Zablokowany menadzer zadań i edytor rejestru

**Posty:** 794 · przez **jackman** 04 Lut 2009, 23:32

Siema
a więc tak jak w temacie mam zablokowany menadżer zadań i edytor rejestru, po probie otwarcia któregoś z nich wyskakuje komunikat ze zostały zablokowane przez administratora, ale nim jestem ja. Ostatnio robiłem format ale to nic nie dało

log z combofixa:

Kod: Zaznacz wszystko: ComboFix 09-02-04.01 - Mateusz 2009-02-04 22:19:02.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.768.468 [GMT 1:00] Uruchomiony z: c:\documents and settings\Mateusz\Pulpit\ComboFix.exe AV: Avira AntiVir PersonalEdition *On-access scanning enabled* (Updated) . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . ---- Poprzednie uruchomienie ------- . c:\windows\system32\setup.ini . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_asc3360pr -------\Legacy_ASC3360PR ((((((((((((((((((((((((( Pliki utworzone od 2009-01-04 do 2009-02-04 ))))))))))))))))))))))))))))))) . 2009-02-04 19:15 . 2009-02-04 19:15 <DIR> d-------- c:\program files\xp-AntiSpy 2009-02-04 19:03 . 2009-02-04 19:05 <DIR> d-------- c:\program files\uTorrent 2009-02-04 19:03 . 2009-02-04 19:05 <DIR> d-------- c:\documents and settings\Mateusz\Dane aplikacji\uTorrent . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-04 18:15 361,600 ----a-w c:\windows\system32\drivers\tcpip.sys 2009-02-04 17:56 --------- d-----w c:\program files\Mozilla Thunderbird 2009-02-04 17:56 --------- d-----w c:\documents and settings\Mateusz\Dane aplikacji\Thunderbird 2009-02-04 17:53 --------- d-----w c:\documents and settings\Mateusz\Dane aplikacji\Nowe Gadu-Gadu 2009-02-04 17:53 --------- d-----w c:\documents and settings\Mateusz\Dane aplikacji\AIMP 2009-02-04 17:47 --------- d-----w c:\program files\Last.fm 2009-02-04 17:46 --------- d-----w c:\program files\SubEdit-Player 2009-02-04 17:46 --------- d-----w c:\program files\AIMP2 2009-02-04 17:45 --------- d-----w c:\program files\K-Lite Codec Pack 2009-02-04 17:40 410,984 ----a-w c:\windows\system32\deploytk.dll 2009-02-04 17:40 --------- d-----w c:\program files\Java 2009-02-04 17:37 --------- d-----w c:\program files\Nowe Gadu-Gadu 2009-02-04 17:36 --------- d-----w c:\program files\Avira 2009-02-04 17:36 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Avira 2009-02-04 17:21 --------- d-----w c:\program files\ZTE ZXDSL 852 2009-02-04 17:19 --------- d-----w c:\program files\Orange 2009-02-04 17:17 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-04 17:17 --------- d-----w c:\program files\Common Files\InstallShield 2009-02-04 16:27 --------- d-----w c:\program files\microsoft frontpage 2009-02-04 16:25 --------- d-----w c:\program files\Usługi online 2009-02-04 16:22 --------- d-----w c:\program files\Windows Media Connect 2 2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys 2008-12-11 00:33 86,016 ----a-w c:\windows\system32\dpl100.dll 2008-12-08 11:53 57,344 ----a-w c:\windows\system32\ff_vfw.dll 2008-12-07 18:08 795,648 ----a-w c:\windows\system32\xvidcore.dll 2008-12-07 18:08 130,048 ----a-w c:\windows\system32\xvidvfw.dll 2008-11-06 16:37 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll 2008-11-06 16:33 684,032 ----a-w c:\windows\system32\divx.dll . ------- Sigcheck ------- 2008-06-20 12:59 361600 ad978a1b783b5719720cff204b666c8e c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys 2008-05-08 19:02 361344 accf5a9a1ffaa490f33dba1c632b95e1 c:\windows\$NtUninstallKB951748$\tcpip.sys 2008-06-20 12:51 361600 9aefa14bd6b182d61e3119fa5f436d3d c:\windows\SoftwareDistribution\Download\5cb56d26ae277f6fc62b86faa15488d1\sp3gdr\tcpip.sys 2008-06-20 12:59 361600 ad978a1b783b5719720cff204b666c8e c:\windows\SoftwareDistribution\Download\5cb56d26ae277f6fc62b86faa15488d1\sp3qfe\tcpip.sys 2009-02-04 19:15 361600 05f3441246bfedc2a5b12cf827012f7f c:\windows\system32\dllcache\tcpip.sys 2009-02-04 19:15 361600 05f3441246bfedc2a5b12cf827012f7f c:\windows\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((( snapshot@2009-02-04_21.58.47.40 ))))))))))))))))))))))))))))))))))))))))) . - 2004-01-09 01:54:06 65,536 ----a-w c:\windows\SOUNDMAN.EXE + 2004-01-09 01:54:06 139,264 ----a-w c:\windows\SOUNDMAN.EXE + 2009-02-04 21:22:41 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_684.dat + 2009-02-04 21:23:20 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_998.dat . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Nowe Gadu-Gadu"="c:\program files\Nowe Gadu-Gadu\gg.exe" [2008-12-22 8966760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "OrangeDeamon"="c:\program files\Orange\Orange.exe" [2008-05-16 20336640] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 340225] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-04 136600] "SoundMan"="SOUNDMAN.EXE" [2004-01-09 c:\windows\SOUNDMAN.EXE] "AdslTaskBar"="stmctrl.dll" [2008-04-23 c:\windows\system32\stmctrl.dll] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"= 1 (0x1) "DisableRegistryTools"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"= "c:\\Program Files\\Avira\\AntiVir PersonalEdition Classic\\avgnt.exe"= "c:\\Program Files\\Orange\\Orange.exe"= "c:\\WINDOWS\\SOUNDMAN.EXE"= R3 Stmatm;ATM/ADSL miniport;c:\windows\system32\drivers\stmatm.sys [2009-02-04 60255] R3 TaurusUsb;ADSL Modem USB Service;c:\windows\system32\drivers\torususb.sys [2009-02-04 683791] S3 asc3360pr;asc3360pr;\??\c:\windows\system32\drivers\ptnhtn.sys --> c:\windows\system32\drivers\ptnhtn.sys [?] . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ TCP: {787A3E6E-C353-49F7-8B8F-2E06C9EE4974} = 79.163.127.70 217.116.100.65 FF - ProfilePath - c:\documents and settings\Mateusz\Dane aplikacji\Mozilla\Firefox\Profiles\5s5yy90w.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/ FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-04 22:23:32 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe c:\program files\Avira\AntiVir PersonalEdition Classic\avguard.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\wscntfy.exe c:\program files\Mozilla Firefox\firefox.exe c:\docume~1\Mateusz\USTAWI~1\Temp\gbeoll.exe c:\docume~1\Mateusz\USTAWI~1\Temp\xcmyo.exe . ************************************************************************** . Czas ukończenia: 2009-02-04 22:26:18 - komputer został uruchomiony ponownie [Mateusz] Przed: 3,592,675,328 bajtów wolnych Po: 3,580,125,184 bajtów wolnych WindowsXP-KB310994-SP2-Pro-BootDisk-PLK.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect 150 --- E O F --- 2009-02-04 17:47:56

i log z HiJackThis:

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:27:33, on 2009-02-04 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Orange\Orange.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Nowe Gadu-Gadu\gg.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\DOCUME~1\Mateusz\USTAWI~1\Temp\gbeoll.exe C:\DOCUME~1\Mateusz\USTAWI~1\Temp\xcmyo.exe C:\WINDOWS\explorer.exe C:\WINDOWS\system32\notepad.exe C:\DOCUME~1\Mateusz\USTAWI~1\Temp\winrvcg.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [OrangeDeamon] C:\Program Files\Orange\Orange.exe O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Nowe Gadu-Gadu] "C:\Program Files\Nowe Gadu-Gadu\gg.exe" O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{787A3E6E-C353-49F7-8B8F-2E06C9EE4974}: NameServer = 79.163.127.70 217.116.100.65 O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe -- End of file - 4345 bytes

**Posty:** 18165 · przez **wojtas** 04 Lut 2009, 23:38

Otworz notatnik i wklej w nim to:

File::
C:\DOCUME~1\Mateusz\USTAWI~1\Temp\gbeoll.exe
C:\DOCUME~1\Mateusz\USTAWI~1\Temp\xcmyo.exe

Folder::
c:\docume~1\Mateusz\USTAWI~1\Temp

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

potem wklej do notatnika:

; (C) Copyright 2004
; by Piotr Palusiński

[version]
signature="$CHICAGO$"

[DefaultInstall]
DelReg = Del_DisableRegistryTools.Reg

[Del_DisableRegistryTools.Reg]
HKCU,%Location%,DisableRegistryTools
HKCU,%Location%,DisableRegedit
HKLM,%Location%,DisableRegistryTools
HKLM,%Location%,DisableRegedit

[Strings]
Location="SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"

zapisz jako > Zmien rozszerzenie z TXT na Wszystkie pliki i zapisz pod nazwa odblokowanie.inf i daj prawym i zainstaluj. potem reset kompa

potem wklej :

Wyłączony edytor rejestru

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"DisableRegistryTools"=–
"DisableRegedit"=–

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"DisableRegistryTools"=–
"DisableRegedit"=–

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> Uruchom plik FIX.REG

potem:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\LocalUser\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"DisableTaskMgr"=dword:00000000
"**del.DisableTaskMgr"=" "

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"DisableTaskMgr"=dword:00000000

Plik >>> Zapisz jako >>> Zmień rozszerzenie z TXT na Wszystkie pliki >>> Zapisz pod nazwą FIX.REG >>> Uruchom plik FIX.REG

**Posty:** 794 · przez **jackman** 04 Lut 2009, 23:54

po każdym użyciu combofixa, usuwa mi go z dysku i muszę pobrać go jeszcze raz. A jak miałem przeciągnąć ten plik na niego to później jak miał log się pokazać to wyskoczył komunikat, ze system Windows nie odnalazł jakiegoś modułu i loga nie było. To chyba coś nie tak?

Dodano 05.02.2009 00:31:37:
sprobowalem jeszcze raz i znowu nie mam loga, jednak po dzialaniu combofixa menadzer zadan jest, dodaje fixy ro rejestru ale jak restartuje kompa to od nowa ten sam problem
pomocy

Dodano 05.02.2009 01:05:42:
wylaczylem przywracanie systemu i otrzymalem po pierwszym kroku ktory opisales taki log:

Kod: Zaznacz wszystko: ComboFix 09-02-04.01 - Mateusz 2009-02-04 23:59:05.5 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.768.561 [GMT 1:00] Uruchomiony z: c:\documents and settings\Mateusz\Pulpit\ComboFix.exe Użyto następujących komend :: c:\documents and settings\Mateusz\Pulpit\CFScript.txt AV: Avira AntiVir PersonalEdition *On-access scanning disabled* (Updated) * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_ASC3360PR -------\Service_asc3360pr ((((((((((((((((((((((((( Pliki utworzone od 2009-01-04 do 2009-02-04 ))))))))))))))))))))))))))))))) . 2009-02-05 00:02 . 2009-02-05 00:02 5,509 --a------ c:\windows\system32\drivers\ptnhtn.sys 2009-02-04 23:13 . 2009-02-04 23:13 16,384 --a------ c:\windows\~DFCD8D.tmp 2009-02-04 22:48 . 2009-02-04 22:48 16,384 --a------ c:\windows\~DFE4B6.tmp 2009-02-04 22:27 . 2009-02-04 22:27 <DIR> d-------- c:\program files\Trend Micro 2009-02-04 19:15 . 2009-02-04 19:15 <DIR> d-------- c:\program files\xp-AntiSpy 2009-02-04 19:03 . 2009-02-04 19:05 <DIR> d-------- c:\program files\uTorrent 2009-02-04 19:03 . 2009-02-04 19:05 <DIR> d-------- c:\documents and settings\Mateusz\Dane aplikacji\uTorrent . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-02-04 18:15 361,600 ----a-w c:\windows\system32\drivers\tcpip.sys 2009-02-04 17:56 --------- d-----w c:\program files\Mozilla Thunderbird 2009-02-04 17:56 --------- d-----w c:\documents and settings\Mateusz\Dane aplikacji\Thunderbird 2009-02-04 17:53 --------- d-----w c:\documents and settings\Mateusz\Dane aplikacji\Nowe Gadu-Gadu 2009-02-04 17:53 --------- d-----w c:\documents and settings\Mateusz\Dane aplikacji\AIMP 2009-02-04 17:47 --------- d-----w c:\program files\Last.fm 2009-02-04 17:46 --------- d-----w c:\program files\SubEdit-Player 2009-02-04 17:46 --------- d-----w c:\program files\AIMP2 2009-02-04 17:45 --------- d-----w c:\program files\K-Lite Codec Pack 2009-02-04 17:40 410,984 ----a-w c:\windows\system32\deploytk.dll 2009-02-04 17:40 --------- d-----w c:\program files\Java 2009-02-04 17:37 --------- d-----w c:\program files\Nowe Gadu-Gadu 2009-02-04 17:36 --------- d-----w c:\program files\Avira 2009-02-04 17:36 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Avira 2009-02-04 17:21 --------- d-----w c:\program files\ZTE ZXDSL 852 2009-02-04 17:19 --------- d-----w c:\program files\Orange 2009-02-04 17:17 --------- d--h--w c:\program files\InstallShield Installation Information 2009-02-04 17:17 --------- d-----w c:\program files\Common Files\InstallShield 2009-02-04 16:27 --------- d-----w c:\program files\microsoft frontpage 2009-02-04 16:25 --------- d-----w c:\program files\Usługi online 2009-02-04 16:22 --------- d-----w c:\program files\Windows Media Connect 2 2008-12-11 10:57 333,952 ----a-w c:\windows\system32\drivers\srv.sys 2008-12-11 00:33 86,016 ----a-w c:\windows\system32\dpl100.dll 2008-12-08 11:53 57,344 ----a-w c:\windows\system32\ff_vfw.dll 2008-12-07 18:08 795,648 ----a-w c:\windows\system32\xvidcore.dll 2008-12-07 18:08 130,048 ----a-w c:\windows\system32\xvidvfw.dll 2008-11-06 16:37 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll 2008-11-06 16:33 684,032 ----a-w c:\windows\system32\divx.dll . ------- Sigcheck ------- 2008-06-20 12:59 361600 ad978a1b783b5719720cff204b666c8e c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys 2008-05-08 19:02 361344 accf5a9a1ffaa490f33dba1c632b95e1 c:\windows\$NtUninstallKB951748$\tcpip.sys 2008-06-20 12:51 361600 9aefa14bd6b182d61e3119fa5f436d3d c:\windows\SoftwareDistribution\Download\5cb56d26ae277f6fc62b86faa15488d1\sp3gdr\tcpip.sys 2008-06-20 12:59 361600 ad978a1b783b5719720cff204b666c8e c:\windows\SoftwareDistribution\Download\5cb56d26ae277f6fc62b86faa15488d1\sp3qfe\tcpip.sys 2009-02-04 19:15 361600 05f3441246bfedc2a5b12cf827012f7f c:\windows\system32\dllcache\tcpip.sys 2009-02-04 19:15 361600 05f3441246bfedc2a5b12cf827012f7f c:\windows\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Nowe Gadu-Gadu"="c:\program files\Nowe Gadu-Gadu\gg.exe" [2008-12-22 9040488] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "OrangeDeamon"="c:\program files\Orange\Orange.exe" [2008-05-16 20336640] "avgnt"="c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-06-12 336129] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-02-04 136600] "SoundMan"="SOUNDMAN.EXE" [2004-01-09 c:\windows\SOUNDMAN.EXE] "AdslTaskBar"="stmctrl.dll" [2008-04-23 c:\windows\system32\stmctrl.dll] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce] "nltide_2"="shell32" [X] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "EnableLUA"= 0 (0x0) [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableTaskMgr"= 1 (0x1) "DisableRegistryTools"= 1 (0x1) [HKEY_LOCAL_MACHINE\software\microsoft\security center] "AntiVirusDisableNotify"=dword:00000001 "UpdatesDisableNotify"=dword:00000001 "AntiVirusOverride"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Java\\jre6\\launch4j-tmp\\JDownloader.exe"= "c:\\Program Files\\Avira\\AntiVir PersonalEdition Classic\\avgnt.exe"= "c:\\Program Files\\Orange\\Orange.exe"= "c:\\WINDOWS\\SOUNDMAN.EXE"= "c:\\Program Files\\Avira\\AntiVir PersonalEdition Classic\\avcenter.exe"= "c:\\Program Files\\Avira\\AntiVir PersonalEdition Classic\\avwsc.exe"= R3 Stmatm;ATM/ADSL miniport;c:\windows\system32\drivers\stmatm.sys [2009-02-04 60255] R3 TaurusUsb;ADSL Modem USB Service;c:\windows\system32\drivers\torususb.sys [2009-02-04 683791] --- Inne Usługi/Sterowniki w Pamięci --- *NewlyCreated* - ASC3360PR . . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.google.pl/ TCP: {787A3E6E-C353-49F7-8B8F-2E06C9EE4974} = 79.163.127.70 217.116.100.65 FF - ProfilePath - c:\documents and settings\Mateusz\Dane aplikacji\Mozilla\Firefox\Profiles\5s5yy90w.default\ FF - prefs.js: browser.startup.homepage - hxxp://www.google.pl/ FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-02-05 00:02:22 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . c:\program files\Avira\AntiVir PersonalEdition Classic\sched.exe c:\program files\Java\jre6\bin\jqs.exe c:\windows\system32\wscntfy.exe . ************************************************************************** . Czas ukończenia: 2009-02-05 0:04:10 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2009-02-04 23:04:06 Przed: 3 947 757 568 bajtów wolnych Po: 3,875,987,456 bajtów wolnych 141 --- E O F --- 2009-02-04 17:47:56

**Posty:** 18165 · przez **wojtas** 05 Lut 2009, 20:54

skasuj:

c:\windows\~DFCD8D.tmp
c:\windows\~DFE4B6.tmp

sprobuj wykonac te zadania z rejestrem..

**Posty:** 794 · przez **jackman** 05 Lut 2009, 21:18

dalej nic, nie mogę się pozbyć tego:

Kod: Zaznacz wszystko: O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

**Posty:** 18165 · przez **wojtas** 05 Lut 2009, 21:21

a w awaryjnym ??

**Posty:** 794 · przez **jackman** 05 Lut 2009, 21:28

nie mogę uruchomić kompa w awaryjnym, zaraz po wybraniu trybu awaryjnego restartuje się

**Posty:** 18165 · przez **wojtas** 05 Lut 2009, 21:40

poczytaj to

**Posty:** 794 · przez **jackman** 05 Lut 2009, 21:58

nic z tego, nawet jak odblokuje to po chwili wszystko wraca do złego stanu

**Posty:** 18165 · przez **wojtas** 05 Lut 2009, 22:16

Wykonaj skan Dr. Web CureIt
6. Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 794 · przez **jackman** 05 Lut 2009, 23:02

same problemy...
Dr. Web CureIt - nie moge znalesc zrodla z ktorego mozna pobrac, kazde jest zle...
http://www.kaspersky.pl/virusscanner.html - nie dziala...
FixIEDef. - nic nie daje...

**Posty:** 18165 · przez **wojtas** 05 Lut 2009, 23:58

daj loga z rsita

**Posty:** 794 · przez **jackman** 06 Lut 2009, 00:25

Kod: Zaznacz wszystko: Logfile of random's system information tool 1.05 (written by random/random) Run by Mateusz at 2009-02-05 23:24:38 Microsoft Windows XP Professional Dodatek Service Pack 3 System drive C: has 4 GB (43%) free of 8 GB Total RAM: 768 MB (65% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:24:40, on 2009-02-05 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Java\jre6\bin\jqs.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Orange\Orange.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Nowe Gadu-Gadu\gg.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Mateusz\Pulpit\RSIT.exe C:\Program Files\Trend Micro\HijackThis\Mateusz.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft.com/fwlink/?LinkId=74005 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [OrangeDeamon] C:\Program Files\Orange\Orange.exe O4 - HKLM\..\Run: [AdslTaskBar] rundll32.exe stmctrl.dll,TaskBar O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Nowe Gadu-Gadu] "C:\Program Files\Nowe Gadu-Gadu\gg.exe" O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\S-1-5-18\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - HKUS\.DEFAULT\..\RunOnce: [nltide_2] regsvr32 /s /n /i:U shell32 (User 'Default user') O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - http://www.mks.com.pl/skaner/SkanerOnline.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{787A3E6E-C353-49F7-8B8F-2E06C9EE4974}: NameServer = 79.163.127.70 217.116.100.65 O23 - Service: Avira AntiVir Personal - Free Antivirus Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing) O23 - Service: Avira AntiVir Personal - Free Antivirus Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing) O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe -- End of file - 3998 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2009-02-04 320920] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-02-04 34816] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-02-04 73728] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2004-01-09 139264] "OrangeDeamon"=C:\Program Files\Orange\Orange.exe [2008-05-16 20516864] "AdslTaskBar"=C:\WINDOWS\system32\stmctrl.dll [2008-04-23 151552] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-02-04 206232] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360] "Nowe Gadu-Gadu"=C:\Program Files\Nowe Gadu-Gadu\gg.exe [2008-12-22 9040488] "Gadu-Gadu"=C:\Program Files\Gadu-Gadu\gg.exe [2008-03-20 2127296] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2008-05-08 133632] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa] "notification packages"= scecli [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableTaskMgr"=1 "DisableRegistryTools"=1 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "EnableLUA"=0 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveAutoRun"=67108863 "NoDrives"=0 "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveAutoRun"= "NoDrives"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Program Files\Nowe Gadu-Gadu\gg.exe"="C:\Program Files\Nowe Gadu-Gadu\gg.exe:*:Enabled:ipsec" "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent" "C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe"="C:\Program Files\Java\jre6\launch4j-tmp\JDownloader.exe:*:Enabled:Java(TM) Platform SE binary" "C:\Program Files\Orange\Orange.exe"="C:\Program Files\Orange\Orange.exe:*:Enabled:ipsec" "C:\WINDOWS\SOUNDMAN.EXE"="C:\WINDOWS\SOUNDMAN.EXE:*:Enabled:ipsec" "C:\WINDOWS\system32\wscntfy.exe"="C:\WINDOWS\system32\wscntfy.exe:*:Enabled:ipsec" "C:\Program Files\Java\jre6\bin\jusched.exe"="C:\Program Files\Java\jre6\bin\jusched.exe:*:Enabled:ipsec" "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe"="C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe:*:Enabled:ipsec" "C:\DOCUME~1\Mateusz\USTAWI~1\Temp\ndrdre.exe"="C:\DOCUME~1\Mateusz\USTAWI~1\Temp\ndrdre.exe:*:Enabled:ipsec" "C:\DOCUME~1\Mateusz\USTAWI~1\Temp\txtbpl.exe"="C:\DOCUME~1\Mateusz\USTAWI~1\Temp\txtbpl.exe:*:Enabled:ipsec" "C:\DOCUME~1\Mateusz\USTAWI~1\Temp\nvprn.exe"="C:\DOCUME~1\Mateusz\USTAWI~1\Temp\nvprn.exe:*:Enabled:ipsec" "C:\DOCUME~1\Mateusz\USTAWI~1\Temp\windixsv.exe"="C:\DOCUME~1\Mateusz\USTAWI~1\Temp\windixsv.exe:*:Enabled:ipsec" "C:\DOCUME~1\Mateusz\USTAWI~1\Temp\winqmbrl.exe"="C:\DOCUME~1\Mateusz\USTAWI~1\Temp\winqmbrl.exe:*:Enabled:ipsec" "C:\DOCUME~1\Mateusz\USTAWI~1\Temp\winljyknk.exe"="C:\DOCUME~1\Mateusz\USTAWI~1\Temp\winljyknk.exe:*:Enabled:ipsec" "C:\DOCUME~1\Mateusz\USTAWI~1\Temp\wingpdjkw.exe"="C:\DOCUME~1\Mateusz\USTAWI~1\Temp\wingpdjkw.exe:*:Enabled:ipsec" "C:\DOCUME~1\Mateusz\USTAWI~1\Temp\agmqir.exe"="C:\DOCUME~1\Mateusz\USTAWI~1\Temp\agmqir.exe:*:Enabled:ipsec" "C:\DOCUME~1\Mateusz\USTAWI~1\Temp\kswff.exe"="C:\DOCUME~1\Mateusz\USTAWI~1\Temp\kswff.exe:*:Enabled:ipsec" "C:\DOCUME~1\Mateusz\USTAWI~1\Temp\vkyol.exe"="C:\DOCUME~1\Mateusz\USTAWI~1\Temp\vkyol.exe:*:Enabled:ipsec" "C:\DOCUME~1\Mateusz\USTAWI~1\Temp\winyjtk.exe"="C:\DOCUME~1\Mateusz\USTAWI~1\Temp\winyjtk.exe:*:Enabled:ipsec" "C:\DOCUME~1\Mateusz\USTAWI~1\Temp\gawr.exe"="C:\DOCUME~1\Mateusz\USTAWI~1\Temp\gawr.exe:*:Enabled:ipsec" "C:\DOCUME~1\Mateusz\USTAWI~1\Temp\windhwx.exe"="C:\DOCUME~1\Mateusz\USTAWI~1\Temp\windhwx.exe:*:Enabled:ipsec" "C:\DOCUME~1\Mateusz\USTAWI~1\Temp\winrbyb.exe"="C:\DOCUME~1\Mateusz\USTAWI~1\Temp\winrbyb.exe:*:Enabled:ipsec" "C:\DOCUME~1\Mateusz\USTAWI~1\Temp\iccnwp.exe"="C:\DOCUME~1\Mateusz\USTAWI~1\Temp\iccnwp.exe:*:Enabled:ipsec" "C:\DOCUME~1\Mateusz\USTAWI~1\Temp\nulg.exe"="C:\DOCUME~1\Mateusz\USTAWI~1\Temp\nulg.exe:*:Enabled:ipsec" "C:\Documents and Settings\Mateusz\Pulpit\DR_WEBcureit_v5.0_www.RAPID-SOFT.INFO\ghj.exe"="C:\Documents and Settings\Mateusz\Pulpit\DR_WEBcureit_v5.0_www.RAPID-SOFT.INFO\ghj.exe:*:Enabled:ipsec" "C:\WINDOWS\Explorer.EXE"="C:\WINDOWS\Explorer.EXE:*:Enabled:ipsec" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" ======List of files/folders created in the last 1 months====== 2009-02-05 23:24:38 ----D---- C:\rsit 2009-02-05 23:22:21 ----D---- C:\WINDOWS\LastGood 2009-02-05 23:11:05 ----D---- C:\Program Files\7-Zip 2009-02-05 22:17:57 ----D---- C:\!KillBox 2009-02-05 22:14:57 ----D---- C:\WINDOWS\system32\CatRoot2 2009-02-05 20:39:47 ----SHD---- C:\RECYCLER 2009-02-05 20:37:04 ----A---- C:\ComboFix.txt 2009-02-05 20:25:02 ----A---- C:\WINDOWS\~DFD446.tmp 2009-02-05 19:54:21 ----D---- C:\WINDOWS\ERUNT 2009-02-05 19:30:02 ----A---- C:\WINDOWS\~DF6352.tmp 2009-02-05 18:50:42 ----A---- C:\rapport.txt 2009-02-05 18:15:49 ----D---- C:\Documents and Settings\Mateusz\Dane aplikacji\Malwarebytes 2009-02-05 18:15:44 ----D---- C:\Program Files\Malwarebytes' Anti-Malware 2009-02-05 18:15:44 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes 2009-02-05 18:11:19 ----HD---- C:\WINDOWS\system32\GroupPolicy 2009-02-05 18:00:40 ----D---- C:\Program Files\CCleaner 2009-02-05 17:55:33 ----A---- C:\WINDOWS\gmer.bat 2009-02-05 17:53:41 ----A---- C:\WINDOWS\gmer.ini 2009-02-05 17:53:40 ----A---- C:\WINDOWS\gmer_uninstall.cmd 2009-02-05 17:53:40 ----A---- C:\WINDOWS\gmer.exe 2009-02-05 17:53:40 ----A---- C:\WINDOWS\gmer.dll 2009-02-05 17:08:26 ----A---- C:\WINDOWS\~DFBAC1.tmp 2009-02-05 17:01:29 ----D---- C:\WINDOWS\Minidump 2009-02-05 15:40:59 ----D---- C:\Documents and Settings\Mateusz\Dane aplikacji\Desktopicon 2009-02-05 15:40:58 ----D---- C:\Program Files\Unlocker 2009-02-05 12:41:22 ----D---- C:\Program Files\SkanerOnline 2009-02-05 12:05:43 ----D---- C:\Documents and Settings\Mateusz\Dane aplikacji\Gadu-Gadu 2009-02-05 12:04:42 ----D---- C:\Program Files\Gadu-Gadu 2009-02-04 22:27:18 ----D---- C:\Program Files\Trend Micro 2009-02-04 22:18:41 ----RASHD---- C:\cmdcons 2009-02-04 21:49:14 ----D---- C:\WINDOWS\ERDNT 2009-02-04 19:15:20 ----D---- C:\Program Files\xp-AntiSpy 2009-02-04 19:07:21 ----D---- C:\Documents and Settings\Mateusz\Dane aplikacji\WinRAR 2009-02-04 19:03:19 ----D---- C:\Program Files\uTorrent 2009-02-04 19:03:18 ----D---- C:\Documents and Settings\Mateusz\Dane aplikacji\uTorrent 2009-02-04 18:56:44 ----D---- C:\Documents and Settings\Mateusz\Dane aplikacji\Thunderbird 2009-02-04 18:56:36 ----D---- C:\Program Files\Mozilla Thunderbird 2009-02-04 18:50:57 ----D---- C:\Documents and Settings\Mateusz\Dane aplikacji\AIMP 2009-02-04 18:49:48 ----D---- C:\WINDOWS\Sun 2009-02-04 18:47:00 ----D---- C:\Program Files\Last.fm 2009-02-04 18:46:36 ----D---- C:\Program Files\AIMP2 2009-02-04 18:46:10 ----D---- C:\Program Files\SubEdit-Player 2009-02-04 18:46:08 ----D---- C:\WINDOWS\ie7updates 2009-02-04 18:45:07 ----A---- C:\WINDOWS\system32\rmoc3260.dll 2009-02-04 18:45:07 ----A---- C:\WINDOWS\system32\pndx5032.dll 2009-02-04 18:45:07 ----A---- C:\WINDOWS\system32\pndx5016.dll 2009-02-04 18:45:07 ----A---- C:\WINDOWS\system32\pncrt.dll 2009-02-04 18:45:06 ----A---- C:\WINDOWS\system32\unrar.dll 2009-02-04 18:45:03 ----A---- C:\WINDOWS\system32\yv12vfw.dll 2009-02-04 18:45:02 ----A---- C:\WINDOWS\system32\xvidvfw.dll 2009-02-04 18:45:02 ----A---- C:\WINDOWS\system32\xvidcore.dll 2009-02-04 18:45:01 ----A---- C:\WINDOWS\system32\qt-dx331.dll 2009-02-04 18:45:01 ----A---- C:\WINDOWS\system32\dpl100.dll 2009-02-04 18:45:01 ----A---- C:\WINDOWS\system32\divx.dll 2009-02-04 18:44:59 ----A---- C:\WINDOWS\system32\ff_vfw.dll.manifest 2009-02-04 18:44:58 ----A---- C:\WINDOWS\system32\ff_vfw.dll 2009-02-04 18:44:57 ----A---- C:\WINDOWS\system32\msvcr71.dll 2009-02-04 18:44:57 ----A---- C:\WINDOWS\system32\msvcp71.dll 2009-02-04 18:44:56 ----D---- C:\Program Files\K-Lite Codec Pack 2009-02-04 18:44:56 ----D---- C:\Documents and Settings\Mateusz\Dane aplikacji\Real 2009-02-04 18:44:56 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Real 2009-02-04 18:43:17 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$ 2009-02-04 18:42:50 ----A---- C:\WINDOWS\system32\wmpns.dll 2009-02-04 18:40:55 ----A---- C:\WINDOWS\system32\MRT.exe 2009-02-04 18:40:24 ----A---- C:\WINDOWS\system32\javaws.exe 2009-02-04 18:40:24 ----A---- C:\WINDOWS\system32\javaw.exe 2009-02-04 18:40:09 ----D---- C:\Program Files\Java 2009-02-04 18:38:41 ----D---- C:\Documents and Settings\Mateusz\Dane aplikacji\Sun 2009-02-04 18:38:03 ----D---- C:\Documents and Settings\Mateusz\Dane aplikacji\Macromedia 2009-02-04 18:37:27 ----D---- C:\Documents and Settings\Mateusz\Dane aplikacji\Nowe Gadu-Gadu 2009-02-04 18:37:09 ----D---- C:\Program Files\Nowe Gadu-Gadu 2009-02-04 18:36:05 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Avira 2009-02-04 18:29:47 ----D---- C:\Documents and Settings\Mateusz\Dane aplikacji\Mozilla 2009-02-04 18:29:38 ----D---- C:\Program Files\Mozilla Firefox 2009-02-04 18:29:05 ----D---- C:\WINDOWS\system32\PreInstall 2009-02-04 18:29:04 ----A---- C:\WINDOWS\system32\spupdsvc.exe 2009-02-04 18:25:05 ----D---- C:\WINDOWS\system32\SoftwareDistribution 2009-02-04 18:21:07 ----D---- C:\Program Files\ZTE ZXDSL 852 2009-02-04 18:20:28 ----D---- C:\WINDOWS\system32\InsFiles 2009-02-04 18:20:25 ----A---- C:\WINDOWS\system32\stmcfg32.dll 2009-02-04 18:20:25 ----A---- C:\WINDOWS\stmtrace.exe 2009-02-04 18:20:25 ----A---- C:\WINDOWS\DSLTest.exe 2009-02-04 18:20:25 ----A---- C:\WINDOWS\DSLSetup.ini 2009-02-04 18:20:24 ----A---- C:\WINDOWS\system32\stmclean.exe 2009-02-04 18:20:23 ----A---- C:\WINDOWS\system32\stmctrl.dll 2009-02-04 18:19:59 ----D---- C:\Documents and Settings\Mateusz\Dane aplikacji\Adobe 2009-02-04 18:19:07 ----D---- C:\Program Files\Orange 2009-02-04 18:18:48 ----A---- C:\WINDOWS\system32\h323log.txt 2009-02-04 18:17:20 ----A---- C:\WINDOWS\system32\ksuser.dll 2009-02-04 18:17:15 ----A---- C:\WINDOWS\system32\RTLCPAPI.dll 2009-02-04 18:17:15 ----A---- C:\WINDOWS\system32\Audio3D.dll 2009-02-04 18:17:15 ----A---- C:\WINDOWS\system32\a3d.dll 2009-02-04 18:17:14 ----N---- C:\WINDOWS\alcupd.exe 2009-02-04 18:17:14 ----N---- C:\WINDOWS\alcrmv.exe 2009-02-04 18:17:14 ----HD---- C:\Program Files\InstallShield Installation Information 2009-02-04 18:17:14 ----A---- C:\WINDOWS\system32\RTLCPL.EXE 2009-02-04 18:17:14 ----A---- C:\WINDOWS\SOUNDMAN.EXE 2009-02-04 18:17:11 ----D---- C:\Program Files\Common Files\InstallShield 2009-02-04 18:17:03 ----A---- C:\WINDOWS\system32\hidserv.dll 2009-02-04 18:15:34 ----A---- C:\WINDOWS\system32\nv4_disp.dll 2009-02-04 18:15:00 ----A---- C:\WINDOWS\system32\usbui.dll 2009-02-04 18:13:51 ----SHD---- C:\WINDOWS\Installer 2009-02-04 18:13:51 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2009-02-04 18:13:50 ----D---- C:\Program Files\Common Files\ODBC 2009-02-04 18:13:50 ----A---- C:\WINDOWS\ODBCINST.INI 2009-02-04 18:13:46 ----D---- C:\Program Files\Common Files\SpeechEngines 2009-02-04 18:13:45 ----RD---- C:\Program Files 2009-02-04 18:13:45 ----D---- C:\Program Files\Common Files\Microsoft Shared 2009-02-04 18:13:45 ----D---- C:\Program Files\Common Files 2009-02-04 18:13:39 ----RA---- C:\WINDOWS\system32\kbdtuq.dll 2009-02-04 18:13:39 ----RA---- C:\WINDOWS\system32\kbdtuf.dll 2009-02-04 18:13:39 ----RA---- C:\WINDOWS\system32\kbdazel.dll 2009-02-04 18:13:35 ----RA---- C:\WINDOWS\system32\kbdycc.dll 2009-02-04 18:13:35 ----RA---- C:\WINDOWS\system32\kbduzb.dll 2009-02-04 18:13:35 ----RA---- C:\WINDOWS\system32\kbdur.dll 2009-02-04 18:13:35 ----RA---- C:\WINDOWS\system32\kbdtat.dll 2009-02-04 18:13:35 ----RA---- C:\WINDOWS\system32\kbdru1.dll 2009-02-04 18:13:35 ----RA---- C:\WINDOWS\system32\kbdmon.dll 2009-02-04 18:13:35 ----RA---- C:\WINDOWS\system32\kbdkyr.dll 2009-02-04 18:13:35 ----RA---- C:\WINDOWS\system32\kbdkaz.dll 2009-02-04 18:13:35 ----RA---- C:\WINDOWS\system32\kbdaze.dll 2009-02-04 18:13:34 ----RA---- C:\WINDOWS\system32\kbdru.dll 2009-02-04 18:13:34 ----RA---- C:\WINDOWS\system32\kbdbu.dll 2009-02-04 18:13:34 ----RA---- C:\WINDOWS\system32\kbdblr.dll 2009-02-04 18:13:31 ----RA---- C:\WINDOWS\system32\kbdhept.dll 2009-02-04 18:13:31 ----RA---- C:\WINDOWS\system32\kbdhela3.dll 2009-02-04 18:13:31 ----RA---- C:\WINDOWS\system32\kbdhela2.dll 2009-02-04 18:13:31 ----RA---- C:\WINDOWS\system32\kbdhe319.dll 2009-02-04 18:13:31 ----RA---- C:\WINDOWS\system32\kbdhe220.dll 2009-02-04 18:13:31 ----RA---- C:\WINDOWS\system32\kbdhe.dll 2009-02-04 18:13:31 ----RA---- C:\WINDOWS\system32\kbdgkl.dll 2009-02-04 18:13:28 ----RA---- C:\WINDOWS\system32\kbdlv1.dll 2009-02-04 18:13:28 ----RA---- C:\WINDOWS\system32\kbdlv.dll 2009-02-04 18:13:28 ----RA---- C:\WINDOWS\system32\kbdlt1.dll 2009-02-04 18:13:28 ----RA---- C:\WINDOWS\system32\kbdlt.dll 2009-02-04 18:13:27 ----RA---- C:\WINDOWS\system32\kbdest.dll 2009-02-04 18:13:18 ----RA---- C:\WINDOWS\system32\kbdycl.dll 2009-02-04 18:13:18 ----RA---- C:\WINDOWS\system32\kbdsl1.dll 2009-02-04 18:13:18 ----RA---- C:\WINDOWS\system32\kbdsl.dll 2009-02-04 18:13:18 ----RA---- C:\WINDOWS\system32\kbdro.dll 2009-02-04 18:13:18 ----RA---- C:\WINDOWS\system32\kbdhu1.dll 2009-02-04 18:13:18 ----RA---- C:\WINDOWS\system32\kbdhu.dll 2009-02-04 18:13:18 ----RA---- C:\WINDOWS\system32\kbdcz2.dll 2009-02-04 18:13:18 ----RA---- C:\WINDOWS\system32\kbdcz1.dll 2009-02-04 18:13:18 ----RA---- C:\WINDOWS\system32\kbdcz.dll 2009-02-04 18:13:18 ----RA---- C:\WINDOWS\system32\kbdcr.dll 2009-02-04 18:13:18 ----RA---- C:\WINDOWS\system32\KBDAL.DLL 2009-02-04 18:13:14 ----A---- C:\WINDOWS\system32\irclass.dll 2009-02-04 18:13:14 ----A---- C:\WINDOWS\system32\dgsetup.dll 2009-02-04 18:13:14 ----A---- C:\WINDOWS\system32\dgrpsetu.dll 2009-02-04 18:13:13 ----A---- C:\WINDOWS\system32\spxcoins.dll 2009-02-04 18:13:13 ----A---- C:\WINDOWS\system32\EqnClass.Dll 2009-02-04 18:13:09 ----N---- C:\WINDOWS\system32\CONFIG.TMP 2009-02-04 18:13:09 ----A---- C:\WINDOWS\TASKMAN.EXE 2009-02-04 18:13:08 ----A---- C:\WINDOWS\system32\batt.dll 2009-02-04 18:13:07 ----A---- C:\WINDOWS\NOTEPAD.EXE 2009-02-04 18:13:05 ----A---- C:\WINDOWS\system32\storprop.dll 2009-02-04 18:12:56 ----ASH---- C:\Documents and Settings\All Users\Dane aplikacji\desktop.ini 2009-02-04 18:11:11 ----RA---- C:\WINDOWS\SET8.tmp 2009-02-04 18:11:08 ----RA---- C:\WINDOWS\SET4.tmp 2009-02-04 18:11:07 ----RA---- C:\WINDOWS\SET3.tmp 2009-02-04 18:11:01 ----D---- C:\WINDOWS\system32\CatRoot 2009-02-04 18:10:56 ----SD---- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft 2009-02-04 18:10:15 ----D---- C:\Documents and Settings 2009-02-04 18:10:14 ----SHD---- C:\System Volume Information 2009-02-04 18:09:12 ----RASH---- C:\boot.ini 2009-02-04 18:05:25 ----SD---- C:\WINDOWS\Downloaded Program Files 2009-02-04 18:05:25 ----RSHDC---- C:\WINDOWS\system32\dllcache 2009-02-04 18:05:25 ----RSD---- C:\WINDOWS\Fonts 2009-02-04 18:05:25 ----RD---- C:\WINDOWS\Web 2009-02-04 18:05:25 ----HD---- C:\WINDOWS\inf 2009-02-04 18:05:25 ----D---- C:\WINDOWS\WinSxS 2009-02-04 18:05:25 ----D---- C:\WINDOWS\WBEM 2009-02-04 18:05:25 ----D---- C:\WINDOWS\twain_32 2009-02-04 18:05:25 ----D---- C:\WINDOWS\Temp 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\wins 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\wbem 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\usmt 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\spool 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\ShellExt 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\Setup 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\ras 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\pl-pl 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\pl 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\oobe 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\npp 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\mui 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\inetsrv 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\IME 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\icsxml 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\ias 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\export 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\drivers 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\dhcp 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\config 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\3com_dmi 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\3076 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\2052 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\1054 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\1045 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\1042 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\1041 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\1037 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\1033 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\1031 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\1028 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32\1025 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system32 2009-02-04 18:05:25 ----D---- C:\WINDOWS\system 2009-02-04 18:05:25 ----D---- C:\WINDOWS\security 2009-02-04 18:05:25 ----D---- C:\WINDOWS\Resources 2009-02-04 18:05:25 ----D---- C:\WINDOWS\repair 2009-02-04 18:05:25 ----D---- C:\WINDOWS\Provisioning 2009-02-04 18:05:25 ----D---- C:\WINDOWS\PeerNet 2009-02-04 18:05:25 ----D---- C:\WINDOWS\pchealth 2009-02-04 18:05:25 ----D---- C:\WINDOWS\Offline Web Pages 2009-02-04 18:05:25 ----D---- C:\WINDOWS\Network Diagnostic 2009-02-04 18:05:25 ----D---- C:\WINDOWS\mui 2009-02-04 18:05:25 ----D---- C:\WINDOWS\msapps 2009-02-04 18:05:25 ----D---- C:\WINDOWS\msagent 2009-02-04 18:05:25 ----D---- C:\WINDOWS\Media 2009-02-04 18:05:25 ----D---- C:\WINDOWS\L2Schemas 2009-02-04 18:05:25 ----D---- C:\WINDOWS\java 2009-02-04 18:05:25 ----D---- C:\WINDOWS\ime 2009-02-04 18:05:25 ----D---- C:\WINDOWS\Help 2009-02-04 18:05:25 ----D---- C:\WINDOWS\ehome 2009-02-04 18:05:25 ----D---- C:\WINDOWS\Driver Cache 2009-02-04 18:05:25 ----D---- C:\WINDOWS\Debug 2009-02-04 18:05:25 ----D---- C:\WINDOWS\Cursors 2009-02-04 18:05:25 ----D---- C:\WINDOWS\Connection Wizard 2009-02-04 18:05:25 ----D---- C:\WINDOWS\Config 2009-02-04 18:05:25 ----D---- C:\WINDOWS\AppPatch 2009-02-04 18:05:25 ----D---- C:\WINDOWS\addins 2009-02-04 18:05:25 ----D---- C:\WINDOWS 2009-02-04 17:35:30 ----D---- C:\Documents and Settings\Mateusz\Dane aplikacji\Identities 2009-02-04 17:35:28 ----HD---- C:\Program Files\Uninstall Information 2009-02-04 17:35:14 ----ASH---- C:\Documents and Settings\Mateusz\Dane aplikacji\desktop.ini 2009-02-04 17:35:13 ----SD---- C:\Documents and Settings\Mateusz\Dane aplikacji\Microsoft 2009-02-04 17:31:47 ----D---- C:\WINDOWS\SoftwareDistribution 2009-02-04 17:31:45 ----D---- C:\WINDOWS\Prefetch 2009-02-04 17:31:44 ----SD---- C:\WINDOWS\system32\Microsoft 2009-02-04 17:31:44 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-02-04 17:27:50 ----D---- C:\WINDOWS\system32\xircom 2009-02-04 17:27:50 ----D---- C:\Program Files\xerox 2009-02-04 17:27:50 ----D---- C:\Program Files\microsoft frontpage 2009-02-04 17:27:25 ----N---- C:\WINDOWS\system32\spmsg.dll 2009-02-04 17:27:24 ----HD---- C:\WINDOWS\$hf_mig$ 2009-02-04 17:27:13 ----A---- C:\WINDOWS\control.ini 2009-02-04 17:27:13 ----A---- C:\AUTOEXEC.BAT 2009-02-04 17:26:55 ----A---- C:\WINDOWS\system32\mapi32.dll 2009-02-04 17:26:01 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest 2009-02-04 17:25:57 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest 2009-02-04 17:25:52 ----HD---- C:\Program Files\WindowsUpdate 2009-02-04 17:25:48 ----D---- C:\Program Files\Usługi online 2009-02-04 17:25:26 ----D---- C:\WINDOWS\system32\DirectX 2009-02-04 17:25:12 ----A---- C:\WINDOWS\system32\atrace.dll 2009-02-04 17:25:06 ----A---- C:\WINDOWS\system32\desktop.ini 2009-02-04 17:25:06 ----A---- C:\WINDOWS\desktop.ini 2009-02-04 17:24:52 ----A---- C:\WINDOWS\system32\nmevtmsg.dll 2009-02-04 17:24:48 ----A---- C:\WINDOWS\system32\acctres.dll 2009-02-04 17:24:46 ----D---- C:\Program Files\Common Files\Services 2009-02-04 17:24:42 ----SD---- C:\WINDOWS\Tasks 2009-02-04 17:24:42 ----A---- C:\WINDOWS\system32\icfgnt5.dll 2009-02-04 17:24:40 ----D---- C:\Program Files\Common Files\MSSoap 2009-02-04 17:24:33 ----D---- C:\WINDOWS\srchasst 2009-02-04 17:24:31 ----D---- C:\WINDOWS\system32\Macromed 2009-02-04 17:24:28 ----A---- C:\WINDOWS\system32\wuweb.dll 2009-02-04 17:24:28 ----A---- C:\WINDOWS\system32\wucltui.dll 2009-02-04 17:24:28 ----A---- C:\WINDOWS\system32\wuauserv.dll 2009-02-04 17:24:27 ----A---- C:\WINDOWS\system32\wups.dll 2009-02-04 17:24:27 ----A---- C:\WINDOWS\system32\wuaueng1.dll 2009-02-04 17:24:27 ----A---- C:\WINDOWS\system32\wuaueng.dll 2009-02-04 17:24:27 ----A---- C:\WINDOWS\system32\wuauclt1.exe 2009-02-04 17:24:27 ----A---- C:\WINDOWS\system32\wuauclt.exe 2009-02-04 17:24:27 ----A---- C:\WINDOWS\system32\wuapi.dll 2009-02-04 17:24:26 ----A---- C:\WINDOWS\system32\bitsprx4.dll 2009-02-04 17:24:26 ----A---- C:\WINDOWS\system32\bitsprx3.dll 2009-02-04 17:24:26 ----A---- C:\WINDOWS\system32\bitsprx2.dll 2009-02-04 17:24:25 ----A---- C:\WINDOWS\system32\qmgrprxy.dll 2009-02-04 17:24:25 ----A---- C:\WINDOWS\system32\qmgr.dll 2009-02-04 17:24:20 ----D---- C:\Program Files\Movie Maker 2009-02-04 17:23:50 ----A---- C:\WINDOWS\system32\safrslv.dll 2009-02-04 17:23:50 ----A---- C:\WINDOWS\system32\safrdm.dll 2009-02-04 17:23:50 ----A---- C:\WINDOWS\system32\safrcdlg.dll 2009-02-04 17:23:50 ----A---- C:\WINDOWS\system32\racpldlg.dll 2009-02-04 17:23:43 ----A---- C:\WINDOWS\system32\fltMc.exe 2009-02-04 17:23:43 ----A---- C:\WINDOWS\system32\fltlib.dll 2009-02-04 17:23:42 ----D---- C:\WINDOWS\system32\Restore 2009-02-04 17:23:41 ----A---- C:\WINDOWS\system32\srsvc.dll 2009-02-04 17:23:41 ----A---- C:\WINDOWS\system32\srrstr.dll 2009-02-04 17:23:41 ----A---- C:\WINDOWS\system32\srclient.dll 2009-02-04 17:23:40 ----A---- C:\WINDOWS\system32\nmmkcert.dll 2009-02-04 17:23:40 ----A---- C:\WINDOWS\system32\mnmdd.dll 2009-02-04 17:23:40 ----A---- C:\WINDOWS\system32\isrdbg32.dll 2009-02-04 17:23:40 ----A---- C:\WINDOWS\system32\ils.dll 2009-02-04 17:23:39 ----A---- C:\WINDOWS\system32\msconf.dll 2009-02-04 17:23:39 ----A---- C:\WINDOWS\system32\mnmsrvc.exe 2009-02-04 17:23:34 ----D---- C:\Program Files\NetMeeting 2009-02-04 17:23:33 ----A---- C:\WINDOWS\system32\msoert2.dll 2009-02-04 17:23:33 ----A---- C:\WINDOWS\system32\msoeacct.dll 2009-02-04 17:23:31 ----A---- C:\WINDOWS\system32\inetres.dll 2009-02-04 17:23:31 ----A---- C:\WINDOWS\system32\inetcomm.dll 2009-02-04 17:23:29 ----D---- C:\Program Files\Outlook Express 2009-02-04 17:23:29 ----A---- C:\WINDOWS\system32\schedsvc.dll 2009-02-04 17:23:29 ----A---- C:\WINDOWS\system32\mstinit.exe 2009-02-04 17:23:28 ----A---- C:\WINDOWS\system32\mstask.dll 2009-02-04 17:23:28 ----A---- C:\WINDOWS\system32\icwphbk.dll 2009-02-04 17:23:27 ----A---- C:\WINDOWS\system32\isign32.dll 2009-02-04 17:23:27 ----A---- C:\WINDOWS\system32\inetcfg.dll 2009-02-04 17:23:27 ----A---- C:\WINDOWS\system32\icwdial.dll 2009-02-04 17:23:18 ----D---- C:\Program Files\Common Files\System 2009-02-04 17:23:15 ----D---- C:\Program Files\Internet Explorer 2009-02-04 17:22:29 ----D---- C:\Program Files\ComPlus Applications 2009-02-04 17:22:27 ----A---- C:\WINDOWS\vbaddin.ini 2009-02-04 17:22:27 ----A---- C:\WINDOWS\vb.ini 2009-02-04 17:22:22 ----D---- C:\WINDOWS\Registration 2009-02-04 17:22:03 ----D---- C:\Program Files\Windows Media Connect 2 2009-02-04 17:22:02 ----D---- C:\Program Files\Windows Media Player 2009-02-04 17:22:00 ----D---- C:\Program Files\Messenger 2009-02-04 17:21:51 ----D---- C:\Program Files\MSN Gaming Zone 2009-02-04 17:21:51 ----A---- C:\WINDOWS\system32\write.exe 2009-02-04 17:21:37 ----A---- C:\WINDOWS\system32\sndvol32.exe 2009-02-04 17:21:37 ----A---- C:\WINDOWS\system32\hticons.dll 2009-02-04 17:21:37 ----A---- C:\WINDOWS\system32\avwav.dll 2009-02-04 17:21:37 ----A---- C:\WINDOWS\system32\avmeter.dll 2009-02-04 17:21:36 ----A---- C:\WINDOWS\system32\avtapi.dll 2009-02-04 17:21:35 ----A---- C:\WINDOWS\system32\winchat.exe 2009-02-04 17:21:23 ----A---- C:\WINDOWS\system32\getuname.dll 2009-02-04 17:21:23 ----A---- C:\WINDOWS\system32\charmap.exe 2009-02-04 17:21:23 ----A---- C:\WINDOWS\system32\calc.exe 2009-02-04 17:21:21 ----A---- C:\WINDOWS\system32\winmine.exe 2009-02-04 17:21:21 ----A---- C:\WINDOWS\system32\sol.exe 2009-02-04 17:21:21 ----A---- C:\WINDOWS\system32\mshearts.exe 2009-02-04 17:21:20 ----A---- C:\WINDOWS\system32\usrlogon.cmd 2009-02-04 17:21:20 ----A---- C:\WINDOWS\system32\tsshutdn.exe 2009-02-04 17:21:20 ----A---- C:\WINDOWS\system32\tskill.exe 2009-02-04 17:21:20 ----A---- C:\WINDOWS\system32\reset.exe 2009-02-04 17:21:20 ----A---- C:\WINDOWS\system32\freecell.exe 2009-02-04 17:21:19 ----A---- C:\WINDOWS\system32\tslabels.ini 2009-02-04 17:21:19 ----A---- C:\WINDOWS\system32\tsdiscon.exe 2009-02-04 17:21:19 ----A---- C:\WINDOWS\system32\tscon.exe 2009-02-04 17:21:19 ----A---- C:\WINDOWS\system32\shadow.exe 2009-02-04 17:21:19 ----A---- C:\WINDOWS\system32\rwinsta.exe 2009-02-04 17:21:19 ----A---- C:\WINDOWS\system32\regini.exe 2009-02-04 17:21:19 ----A---- C:\WINDOWS\system32\rdpcfgex.dll 2009-02-04 17:21:19 ----A---- C:\WINDOWS\system32\qwinsta.exe 2009-02-04 17:21:19 ----A---- C:\WINDOWS\system32\qappsrv.exe 2009-02-04 17:21:18 ----A---- C:\WINDOWS\system32\msg.exe 2009-02-04 17:21:18 ----A---- C:\WINDOWS\system32\msdtcprf.ini 2009-02-04 17:21:18 ----A---- C:\WINDOWS\system32\logoff.exe 2009-02-04 17:21:18 ----A---- C:\WINDOWS\system32\cdmodem.dll 2009-02-04 17:21:07 ----A---- C:\WINDOWS\system32\wmimgmt.msc 2009-02-04 17:21:06 ----A---- C:\WINDOWS\system32\accwiz.exe 2009-02-04 17:21:05 ----A---- C:\WINDOWS\system32\sndrec32.exe 2009-02-04 17:21:05 ----A---- C:\WINDOWS\system32\mplay32.exe 2009-02-04 17:21:05 ----A---- C:\WINDOWS\system32\hypertrm.dll 2009-02-04 17:21:04 ----D---- C:\Program Files\Windows NT 2009-02-04 17:21:03 ----A---- C:\WINDOWS\system32\mspaint.exe 2009-02-04 17:21:03 ----A---- C:\WINDOWS\system32\clipbrd.exe 2009-02-04 17:21:02 ----A---- C:\WINDOWS\system32\spider.exe 2009-02-04 17:21:00 ----A---- C:\WINDOWS\system32\tsgqec.dll 2009-02-04 17:21:00 ----A---- C:\WINDOWS\system32\tscfgwmi.dll 2009-02-04 17:20:59 ----A---- C:\WINDOWS\system32\rhttpaa.dll 2009-02-04 17:20:59 ----A---- C:\WINDOWS\system32\aaclient.dll 2009-02-04 17:20:58 ----A---- C:\WINDOWS\system32\mstscax.dll 2009-02-04 17:20:57 ----A---- C:\WINDOWS\system32\sessmgr.exe 2009-02-04 17:20:57 ----A---- C:\WINDOWS\system32\remotepg.dll 2009-02-04 17:20:57 ----A---- C:\WINDOWS\system32\rdshost.exe 2009-02-04 17:20:57 ----A---- C:\WINDOWS\system32\rdsaddin.exe 2009-02-04 17:20:57 ----A---- C:\WINDOWS\system32\rdchost.dll 2009-02-04 17:20:57 ----A---- C:\WINDOWS\system32\mstsc.exe 2009-02-04 17:20:56 ----A---- C:\WINDOWS\system32\termsrv.dll 2009-02-04 17:20:56 ----A---- C:\WINDOWS\system32\rdpwsx.dll 2009-02-04 17:20:56 ----A---- C:\WINDOWS\system32\rdpsnd.dll 2009-02-04 17:20:56 ----A---- C:\WINDOWS\system32\rdpclip.exe 2009-02-04 17:20:56 ----A---- C:\WINDOWS\system32\qprocess.exe 2009-02-04 17:20:56 ----A---- C:\WINDOWS\system32\icaapi.dll 2009-02-04 17:20:56 ----A---- C:\WINDOWS\system32\cfgbkend.dll 2009-02-04 17:20:55 ----D---- C:\WINDOWS\system32\MsDtc 2009-02-04 17:20:55 ----A---- C:\WINDOWS\system32\mtxoci.dll 2009-02-04 17:20:55 ----A---- C:\WINDOWS\system32\msdtcuiu.dll 2009-02-04 17:20:54 ----A---- C:\WINDOWS\system32\msdtctm.dll 2009-02-04 17:20:54 ----A---- C:\WINDOWS\system32\msdtcprx.dll 2009-02-04 17:20:53 ----A---- C:\WINDOWS\system32\xolehlp.dll 2009-02-04 17:20:53 ----A---- C:\WINDOWS\system32\msdtclog.dll 2009-02-04 17:20:53 ----A---- C:\WINDOWS\system32\msdtc.exe 2009-02-04 17:20:52 ----A---- C:\WINDOWS\system32\dcomcnfg.exe 2009-02-04 17:20:51 ----D---- C:\WINDOWS\system32\Com 2009-02-04 17:20:51 ----A---- C:\WINDOWS\system32\mtxlegih.dll 2009-02-04 17:20:51 ----A---- C:\WINDOWS\system32\mtxex.dll 2009-02-04 17:20:51 ----A---- C:\WINDOWS\system32\mtxdm.dll 2009-02-04 17:20:51 ----A---- C:\WINDOWS\system32\comrepl.dll 2009-02-04 17:20:51 ----A---- C:\WINDOWS\system32\comaddin.dll 2009-02-04 17:20:51 ----A---- C:\WINDOWS\system32\colbact.dll 2009-02-04 17:20:50 ----A---- C:\WINDOWS\system32\stclient.dll 2009-02-04 17:20:50 ----A---- C:\WINDOWS\system32\clbcatex.dll 2009-02-04 17:20:50 ----A---- C:\WINDOWS\system32\catsrvps.dll 2009-02-04 17:20:49 ----A---- C:\WINDOWS\system32\comsvcs.dll 2009-02-04 17:20:49 ----A---- C:\WINDOWS\system32\catsrvut.dll 2009-02-04 17:20:49 ----A---- C:\WINDOWS\system32\catsrv.dll 2009-02-04 17:20:48 ----A---- C:\WINDOWS\system32\comuid.dll 2009-02-04 17:20:48 ----A---- C:\WINDOWS\system32\comsnap.dll 2009-02-04 17:20:48 ----A---- C:\WINDOWS\system32\clbcatq.dll 2009-02-04 17:20:39 ----A---- C:\WINDOWS\system32\servdeps.dll 2009-02-04 17:20:38 ----A---- C:\WINDOWS\system32\mmfutil.dll 2009-02-04 17:20:38 ----A---- C:\WINDOWS\system32\licwmi.dll 2009-02-04 17:20:38 ----A---- C:\WINDOWS\system32\cmprops.dll ======List of files/folders modified in the last 1 months====== 2009-02-05 20:35:08 ----A---- C:\WINDOWS\system.ini 2009-02-04 17:27:11 ----A---- C:\WINDOWS\win.ini ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 AmdK7;Sterownik procesora AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2008-04-14 41856] R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2008-10-30 75072] R1 kbdhid;Sterownik klawiatury HID; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720] R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352] R3 ALCXSENS;Service for WDM 3D Audio Driver; C:\WINDOWS\system32\drivers\ALCXSENS.SYS [2003-12-11 391424] R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-01-09 601100] R3 asc3360pr;asc3360pr; \??\C:\WINDOWS\system32\drivers\ptnhtn.sys [] R3 FETNDIS;Sterownik NT karty VIA PCI 10/100Mb Fast Ethernet; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165] R3 hidusb;Sterownik Microsoft klasy HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368] R3 mouhid;Sterownik myszy HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-26 12160] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2008-04-13 1897408] R3 Stmatm;ATM/ADSL miniport; C:\WINDOWS\system32\DRIVERS\stmatm.sys [2008-04-23 60255] R3 TaurusUsb;ADSL Modem USB Service; C:\WINDOWS\system32\DRIVERS\torususb.sys [2008-04-23 683791] R3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128] R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208] R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608] S1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys [] S3 avgntflt;avgntflt; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys [] S3 catchme;catchme; \??\C:\ComboFix\catchme.sys [] S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2008-05-08 77568] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2008-05-08 82944] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-02-04 152984] S2 AntiVirScheduler;Avira AntiVir Personal - Free Antivirus Scheduler; C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe [] S2 AntiVirService;Avira AntiVir Personal - Free Antivirus Guard; C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe [] S3 WMPNetworkSvc;Usługa udostępniania w sieci programu Windows Media Player; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-12-01 987648] S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336] -----------------EOF-----------------

ten drugi plik w notatniku tez?

**Posty:** 1 · przez **karlos1843** 06 Lut 2009, 00:48

Witam! jest to wina beznadziejnego robaka <win.sality.aa> blokuje wszystko co zwiazane ze scanem antywirusowym, zaraza obiekty startowe dyskow, partycji , szyko sie pleni. Jedyny sposob - instalacja systemu na odrebnym dysku, instalacja kaspera, dopiero wtedy podlacz zarazone dyski i wykonaj skan! zadziala na 100%

**Posty:** 18165 · przez **wojtas** 06 Lut 2009, 20:12

opróżnij ten folder:

C:\DOCUME~1\Mateusz\USTAWI~1\Temp

**Posty:** 794 · przez **jackman** 06 Lut 2009, 21:11

opróżniałem ten folder kilka razy ale zawsze po restarcie coś tam znowu było, przed chwila zrobiłem format i jak na razie wszystko jest dobrze