8D1F-CF0454E35A87}"= UDP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb "{4D4DF9B1-2326-44B1-92B9-68592A4626DA}"= TCP:C:\Program Files\Winamp Remote\bin\Orb.exe:Orb "{AB46A911-4CFD-4690-8E93-411094E38F51}"= UDP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray "{28990774-FEEE-4A38-9BC2-730860C1548D}"= TCP:C:\Program Files\Winamp Remote\bin\OrbTray.exe:OrbTray "{CA4C8089-4DA5-4827-A1DD-2E053F98891B}"= UDP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client "{9BCE6A21-2FFD-4B81-AB63-E32434132FBF}"= TCP:C:\Program Files\Winamp Remote\bin\OrbStreamerClient.exe:Orb Stream Client "TCP Query User{0117C436-9C3F-44DC-99BC-2ACBD7A482FC}C:\\program files\\bearshare applications\\bearshare\\bearshare.exe"= UDP:C:\program files\bearshare applications\bearshare\bearshare.exe:BearShare "UDP Query User{1C6E4B28-3845-4000-B41A-90F1014EED75}C:\\program files\\bearshare applications\\bearshare\\bearshare.exe"= TCP:C:\program files\bearshare applications\bearshare\bearshare.exe:BearShare "TCP Query User{0DDE4A44-74F3-466B-9540-4A6A086AFB65}C:\\program files\\ares\\ares.exe"= UDP:C:\program files\ares\ares.exe:Ares p2p for windows "UDP Query User{8F60C8C1-0852-4246-BDF1-72808F6D841D}C:\\program files\\ares\\ares.exe"= TCP:C:\program files\ares\ares.exe:Ares p2p for windows "TCP Query User{36C7112B-0D6A-4D38-8B7E-199030CD4AF2}C:\\program files\\internet explorer\\iexplore.exe"= UDP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "UDP Query User{4CD1C0C8-7DB3-4E10-84AE-6A9F2C64306C}C:\\program files\\internet explorer\\iexplore.exe"= TCP:C:\program files\internet explorer\iexplore.exe:Internet Explorer "TCP Query User{7F59444E-9817-4713-B41C-00BA0640B4A8}C:\\program files\\mozilla firefox\\firefox.exe"= UDP:C:\program files\mozilla firefox\firefox.exe:Firefox "UDP Query User{C1C5CFC3-A5AC-484B-8230-52329E4D876B}C:\\program files\\mozilla firefox\\firefox.exe"= TCP:C:\program files\mozilla firefox\firefox.exe:Firefox "TCP Query User{31E01CE7-1FAC-4EAF-8023-79B57320EDAA}C:\\program files\\voipcheapcom\\voipcheapcom.exe"= UDP:C:\program files\voipcheapcom\voipcheapcom.exe:Client to make VoIP calls. "UDP Query User{5A611937-3DE3-4C27-A20D-E6E68549B538}C:\\program files\\voipcheapcom\\voipcheapcom.exe"= TCP:C:\program files\voipcheapcom\voipcheapcom.exe:Client to make VoIP calls. [HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System] "DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic| R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\Windows\system32\Drivers\avgldx86.sys [2008-10-07 97928] R2 AEADIFilters;Andrea ADI Filters Service;C:\Windows\system32\AEADISRV.EXE [2007-02-06 69632] R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-10-07 875288] R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-10-07 231704] R2 MSSQL$MSSMLBIZ;SQL Server (MSSMLBIZ);c:\Program Files\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2006-04-14 28933976] R2 pdfcDispatcher;PDF Document Manager;C:\Program Files\PDF Complete\pdfsvc.exe [2007-05-08 540448] R3 AvgWfpX;AVG Free8 Firewall Driver x86;C:\Windows\system32\Drivers\avgwfpx.sys [2008-10-01 69128] R3 btwaudio;Urz1dzenie dYwiekowe Bluetooth;C:\Windows\system32\drivers\btwaudio.sys [2007-05-11 79664] R3 btwavdt;Bluetooth AVDT;C:\Windows\system32\drivers\btwavdt.sys [2007-05-11 81200] R3 btwrchid;btwrchid;C:\Windows\system32\DRIVERS\btwrchid.sys [2007-05-11 16432] S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;C:\Windows\system32\DRIVERS\b57nd60x.sys [2006-11-02 167936] S3 DAMDrv;DAMDrv;C:\Windows\system32\DRIVERS\DAMDrv.sys [2007-06-08 30008] S3 FLCDLOCK;HP ProtectTools Device Locking / Auditing;C:\Windows\system32\flcdlock.exe [2007-06-08 172131] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] LocalServiceNoNetwork REG_MULTI_SZ PLA DPS BFE mpssvc bthsvcs REG_MULTI_SZ BthServ [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8663650a-9ac2-11dd-948c-001e37beb9b9}] \shell\AutoRun\command - kn6jhgc.cmd \shell\explore\Command - kn6jhgc.cmd \shell\open\Command - kn6jhgc.cmd [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "C:\Program Files\Common Files\LightScribe\LSRunOnce.exe" . Zawartość folderu 'Zaplanowane zadania' 2008-10-28 C:\Windows\Tasks\User_Feed_Synchronization-{A5505D74-F1C8-4BDD-BCB9-2BD67DB9D042}.job - C:\Windows\system32\msfeedssync.exe [2006-11-02 10:45] . . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Users\Aleksandra\AppData\Roaming\Mozilla\Firefox\Profiles\ol8n2hlo.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - google.pl FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF -: plugin - C:\Program Files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPCARDS.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-28 21:11:18 Windows 6.0.6000 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-10-28 21:14:38 ComboFix-quarantined-files.txt 2008-10-28 20:14:33 Przed: 180,527,374,336 bajtów wolnych Po: 179,147,247,616 bajtów wolnych 327 --- E O F --- 2008-10-25 01:00:49

Twoja odpowiedz na tą wiadomosc odczytam jutro, bo dzisiaj musze juz leciec..naprawde dziekuje Ci za pomoc, bardzo mi zalezy zeby sie pozbyc tego smiecia...

**Posty:** 7956 · przez **Magik** 28 Paź 2008, 22:35

jesli korzystasz z pendrive skanujesz go

http://www.programosy.pl/program,flash-desinfector.html

partycje komputera tez......

znasz te pliki??

Kod: Zaznacz wszystko: C:\#1kopii zapasowej.2.fbw C:\#1kopii zapasowej.1.exe

jesli nie pzreskanuj na virustotal.com i wklej raport

wklej do notatnika

Kod: Zaznacz wszystko: Windows Registry Editor Version 5.00 [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8663650a-9ac2-11dd-948c-001e37beb9b9}]

zapisz jako fix.reg i odpal

wklej do notatnika

Kod: Zaznacz wszystko: FILE:: C:\Program Files\desktop.ini

Plik -> zapisz jako -> CFScript.txt (najwygodniej będzie, jeśli zapiszesz w takiej lokalizacji, by ikonka CFScript.txt znalazła się obok ikonki ComboFix.exe)
Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe
przeskanuj komputer
http://www.kaspersky.com/virusscanner

i sprobuj odpalic sdfix w trybie normalnym, opis w linku ponizej

http://cybertrash.pl/images/tata/SDFix.html