Trojan-gamethief.win32.magania & amvo

**Posty:** 7 · przez **Tohokami** 28 Sie 2009, 17:45

Ohayo ;]
Mam następujące problemy Kasperski wykrył mi 'GameThief' i nie mogę się go pozbyć żadnym antyvirem mógł bym go ręcznie wywalić (C:\hx.exe) ale nie mogę zobaczyć ukrytych plików i każdy dysk(partycja) otwiera mi się w nowym oknie dlatego mam też podejrzenie o amvo. Dlatego proszę o pomoc. Jeżeli coś źle zrobiłem lub jeszcze czegoś nie zrobiłem napiszcie ;]

Oto logi z RSITA: (RISTA zrobił mi dwa pliki .txt log i info i pytanie czy info też jest istotne i mam je tu umieścić ?)

Kod: Zaznacz wszystko: Logfile of random's system information tool 1.06 (written by random/random) Run by Administrator at 2009-08-28 15:19:32 Microsoft Windows XP Professional Dodatek Service Pack 3 System drive C: has 21 GB (86%) free of 25 GB Total RAM: 767 MB (49% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:20:05, on 2009-08-28 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\HP\HP Software Update\HPWuSchd2.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\TGTSoft\StyleXP\StyleXP.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\devldr32.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Miranda IM\miranda32.exe C:\Program Files\foobar2000\foobar2000.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Administrator\Pulpit\RSIT.exe C:\Program Files\trend micro\Administrator.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [cdoosoft] C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\herss.exe O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O13 - Gopher Prefix: O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: nProtect GameGuard Service (npggsvc) - Unknown owner - C:\WINDOWS\system32\GameMon.des.exe (file missing) O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe -- End of file - 4184 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-08-28 41368] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-08-28 73728] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-08-28 148888] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-15 15360] "cdoosoft"=C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\herss.exe [2009-08-27 113233] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [2007-03-11 49152] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe [2006-05-24 1372160] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent] C:\WINDOWS\system32\Ati2evxx.dll [2007-07-28 118784] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\wpdshserviceobj.dll [2009-06-30 133632] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 "NoDriveAutoRun"=67108863 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "HonorAutoRunSetting"= "NoDriveAutoRun"= "NoDriveTypeAutoRun"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "F:\Miranda IM\miranda32.exe"="F:\Miranda IM\miranda32.exe:*:Enabled:Miranda IM" "C:\Soldat\Soldat.exe"="C:\Soldat\Soldat.exe:*:Enabled:http://soldat.pl" "C:\Miranda IM\miranda32.exe"="C:\Miranda IM\miranda32.exe:*:Enabled:Miranda IM" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{421fc6b9-9308-11de-8933-806d6172696f}] shell\AutoRun\command - D:\hx.exe shell\open\command - D:\hx.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{421fc6bb-9308-11de-8933-806d6172696f}] shell\AutoRun\command - C:\hx.exe shell\open\command - C:\hx.exe [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c250dfb3-92fc-11de-8696-000c7686a9ce}] shell\AutoRun\command - F:\hx.exe shell\open\command - F:\hx.exe ======List of files/folders created in the last 1 months====== 2009-08-28 15:19:33 ----D---- C:\Program Files\trend micro 2009-08-28 15:19:32 ----D---- C:\rsit 2009-08-28 15:17:14 ----D---- C:\Qoobox 2009-08-28 14:08:01 ----D---- C:\WINDOWS\Sun 2009-08-28 14:06:59 ----A---- C:\WINDOWS\system32\javaws.exe 2009-08-28 14:06:59 ----A---- C:\WINDOWS\system32\javaw.exe 2009-08-28 14:06:59 ----A---- C:\WINDOWS\system32\java.exe 2009-08-28 14:06:59 ----A---- C:\WINDOWS\system32\deploytk.dll 2009-08-28 14:06:37 ----D---- C:\Program Files\Java 2009-08-28 14:03:09 ----D---- C:\Documents and Settings\Administrator\Dane aplikacji\Sun 2009-08-28 13:20:54 ----D---- C:\Program Files\CCleaner 2009-08-28 08:04:31 ----D---- C:\Soldat 2009-08-28 08:04:31 ----D---- C:\Documents and Settings\Administrator\Dane aplikacji\Soldat 2009-08-28 00:58:45 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\WEBREG 2009-08-28 00:55:05 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Hewlett-Packard 2009-08-28 00:54:53 ----RA---- C:\WINDOWS\system32\hpzids01.dll 2009-08-28 00:54:51 ----A---- C:\WINDOWS\system32\hpzll5ha.dll 2009-08-28 00:54:01 ----RA---- C:\WINDOWS\system32\hppldcoi.dll 2009-08-28 00:54:01 ----RA---- C:\WINDOWS\system32\hpowiax3.dll 2009-08-28 00:54:01 ----RA---- C:\WINDOWS\system32\hpovst10.dll 2009-08-28 00:54:01 ----RA---- C:\WINDOWS\system32\hpotscl3.dll 2009-08-28 00:54:01 ----RA---- C:\WINDOWS\system32\difxapi.dll 2009-08-28 00:52:10 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\HPSSUPPLY 2009-08-28 00:35:31 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\HP Product Assistant 2009-08-28 00:35:28 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\HP 2009-08-28 00:34:58 ----D---- C:\Program Files\Common Files\HP 2009-08-28 00:34:25 ----D---- C:\Program Files\Hewlett-Packard 2009-08-28 00:34:00 ----D---- C:\Program Files\Common Files\Hewlett-Packard 2009-08-28 00:32:54 ----DC---- C:\WINDOWS\system32\DRVSTORE 2009-08-28 00:32:25 ----D---- C:\Program Files\HP 2009-08-28 00:32:02 ----HD---- C:\Config.Msi 2009-08-27 20:23:57 ----D---- C:\Program Files\Common Files\INCA Shared 2009-08-27 17:07:42 ----D---- C:\Documents and Settings\Administrator\Dane aplikacji\Media Player Classic 2009-08-27 17:06:49 ----D---- C:\Program Files\Combined Community Codec Pack 2009-08-27 17:02:41 ----D---- C:\Program Files\WinRAR 2009-08-27 16:59:09 ----D---- C:\Program Files\SubEdit-Player 2009-08-27 16:36:29 ----A---- C:\WINDOWS\system32\qttask.exe 2009-08-27 16:34:47 ----A---- C:\WINDOWS\system32\pndx5032.dll 2009-08-27 16:34:46 ----A---- C:\WINDOWS\system32\rmoc3260.dll 2009-08-27 16:34:46 ----A---- C:\WINDOWS\system32\pndx5016.dll 2009-08-27 16:34:46 ----A---- C:\WINDOWS\system32\pncrt.dll 2009-08-27 16:34:40 ----D---- C:\WINDOWS\system32\QuickTime 2009-08-27 16:34:40 ----A---- C:\WINDOWS\system32\MSVCR71.dll 2009-08-27 16:34:38 ----A---- C:\WINDOWS\mmtvmj.ini 2009-08-27 16:34:38 ----A---- C:\WINDOWS\m3jp2k.ini 2009-08-27 16:34:37 ----A---- C:\WINDOWS\m3jpeg.ini 2009-08-27 16:34:34 ----A---- C:\WINDOWS\system32\mplvpx.dll 2009-08-27 16:34:34 ----A---- C:\WINDOWS\system32\mplvm6.dll 2009-08-27 16:34:33 ----A---- C:\WINDOWS\system32\mplvw7.dll 2009-08-27 16:34:33 ----A---- C:\WINDOWS\system32\mplva6.dll 2009-08-27 16:34:33 ----A---- C:\WINDOWS\system32\mplaw7.dll 2009-08-27 16:34:33 ----A---- C:\WINDOWS\system32\mplapx.dll 2009-08-27 16:34:33 ----A---- C:\WINDOWS\system32\mplam6.dll 2009-08-27 16:34:33 ----A---- C:\WINDOWS\system32\mplaa6.dll 2009-08-27 16:34:33 ----A---- C:\WINDOWS\system32\cpuinf32.dll 2009-08-27 16:34:32 ----A---- C:\WINDOWS\system32\unrar.dll 2009-08-27 16:34:29 ----A---- C:\WINDOWS\system32\xvidcore.dll 2009-08-27 16:34:25 ----D---- C:\Program Files\ACE Mega CoDecS Pack 2009-08-27 16:00:38 ----D---- C:\Documents and Settings\Administrator\Dane aplikacji\Macromedia 2009-08-27 16:00:38 ----D---- C:\Documents and Settings\Administrator\Dane aplikacji\Adobe 2009-08-27 15:27:00 ----D---- C:\Documents and Settings\Administrator\Dane aplikacji\foobar2000 2009-08-27 15:26:09 ----D---- C:\Program Files\foobar2000 2009-08-27 15:22:36 ----D---- C:\Program Files\TGTSoft 2009-08-27 15:17:00 ----RD---- C:\Miranda IM 2009-08-27 15:12:12 ----A---- C:\WINDOWS\ODBC.INI 2009-08-27 15:12:06 ----A---- C:\WINDOWS\system32\mdimon.dll 2009-08-27 15:11:21 ----D---- C:\Program Files\Common Files\DESIGNER 2009-08-27 15:11:09 ----D---- C:\WINDOWS\SHELLNEW 2009-08-27 15:11:08 ----D---- C:\Program Files\Microsoft Office 2009-08-27 15:08:35 ----A---- C:\WINDOWS\system32\h323log.txt 2009-08-27 15:07:55 ----D---- C:\Program Files\DAEMON Tools 2009-08-27 15:05:42 ----A---- C:\WINDOWS\system32\storprop.dll 2009-08-27 15:05:13 ----A---- C:\WINDOWS\system32\sfman32.dll 2009-08-27 15:05:13 ----A---- C:\WINDOWS\system32\sblfx.dll 2009-08-27 15:05:13 ----A---- C:\WINDOWS\system32\devldr32.exe 2009-08-27 15:05:13 ----A---- C:\WINDOWS\system32\devcon32.dll 2009-08-27 15:05:13 ----A---- C:\WINDOWS\system32\ctwdm32.dll 2009-08-27 15:05:12 ----A---- C:\WINDOWS\system32\ksuser.dll 2009-08-27 15:04:52 ----A---- C:\WINDOWS\system32\usbui.dll 2009-08-27 15:03:39 ----A---- C:\WINDOWS\system32\CF10229.exe 2009-08-27 15:03:12 ----A---- C:\WINDOWS\imsins.BAK 2009-08-27 15:03:08 ----SHD---- C:\WINDOWS\Installer 2009-08-27 15:03:08 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2009-08-27 15:03:07 ----D---- C:\Program Files\Common Files\ODBC 2009-08-27 15:03:07 ----A---- C:\WINDOWS\ODBCINST.INI 2009-08-27 15:03:02 ----D---- C:\Program Files\Common Files\SpeechEngines 2009-08-27 15:03:01 ----RD---- C:\Program Files 2009-08-27 15:03:01 ----D---- C:\Program Files\Common Files\Microsoft Shared 2009-08-27 15:03:01 ----D---- C:\Program Files\Common Files 2009-08-27 15:02:45 ----RA---- C:\WINDOWS\system32\kbdtuq.dll 2009-08-27 15:02:45 ----RA---- C:\WINDOWS\system32\kbdtuf.dll 2009-08-27 15:02:45 ----RA---- C:\WINDOWS\system32\kbdazel.dll 2009-08-27 15:02:43 ----RA---- C:\WINDOWS\system32\kbdkyr.dll 2009-08-27 15:02:42 ----RA---- C:\WINDOWS\system32\kbdycc.dll 2009-08-27 15:02:42 ----RA---- C:\WINDOWS\system32\kbduzb.dll 2009-08-27 15:02:42 ----RA---- C:\WINDOWS\system32\kbdur.dll 2009-08-27 15:02:42 ----RA---- C:\WINDOWS\system32\kbdtat.dll 2009-08-27 15:02:42 ----RA---- C:\WINDOWS\system32\kbdru1.dll 2009-08-27 15:02:42 ----RA---- C:\WINDOWS\system32\kbdru.dll 2009-08-27 15:02:42 ----RA---- C:\WINDOWS\system32\kbdmon.dll 2009-08-27 15:02:42 ----RA---- C:\WINDOWS\system32\kbdkaz.dll 2009-08-27 15:02:42 ----RA---- C:\WINDOWS\system32\kbdbu.dll 2009-08-27 15:02:42 ----RA---- C:\WINDOWS\system32\kbdblr.dll 2009-08-27 15:02:42 ----RA---- C:\WINDOWS\system32\kbdaze.dll 2009-08-27 15:02:39 ----RA---- C:\WINDOWS\system32\kbdhept.dll 2009-08-27 15:02:39 ----RA---- C:\WINDOWS\system32\kbdhela3.dll 2009-08-27 15:02:39 ----RA---- C:\WINDOWS\system32\kbdhela2.dll 2009-08-27 15:02:39 ----RA---- C:\WINDOWS\system32\kbdhe319.dll 2009-08-27 15:02:39 ----RA---- C:\WINDOWS\system32\kbdhe220.dll 2009-08-27 15:02:39 ----RA---- C:\WINDOWS\system32\kbdhe.dll 2009-08-27 15:02:39 ----RA---- C:\WINDOWS\system32\kbdgkl.dll 2009-08-27 15:02:37 ----RA---- C:\WINDOWS\system32\kbdlv1.dll 2009-08-27 15:02:37 ----RA---- C:\WINDOWS\system32\kbdlv.dll 2009-08-27 15:02:37 ----RA---- C:\WINDOWS\system32\kbdlt1.dll 2009-08-27 15:02:37 ----RA---- C:\WINDOWS\system32\kbdlt.dll 2009-08-27 15:02:37 ----RA---- C:\WINDOWS\system32\kbdest.dll 2009-08-27 15:02:28 ----RA---- C:\WINDOWS\system32\kbdycl.dll 2009-08-27 15:02:28 ----RA---- C:\WINDOWS\system32\kbdsl1.dll 2009-08-27 15:02:28 ----RA---- C:\WINDOWS\system32\kbdsl.dll 2009-08-27 15:02:28 ----RA---- C:\WINDOWS\system32\kbdro.dll 2009-08-27 15:02:28 ----RA---- C:\WINDOWS\system32\kbdhu1.dll 2009-08-27 15:02:28 ----RA---- C:\WINDOWS\system32\kbdhu.dll 2009-08-27 15:02:28 ----RA---- C:\WINDOWS\system32\kbdcz2.dll 2009-08-27 15:02:28 ----RA---- C:\WINDOWS\system32\kbdcz1.dll 2009-08-27 15:02:28 ----RA---- C:\WINDOWS\system32\kbdcz.dll 2009-08-27 15:02:28 ----RA---- C:\WINDOWS\system32\kbdcr.dll 2009-08-27 15:02:28 ----RA---- C:\WINDOWS\system32\KBDAL.DLL 2009-08-27 15:02:15 ----D---- C:\WINDOWS\ERDNT 2009-08-27 15:02:13 ----ASH---- C:\Documents and Settings\All Users\Dane aplikacji\desktop.ini 2009-08-27 15:00:16 ----D---- C:\WINDOWS\system32\CatRoot2 2009-08-27 15:00:16 ----D---- C:\WINDOWS\system32\CatRoot 2009-08-27 15:00:10 ----SD---- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft 2009-08-27 14:59:50 ----A---- C:\WINDOWS\setuplog.txt 2009-08-27 14:59:44 ----D---- C:\Documents and Settings 2009-08-27 14:59:43 ----SHD---- C:\System Volume Information 2009-08-27 14:58:43 ----SH---- C:\boot.ini 2009-08-27 14:54:36 ----RD---- C:\WINDOWS\Offline Web Pages 2009-08-27 14:54:36 ----RD---- C:\WINDOWS\Downloaded Program Files 2009-08-27 14:54:36 ----D---- C:\WINDOWS\WinSxS 2009-08-27 14:54:36 ----D---- C:\WINDOWS\WBEM 2009-08-27 14:54:36 ----D---- C:\WINDOWS\system32\pl-pl 2009-08-27 14:54:36 ----D---- C:\WINDOWS\system32\pl 2009-08-27 14:54:36 ----D---- C:\WINDOWS\system32\inetsrv 2009-08-27 14:54:36 ----D---- C:\WINDOWS\system32\IME 2009-08-27 14:54:36 ----D---- C:\WINDOWS\system32\3com_dmi 2009-08-27 14:54:36 ----D---- C:\WINDOWS\system32\1045 2009-08-27 14:54:36 ----D---- C:\WINDOWS\PeerNet 2009-08-27 14:54:36 ----D---- C:\WINDOWS\pchealth 2009-08-27 14:54:36 ----D---- C:\WINDOWS\Network Diagnostic 2009-08-27 14:54:36 ----D---- C:\WINDOWS\mui 2009-08-27 14:54:36 ----D---- C:\WINDOWS\L2Schemas 2009-08-27 14:54:36 ----D---- C:\WINDOWS\ime 2009-08-27 14:54:36 ----D---- C:\WINDOWS\ehome 2009-08-27 14:54:35 ----RSD---- C:\WINDOWS\Fonts 2009-08-27 14:54:35 ----RD---- C:\WINDOWS\Web 2009-08-27 14:54:35 ----HD---- C:\WINDOWS\inf 2009-08-27 14:54:35 ----D---- C:\WINDOWS\twain_32 2009-08-27 14:54:35 ----D---- C:\WINDOWS\Temp 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\wins 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\wbem 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\usmt 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\spool 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\ShellExt 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\Setup 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\ras 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\oobe 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\npp 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\mui 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\icsxml 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\ias 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\export 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\drivers 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\dhcp 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\config 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\3076 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\2052 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\1054 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\1042 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\1041 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\1037 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\1033 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\1031 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\1028 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32\1025 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system32 2009-08-27 14:54:35 ----D---- C:\WINDOWS\system 2009-08-27 14:54:35 ----D---- C:\WINDOWS\security 2009-08-27 14:54:35 ----D---- C:\WINDOWS\Resources 2009-08-27 14:54:35 ----D---- C:\WINDOWS\repair 2009-08-27 14:54:35 ----D---- C:\WINDOWS\Provisioning 2009-08-27 14:54:35 ----D---- C:\WINDOWS\msapps 2009-08-27 14:54:35 ----D---- C:\WINDOWS\msagent 2009-08-27 14:54:35 ----D---- C:\WINDOWS\Media 2009-08-27 14:54:35 ----D---- C:\WINDOWS\java 2009-08-27 14:54:35 ----D---- C:\WINDOWS\Help 2009-08-27 14:54:35 ----D---- C:\WINDOWS\Driver Cache 2009-08-27 14:54:35 ----D---- C:\WINDOWS\Debug 2009-08-27 14:54:35 ----D---- C:\WINDOWS\Cursors 2009-08-27 14:54:35 ----D---- C:\WINDOWS\Connection Wizard 2009-08-27 14:54:35 ----D---- C:\WINDOWS\Config 2009-08-27 14:54:35 ----D---- C:\WINDOWS\AppPatch 2009-08-27 14:54:35 ----D---- C:\WINDOWS\addins 2009-08-27 14:54:35 ----D---- C:\WINDOWS 2009-08-27 14:35:36 ----N---- C:\WINDOWS\system32\ati2sgag.exe 2009-08-27 14:35:22 ----HD---- C:\Program Files\InstallShield Installation Information 2009-08-27 14:26:13 ----D---- C:\Program Files\Common Files\InstallShield 2009-08-27 14:26:05 ----D---- C:\ATI 2009-08-27 14:22:09 ----SHD---- C:\RECYCLER 2009-08-27 13:46:25 ----D---- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla 2009-08-27 13:46:07 ----D---- C:\Program Files\Mozilla Firefox 2009-08-27 13:30:03 ----RSH---- C:\hx.exe 2009-08-27 13:29:01 ----A---- C:\WINDOWS\system32\msrating.dll.mui 2009-08-27 13:29:01 ----A---- C:\WINDOWS\system32\mshta.exe.mui 2009-08-27 13:29:01 ----A---- C:\WINDOWS\system32\ieframe.dll.mui 2009-08-27 13:29:01 ----A---- C:\WINDOWS\system32\iedkcs32.dll.mui 2009-08-27 13:29:01 ----A---- C:\WINDOWS\system32\ie4uinit.exe.mui 2009-08-27 13:28:40 ----D---- C:\Documents and Settings\Administrator\Dane aplikacji\Identities 2009-08-27 13:28:36 ----HD---- C:\Program Files\Uninstall Information 2009-08-27 13:28:31 ----ASH---- C:\Documents and Settings\Administrator\Dane aplikacji\desktop.ini 2009-08-27 13:28:29 ----SD---- C:\Documents and Settings\Administrator\Dane aplikacji\Microsoft 2009-08-27 13:28:16 ----D---- C:\WINDOWS\SoftwareDistribution 2009-08-27 13:28:07 ----SD---- C:\WINDOWS\system32\Microsoft 2009-08-27 13:28:07 ----D---- C:\WINDOWS\Prefetch 2009-08-27 13:28:06 ----A---- C:\WINDOWS\SchedLgU.Txt 2009-08-27 13:19:31 ----HD---- C:\WINDOWS\$hf_mig$ 2009-08-27 13:19:24 ----N---- C:\WINDOWS\system32\spmsg.dll 2009-08-27 13:19:24 ----A---- C:\WINDOWS\system32\spupdsvc.exe 2009-08-27 13:19:08 ----A---- C:\WINDOWS\control.ini 2009-08-27 13:19:08 ----A---- C:\AUTOEXEC.BAT 2009-08-27 13:18:48 ----A---- C:\WINDOWS\OEWABLog.txt 2009-08-27 13:18:42 ----D---- C:\WINDOWS\system32\dllcache 2009-08-27 13:18:42 ----A---- C:\WINDOWS\system32\mapi32.dll 2009-08-27 13:17:20 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest 2009-08-27 13:17:15 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest 2009-08-27 13:17:07 ----HD---- C:\Program Files\WindowsUpdate 2009-08-27 13:17:01 ----D---- C:\Program Files\Usługi online 2009-08-27 13:16:34 ----D---- C:\WINDOWS\system32\DirectX 2009-08-27 13:16:23 ----A---- C:\WINDOWS\system32\atrace.dll 2009-08-27 13:16:20 ----A---- C:\WINDOWS\system32\desktop.ini 2009-08-27 13:16:20 ----A---- C:\WINDOWS\desktop.ini 2009-08-27 13:16:12 ----A---- C:\WINDOWS\system32\nmevtmsg.dll 2009-08-27 13:16:10 ----A---- C:\WINDOWS\system32\acctres.dll 2009-08-27 13:16:09 ----D---- C:\Program Files\Common Files\Services 2009-08-27 13:16:05 ----SD---- C:\WINDOWS\Tasks 2009-08-27 13:16:05 ----A---- C:\WINDOWS\system32\icfgnt5.dll 2009-08-27 13:16:04 ----D---- C:\Program Files\Common Files\MSSoap 2009-08-27 13:15:55 ----D---- C:\WINDOWS\srchasst 2009-08-27 13:15:54 ----D---- C:\WINDOWS\system32\Macromed 2009-08-27 13:15:51 ----A---- C:\WINDOWS\system32\wuweb.dll 2009-08-27 13:15:51 ----A---- C:\WINDOWS\system32\wucltui.dll 2009-08-27 13:15:51 ----A---- C:\WINDOWS\system32\wuauserv.dll 2009-08-27 13:15:51 ----A---- C:\WINDOWS\system32\wuaueng1.dll 2009-08-27 13:15:50 ----A---- C:\WINDOWS\system32\wups.dll 2009-08-27 13:15:50 ----A---- C:\WINDOWS\system32\wuaueng.dll 2009-08-27 13:15:50 ----A---- C:\WINDOWS\system32\wuauclt1.exe 2009-08-27 13:15:50 ----A---- C:\WINDOWS\system32\wuauclt.exe 2009-08-27 13:15:50 ----A---- C:\WINDOWS\system32\wuapi.dll 2009-08-27 13:15:50 ----A---- C:\WINDOWS\system32\bitsprx4.dll 2009-08-27 13:15:50 ----A---- C:\WINDOWS\system32\bitsprx3.dll 2009-08-27 13:15:50 ----A---- C:\WINDOWS\system32\bitsprx2.dll 2009-08-27 13:15:49 ----A---- C:\WINDOWS\system32\qmgrprxy.dll 2009-08-27 13:15:49 ----A---- C:\WINDOWS\system32\qmgr.dll 2009-08-27 13:15:45 ----D---- C:\Program Files\Movie Maker 2009-08-27 13:15:18 ----A---- C:\WINDOWS\system32\safrslv.dll 2009-08-27 13:15:18 ----A---- C:\WINDOWS\system32\safrdm.dll 2009-08-27 13:15:18 ----A---- C:\WINDOWS\system32\safrcdlg.dll 2009-08-27 13:15:17 ----A---- C:\WINDOWS\system32\racpldlg.dll 2009-08-27 13:15:12 ----D---- C:\WINDOWS\system32\Restore 2009-08-27 13:15:12 ----A---- C:\WINDOWS\system32\srsvc.dll 2009-08-27 13:15:12 ----A---- C:\WINDOWS\system32\srrstr.dll 2009-08-27 13:15:12 ----A---- C:\WINDOWS\system32\fltMc.exe 2009-08-27 13:15:12 ----A---- C:\WINDOWS\system32\fltlib.dll 2009-08-27 13:15:11 ----A---- C:\WINDOWS\system32\srclient.dll 2009-08-27 13:15:11 ----A---- C:\WINDOWS\system32\ils.dll 2009-08-27 13:15:10 ----A---- C:\WINDOWS\system32\nmmkcert.dll 2009-08-27 13:15:10 ----A---- C:\WINDOWS\system32\msconf.dll 2009-08-27 13:15:10 ----A---- C:\WINDOWS\system32\mnmsrvc.exe 2009-08-27 13:15:10 ----A---- C:\WINDOWS\system32\mnmdd.dll 2009-08-27 13:15:10 ----A---- C:\WINDOWS\system32\isrdbg32.dll 2009-08-27 13:15:06 ----D---- C:\Program Files\NetMeeting 2009-08-27 13:15:06 ----A---- C:\WINDOWS\system32\msoert2.dll 2009-08-27 13:15:06 ----A---- C:\WINDOWS\system32\msoeacct.dll 2009-08-27 13:15:04 ----A---- C:\WINDOWS\system32\inetres.dll 2009-08-27 13:15:04 ----A---- C:\WINDOWS\system32\inetcomm.dll 2009-08-27 13:15:01 ----D---- C:\Program Files\Outlook Express 2009-08-27 13:15:01 ----A---- C:\WINDOWS\system32\schedsvc.dll 2009-08-27 13:15:01 ----A---- C:\WINDOWS\system32\mstinit.exe 2009-08-27 13:15:01 ----A---- C:\WINDOWS\system32\mstask.dll 2009-08-27 13:15:00 ----A---- C:\WINDOWS\system32\isign32.dll 2009-08-27 13:15:00 ----A---- C:\WINDOWS\system32\inetcfg.dll 2009-08-27 13:15:00 ----A---- C:\WINDOWS\system32\icwphbk.dll 2009-08-27 13:15:00 ----A---- C:\WINDOWS\system32\icwdial.dll 2009-08-27 13:14:52 ----D---- C:\Program Files\Common Files\System 2009-08-27 13:14:50 ----D---- C:\Program Files\Internet Explorer 2009-08-27 13:13:52 ----D---- C:\Program Files\ComPlus Applications 2009-08-27 13:13:50 ----A---- C:\WINDOWS\vbaddin.ini 2009-08-27 13:13:50 ----A---- C:\WINDOWS\vb.ini 2009-08-27 13:13:44 ----D---- C:\WINDOWS\Registration 2009-08-27 13:13:19 ----D---- C:\Program Files\Windows Media Connect 2 2009-08-27 13:13:18 ----D---- C:\Program Files\Windows Media Player 2009-08-27 13:13:16 ----D---- C:\Program Files\Messenger 2009-08-27 13:13:11 ----D---- C:\Program Files\MSN Gaming Zone 2009-08-27 13:13:11 ----A---- C:\WINDOWS\system32\write.exe 2009-08-27 13:12:57 ----A---- C:\WINDOWS\system32\sndvol32.exe 2009-08-27 13:12:57 ----A---- C:\WINDOWS\system32\hticons.dll 2009-08-27 13:12:57 ----A---- C:\WINDOWS\system32\avwav.dll 2009-08-27 13:12:57 ----A---- C:\WINDOWS\system32\avtapi.dll 2009-08-27 13:12:57 ----A---- C:\WINDOWS\system32\avmeter.dll 2009-08-27 13:12:56 ----A---- C:\WINDOWS\system32\winchat.exe 2009-08-27 13:12:47 ----A---- C:\WINDOWS\system32\getuname.dll 2009-08-27 13:12:46 ----A---- C:\WINDOWS\system32\charmap.exe 2009-08-27 13:12:46 ----A---- C:\WINDOWS\system32\calc.exe 2009-08-27 13:12:45 ----A---- C:\WINDOWS\system32\winmine.exe 2009-08-27 13:12:45 ----A---- C:\WINDOWS\system32\sol.exe 2009-08-27 13:12:45 ----A---- C:\WINDOWS\system32\mshearts.exe 2009-08-27 13:12:44 ----A---- C:\WINDOWS\system32\usrlogon.cmd 2009-08-27 13:12:44 ----A---- C:\WINDOWS\system32\tsshutdn.exe 2009-08-27 13:12:44 ----A---- C:\WINDOWS\system32\tslabels.ini 2009-08-27 13:12:44 ----A---- C:\WINDOWS\system32\tskill.exe 2009-08-27 13:12:44 ----A---- C:\WINDOWS\system32\tsdiscon.exe 2009-08-27 13:12:44 ----A---- C:\WINDOWS\system32\tscon.exe 2009-08-27 13:12:44 ----A---- C:\WINDOWS\system32\reset.exe 2009-08-27 13:12:44 ----A---- C:\WINDOWS\system32\freecell.exe 2009-08-27 13:12:43 ----A---- C:\WINDOWS\system32\shadow.exe 2009-08-27 13:12:43 ----A---- C:\WINDOWS\system32\rwinsta.exe 2009-08-27 13:12:43 ----A---- C:\WINDOWS\system32\regini.exe 2009-08-27 13:12:43 ----A---- C:\WINDOWS\system32\rdpcfgex.dll 2009-08-27 13:12:43 ----A---- C:\WINDOWS\system32\qwinsta.exe 2009-08-27 13:12:43 ----A---- C:\WINDOWS\system32\qappsrv.exe 2009-08-27 13:12:43 ----A---- C:\WINDOWS\system32\msg.exe 2009-08-27 13:12:43 ----A---- C:\WINDOWS\system32\logoff.exe 2009-08-27 13:12:42 ----A---- C:\WINDOWS\system32\msdtcprf.ini 2009-08-27 13:12:42 ----A---- C:\WINDOWS\system32\cdmodem.dll 2009-08-27 13:12:34 ----A---- C:\WINDOWS\system32\wmimgmt.msc 2009-08-27 13:12:33 ----A---- C:\WINDOWS\system32\accwiz.exe 2009-08-27 13:12:32 ----A---- C:\WINDOWS\system32\sndrec32.exe 2009-08-27 13:12:32 ----A---- C:\WINDOWS\system32\mplay32.exe 2009-08-27 13:12:32 ----A---- C:\WINDOWS\system32\hypertrm.dll 2009-08-27 13:12:31 ----D---- C:\Program Files\Windows NT 2009-08-27 13:12:31 ----A---- C:\WINDOWS\system32\mspaint.exe 2009-08-27 13:12:31 ----A---- C:\WINDOWS\system32\clipbrd.exe 2009-08-27 13:12:30 ----A---- C:\WINDOWS\system32\spider.exe 2009-08-27 13:12:29 ----A---- C:\WINDOWS\system32\tsgqec.dll 2009-08-27 13:12:29 ----A---- C:\WINDOWS\system32\tscfgwmi.dll 2009-08-27 13:12:28 ----A---- C:\WINDOWS\system32\rhttpaa.dll 2009-08-27 13:12:28 ----A---- C:\WINDOWS\system32\aaclient.dll 2009-08-27 13:12:27 ----A---- C:\WINDOWS\system32\remotepg.dll 2009-08-27 13:12:27 ----A---- C:\WINDOWS\system32\rdsaddin.exe 2009-08-27 13:12:27 ----A---- C:\WINDOWS\system32\mstscax.dll 2009-08-27 13:12:27 ----A---- C:\WINDOWS\system32\mstsc.exe 2009-08-27 13:12:26 ----A---- C:\WINDOWS\system32\termsrv.dll 2009-08-27 13:12:26 ----A---- C:\WINDOWS\system32\sessmgr.exe 2009-08-27 13:12:26 ----A---- C:\WINDOWS\system32\rdshost.exe 2009-08-27 13:12:26 ----A---- C:\WINDOWS\system32\rdpwsx.dll 2009-08-27 13:12:26 ----A---- C:\WINDOWS\system32\rdpsnd.dll 2009-08-27 13:12:26 ----A---- C:\WINDOWS\system32\rdpclip.exe 2009-08-27 13:12:26 ----A---- C:\WINDOWS\system32\rdchost.dll 2009-08-27 13:12:26 ----A---- C:\WINDOWS\system32\qprocess.exe 2009-08-27 13:12:25 ----D---- C:\WINDOWS\system32\MsDtc 2009-08-27 13:12:25 ----A---- C:\WINDOWS\system32\mtxoci.dll 2009-08-27 13:12:25 ----A---- C:\WINDOWS\system32\msdtcuiu.dll 2009-08-27 13:12:25 ----A---- C:\WINDOWS\system32\icaapi.dll 2009-08-27 13:12:25 ----A---- C:\WINDOWS\system32\cfgbkend.dll 2009-08-27 13:12:24 ----A---- C:\WINDOWS\system32\xolehlp.dll 2009-08-27 13:12:24 ----A---- C:\WINDOWS\system32\msdtctm.dll 2009-08-27 13:12:24 ----A---- C:\WINDOWS\system32\msdtcprx.dll 2009-08-27 13:12:24 ----A---- C:\WINDOWS\system32\msdtclog.dll 2009-08-27 13:12:24 ----A---- C:\WINDOWS\system32\msdtc.exe 2009-08-27 13:12:22 ----D---- C:\WINDOWS\system32\Com 2009-08-27 13:12:22 ----A---- C:\WINDOWS\system32\mtxlegih.dll 2009-08-27 13:12:22 ----A---- C:\WINDOWS\system32\mtxex.dll 2009-08-27 13:12:22 ----A---- C:\WINDOWS\system32\mtxdm.dll 2009-08-27 13:12:22 ----A---- C:\WINDOWS\system32\dcomcnfg.exe 2009-08-27 13:12:22 ----A---- C:\WINDOWS\system32\comrepl.dll 2009-08-27 13:12:22 ----A---- C:\WINDOWS\system32\comaddin.dll 2009-08-27 13:12:22 ----A---- C:\WINDOWS\system32\colbact.dll 2009-08-27 13:12:21 ----A---- C:\WINDOWS\system32\stclient.dll 2009-08-27 13:12:21 ----A---- C:\WINDOWS\system32\clbcatex.dll 2009-08-27 13:12:21 ----A---- C:\WINDOWS\system32\catsrvut.dll 2009-08-27 13:12:21 ----A---- C:\WINDOWS\system32\catsrvps.dll 2009-08-27 13:12:21 ----A---- C:\WINDOWS\system32\catsrv.dll 2009-08-27 13:12:20 ----A---- C:\WINDOWS\system32\comsvcs.dll 2009-08-27 13:12:19 ----A---- C:\WINDOWS\system32\comuid.dll 2009-08-27 13:12:19 ----A---- C:\WINDOWS\system32\comsnap.dll 2009-08-27 13:12:19 ----A---- C:\WINDOWS\system32\clbcatq.dll 2009-08-27 13:12:10 ----A---- C:\WINDOWS\system32\servdeps.dll 2009-08-27 13:12:10 ----A---- C:\WINDOWS\system32\mmfutil.dll 2009-08-27 13:12:10 ----A---- C:\WINDOWS\system32\licwmi.dll 2009-08-27 13:12:10 ----A---- C:\WINDOWS\system32\cmprops.dll ======List of files/folders modified in the last 1 months====== 2009-08-28 00:55:41 ----A---- C:\WINDOWS\win.ini 2009-08-27 16:36:34 ----A---- C:\WINDOWS\system.ini ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 AmdK7;Sterownik procesora AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2009-06-30 41856] R1 StyleXPHelper;StyleXPHelper; \??\C:\Program Files\TGTSoft\StyleXP\StyleXPHelper.exe [] R3 Arp1394;Protokół klienta 1394 ARP; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2009-06-30 60800] R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2007-07-28 2371584] R3 ctljystk;Port gier dla karty Creative SB Live!; C:\WINDOWS\system32\DRIVERS\ctljystk.sys [2001-08-17 3712] R3 emu10k;Creative SB Live! (WDM); C:\WINDOWS\system32\drivers\emu10k1m.sys [2001-08-17 283904] R3 emu10k1;Sterownik Creative Interface Manager (WDM); C:\WINDOWS\system32\drivers\ctlfacem.sys [2001-08-17 6912] R3 FETNDIS;Sterownik NT karty VIA PCI 10/100Mb Fast Ethernet; C:\WINDOWS\system32\DRIVERS\fetnd5.sys [2001-08-17 27165] R3 HPZid412;IEEE-1284.4 Driver HPZid412; C:\WINDOWS\system32\DRIVERS\HPZid412.sys [2007-03-07 49920] R3 HPZipr12;Print Class Driver for IEEE-1284.4 HPZipr12; C:\WINDOWS\system32\DRIVERS\HPZipr12.sys [2007-03-07 16496] R3 HPZius12;USB to IEEE-1284.4 Translation Driver HPZius12; C:\WINDOWS\system32\DRIVERS\HPZius12.sys [2007-03-07 21568] R3 ms_mpu401;Sterownik portu MIDI UART Microsoft MPU-401; C:\WINDOWS\system32\drivers\msmpu401.sys [2001-08-17 2944] R3 NIC1394;Sterownik sieci 1394; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2009-06-30 61824] R3 sfman;Sterownik Creative SoundFont Manager (WDM); C:\WINDOWS\system32\drivers\sfmanm.sys [2001-08-17 36480] R3 usbccgp;Rodzajowy sterownik nadrzędny USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-15 32128] R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-15 30208] R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-15 59520] R3 usbprint;Klasa PRINTER USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-14 25856] R3 usbscan;Sterownik skanera USB; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104] R3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-15 20608] S3 afsuu4k4;afsuu4k4; C:\WINDOWS\system32\drivers\afsuu4k4.sys [] S3 NPPTNT2;NPPTNT2; \??\C:\WINDOWS\system32\npptNT2.sys [] S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2009-06-30 77568] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2009-06-30 82944] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2007-07-28 483328] R2 hpqddsvc;Usługa HP CUE DeviceDiscovery; C:\WINDOWS\system32\svchost.exe [2008-04-15 14336] R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2009-08-28 152984] R2 Net Driver HPZ12;Net Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-15 14336] R2 Pml Driver HPZ12;Pml Driver HPZ12; C:\WINDOWS\System32\svchost.exe [2008-04-15 14336] R2 StyleXPService;StyleXPService; C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe [2006-05-24 372736] R3 hpqcxs08;hpqcxs08; C:\WINDOWS\system32\svchost.exe [2008-04-15 14336] S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2007-07-27 593920] S3 npggsvc;nProtect GameGuard Service; C:\WINDOWS\system32\GameMon.des [2009-08-27 3471608] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136] S3 WMPNetworkSvc;Usługa udostępniania w sieci programu Windows Media Player; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-12-01 918016] S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-15 14336] -----------------EOF-----------------

Z góry dziękuje

**Posty:** 18165 · przez **wojtas** 28 Sie 2009, 20:44

Pobierz OTL i daj z niego loga

**Posty:** 7 · przez **Tohokami** 28 Sie 2009, 21:06

http://wklej.org/id/141808/ Proszę.

**Posty:** 18165 · przez **wojtas** 29 Sie 2009, 14:45

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-725345543-1767777339-842925246-500..\Run: [cdoosoft] C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\herss.exe ()
O32 - AutoRun File - [2009-08-28 21:00:44 | 00,000,051 | RHS- | M] () - C:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-08-28 21:00:44 | 00,000,051 | RHS- | M] () - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2009-08-28 21:00:44 | 00,000,051 | RHS- | M] () - F:\autorun.inf -- [ NTFS ]
O33 - MountPoints2\{421fc6b9-9308-11de-8933-806d6172696f}\Shell\AutoRun\command - "" = D:\hx.exe -- [2009-08-27 13:30:32 | 00,113,233 | RHS- | M] ()
O33 - MountPoints2\{421fc6b9-9308-11de-8933-806d6172696f}\Shell\open\Command - "" = D:\hx.exe -- [2009-08-27 13:30:32 | 00,113,233 | RHS- | M] ()
O33 - MountPoints2\{421fc6bb-9308-11de-8933-806d6172696f}\Shell\AutoRun\command - "" = C:\hx.exe -- [2009-08-27 13:30:32 | 00,113,233 | RHS- | M] ()
O33 - MountPoints2\{421fc6bb-9308-11de-8933-806d6172696f}\Shell\open\Command - "" = C:\hx.exe -- [2009-08-27 13:30:32 | 00,113,233 | RHS- | M] ()
O33 - MountPoints2\{c250dfb3-92fc-11de-8696-000c7686a9ce}\Shell\AutoRun\command - "" = F:\hx.exe -- [2009-08-27 13:30:32 | 00,113,233 | RHS- | M] ()
O33 - MountPoints2\{c250dfb3-92fc-11de-8696-000c7686a9ce}\Shell\open\Command - "" = F:\hx.exe -- [2009-08-27 13:30:32 | 00,113,233 | RHS- | M] ()

:Files
C:\hx.exe
D:\hx.exe
F:\hx.exe

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db1b3e60-05ac-11de-a5d3-00001cd72a97}]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .

Następnie uruchamiasz OTL z opcją Run Scan. Pokazujesz nowy log OTL.txt oraz raport z czyszczenia kompa

**Posty:** 7 · przez **Tohokami** 29 Sie 2009, 16:35

http://wklej.org/id/142060/

Niewiem czy to o to Ci chodziło z tym raportem

Kod: Zaznacz wszystko: All processes killed ========== OTL ========== No active process named explorer.exe was found! Registry value HKEY_USERS\S-1-5-21-725345543-1767777339-842925246-500\Software\Microsoft\Windows\CurrentVersion\Run\\cdoosoft deleted successfully. C:\Documents and Settings\Administrator\Ustawienia lokalne\Temp\herss.exe moved successfully. C:\autorun.inf moved successfully. D:\autorun.inf moved successfully. F:\autorun.inf moved successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{421fc6b9-9308-11de-8933-806d6172696f}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{421fc6b9-9308-11de-8933-806d6172696f}\ not found. D:\hx.exe moved successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{421fc6b9-9308-11de-8933-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{421fc6b9-9308-11de-8933-806d6172696f}\ not found. File D:\hx.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{421fc6bb-9308-11de-8933-806d6172696f}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{421fc6bb-9308-11de-8933-806d6172696f}\ not found. C:\hx.exe moved successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{421fc6bb-9308-11de-8933-806d6172696f}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{421fc6bb-9308-11de-8933-806d6172696f}\ not found. File C:\hx.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c250dfb3-92fc-11de-8696-000c7686a9ce}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c250dfb3-92fc-11de-8696-000c7686a9ce}\ not found. F:\hx.exe moved successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{c250dfb3-92fc-11de-8696-000c7686a9ce}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c250dfb3-92fc-11de-8696-000c7686a9ce}\ not found. File F:\hx.exe not found. ========== FILES ========== File\Folder C:\hx.exe not found. File\Folder D:\hx.exe not found. File\Folder F:\hx.exe not found. ========== REGISTRY ========== Registry key HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db1b3e60-05ac-11de-a5d3-00001cd72a97}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{db1b3e60-05ac-11de-a5d3-00001cd72a97}\ not found. HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"SuperHidden"|dword:00000001 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"Hidden"|dword:00000001 /E : value set successfully! HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\\"ShowSuperHidden"|dword:00000001 /E : value set successfully! HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\\"CheckedValue"|dword:00000001 /E : value set successfully! Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden\ deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden\\@|"" /E : value set successfully! ========== COMMANDS ========== [EMPTYTEMP] User: Administrator ->Temp folder emptied: 91042982 bytes ->Temporary Internet Files folder emptied: 2440282 bytes ->Java cache emptied: 13553543 bytes ->FireFox cache emptied: 88636661 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: LocalService ->Temp folder emptied: 0 bytes File delete failed. C:\Documents and Settings\LocalService\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat scheduled to be deleted on reboot. ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes Windows Temp folder emptied: 632463 bytes RecycleBin emptied: 23940622 bytes Total Files Cleaned = 210,14 mb OTL by OldTimer - Version 3.0.10.7 log created on 08292009_150338 Files\Folders moved on Reboot... Registry entries deleted on Reboot...

Pliki ukryte już widać ;]

**Posty:** 18165 · przez **wojtas** 30 Sie 2009, 11:31

1.Uruchom OTL z opcji CleanUp
2. wykonaj optymalizację windowsa
3.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem]
4. zrób skan Malwarebytes Anti-Malware (usuń co znajdzie )

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

**Posty:** 7 · przez **Tohokami** 30 Sie 2009, 18:16

Proszę

Kod: Zaznacz wszystko: -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7.0: raport skanowania niedziela, 30 sierpień 2009 System operacyjny: Microsoft Windows XP Professional Dodatek Service Pack 3 (build 2600) Wersja Kaspersky Online Scanner: 7.0.26.13 Data ostatniej aktualizacji baz danych: Sunday, August 30, 2009 14:44:38 Liczba wpisów: 2729016 -------------------------------------------------------------------------------- Ustawienia skanowania: typ baz danych użytych do skanowania: rozszerzone Skanuj archiwa: tak Skanuj pocztowe bazy danych: tak Obszar skanowania - Mój komputer: A:\ C:\ D:\ E:\ F:\ G:\ Statystyki skanowania: Przeskanowanych obiektów: 73055 Wykrytych zagrożeń: 3 Wyykrytych zainfekowanych obiektów: 5 Wykrytych podejrzanych obiektów: 0 Czas skanowania: 03:04:11 Nazwa pliku / Zagrożenie / Liczba zagrożeń C:\t8s2x.exe Zainfekowanych: Trojan-GameThief.Win32.Magania.bxsg 1 D:\t8s2x.exe Zainfekowanych: Trojan-GameThief.Win32.Magania.bxsg 1 F:\g8k.exe Zainfekowanych: Worm.Win32.AutoRun.aust 1 F:\kgji.exe Zainfekowanych: Trojan-GameThief.Win32.Magania.bwoy 1 F:\t8s2x.exe Zainfekowanych: Trojan-GameThief.Win32.Magania.bxsg 1 Wybrany obszar został przeskanowany.

**Posty:** 18165 · przez **wojtas** 30 Sie 2009, 18:33

Uruchom OTL i w oknie Custom Scans/Fixes wklej :

:OTL
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)

:Files
C:\t8s2x.exe
D:\t8s2x.exe
F:\g8k.exe
F:\kgji.exe
F:\t8s2x.exe

:Reg
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{db1b3e60-05ac-11de-a5d3-00001cd72a97}]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"SuperHidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden"=dword:00000001
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"ShowSuperHidden"=dword:00000001
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\SuperHidden\Policy\DontShowSuperHidden]
@=""

:Commands
[emptytemp]
[start explorer]
[Reboot]

Kliknij w Run Fix. I potwierdz reset kompa .

Autor postu otrzymał pochwałę

**Posty:** 7 · przez **Tohokami** 31 Sie 2009, 11:31

Dziękuj już po problemie. A wirusy przeniosło do folderu _OTL (na dysku C) usunąłem i już ich niema skan już potem nic nie wykrył, jak by jeszcze coś sie działo napiszę ;]

Kto jest na forum