Menedżer zadań został wyłączony przez administratora

**Posty:** 31 · przez **zgorzelice** 22 Gru 2008, 14:47

Witam.
Mam dwa trojany które blokują mi edycje rejestru i menedżer zadań. Gdy chce włączyć menedżer zadań wyskakuje mi "Menedżer zadań został wyłączony przez administratora" a gdy chce edytować rejestr "Edycja rejestru została wyłączona przez administratora sieci". Czytałem, że trzeba robić coś z logami, tylko że ComboFix mi się nie włączy, wyskakuje: "Ukończono tylko część żądania ReadProcesMemory lub WriteProcesMemory". Na innym forum znalazłem, że pomóć może program Trojan Remover. Znajduje mi sie trojany ale nie wiem dlaczego ich nie usuwa.
Kompa mam właśnie po formacie.
Proszę o pomoc

Tu macie focie, żę trojan remover je wyszukuje:

**Posty:** 684 · przez **djarta** 22 Gru 2008, 14:49

Daj log z ComboFixa + SDFixa.

===========
K.

**Posty:** 31 · przez **zgorzelice** 22 Gru 2008, 15:36

ComboFix mi sie nie uruchomi, wyskakuje "Ukończono tylko część żądania ReadProcesMemory lub WriteProcesMemory".

SDFix:

Kod: Zaznacz wszystko: a-squared Command Line Scanner - Version 4.0 Last update: N/A Scan settings: Objects: Memory, Traces, Cookies, C: Scan archives: On Heuristics: Off ADS Scan: On Scan start: 2008-12-22 14:03:47 [164] C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\scupl.exe detected: Virus.Win32.Sality!IK [1508] C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\wincugfbk.exe detected: Virus.Win32.Sality!IK C:\Documents and Settings\dibi kuper\Pulpit\SDFix.exe detected: Virus.Win32.Sality!IK C:\Documents and Settings\dibi kuper\Ustawienia lokalne\Temp\scupl.exe detected: Virus.Win32.Sality!IK C:\Documents and Settings\dibi kuper\Ustawienia lokalne\Temp\wincugfbk.exe detected: Virus.Win32.Sality!IK C:\NVIDIA\Win2KXP\94.24\nvudisp.exe detected: Virus.Win32.Sality!IK C:\Program Files\Adobe\Acrobat 7.0\Setup Files\RdrBig708\ENU\instmsiw.exe detected: Virus.Win32.Sality!IK C:\SDFix\apps\Process.exe detected: Riskware.RiskTool.Win32.Processor.20!A2 Scanned Files: 19009 Traces: 310528 Cookies: 5 Processes: 23 Found Files: 6 Traces: 0 Cookies: 0 Processes: 2 Quarantined Files: 6 Traces: 0 Cookies: 0 Processes: 0 Scan end: 2008-12-22 14:33:36 Scan time: 0:29:49

**Posty:** 18165 · przez **wojtas** 22 Gru 2008, 17:03

zle wykonany sdfix, daj loga z rsita

**Posty:** 31 · przez **zgorzelice** 22 Gru 2008, 17:13

Kod: Zaznacz wszystko: Logfile of random's system information tool 1.05 (written by random/random) Run by dibi kuper at 2008-12-22 16:12:10 Microsoft Windows XP Professional Dodatek Service Pack 2 System drive C: has 6 GB (55%) free of 10 GB Total RAM: 1023 MB (70% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 16:12:16, on 2008-12-22 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\SOUNDMAN.EXE C:\WINDOWS\system32\ctfmon.exe D:\PROGRAMY\AdobeReader\Reader\reader_sl.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\System32\svchost.exe D:\PROGRAMY\Gadu-Gadu\gg.exe D:\PROGRAMY\Opera\Opera.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\ustw.exe C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winxqtim.exe C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\hibnt.exe C:\Documents and Settings\dibi kuper\Pulpit\RSIT.exe C:\Program Files\trend micro\dibi kuper.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\PROGRAMY\AdobeReader\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [TrojanScanner] D:\PROGRAMY\Trojan Remover\Trjscan.exe /boot O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\PROGRAMY\AdobeReader\Reader\reader_sl.exe O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe -- End of file - 2683 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] Adobe PDF Reader Link Helper - D:\PROGRAMY\AdobeReader\ActiveX\AcroIEHelper.dll [2006-01-12 63128] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-04-19 7700480] "nwiz"=nwiz.exe /install [] "NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2007-04-19 86016] "TrojanScanner"=D:\PROGRAMY\Trojan Remover\Trjscan.exe [2008-12-10 1230728] "NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe [2001-07-09 225280] "SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2007-04-16 577536] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2004-08-03 15360] C:\Documents and Settings\All Users\Menu Start\Programy\Autostart Adobe Reader Speed Launch.lnk - D:\PROGRAMY\AdobeReader\Reader\reader_sl.exe [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System] "DisableTaskMgr"=1 "DisableRegistryTools"=1 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 "EnableLUA"=0 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=0 "NoRecycleFiles"=0 "NoWelcomeScreen"=0 "NoStartMenuEjectPC"=0 [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoStartMenuEjectPC"= [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "D:\PROGRAMY\Instalki\install_flash_player_10_active_x.exe"="D:\PROGRAMY\Instalki\install_flash_player_10_active_x.exe:*:Enabled:ipsec" "C:\WINDOWS\Explorer.EXE"="C:\WINDOWS\Explorer.EXE:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\exysbo.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\exysbo.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\dgeo.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\dgeo.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winkgdaeb.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winkgdaeb.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winfkdu.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winfkdu.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\wincemh.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\wincemh.exe:*:Enabled:ipsec" "C:\WINDOWS\system32\nwiz.exe"="C:\WINDOWS\system32\nwiz.exe:*:Enabled:ipsec" "C:\WINDOWS\system32\netsh.exe"="C:\WINDOWS\system32\netsh.exe:*:Enabled:ipsec" "C:\WINDOWS\system32\userinit.exe"="C:\WINDOWS\system32\userinit.exe:*:Enabled:ipsec" "C:\WINDOWS\system32\RUNDLL32.EXE"="C:\WINDOWS\system32\RUNDLL32.EXE:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winddisq.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winddisq.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winunilqp.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winunilqp.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winpovp.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winpovp.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\pdyak.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\pdyak.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winskyvj.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winskyvj.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winuaxxj.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winuaxxj.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winkvfbn.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winkvfbn.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\lvcd.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\lvcd.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\kscy.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\kscy.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winxlqiha.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winxlqiha.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\wingttcj.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\wingttcj.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winwxgsup.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winwxgsup.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winlratma.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winlratma.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\fmre.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\fmre.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\udmq.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\udmq.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winddijh.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winddijh.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\kqpky.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\kqpky.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\vamdb.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\vamdb.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\wininuhhh.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\wininuhhh.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winurcjp.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winurcjp.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winaela.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winaela.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\wingotom.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\wingotom.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\dtuakt.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\dtuakt.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winuprcnw.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winuprcnw.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\enheh.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\enheh.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\cxhc.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\cxhc.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\wingjfgu.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\wingjfgu.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winauwj.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winauwj.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\elir.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\elir.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\scupl.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\scupl.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\wincugfbk.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\wincugfbk.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winccjdg.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winccjdg.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\xlyw.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\xlyw.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winhymhq.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winhymhq.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winytgg.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winytgg.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winlbuv.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winlbuv.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winpvqf.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winpvqf.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winsyhc.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winsyhc.exe:*:Enabled:ipsec" "D:\PROGRAMY\AdobeReader\Reader\reader_sl.exe"="D:\PROGRAMY\AdobeReader\Reader\reader_sl.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\jiloq.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\jiloq.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\windircm.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\windircm.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\diocpx.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\diocpx.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winkiase.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winkiase.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\nqhg.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\nqhg.exe:*:Enabled:ipsec" "D:\PROGRAMY\Opera\Opera.exe"="D:\PROGRAMY\Opera\Opera.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winbxhnkj.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winbxhnkj.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winqgmgr.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winqgmgr.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\ketnxt.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\ketnxt.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\wiflv.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\wiflv.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\ustw.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\ustw.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winxqtim.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winxqtim.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\hibnt.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\hibnt.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\tlxi.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\tlxi.exe:*:Enabled:ipsec" "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winpynshb.exe"="C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp\winpynshb.exe:*:Enabled:ipsec" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" ======List of files/folders created in the last 1 months====== 2008-12-22 16:12:10 ----D---- C:\rsit 2008-12-22 16:12:10 ----D---- C:\Program Files\trend micro 2008-12-22 15:07:47 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$ 2008-12-22 15:07:43 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$ 2008-12-22 15:07:38 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$ 2008-12-22 15:07:33 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$ 2008-12-22 15:07:28 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$ 2008-12-22 15:07:23 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$ 2008-12-22 15:07:18 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$ 2008-12-22 15:07:06 ----HDC---- C:\WINDOWS\$NtUninstallKB958215$ 2008-12-22 15:06:59 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$ 2008-12-22 15:06:53 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$ 2008-12-22 15:06:48 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$ 2008-12-22 15:06:39 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$ 2008-12-22 15:06:32 ----HDC---- C:\WINDOWS\$NtUninstallKB960714$ 2008-12-22 15:06:27 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$ 2008-12-22 15:06:22 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$ 2008-12-22 15:06:17 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$ 2008-12-22 15:06:12 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$ 2008-12-22 15:06:08 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$ 2008-12-22 15:06:04 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$ 2008-12-22 15:05:59 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$ 2008-12-22 15:05:54 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$ 2008-12-22 15:05:49 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$ 2008-12-22 15:05:42 ----HDC---- C:\WINDOWS\$NtUninstallKB944338-v2$ 2008-12-22 15:01:26 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-12-22 14:40:27 ----A---- C:\WINDOWS\system32\ChCfg.exe 2008-12-22 14:39:57 ----A---- C:\WINDOWS\system32\ksuser.dll 2008-12-22 14:39:48 ----D---- C:\Program Files\Realtek AC97 2008-12-22 14:39:47 ----A---- C:\WINDOWS\system32\RTLCPL.exe 2008-12-22 14:39:45 ----A---- C:\WINDOWS\system32\RtlCPAPI.dll 2008-12-22 14:39:45 ----A---- C:\WINDOWS\soundman.exe 2008-12-22 14:39:45 ----A---- C:\WINDOWS\alcupd.exe 2008-12-22 14:39:45 ----A---- C:\WINDOWS\Alcrmv.exe 2008-12-22 14:39:44 ----HD---- C:\Program Files\InstallShield Installation Information 2008-12-22 14:37:42 ----A---- C:\WINDOWS\system32\TwnLib20.dll 2008-12-22 14:37:39 ----A---- C:\WINDOWS\system32\picn20.dll 2008-12-22 14:37:38 ----A---- C:\WINDOWS\system32\imagx5.dll 2008-12-22 14:37:38 ----A---- C:\WINDOWS\system32\imagr5.dll 2008-12-22 14:37:37 ----A---- C:\WINDOWS\system32\ImagXpr5.dll 2008-12-22 14:37:36 ----D---- C:\Program Files\Common Files\Ahead 2008-12-22 14:37:36 ----A---- C:\WINDOWS\system32\NeroCheck.exe 2008-12-22 13:59:08 ----D---- C:\SDFix 2008-12-22 13:52:38 ----D---- C:\Documents and Settings\dibi kuper\Dane aplikacji\Macromedia 2008-12-22 13:52:38 ----D---- C:\Documents and Settings\dibi kuper\Dane aplikacji\Adobe 2008-12-22 13:51:55 ----A---- C:\WINDOWS\system32\ff_vfw.dll.manifest 2008-12-22 13:51:54 ----A---- C:\WINDOWS\system32\pthreadGC2.dll 2008-12-22 13:51:54 ----A---- C:\WINDOWS\system32\ff_vfw.dll 2008-12-22 13:34:27 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Simply Super Software 2008-12-22 13:25:24 ----A---- C:\WINDOWS\system32\VB6STKIT.DLL 2008-12-22 13:25:24 ----A---- C:\WINDOWS\system32\VB5DB.DLL 2008-12-22 12:40:51 ----A---- C:\WINDOWS\system32\h323log.txt 2008-12-22 12:38:26 ----A---- C:\WINDOWS\system32\usbui.dll 2008-12-22 12:37:20 ----A---- C:\WINDOWS\imsins.BAK 2008-12-22 12:37:17 ----SHD---- C:\WINDOWS\Installer 2008-12-22 12:37:17 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2008-12-22 12:37:16 ----D---- C:\Program Files\Common Files\ODBC 2008-12-22 12:37:16 ----A---- C:\WINDOWS\ODBCINST.INI 2008-12-22 12:37:13 ----RD---- C:\Program Files 2008-12-22 12:37:13 ----D---- C:\Program Files\Common Files\SpeechEngines 2008-12-22 12:37:13 ----D---- C:\Program Files\Common Files\Microsoft Shared 2008-12-22 12:37:13 ----D---- C:\Program Files\Common Files 2008-12-22 12:37:06 ----RA---- C:\WINDOWS\system32\kbdtuq.dll 2008-12-22 12:37:06 ----RA---- C:\WINDOWS\system32\kbdtuf.dll 2008-12-22 12:37:06 ----RA---- C:\WINDOWS\system32\kbdazel.dll 2008-12-22 12:37:04 ----RA---- C:\WINDOWS\system32\kbduzb.dll 2008-12-22 12:37:04 ----RA---- C:\WINDOWS\system32\kbdur.dll 2008-12-22 12:37:04 ----RA---- C:\WINDOWS\system32\kbdtat.dll 2008-12-22 12:37:04 ----RA---- C:\WINDOWS\system32\kbdmon.dll 2008-12-22 12:37:04 ----RA---- C:\WINDOWS\system32\kbdkyr.dll 2008-12-22 12:37:04 ----RA---- C:\WINDOWS\system32\kbdkaz.dll 2008-12-22 12:37:04 ----RA---- C:\WINDOWS\system32\kbdaze.dll 2008-12-22 12:37:03 ----RA---- C:\WINDOWS\system32\kbdycc.dll 2008-12-22 12:37:03 ----RA---- C:\WINDOWS\system32\kbdru1.dll 2008-12-22 12:37:03 ----RA---- C:\WINDOWS\system32\kbdru.dll 2008-12-22 12:37:03 ----RA---- C:\WINDOWS\system32\kbdbu.dll 2008-12-22 12:37:03 ----RA---- C:\WINDOWS\system32\kbdblr.dll 2008-12-22 12:37:01 ----RA---- C:\WINDOWS\system32\kbdhept.dll 2008-12-22 12:37:01 ----RA---- C:\WINDOWS\system32\kbdhela3.dll 2008-12-22 12:37:01 ----RA---- C:\WINDOWS\system32\kbdhela2.dll 2008-12-22 12:37:01 ----RA---- C:\WINDOWS\system32\kbdhe319.dll 2008-12-22 12:37:01 ----RA---- C:\WINDOWS\system32\kbdhe220.dll 2008-12-22 12:37:01 ----RA---- C:\WINDOWS\system32\kbdhe.dll 2008-12-22 12:37:01 ----RA---- C:\WINDOWS\system32\kbdgkl.dll 2008-12-22 12:36:59 ----RA---- C:\WINDOWS\system32\kbdlv1.dll 2008-12-22 12:36:59 ----RA---- C:\WINDOWS\system32\kbdlv.dll 2008-12-22 12:36:59 ----RA---- C:\WINDOWS\system32\kbdlt1.dll 2008-12-22 12:36:59 ----RA---- C:\WINDOWS\system32\kbdlt.dll 2008-12-22 12:36:59 ----RA---- C:\WINDOWS\system32\kbdest.dll 2008-12-22 12:36:55 ----A---- C:\WINDOWS\system32\kbdycl.dll 2008-12-22 12:36:55 ----A---- C:\WINDOWS\system32\kbdsl1.dll 2008-12-22 12:36:55 ----A---- C:\WINDOWS\system32\kbdsl.dll 2008-12-22 12:36:55 ----A---- C:\WINDOWS\system32\kbdro.dll 2008-12-22 12:36:55 ----A---- C:\WINDOWS\system32\kbdhu1.dll 2008-12-22 12:36:55 ----A---- C:\WINDOWS\system32\kbdhu.dll 2008-12-22 12:36:55 ----A---- C:\WINDOWS\system32\kbdcz2.dll 2008-12-22 12:36:55 ----A---- C:\WINDOWS\system32\kbdcz1.dll 2008-12-22 12:36:55 ----A---- C:\WINDOWS\system32\kbdcz.dll 2008-12-22 12:36:55 ----A---- C:\WINDOWS\system32\kbdcr.dll 2008-12-22 12:36:55 ----A---- C:\WINDOWS\system32\KBDAL.DLL 2008-12-22 12:36:54 ----A---- C:\WINDOWS\system32\spxcoins.dll 2008-12-22 12:36:54 ----A---- C:\WINDOWS\system32\irclass.dll 2008-12-22 12:36:54 ----A---- C:\WINDOWS\system32\dgsetup.dll 2008-12-22 12:36:54 ----A---- C:\WINDOWS\system32\dgrpsetu.dll 2008-12-22 12:36:53 ----A---- C:\WINDOWS\system32\EqnClass.Dll 2008-12-22 12:36:51 ----N---- C:\WINDOWS\system32\CONFIG.TMP 2008-12-22 12:36:51 ----A---- C:\WINDOWS\TASKMAN.EXE 2008-12-22 12:36:51 ----A---- C:\WINDOWS\system32\batt.dll 2008-12-22 12:36:50 ----A---- C:\WINDOWS\NOTEPAD.EXE 2008-12-22 12:36:49 ----A---- C:\WINDOWS\system32\storprop.dll 2008-12-22 12:36:41 ----ASH---- C:\Documents and Settings\All Users\Dane aplikacji\desktop.ini 2008-12-22 12:36:36 ----RA---- C:\WINDOWS\SET8.tmp 2008-12-22 12:36:33 ----RA---- C:\WINDOWS\SET4.tmp 2008-12-22 12:36:32 ----RA---- C:\WINDOWS\SET3.tmp 2008-12-22 12:36:27 ----D---- C:\WINDOWS\system32\CatRoot2 2008-12-22 12:36:27 ----D---- C:\WINDOWS\system32\CatRoot 2008-12-22 12:36:21 ----SD---- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft 2008-12-22 12:36:00 ----A---- C:\WINDOWS\setuplog.txt 2008-12-22 12:35:56 ----D---- C:\Documents and Settings 2008-12-22 12:35:55 ----SHD---- C:\System Volume Information 2008-12-22 12:35:13 ----SH---- C:\boot.ini 2008-12-22 12:33:32 ----AD---- C:\Documents and Settings\All Users\Dane aplikacji\TEMP 2008-12-22 12:30:48 ----A---- C:\WINDOWS\system32\ztvunrar36.dll 2008-12-22 12:30:48 ----A---- C:\WINDOWS\system32\ztvunace26.dll 2008-12-22 12:30:48 ----A---- C:\WINDOWS\system32\ztvcabinet.dll 2008-12-22 12:30:48 ----A---- C:\WINDOWS\system32\unrar3.dll 2008-12-22 12:30:48 ----A---- C:\WINDOWS\system32\unacev2.dll 2008-12-22 12:30:46 ----D---- C:\Documents and Settings\dibi kuper\Dane aplikacji\Simply Super Software 2008-12-22 12:30:10 ----RSHDC---- C:\WINDOWS\system32\dllcache 2008-12-22 12:30:10 ----RSD---- C:\WINDOWS\Fonts 2008-12-22 12:30:10 ----RD---- C:\WINDOWS\Web 2008-12-22 12:30:10 ----HD---- C:\WINDOWS\inf 2008-12-22 12:30:10 ----D---- C:\WINDOWS\WinSxS 2008-12-22 12:30:10 ----D---- C:\WINDOWS\twain_32 2008-12-22 12:30:10 ----D---- C:\WINDOWS\Temp 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\wins 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\wbem 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\usmt 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\spool 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\ShellExt 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\Setup 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\ras 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\oobe 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\npp 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\mui 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\inetsrv 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\IME 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\icsxml 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\ias 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\export 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\drivers 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\dhcp 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\config 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\3com_dmi 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\3076 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\2052 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\1054 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\1045 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\1042 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\1041 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\1037 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\1033 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\1031 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\1028 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32\1025 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system32 2008-12-22 12:30:10 ----D---- C:\WINDOWS\system 2008-12-22 12:30:10 ----D---- C:\WINDOWS\security 2008-12-22 12:30:10 ----D---- C:\WINDOWS\Resources 2008-12-22 12:30:10 ----D---- C:\WINDOWS\repair 2008-12-22 12:30:10 ----D---- C:\WINDOWS\Provisioning 2008-12-22 12:30:10 ----D---- C:\WINDOWS\PeerNet 2008-12-22 12:30:10 ----D---- C:\WINDOWS\pchealth 2008-12-22 12:30:10 ----D---- C:\WINDOWS\mui 2008-12-22 12:30:10 ----D---- C:\WINDOWS\msapps 2008-12-22 12:30:10 ----D---- C:\WINDOWS\msagent 2008-12-22 12:30:10 ----D---- C:\WINDOWS\Media 2008-12-22 12:30:10 ----D---- C:\WINDOWS\java 2008-12-22 12:30:10 ----D---- C:\WINDOWS\ime 2008-12-22 12:30:10 ----D---- C:\WINDOWS\Help 2008-12-22 12:30:10 ----D---- C:\WINDOWS\ehome 2008-12-22 12:30:10 ----D---- C:\WINDOWS\Driver Cache 2008-12-22 12:30:10 ----D---- C:\WINDOWS\Debug 2008-12-22 12:30:10 ----D---- C:\WINDOWS\Cursors 2008-12-22 12:30:10 ----D---- C:\WINDOWS\Connection Wizard 2008-12-22 12:30:10 ----D---- C:\WINDOWS\Config 2008-12-22 12:30:10 ----D---- C:\WINDOWS\AppPatch 2008-12-22 12:30:10 ----D---- C:\WINDOWS\addins 2008-12-22 12:30:10 ----D---- C:\WINDOWS 2008-12-22 12:20:15 ----HD---- C:\WINDOWS\system32\GroupPolicy 2008-12-22 12:11:15 ----D---- C:\WINDOWS\system32\CatRoot_bak 2008-12-22 12:10:56 ----D---- C:\Documents and Settings\dibi kuper\Dane aplikacji\Opera 2008-12-22 12:06:16 ----D---- C:\WINDOWS\system32\PreInstall 2008-12-22 12:06:15 ----N---- C:\WINDOWS\system32\spmsg.dll 2008-12-22 12:06:15 ----A---- C:\WINDOWS\system32\spupdsvc.exe 2008-12-22 12:06:14 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$ 2008-12-22 12:06:14 ----HD---- C:\WINDOWS\$hf_mig$ 2008-12-22 12:02:36 ----D---- C:\Program Files\Common Files\Adobe 2008-12-22 12:02:33 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Adobe 2008-12-22 12:01:16 ----D---- C:\Program Files\Adobe 2008-12-22 12:00:07 ----SHD---- C:\RECYCLER 2008-12-22 11:56:08 ----D---- C:\WINDOWS\nview 2008-12-22 11:56:07 ----A---- C:\WINDOWS\system32\nvudisp.exe 2008-12-22 11:55:56 ----A---- C:\WINDOWS\system32\NVUNINST.EXE 2008-12-22 11:55:48 ----D---- C:\Program Files\Common Files\InstallShield 2008-12-22 11:55:25 ----D---- C:\NVIDIA 2008-12-22 11:54:29 ----D---- C:\Documents and Settings\dibi kuper\Dane aplikacji\Identities 2008-12-22 11:54:27 ----HD---- C:\Program Files\Uninstall Information 2008-12-22 11:54:22 ----ASH---- C:\Documents and Settings\dibi kuper\Dane aplikacji\desktop.ini 2008-12-22 11:54:21 ----SD---- C:\Documents and Settings\dibi kuper\Dane aplikacji\Microsoft 2008-12-22 11:53:56 ----D---- C:\WINDOWS\system32\SoftwareDistribution 2008-12-22 11:52:53 ----D---- C:\WINDOWS\SoftwareDistribution 2008-12-22 11:52:44 ----D---- C:\WINDOWS\Prefetch 2008-12-22 11:52:43 ----SD---- C:\WINDOWS\system32\Microsoft 2008-12-22 11:52:43 ----A---- C:\WINDOWS\SchedLgU.Txt 2008-12-22 11:48:18 ----D---- C:\WINDOWS\system32\xircom 2008-12-22 11:48:18 ----D---- C:\Program Files\xerox 2008-12-22 11:48:18 ----D---- C:\Program Files\microsoft frontpage 2008-12-22 11:47:52 ----A---- C:\WINDOWS\control.ini 2008-12-22 11:47:52 ----A---- C:\AUTOEXEC.BAT 2008-12-22 11:47:36 ----A---- C:\WINDOWS\OEWABLog.txt 2008-12-22 11:47:31 ----A---- C:\WINDOWS\system32\mapi32.dll 2008-12-22 11:46:22 ----SD---- C:\WINDOWS\Downloaded Program Files 2008-12-22 11:46:22 ----RD---- C:\WINDOWS\Offline Web Pages 2008-12-22 11:46:22 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest 2008-12-22 11:46:15 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest 2008-12-22 11:46:10 ----HD---- C:\Program Files\WindowsUpdate 2008-12-22 11:46:06 ----D---- C:\Program Files\Usługi online 2008-12-22 11:45:46 ----D---- C:\WINDOWS\system32\DirectX 2008-12-22 11:45:16 ----A---- C:\WINDOWS\system32\atrace.dll 2008-12-22 11:45:09 ----A---- C:\WINDOWS\system32\desktop.ini 2008-12-22 11:45:09 ----A---- C:\WINDOWS\desktop.ini 2008-12-22 11:45:02 ----A---- C:\WINDOWS\system32\nmevtmsg.dll 2008-12-22 11:45:01 ----A---- C:\WINDOWS\system32\acctres.dll 2008-12-22 11:45:00 ----D---- C:\Program Files\Common Files\Services 2008-12-22 11:44:57 ----SD---- C:\WINDOWS\Tasks 2008-12-22 11:44:57 ----A---- C:\WINDOWS\system32\icfgnt5.dll 2008-12-22 11:44:56 ----D---- C:\Program Files\Common Files\MSSoap 2008-12-22 11:44:52 ----D---- C:\WINDOWS\srchasst 2008-12-22 11:44:49 ----D---- C:\WINDOWS\system32\Macromed 2008-12-22 11:44:46 ----A---- C:\WINDOWS\system32\wuweb.dll 2008-12-22 11:44:46 ----A---- C:\WINDOWS\system32\wucltui.dll 2008-12-22 11:44:46 ----A---- C:\WINDOWS\system32\wuauserv.dll 2008-12-22 11:44:45 ----A---- C:\WINDOWS\system32\wups.dll 2008-12-22 11:44:45 ----A---- C:\WINDOWS\system32\wuaueng1.dll 2008-12-22 11:44:45 ----A---- C:\WINDOWS\system32\wuaueng.dll 2008-12-22 11:44:45 ----A---- C:\WINDOWS\system32\wuauclt1.exe 2008-12-22 11:44:45 ----A---- C:\WINDOWS\system32\wuauclt.exe 2008-12-22 11:44:44 ----A---- C:\WINDOWS\system32\wuapi.dll 2008-12-22 11:44:44 ----A---- C:\WINDOWS\system32\qmgrprxy.dll 2008-12-22 11:44:44 ----A---- C:\WINDOWS\system32\qmgr.dll 2008-12-22 11:44:44 ----A---- C:\WINDOWS\system32\bitsprx3.dll 2008-12-22 11:44:44 ----A---- C:\WINDOWS\system32\bitsprx2.dll 2008-12-22 11:44:41 ----D---- C:\Program Files\Movie Maker 2008-12-22 11:44:36 ----A---- C:\WINDOWS\system32\safrslv.dll 2008-12-22 11:44:36 ----A---- C:\WINDOWS\system32\safrdm.dll 2008-12-22 11:44:36 ----A---- C:\WINDOWS\system32\safrcdlg.dll 2008-12-22 11:44:36 ----A---- C:\WINDOWS\system32\racpldlg.dll 2008-12-22 11:44:33 ----A---- C:\WINDOWS\system32\fltMc.exe 2008-12-22 11:44:33 ----A---- C:\WINDOWS\system32\fltlib.dll 2008-12-22 11:44:32 ----D---- C:\WINDOWS\system32\Restore 2008-12-22 11:44:32 ----A---- C:\WINDOWS\system32\srsvc.dll 2008-12-22 11:44:32 ----A---- C:\WINDOWS\system32\srrstr.dll 2008-12-22 11:44:32 ----A---- C:\WINDOWS\system32\srclient.dll 2008-12-22 11:44:32 ----A---- C:\WINDOWS\system32\ils.dll 2008-12-22 11:44:31 ----A---- C:\WINDOWS\system32\nmmkcert.dll 2008-12-22 11:44:31 ----A---- C:\WINDOWS\system32\msconf.dll 2008-12-22 11:44:31 ----A---- C:\WINDOWS\system32\mnmsrvc.exe 2008-12-22 11:44:31 ----A---- C:\WINDOWS\system32\mnmdd.dll 2008-12-22 11:44:31 ----A---- C:\WINDOWS\system32\isrdbg32.dll 2008-12-22 11:44:28 ----D---- C:\Program Files\NetMeeting 2008-12-22 11:44:28 ----A---- C:\WINDOWS\system32\msoert2.dll 2008-12-22 11:44:28 ----A---- C:\WINDOWS\system32\msoeacct.dll 2008-12-22 11:44:24 ----A---- C:\WINDOWS\system32\inetres.dll 2008-12-22 11:44:24 ----A---- C:\WINDOWS\system32\inetcomm.dll 2008-12-22 11:44:22 ----D---- C:\Program Files\Outlook Express 2008-12-22 11:44:22 ----A---- C:\WINDOWS\system32\schedsvc.dll 2008-12-22 11:44:22 ----A---- C:\WINDOWS\system32\mstinit.exe 2008-12-22 11:44:22 ----A---- C:\WINDOWS\system32\mstask.dll 2008-12-22 11:44:21 ----A---- C:\WINDOWS\system32\isign32.dll 2008-12-22 11:44:21 ----A---- C:\WINDOWS\system32\inetcfg.dll 2008-12-22 11:44:21 ----A---- C:\WINDOWS\system32\icwphbk.dll 2008-12-22 11:44:21 ----A---- C:\WINDOWS\system32\icwdial.dll 2008-12-22 11:44:12 ----D---- C:\Program Files\Common Files\System 2008-12-22 11:44:10 ----D---- C:\Program Files\Internet Explorer 2008-12-22 11:43:30 ----D---- C:\Program Files\ComPlus Applications 2008-12-22 11:43:28 ----A---- C:\WINDOWS\vbaddin.ini 2008-12-22 11:43:28 ----A---- C:\WINDOWS\vb.ini 2008-12-22 11:43:24 ----D---- C:\WINDOWS\Registration 2008-12-22 11:43:16 ----D---- C:\Program Files\Windows Media Player 2008-12-22 11:43:10 ----D---- C:\Program Files\Messenger 2008-12-22 11:43:06 ----D---- C:\Program Files\MSN Gaming Zone 2008-12-22 11:43:06 ----A---- C:\WINDOWS\system32\write.exe 2008-12-22 11:42:55 ----A---- C:\WINDOWS\system32\sndvol32.exe 2008-12-22 11:42:55 ----A---- C:\WINDOWS\system32\hticons.dll 2008-12-22 11:42:55 ----A---- C:\WINDOWS\system32\avwav.dll 2008-12-22 11:42:55 ----A---- C:\WINDOWS\system32\avtapi.dll 2008-12-22 11:42:55 ----A---- C:\WINDOWS\system32\avmeter.dll 2008-12-22 11:42:54 ----A---- C:\WINDOWS\system32\winchat.exe 2008-12-22 11:42:44 ----A---- C:\WINDOWS\system32\getuname.dll 2008-12-22 11:42:43 ----A---- C:\WINDOWS\system32\winmine.exe 2008-12-22 11:42:43 ----A---- C:\WINDOWS\system32\sol.exe 2008-12-22 11:42:43 ----A---- C:\WINDOWS\system32\charmap.exe 2008-12-22 11:42:43 ----A---- C:\WINDOWS\system32\calc.exe 2008-12-22 11:42:42 ----A---- C:\WINDOWS\system32\usrlogon.cmd 2008-12-22 11:42:42 ----A---- C:\WINDOWS\system32\tsshutdn.exe 2008-12-22 11:42:42 ----A---- C:\WINDOWS\system32\tslabels.ini 2008-12-22 11:42:42 ----A---- C:\WINDOWS\system32\tskill.exe 2008-12-22 11:42:42 ----A---- C:\WINDOWS\system32\reset.exe 2008-12-22 11:42:42 ----A---- C:\WINDOWS\system32\mshearts.exe 2008-12-22 11:42:42 ----A---- C:\WINDOWS\system32\freecell.exe 2008-12-22 11:42:41 ----A---- C:\WINDOWS\system32\tsdiscon.exe 2008-12-22 11:42:41 ----A---- C:\WINDOWS\system32\tscon.exe 2008-12-22 11:42:41 ----A---- C:\WINDOWS\system32\shadow.exe 2008-12-22 11:42:41 ----A---- C:\WINDOWS\system32\rwinsta.exe 2008-12-22 11:42:41 ----A---- C:\WINDOWS\system32\regini.exe 2008-12-22 11:42:41 ----A---- C:\WINDOWS\system32\rdpcfgex.dll 2008-12-22 11:42:41 ----A---- C:\WINDOWS\system32\qwinsta.exe 2008-12-22 11:42:41 ----A---- C:\WINDOWS\system32\qappsrv.exe 2008-12-22 11:42:41 ----A---- C:\WINDOWS\system32\msg.exe 2008-12-22 11:42:41 ----A---- C:\WINDOWS\system32\logoff.exe 2008-12-22 11:42:40 ----A---- C:\WINDOWS\system32\msdtcprf.ini 2008-12-22 11:42:40 ----A---- C:\WINDOWS\system32\cdmodem.dll 2008-12-22 11:42:39 ----A---- C:\WINDOWS\system32\stclient.dll 2008-12-22 11:42:39 ----A---- C:\WINDOWS\system32\mtxlegih.dll 2008-12-22 11:42:39 ----A---- C:\WINDOWS\system32\mtxex.dll 2008-12-22 11:42:39 ----A---- C:\WINDOWS\system32\mtxdm.dll 2008-12-22 11:42:39 ----A---- C:\WINDOWS\system32\dcomcnfg.exe 2008-12-22 11:42:39 ----A---- C:\WINDOWS\system32\comsnap.dll 2008-12-22 11:42:39 ----A---- C:\WINDOWS\system32\comrepl.dll 2008-12-22 11:42:39 ----A---- C:\WINDOWS\system32\comaddin.dll 2008-12-22 11:42:30 ----A---- C:\WINDOWS\system32\wmimgmt.msc 2008-12-22 11:42:29 ----A---- C:\WINDOWS\system32\accwiz.exe 2008-12-22 11:42:28 ----D---- C:\Program Files\Windows NT 2008-12-22 11:42:28 ----A---- C:\WINDOWS\system32\sndrec32.exe 2008-12-22 11:42:28 ----A---- C:\WINDOWS\system32\mspaint.exe 2008-12-22 11:42:28 ----A---- C:\WINDOWS\system32\mplay32.exe 2008-12-22 11:42:28 ----A---- C:\WINDOWS\system32\hypertrm.dll 2008-12-22 11:42:27 ----A---- C:\WINDOWS\system32\tscfgwmi.dll 2008-12-22 11:42:27 ----A---- C:\WINDOWS\system32\spider.exe 2008-12-22 11:42:27 ----A---- C:\WINDOWS\system32\clipbrd.exe 2008-12-22 11:42:26 ----A---- C:\WINDOWS\system32\tscupgrd.exe 2008-12-22 11:42:26 ----A---- C:\WINDOWS\system32\sessmgr.exe 2008-12-22 11:42:26 ----A---- C:\WINDOWS\system32\remotepg.dll 2008-12-22 11:42:26 ----A---- C:\WINDOWS\system32\rdshost.exe 2008-12-22 11:42:26 ----A---- C:\WINDOWS\system32\rdsaddin.exe 2008-12-22 11:42:26 ----A---- C:\WINDOWS\system32\rdchost.dll 2008-12-22 11:42:26 ----A---- C:\WINDOWS\system32\mstscax.dll 2008-12-22 11:42:26 ----A---- C:\WINDOWS\system32\mstsc.exe 2008-12-22 11:42:25 ----D---- C:\WINDOWS\system32\MsDtc 2008-12-22 11:42:25 ----A---- C:\WINDOWS\system32\termsrv.dll 2008-12-22 11:42:25 ----A---- C:\WINDOWS\system32\rdpwsx.dll 2008-12-22 11:42:25 ----A---- C:\WINDOWS\system32\rdpsnd.dll 2008-12-22 11:42:25 ----A---- C:\WINDOWS\system32\rdpclip.exe 2008-12-22 11:42:25 ----A---- C:\WINDOWS\system32\qprocess.exe 2008-12-22 11:42:25 ----A---- C:\WINDOWS\system32\msdtcuiu.dll 2008-12-22 11:42:25 ----A---- C:\WINDOWS\system32\icaapi.dll 2008-12-22 11:42:25 ----A---- C:\WINDOWS\system32\cfgbkend.dll 2008-12-22 11:42:24 ----A---- C:\WINDOWS\system32\xolehlp.dll 2008-12-22 11:42:24 ----A---- C:\WINDOWS\system32\mtxoci.dll 2008-12-22 11:42:24 ----A---- C:\WINDOWS\system32\msdtctm.dll 2008-12-22 11:42:24 ----A---- C:\WINDOWS\system32\msdtcprx.dll 2008-12-22 11:42:24 ----A---- C:\WINDOWS\system32\msdtclog.dll 2008-12-22 11:42:24 ----A---- C:\WINDOWS\system32\msdtc.exe 2008-12-22 11:42:23 ----D---- C:\WINDOWS\system32\Com 2008-12-22 11:42:23 ----A---- C:\WINDOWS\system32\colbact.dll 2008-12-22 11:42:23 ----A---- C:\WINDOWS\system32\clbcatex.dll 2008-12-22 11:42:23 ----A---- C:\WINDOWS\system32\catsrvut.dll 2008-12-22 11:42:23 ----A---- C:\WINDOWS\system32\catsrvps.dll 2008-12-22 11:42:22 ----A---- C:\WINDOWS\system32\comuid.dll 2008-12-22 11:42:22 ----A---- C:\WINDOWS\system32\comsvcs.dll 2008-12-22 11:42:22 ----A---- C:\WINDOWS\system32\clbcatq.dll 2008-12-22 11:42:22 ----A---- C:\WINDOWS\system32\catsrv.dll 2008-12-22 11:42:12 ----A---- C:\WINDOWS\system32\servdeps.dll 2008-12-22 11:42:12 ----A---- C:\WINDOWS\system32\mmfutil.dll 2008-12-22 11:42:12 ----A---- C:\WINDOWS\system32\licwmi.dll 2008-12-22 11:42:12 ----A---- C:\WINDOWS\system32\cmprops.dll ======List of files/folders modified in the last 1 months====== 2008-12-22 11:59:46 ----A---- C:\WINDOWS\system.ini 2008-12-22 11:47:51 ----A---- C:\WINDOWS\win.ini 2008-12-12 18:36:30 ----A---- C:\WINDOWS\system32\mshtml.dll ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 AmdK7;Sterownik procesora AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2004-08-03 41472] R3 abp470n5;abp470n5; \??\C:\WINDOWS\system32\drivers\ilmojn.sys [] R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2008-01-24 4127488] R3 hidusb;Sterownik Microsoft klasy HID; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2001-08-17 9600] R3 mouhid;Sterownik myszy HID; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-10-26 12160] R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-04-19 3988384] R3 rtl8139;Sterownik NT karty Realtek RTL8139(A/B/C)-based PCI Fast Ethernet; C:\WINDOWS\system32\DRIVERS\RTL8139.SYS [2004-08-03 20992] R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624] R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600] R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2007-04-19 159810] -----------------EOF-----------------

**Posty:** 18165 · przez **wojtas** 22 Gru 2008, 21:36

odpal HijackThis i skasuj to:

Kod: Zaznacz wszystko: O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

Pobierz i uruchom narzędzie
The Avenger
w bialym polu wklej tekst:

Folders to delete:

C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp

Kopiujesz - Klikasz na Paste Script from Clipboard - Execute - Potwierdzasz i zgadzasz się na restart klikając OK.
Po wykonaniu skasuj z dysku plik: C:\Avenger\backup.zip i wklej raport na forum C:\avenger.txt
1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 31 · przez **zgorzelice** 22 Gru 2008, 22:34

AVENGER

Kod: Zaznacz wszystko: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! Folder "C:\DOCUME~1\DIBIKU~1\USTAWI~1\Temp" deleted successfully. Completed script processing. ******************* Finished! Terminate.

FixIEDef

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.20.6874 * * * ******************************************************************************** Created at 21:08:50 on Monday, December 22, 2008 Time Zone : Logged On User : dibi kuper Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 AMD Athlon(tm) XP 2000+ System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 10.31 GB System Drive Free : 6.23 GB Total Physical Memory: 1023 MB Free Physical Memory : 784 MB Total Page File : 1023 MB Free Page File : 2318 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1973 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

a kaspersky: Nie można wyświetlić strony