Witam
dzis po włączeniu komp. uruchomiła się plansza " Sprawdzenie spójności plików…" dysk D
System mam na C, po sprawdzeniu uruchomił się komputer ale kiedy pojawia się plansza " zapraszamy" to mieli w tym miejscu i po chwili pojawia się pulpit bez ikon.
Znów mieli chwilę po czym pojawiają się ikony ale bez paska menu. Nie działa Ctrl C i jest mniej uruchomionych zadań, nie działa sieć.
Z konsoli odzyskiwania skopiowałem explorer.exe ale nic nie pomogło.
Programy antywirusowe nic nie znalazly.
Jak to rozwiązać ?
ComboFix 08-11-28.03 - MONIKA 2008-11-30 10:51:31.3 - NTFSx86
Uruchomiony z: d:\programy\Narzędzia\ComboFix.exe
* Resident AV is active
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windows\system32\Dvbpws.dll
D:\explorer.exe
.
((((((((((((((((((((((((( Pliki utworzone od 2008-10-28 do 2008-11-30 )))))))))))))))))))))))))))))))
.
2008-11-30 11:45 . 2004-08-04 01:44 1,033,728 --a------ c:\windows\explorer.exe
2008-11-29 17:41 . 2008-11-30 10:53
2008-11-29 17:41 . 2008-07-05 15:42
2008-11-29 17:41 . 2008-07-05 14:16
2008-11-29 17:41 . 2008-07-05 15:42
2008-11-29 17:41 . 2008-07-05 15:42
2008-11-29 17:41 . 2008-07-05 15:42
2008-11-29 17:41 . 2008-07-05 15:42
2008-11-29 17:41 . 2008-11-29 17:41
2008-11-25 16:19 . 2008-11-25 16:19
2008-11-20 21:15 . 2008-11-20 21:18
2008-11-20 21:15 . 2008-11-25 18:28
2008-11-20 21:15 . 2008-11-25 18:28
2008-11-20 21:14 . 2008-11-20 21:18
2008-11-20 21:14 . 2008-11-20 21:14
2008-11-20 19:59 . 2008-11-24 19:24
2008-11-18 17:59 . 2008-11-18 17:59
2008-11-18 17:15 . 2008-11-19 20:49
2008-11-12 17:22 . 2008-09-04 18:17 1,106,944 -----c— c:\windows\system32\dllcache\msxml3.dll
2008-11-12 17:22 . 2008-10-24 12:21 455,296 -----c— c:\windows\system32\dllcache\mrxsmb.sys
2008-11-07 19:57 . 2008-11-07 19:57
2008-11-07 19:48 . 2008-11-26 16:50
2008-11-03 19:09 . 2008-11-03 19:09
2008-11-03 19:06 . 2008-11-03 19:06
2008-10-28 20:58 . 2008-10-28 20:58
2008-10-27 20:53 . 2008-10-27 20:53
2008-10-27 20:53 . 2008-10-27 20:56
2008-10-27 20:53 . 2008-11-19 20:05 143,096 --a------ c:\windows\system32\guard32.dll
2008-10-27 20:53 . 2008-11-19 20:05 99,216 --a------ c:\windows\system32\drivers\cmdguard.sys
2008-10-27 20:53 . 2008-11-19 20:05 31,504 --a------ c:\windows\system32\drivers\cmdhlp.sys
2008-10-24 15:06 . 2008-10-15 17:36 337,408 -----c— c:\windows\system32\dllcache\netapi32.dll
2008-10-23 19:41 . 2008-10-23 19:41
2008-10-22 18:47 . 2008-10-27 21:42
2008-10-19 19:46 . 2008-10-19 19:46 5,850 --a------ c:\windows\system32\acdb.err
2008-10-15 19:15 . 2008-10-15 21:22
2008-10-15 18:41 . 2008-09-08 11:41 333,824 -----c— c:\windows\system32\dllcache\srv.sys
2008-10-15 18:32 . 2008-09-15 16:27 1,846,656 -----c— c:\windows\system32\dllcache\win32k.sys
2008-10-15 18:31 . 2008-08-14 14:26 2,190,464 -----c— c:\windows\system32\dllcache\ntoskrnl.exe
2008-10-15 18:31 . 2008-08-14 14:26 2,146,816 -----c— c:\windows\system32\dllcache\ntkrnlmp.exe
2008-10-15 18:31 . 2008-08-14 14:26 2,067,328 -----c— c:\windows\system32\dllcache\ntkrnlpa.exe
2008-10-15 18:31 . 2008-08-14 14:26 2,025,472 -----c— c:\windows\system32\dllcache\ntkrpamp.exe
2008-10-14 21:41 . 1998-10-07 12:54 327,168 --a------ c:\windows\IsUn0415.exe
2008-10-10 18:04 . 2008-10-10 18:04
2008-10-10 17:51 . 2008-04-13 19:45 26,112 --a------ c:\windows\system32\drivers\usbser.sys
2008-10-10 17:51 . 2008-04-13 19:45 26,112 --a–c— c:\windows\system32\dllcache\usbser.sys
2008-10-10 17:51 . 2008-10-10 17:51 0 --ah----- c:\windows\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2008-10-10 17:51 . 2008-10-10 17:51 0 --ah----- c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2008-10-10 17:48 . 2008-10-10 17:48
2008-10-10 17:44 . 2008-10-10 17:51
2008-10-10 17:44 . 2008-10-10 17:51
2008-10-10 17:44 . 2008-10-10 17:51
2008-10-10 17:43 . 2008-10-10 17:43
2008-10-10 17:43 . 2008-10-10 17:46
2008-10-10 17:43 . 2008-10-10 17:43
2008-10-10 17:43 . 2008-10-10 17:43
2008-10-10 17:43 . 2008-10-10 17:45
2008-10-10 17:43 . 2008-05-07 06:39 1,419,232 --a------ c:\windows\system32\wdfcoinstaller01005.dll
2008-10-10 17:43 . 2008-05-07 06:38 659,968 --a------ c:\windows\system32\nmwcdcocls.dll
2008-10-10 17:43 . 2008-05-07 06:38 90,624 --a------ c:\windows\system32\nmwcdcls.dll
2008-10-10 17:43 . 2007-09-17 14:53 21,632 --a------ c:\windows\system32\drivers\pccsmcfd.sys
2008-10-10 17:43 . 2008-05-07 06:38 20,864 --a------ c:\windows\system32\drivers\ccdcmbo.sys
2008-10-10 17:43 . 2008-05-07 06:38 17,536 --a------ c:\windows\system32\drivers\ccdcmb.sys
2008-10-10 17:43 . 2008-05-07 06:38 8,064 --a------ c:\windows\system32\drivers\usbser_lowerfltj.sys
2008-10-10 17:43 . 2008-06-06 08:24 8,064 --a------ c:\windows\system32\drivers\usbser_lowerflt.sys
2008-10-10 17:42 . 2008-10-10 17:45
2008-10-08 21:31 . 2008-10-08 21:31
2008-10-02 16:54 . 2008-10-02 17:43
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-29 18:01 --------- d-----w c:\program files\Registry Clean Expert
2008-11-29 16:36 --------- d-----w c:\program files\Microsoft Bootvis
2008-11-28 19:26 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Microsoft Help
2008-11-25 15:36 --------- d-----w c:\documents and settings\MONIKA\Dane aplikacji\uTorrent
2008-11-25 15:20 --------- d-----w c:\program files\SUPERAntiSpyware
2008-11-24 18:19 --------- d-----w c:\program files\SpywareBlaster
2008-11-18 17:05 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\RFA_Backups
2008-11-18 16:27 --------- d-----w c:\program files\Windows Media Connect 2
2008-11-18 16:27 --------- d-----w c:\program files\QuickTime Alternative
2008-11-18 16:27 --------- d-----w c:\program files\Program sieciowy dla SAGEM Wi-Fi 11g USB adapter
2008-11-16 19:09 --------- d-----w c:\program files\Spybot - Search & Destroy
2008-11-03 18:30 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Martau
2008-11-03 18:09 --------- d-----w c:\program files\Common Files\InstallShield
2008-10-28 18:06 --------- d-----w c:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-10-27 19:53 --------- d-----w c:\documents and settings\MONIKA\Dane aplikacji\Comodo
2008-10-24 16:56 --------- d-----w c:\program files\GN Ukrywacz
2008-10-24 11:21 455,296 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-09-30 15:43 1,286,152 ----a-w c:\windows\system32\msxml4.dll
2008-09-15 15:27 1,846,656 ----a-w c:\windows\system32\win32k.sys
2008-09-10 01:15 1,307,648 ------w c:\windows\system32\msxml6.dll
2008-09-04 17:17 1,106,944 ----a-w c:\windows\system32\msxml3.dll
2008-08-26 08:27 826,368 ----a-w c:\windows\system32\wininet.dll
2008-08-14 13:26 2,146,816 ----a-w c:\windows\system32\ntoskrnl.exe
2008-08-14 13:26 2,025,472 ----a-w c:\windows\system32\ntkrnlpa.exe
2008-08-11 18:29 81,920 ----a-w c:\windows\ALCFDRTM.EXE
2008-08-09 14:05 25,992 ----a-w c:\windows\system32\pgdfgsvc.exe
2006-06-23 06:48 32,768 ----a-r c:\windows\inf\UpdateUSB.exe
2008-07-10 14:52 32,768 --sha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008063020080707\index.dat
2008-07-10 14:52 32,768 --sha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\MSHist012008071020080711\index.dat
.
------- Sigcheck -------
2008-04-14 18:21 14336 8607d35d92528e2df386f19a960d23ce c:\windows\ServicePackFiles\i386\svchost.exe
2008-04-14 18:21 14336 8607d35d92528e2df386f19a960d23ce c:\windows\system32\svchost.exe
2008-04-14 18:20 580096 a435c5c069afd901751ac323ad238793 c:\windows\ServicePackFiles\i386\user32.dll
2008-04-14 18:20 580096 a435c5c069afd901751ac323ad238793 c:\windows\system32\user32.dll
2008-04-14 18:20 82432 c0aa2ab856680c44739b41e01f5bd4e9 c:\windows\ServicePackFiles\i386\ws2_32.dll
2008-04-14 18:20 82432 c0aa2ab856680c44739b41e01f5bd4e9 c:\windows\system32\ws2_32.dll
2008-04-21 08:03 662016 39179de4ea2dce5d646bbf3b408b50ee c:\windows\ie7\wininet.dll
2007-08-13 17:54 818688 a4a0fc92358f39538a6494c42ef99fe9 c:\windows\ie7updates\KB950759-IE7\wininet.dll
2008-04-23 08:20 826368 e1c03d3bba5fed8c37df83a57890978d c:\windows\ie7updates\KB953838-IE7\wininet.dll
2008-06-23 17:42 826368 15c09e8a74a0988fb2f24eff9d68d886 c:\windows\ie7updates\KB956390-IE7\wininet.dll
2008-04-14 18:20 668672 0457f0afd6ee10445d8cf721fb5fa4eb c:\windows\ServicePackFiles\i386\wininet.dll
2008-08-26 09:27 826368 56422e11aa9b71e4e4b26e3bd6122189 c:\windows\system32\wininet.dll
2008-08-26 09:27 826368 56422e11aa9b71e4e4b26e3bd6122189 c:\windows\system32\dllcache\wininet.dll
2008-04-13 20:20 361344 93ea8d04ec73a85db02eb8805988f733 c:\windows\ServicePackFiles\i386\tcpip.sys
2006-03-02 13:00 359040 9f4b36614a0fc234525ba224957de55c c:\windows\SoftwareDistribution\Download\273b740ad076bd194b25292bd4f83e18\backup\sp2gdr\tcpip.sys
2006-03-02 13:00 359040 9f4b36614a0fc234525ba224957de55c c:\windows\SoftwareDistribution\Download\273b740ad076bd194b25292bd4f83e18\backup\sp2qfe\tcpip.sys
2008-06-20 12:51 361600 9aefa14bd6b182d61e3119fa5f436d3d c:\windows\system32\dllcache\tcpip.sys
2008-06-20 12:51 361600 9aefa14bd6b182d61e3119fa5f436d3d c:\windows\system32\drivers\tcpip.sys
2008-04-14 18:21 510464 51fd2e13d723857b9ca239ae77150f48 c:\windows\ServicePackFiles\i386\winlogon.exe
2008-04-14 18:21 510464 51fd2e13d723857b9ca239ae77150f48 c:\windows\system32\winlogon.exe
2008-04-13 20:20 182656 1df7f42665c94b825322fae71721130d c:\windows\ServicePackFiles\i386\ndis.sys
2008-04-13 20:20 182656 1df7f42665c94b825322fae71721130d c:\windows\system32\drivers\ndis.sys
2008-04-13 19:53 36608 3bb22519a194418d5fec05d800a19ad0 c:\windows\ServicePackFiles\i386\ip6fw.sys
2008-04-13 19:53 36608 3bb22519a194418d5fec05d800a19ad0 c:\windows\system32\drivers\ip6fw.sys
2008-08-14 14:26 2067328 5ab2f07ad3fd76790294ddccc6e06d46 c:\windows\Driver Cache\i386\ntkrnlpa.exe
2008-04-14 17:29 2067200 4bba965664faa56b187c27f4cad7e7c5 c:\windows\ServicePackFiles\i386\ntkrnlpa.exe
2008-08-14 14:26 2025472 e7a6d707315001dddc18e2fd4e0d0a6b c:\windows\system32\ntkrnlpa.exe
2008-08-14 14:26 2067328 5ab2f07ad3fd76790294ddccc6e06d46 c:\windows\system32\dllcache\ntkrnlpa.exe
2008-08-14 14:26 2190464 9ce159c91e076ff6c25d055310ebb259 c:\windows\Driver Cache\i386\ntoskrnl.exe
2008-04-14 17:30 2190336 8ca14ecf04594eabbe93c9ff2e3cbfb1 c:\windows\ServicePackFiles\i386\ntoskrnl.exe
2008-08-14 14:26 2146816 5f320d7766c59566310ce2f255b6672b c:\windows\system32\ntoskrnl.exe
2008-08-14 14:26 2190464 9ce159c91e076ff6c25d055310ebb259 c:\windows\system32\dllcache\ntoskrnl.exe
2004-08-04 01:44 1033728 379098a96e6c165b659de7e4328010ea c:\windows\explorer.exe
2008-04-14 18:21 1035264 c791ed9eac5e76d9525e157b1d7a599a c:\windows\ServicePackFiles\i386\explorer.exe
2008-04-14 18:21 109056 3e3ae424e27c4cefe4cab368c7b570ea c:\windows\ServicePackFiles\i386\services.exe
2008-04-14 18:21 109056 3e3ae424e27c4cefe4cab368c7b570ea c:\windows\system32\services.exe
2008-04-14 18:21 13312 88296f7943f30a1ee3af735440b92268 c:\windows\ServicePackFiles\i386\lsass.exe
2008-04-14 18:21 13312 88296f7943f30a1ee3af735440b92268 c:\windows\system32\lsass.exe
2008-04-14 18:21 15360 1bd41eda5b869afc99895c39a8de36e1 c:\windows\ServicePackFiles\i386\ctfmon.exe
2008-04-14 18:21 15360 1bd41eda5b869afc99895c39a8de36e1 c:\windows\system32\ctfmon.exe
2008-04-14 18:21 57856 dd69ec597ab942c39b950d9c3ce1375d c:\windows\ServicePackFiles\i386\spoolsv.exe
2008-04-14 18:21 57856 dd69ec597ab942c39b950d9c3ce1375d c:\windows\system32\spoolsv.exe
2008-04-14 18:21 26624 2a5b37d520508be6570a3ea79695f5b5 c:\windows\ServicePackFiles\i386\userinit.exe
2008-04-14 18:21 26624 2a5b37d520508be6570a3ea79695f5b5 c:\windows\system32\userinit.exe
2008-04-14 18:20 296448 52e0505408edd4ab5ccc7f83b67b4299 c:\windows\ServicePackFiles\i386\termsrv.dll
2008-04-14 18:20 296448 52e0505408edd4ab5ccc7f83b67b4299 c:\windows\system32\termsrv.dll
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“SpybotSD TeaTimer”=“c:\program files\Spybot - Search & Destroy\TeaTimer.exe” [2008-09-16 1833296]
“WinFast Schedule”=“c:\program files\WinFast\WFDTV\WFWIZ.exe” [2008-06-20 2887680]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
“egui”=“c:\program files\ESET\ESET NOD32 Antivirus\egui.exe” [2008-06-10 1447168]
“WinFastDTV”=“c:\program files\WinFast\WFDTV\DTVSchdl.exe” [2008-06-20 90112]
“NvCplDaemon”=“c:\windows\system32\NvCpl.dll” [2008-05-16 13529088]
“COMODO Firewall Pro”=“c:\program files\COMODO\Firewall\cfp.exe” [2008-11-19 1796856]
“COMODO Internet Security”=“c:\program files\COMODO\Firewall\cfp.exe” [2008-11-19 1796856]
“SnoopFreeUI”=“SnoopFreeUI.exe” [2008-07-10 c:\windows\SnoopFreeUI.exe]
[HKEY_USERS.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
“CTFMON.EXE”=“c:\windows\system32\CTFMON.EXE” [2008-04-14 15360]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
“{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}”= “c:\program files\SUPERAntiSpyware\SASSEH.DLL” [2008-05-13 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify!SASWinLogon]
2008-09-11 17:12 352256 c:\program files\SUPERAntiSpyware\SASWINLO.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
“AppInit_DLLs”= c:\windows\system32\guard32.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
“msacm.ac3filter”= ac3filter.acm
“VIDC.MJPG”= Pvmjpg30.dll
[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Acrobat Speed Launcher.lnk]
backup=c:\windows\pss\Adobe Acrobat Speed Launcher.lnkCommon Startup
[HKLM~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Acrobat Synchronizer.lnk]
backup=c:\windows\pss\Adobe Acrobat Synchronizer.lnkCommon Startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acrobat Assistant 8.0]
–a------ 2008-01-11 18:54 623992 c:\program files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Acronis Scheduler2 Service]
–a------ 2006-01-08 17:26 118784 c:\program files\Common Files\Acronis\Schedule2\schedhlp.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
–a------ 2008-04-17 13:14 98616 c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BDRegion]
–a------ 2008-03-21 09:21 91432 c:\program files\CyberLink\Shared Files\brs.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
–a------ 2006-10-09 10:28 139264 c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTFMON.EXE]
–a------ 2008-04-14 18:21 15360 c:\windows\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
–a------ 2008-07-04 16:01 486856 c:\program files\DAEMON Tools Lite\daemon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPWUTOOLBOX]
–a------ 2006-11-15 09:39 352256 c:\program files\HP\HP Officejet Pro K550 Series\Toolbox\HPWUTBX.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\JMB36X Configure]
-r------- 2006-07-12 10:47 352256 c:\windows\system32\JMRaidTool.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LaunchList]
–a------ 2007-03-21 14:41 145496 c:\program files\Pinnacle\Studio 11\LaunchList2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
–a------ 2008-06-09 09:16 2363392 c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
–a------ 2006-01-12 15:40 155648 c:\program files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nokia.PCSync]
–a------ 2008-06-17 15:00 1249280 c:\program files\Nokia\Nokia PC Suite 7\PcSync2.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
–a------ 2008-05-16 13:01 13529088 c:\windows\system32\nvcpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
–a------ 2008-05-16 13:01 86016 c:\windows\system32\nvmctray.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Odkurzacz-MCD]
–a------ 2008-08-16 16:01 264704 c:\program files\Odkurzacz\odk_mcd.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
–a------ 2008-08-11 07:31 1124352 c:\program files\Nokia\Nokia PC Suite 7\PCSuite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDVD8LanguageShortcut]
--------- 2007-12-14 10:36 50472 c:\program files\CyberLink\PowerDVD8\Language\Language.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RegClean Expert Scheduler]
–a------ 2008-06-12 19:21 601848 c:\program files\Registry Clean Expert\RCHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl8]
--------- 2008-03-20 19:23 83240 c:\program files\CyberLink\PowerDVD8\PDVD8Serv.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\rfagent]
–a------ 2007-06-12 14:37 617088 c:\program files\RFA Platinum\rfagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
–a------ 2008-11-25 16:20 1805552 c:\program files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrueImageMonitor.exe]
–a------ 2006-01-08 17:26 1006938 c:\program files\Acronis\TrueImage\TrueImageMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]
–a------ 2005-05-04 01:43 69632 c:\windows\Alcmtr.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
–a------ 2008-05-16 13:01 1630208 c:\windows\system32\nwiz.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
–a------ 2006-11-15 00:21 16270848 c:\windows\RTHDCPL.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SkyTel]
–a------ 2006-05-17 01:04 2879488 c:\windows\SkyTel.exe
[HKLM~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
“%windir%\system32\sessmgr.exe”=
“%windir%\Network Diagnostic\xpnetdiag.exe”=
“c:\Program Files\Microsoft Office\Office12\ONENOTE.EXE”=
“c:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE”=
“c:\Program Files\Nero\Nero 7\Nero ShowTime\ShowTime.exe”=
“c:\Program Files\Pinnacle\Studio 11\programs\RM.exe”=
“c:\Program Files\Pinnacle\Studio 11\programs\Studio.exe”=
“c:\Program Files\Pinnacle\Studio 11\programs\PMSRegisterFile.exe”=
“c:\Program Files\Pinnacle\Studio 11\programs\umi.exe”=
“c:\Program Files\uTorrent\uTorrent.exe”=
“c:\Program Files\Spik\Spik.exe”=
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
“c:\program files\Common Files\LightScribe\LSRunOnce.exe”
.
-
-
-
- USUNIĘTO PUSTE WPISY - - - -
-
-
URLSearchHooks-{0579B4B6-0293-4d73-B02D-5EBB0BA0F0A2} - (no file)
.
------- Skan uzupełniający -------
.
FireFox -: Profile - c:\documents and settings\MONIKA\Dane aplikacji\Mozilla\Firefox\Profiles\4cclw8dg.default\
FF -: plugin - c:\program files\Adobe\Acrobat 8.0\Acrobat\browser\nppdf32.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npwpk.dll
FF -: plugin - c:\program files\Spik\mozilla\npwpk.dll
FF -: plugin - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-30 10:55:57
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów …
skanowanie ukrytych wpisów autostartu …
skanowanie ukrytych plików …
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet004\Services\EverestDriver]
“ImagePath”="??\d:\programy\Narzędzia\Portable Everest.Ultimate.Edition.v4.20.1170.Final\kerneld.wnt"
[HKEY_LOCAL_MACHINE\System\ControlSet004\Services{FE4C91E7-22C2-4D0C-9F6B-82F1B7742054}]
“ImagePath”="??\c:\program files\CyberLink\PowerDVD8\000.fcl"
.
--------------------- Pliki DLL ładowane pod uruchomionymi procesami ---------------------
-
-
-
-
-
-
- > ‘winlogon.exe’(1132)
-
-
-
-
-
c:\program files\SUPERAntiSpyware\SASWINLO.DLL
-
-
-
-
-
-
- > ‘lsass.exe’(1188)
-
-
-
-
-
c:\windows\system32\relog_ap.dll
.
------------------------ Pozostałe uruchomione procesy ------------------------
.
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\COMODO\Firewall\cmdagent.exe
c:\program files\ESET\ESET NOD32 Antivirus\ekrn.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\system32\nvsvc32.exe
c:\program files\RAXCO\PerfectDisk\PDAgent.exe
c:\windows\system32\SnoopFreeSvc.exe
c:\program files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files\Program sieciowy dla SAGEM Wi-Fi 11g USB adapter\WLANUTL.EXE
.
**************************************************************************
.
Czas ukończenia: 2008-11-30 10:57:55 - komputer został uruchomiony ponownie
ComboFix-quarantined-files.txt 2008-11-30 09:57:51
ComboFix2.txt 2008-11-29 18:35:08
ComboFix3.txt 2008-10-06 16:27:40
Przed: 132 238 565 376 bajtów wolnych
Po: 132,221,009,920 bajtów wolnych
310 — E O F — 2008-11-12 20:42:27
