Po usunięciu wirusów zniknął mi pulpit pasek start i ikony


(Imperial_Dragon) #1

witam wszystkich. mam tu taki problem. po skanowaniu kompa avastem pro i usunięciem wirusów zniknął mi pulpit ikony pasek zadań, jest tylko tapeta i nic więcej.

jedyne co można zrobić to (ctr+alt+del). przywracanie do wczesniejszego stanu też nic nie daje bo nie może tego z jakiegos powodu zrobić.

prosze was o pomoc.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 21:35:37, on 2009-04-18

Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Safe mode with network support


Running processes:

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\WINDOWS\system32\igfxsrvc.exe

C:\Documents and Settings\icservice\Pulpit\HiJackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza

F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\twex.exe,

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL

O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL

O3 - Toolbar: Solid Converter PDF - {259F616C-A300-44F5-B04A-ED001A26C85C} - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\ExploreExtPDF.dll

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe

O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\RunOnce: [aswAhAScr.dll] C:\PROGRA~1\ALWILS~1\Avast4\ASWREG~1.EXE "C:\Program Files\Alwil Software\Avast4\AhAScr.dll"

O4 - HKLM\..\RunOnce: [PackFolders] C:\WINDOWS\BricoPackFoldersDelete.cmd

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra button: (no name) - SolidConverterPDF - (no file) (HKCU)

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL

O20 - AppInit_DLLs: c:\progra~1\ThunMail\testabd.dll

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe

O23 - Service: O2Micro Flash Memory (O2Flash) - Unknown owner - c:\WINDOWS\system32\o2flash.exe

O23 - Service: SolidPDFConverterReadSpool (ScReadSpool) - VoyagerSoft, LLC - C:\Program Files\SolidDocuments\SolidConverterPDF\SCPDF\SolidPdfService.exe


--

End of file - 5585 bytes

(Hubert Knight) #2

Start -> Uruchom -> explorer.exe .Jak to nie pomoże, to na starcie wciskaj F8 i albo Ostatnia Znana Dobra Konfiguracja, albo w Tryb Awaryjny i Przywracanie Systemu. Ja bym Ci radził zainwestować w jakiegoś lepszego antywirusa.


(Dzimi21) #3

Wciśnij ctrl+alt+del weź nowe zadanie i wpisz explorer.exe to powinno przywrócić pasek start, ikony itp. Jeśli wyskoczy błąd to spróbuj przy wrócić plik explorer.exe z konsoli odzyskiwania systemu.


(Imperial_Dragon) #4

wielkie dzięki, ctr+alt+del = nowe zadanie i explorer.exe osunęło problem.

jeszcze raz dziękuje za pomoc.


(Leon$) #5

usuń HijackThisem >> Fix checked

Pobierz Combofix http://www.searchengines.pl/index.php?s ... ntry395642 ale nie włączaj

Podczas pobierania i skanu Combofixem proszę wyłączyć wszelkie zapory i antywirusy

Otwórz notatnik i wklej

zapisz jako CFScript.txt (zapisz by ikonka CFScript.txt była obok ikonki ComboFix.exe) >> Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

Powinno rozpocząć się usuwanie

Potem log z usuwania Combofix

:slight_smile:


(Imperial_Dragon) #6
ComboFix 09-04-19.01 - icservice 2009-04-19 22:59.3 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.1014.482 [GMT 2:00]

Uruchomiony z: c:\documents and settings\icservice\Pulpit\ComboFix.exe

Użyto następujących komend :: c:\documents and settings\icservice\Pulpit\CFScript.txt.txt

AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)

FW: Kaspersky Internet Security *disabled*

 * Utworzono nowy punkt przywracania


FILE ::

c:\progra~1\ThunMail\testabd.dll

c:\windows\system32\twex.exe

.


((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))

.


c:\program files\AskTBar

c:\program files\AskTBar\bar\1.bin\A5POPSWT.DLL

c:\program files\AskTBar\bar\Cache\[u]0[/u]03B60AF

c:\program files\AskTBar\bar\Cache\[u]0[/u]03B6468

c:\program files\AskTBar\bar\Cache\[u]0[/u]03B663C.bin

c:\program files\AskTBar\bar\Cache\[u]0[/u]03B67D3.bin

c:\program files\AskTBar\bar\Cache\[u]0[/u]03B77B1.bin

c:\program files\AskTBar\bar\Cache\[u]0[/u]03B79F3.bin

c:\program files\AskTBar\bar\Cache\files.ini

c:\program files\AskTBar\bar\History\search2

c:\program files\AskTBar\bar\Settings\prevcfg2.htm


[COLOR=RED] . . . jest zainfekowany!![/COLOR]


.

((((((((((((((((((((((((( Pliki utworzone od 2009-03-19 do 2009-04-19 )))))))))))))))))))))))))))))))

.


2009-04-18 20:16 . 2009-04-18 20:37	89601	----a-w	c:\windows\system32\drivers\klick.dat

2009-04-18 20:16 . 2009-04-18 20:37	101287	----a-w	c:\windows\system32\drivers\klin.dat

2009-04-18 20:15 . 2009-04-18 20:44	677408	--sha-w	c:\windows\system32\drivers\fidbox.dat

2009-04-18 20:15 . 2009-04-18 20:44	7420	--sha-w	c:\windows\system32\drivers\fidbox.idx

2009-04-18 20:15 . 2009-04-18 20:44	253984	--sha-w	c:\windows\system32\drivers\fidbox2.dat

2009-04-18 20:15 . 2009-04-18 20:44	1948	--sha-w	c:\windows\system32\drivers\fidbox2.idx

2009-04-18 20:15 . 2009-04-18 20:44	--------	d-----w	c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Kaspersky Lab

2009-04-18 20:14 . 2009-04-18 20:14	--------	d-----w	c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Kaspersky Lab Setup Files

2009-04-18 20:01 . 2009-04-18 20:01	67072	----a-w	c:\windows\system32\7.tmp

2009-04-18 20:01 . 2009-04-18 20:01	1	----a-w	c:\windows\system32\6.tmp

2009-04-18 20:01 . 2009-04-18 20:01	84	----a-w	c:\windows\system32\5.tmp

2009-04-18 19:57 . 2009-04-18 20:01	--------	d-----w	C:\fixwareout

2009-04-18 19:33 . 2009-04-18 19:33	67072	----a-w	c:\windows\system32\4.tmp

2009-04-18 19:33 . 2009-04-18 19:33	1	----a-w	c:\windows\system32\3.tmp

2009-04-18 19:33 . 2009-04-18 19:33	84	----a-w	c:\windows\system32\2.tmp

2009-04-18 17:48 . 2009-04-18 17:48	68	----a-w	C:\pdfinfo.ini

2009-04-18 17:47 . 2009-04-18 17:47	36	----a-w	c:\windows\verypdf.ini

2009-04-18 17:47 . 2009-04-18 17:47	1024	----a-w	c:\windows\system32\pwdremover.dat

2009-04-18 17:23 . 2009-04-18 17:23	--------	d-----w	c:\documents and settings\icservice\Dane aplikacji\Quark

2009-04-18 16:09 . 2009-04-18 17:55	167	----a-w	c:\windows\ConverterCore.INI

2009-04-18 15:58 . 2009-04-18 15:58	--------	d-----w	c:\documents and settings\All Users.WINDOWS\Dane aplikacji\SolidDocuments

2009-04-18 15:45 . 2009-04-18 15:45	--------	d-----w	c:\windows\system32\QuickTime

2009-04-18 15:45 . 2009-04-18 15:45	--------	d-----w	c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Quark

2009-04-18 15:44 . 2009-04-18 17:23	54156	---ha-w	c:\windows\QTFont.qfn

2009-04-18 15:44 . 2009-04-18 15:44	1409	----a-w	c:\windows\QTFont.for

2009-04-18 15:43 . 2009-04-18 15:43	--------	d-----w	c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Apple Computer

2009-04-18 15:34 . 2009-04-18 18:47	--------	d-----w	c:\documents and settings\icservice\Dane aplikacji\SolidDocuments

2009-04-18 09:48 . 2009-04-18 09:48	68520	----a-w	c:\documents and settings\icservice\Dane aplikacji\GDIPFONTCACHEV1.DAT

2009-04-18 09:44 . 2009-04-18 09:44	427	----a-w	c:\windows\ODBC.INI

2009-04-18 09:39 . 2005-01-24 08:52	65308	----a-w	c:\windows\system32\PSConvert.exe

2009-04-18 09:39 . 2005-01-24 08:36	137	----a-w	c:\windows\system32\psparam.ini

2009-04-18 09:39 . 2004-09-26 14:35	2768896	----a-w	c:\windows\system32\GSDLL32.dll

2009-04-18 09:39 . 2004-09-25 22:35	147456	----a-w	c:\windows\system32\gswin32c.exe

2009-04-17 19:01 . 2009-04-17 19:01	--------	d-----w	c:\documents and settings\icservice\Dane aplikacji\AdobeUM

2009-04-17 17:38 . 2009-04-17 17:38	--------	d-----w	c:\documents and settings\icservice\Ustawienia lokalne\Dane aplikacji\Ahead

2009-04-17 11:52 . 2009-04-17 11:52	--------	d-----w	c:\documents and settings\icservice\Dane aplikacji\Nero

2009-04-17 11:48 . 2009-04-17 11:48	--------	d-----w	c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Nero

2009-04-17 11:34 . 2008-06-14 18:01	273024	-c----w	c:\windows\system32\dllcache\bthport.sys

2009-04-17 11:34 . 2008-06-14 18:01	273024	------w	c:\windows\system32\drivers\bthport.sys

2009-04-17 11:30 . 2009-02-09 11:52	2017280	-c----w	c:\windows\system32\dllcache\ntkrpamp.exe

2009-04-17 11:30 . 2009-02-09 11:52	2059008	-c----w	c:\windows\system32\dllcache\ntkrnlpa.exe

2009-04-17 11:30 . 2009-02-09 11:52	2181760	-c----w	c:\windows\system32\dllcache\ntoskrnl.exe

2009-04-17 11:30 . 2009-02-09 11:52	2137600	-c----w	c:\windows\system32\dllcache\ntkrnlmp.exe

2009-04-17 11:27 . 2008-10-24 11:10	453632	-c----w	c:\windows\system32\dllcache\mrxsmb.sys

2009-04-17 11:26 . 2009-04-17 11:26	--------	d-----w	c:\documents and settings\icservice\Ustawienia lokalne\Dane aplikacji\ACD Systems

2009-04-17 11:26 . 2009-04-17 11:26	--------	d-----w	c:\documents and settings\icservice\Dane aplikacji\ACD Systems

2009-04-17 11:24 . 2009-04-17 11:24	--------	d-----w	c:\documents and settings\All Users.WINDOWS\Dane aplikacji\ACD Systems

2009-04-17 11:23 . 2009-04-17 11:23	--------	d-----w	c:\documents and settings\icservice\Ustawienia lokalne\Dane aplikacji\Downloaded Installations

2009-04-17 11:17 . 2009-04-18 17:24	69016	----a-w	c:\documents and settings\icservice\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT

2009-04-17 11:15 . 2003-03-18 19:20	1060864	----a-w	c:\windows\system32\MFC71.dll

2009-04-17 11:09 . 2009-04-17 11:09	--------	d-----w	c:\documents and settings\icservice\Ustawienia lokalne\Dane aplikacji\Stardock

2009-04-17 11:08 . 2009-04-17 11:08	46274	----a-w	c:\windows\BricoPackUninst.cmd

2009-04-17 11:07 . 2009-04-17 11:07	3932214	----a-w	c:\windows\BricoPack Wallpaper.bmp

2009-04-17 11:07 . 2009-04-17 11:08	2276	----a-w	c:\windows\BricoPackFoldersDelete.cmd

2009-04-17 10:13 . 2001-08-17 21:59	3072	----a-w	c:\windows\system32\drivers\audstub.sys

2009-04-17 10:12 . 2004-08-04 00:35	58624	----a-w	c:\windows\system32\drivers\redbook.sys

2009-04-17 10:12 . 2001-08-17 21:46	6400	----a-w	c:\windows\system32\drivers\enum1394.sys

2009-04-17 10:12 . 2004-08-03 22:31	20992	----a-w	c:\windows\system32\drivers\RTL8139.sys

2009-04-17 10:12 . 2004-08-03 22:44	77312	-c--a-w	c:\windows\system32\dllcache\usbui.dll

2009-04-17 10:12 . 2004-08-03 22:44	77312	----a-w	c:\windows\system32\usbui.dll

2009-04-17 10:12 . 2001-08-17 21:58	9344	----a-w	c:\windows\system32\drivers\compbatt.sys

2009-04-17 10:12 . 2001-08-17 21:57	14080	----a-w	c:\windows\system32\drivers\battc.sys

2009-04-17 10:12 . 2004-08-03 23:07	14080	----a-w	c:\windows\system32\drivers\CmBatt.sys

2009-04-17 10:09 . 2001-10-26 17:27	19968	-c--a-w	c:\windows\system32\dllcache\agt040e.dll

2009-04-17 10:08 . 2009-04-17 08:17	--------	d--h--w	c:\documents and settings\Default User.WINDOWS

2009-04-17 10:08 . 2009-04-17 08:16	--------	d-----w	c:\documents and settings\All Users.WINDOWS

2009-04-17 10:08 . 2009-04-17 08:22	686	----a-w	c:\windows\system32\$winnt$.inf

2009-04-17 10:03 . 2009-04-17 10:03	--------	d-----w	c:\windows\NLDRV

2009-04-17 09:58 . 2009-04-18 10:05	--------	d-----w	c:\documents and settings\icservice\Ustawienia lokalne\Dane aplikacji\Adobe

2009-04-17 09:55 . 2006-10-26 17:56	32592	----a-w	c:\windows\system32\msonpmon.dll

2009-04-17 09:51 . 2009-04-17 09:51	--------	d-----w	c:\documents and settings\icservice\Ustawienia lokalne\Dane aplikacji\Microsoft Help

2009-04-17 09:51 . 2009-04-18 10:27	--------	d-----w	c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Microsoft Help

2009-04-17 09:45 . 2001-09-14 20:24	36864	----a-w	c:\windows\system32\RemoveFiles.exe

2009-04-17 09:33 . 2009-04-17 09:33	--------	d-----w	c:\documents and settings\icservice\Ustawienia lokalne\Dane aplikacji\Identities

2009-04-17 09:27 . 2009-04-17 09:27	940794	----a-w	c:\windows\system32\LoopyMusic.wav

2009-04-17 09:27 . 2009-04-17 09:27	146650	----a-w	c:\windows\system32\BuzzingBee.wav

2009-04-17 09:25 . 2005-04-16 20:20	487424	----a-w	c:\windows\RtlExUpd.dll

2009-04-17 09:20 . 2008-07-09 07:57	26488	----a-w	c:\windows\system32\spupdsvc.exe

2009-04-17 09:20 . 2009-04-17 09:20	--------	d-----w	C:\SWSetup

2009-04-17 09:08 . 2009-04-17 09:08	0	----a-w	c:\windows\nsreg.dat

2009-04-17 09:04 . 2009-04-17 09:04	--------	d-s---w	c:\documents and settings\icservice\UserData

2009-04-17 09:03 . 2009-04-17 09:03	--------	d-----w	c:\documents and settings\icservice\Ustawienia lokalne\Dane aplikacji\Mozilla

2009-04-17 08:59 . 2009-04-17 08:59	717296	----a-w	c:\windows\system32\drivers\sptd.sys

2009-04-17 08:59 . 2009-04-17 08:59	--------	d-----w	c:\documents and settings\icservice\Dane aplikacji\DAEMON Tools

2009-04-17 08:55 . 2008-07-09 09:05	421888	----a-w	c:\windows\system32\ac3filter.acm

2009-04-17 08:46 . 2004-08-03 21:08	26496	-c--a-w	c:\windows\system32\dllcache\usbstor.sys

2009-04-17 08:38 . 2006-02-27 03:46	81408	----a-w	c:\windows\system32\drivers\Rtnicxp.sys

2009-04-17 08:34 . 2009-04-17 08:34	84	----a-w	c:\windows\VSWizard.ini

2009-04-17 08:33 . 2006-03-23 10:18	143360	----a-w	c:\windows\system32\igfxres.dll

2009-04-17 08:23 . 2009-04-19 21:00	--------	d--h--w	c:\documents and settings\LocalService.ZARZĄDZANIE NT\Ustawienia lokalne

2009-04-17 08:20 . 2004-08-03 22:44	4096	-c--a-w	c:\windows\system32\dllcache\rpcref.dll

2009-04-17 08:19 . 2004-08-03 21:04	106496	-c--a-w	c:\windows\system32\dllcache\imekrcic.dll

2009-04-17 08:18 . 2001-07-21 22:20	66082	-c--a-w	c:\windows\system32\dllcache\c_1145.nls

2009-04-17 08:17 . 2009-04-18 20:08	2596	----a-w	c:\windows\system32\CONFIG.NT

2009-04-17 08:17 . 2009-04-17 08:17	0	----a-w	c:\windows\control.ini

2009-04-17 08:17 . 2009-04-17 08:17	23392	----a-w	c:\windows\system32\nscompat.tlb

2009-04-17 08:17 . 2009-04-17 08:17	16832	----a-w	c:\windows\system32\amcompat.tlb

2009-04-17 08:17 . 2009-04-17 11:24	316640	----a-w	c:\windows\WMSysPr9.prx

2009-04-17 08:17 . 2009-04-17 08:17	--------	d-----w	c:\documents and settings\Default User.WINDOWS\Ustawienia lokalne\Dane aplikacji\Microsoft

2009-04-17 08:16 . 2009-04-17 08:58	--------	d-sh--w	c:\documents and settings\All Users.WINDOWS\DRM

2009-04-17 08:16 . 2009-04-17 08:16	488	---ha-r	c:\windows\system32\WindowsLogon.manifest

2009-04-17 08:16 . 2009-04-17 08:16	488	---ha-r	c:\windows\system32\logonui.exe.manifest

2009-04-17 08:16 . 2009-04-17 08:16	749	---ha-r	c:\windows\WindowsShell.Manifest

2009-04-17 08:16 . 2009-04-17 08:16	749	---ha-r	c:\windows\system32\wuaucpl.cpl.manifest

2009-04-17 08:16 . 2009-04-17 08:16	749	---ha-r	c:\windows\system32\sapi.cpl.manifest

2009-04-17 08:16 . 2009-04-17 08:16	749	---ha-r	c:\windows\system32\nwc.cpl.manifest

2009-04-17 08:16 . 2009-04-17 08:16	749	---ha-r	c:\windows\system32\ncpa.cpl.manifest

2009-04-17 08:16 . 2009-04-17 08:16	749	---ha-r	c:\windows\system32\cdplayer.exe.manifest

2009-04-17 08:16 . 2001-07-22 02:53	4399505	-c--a-w	c:\windows\system32\dllcache\nls302en.lex

2009-04-17 08:14 . 2009-04-17 08:14	21856	----a-w	c:\windows\system32\emptyregdb.dat

2009-04-17 08:13 . 2001-10-26 17:29	605696	-c--a-w	c:\windows\system32\dllcache\getuname.dll

2009-04-15 18:14 . 2009-04-15 18:14	--------	d-----w	c:\documents and settings\icserwis\Dane aplikacji\Programer

2009-04-15 12:52 . 2009-04-15 12:52	--------	d-----w	c:\documents and settings\icserwis\Ustawienia lokalne\Dane aplikacji\Opera

2009-04-14 17:51 . 2009-04-14 17:51	101840	----a-w	c:\documents and settings\icserwis\Dane aplikacji\GDIPFONTCACHEV1.DAT

2009-04-14 12:02 . 2009-04-14 12:02	--------	d-----w	C:\DeskUpdate.tmp

2009-04-14 10:41 . 2009-04-14 10:41	--------	d-----w	c:\documents and settings\icserwis\Ustawienia lokalne\Dane aplikacji\eSupport.com

2009-04-12 14:52 . 2009-04-18 09:39	--------	d-----w	c:\windows\system32\lib

2009-04-12 14:52 . 2009-04-18 09:39	--------	d-----w	c:\windows\system32\fonts

2009-04-10 07:26 . 2009-04-10 07:26	--------	d-----w	c:\documents and settings\icserwis\Dane aplikacji\OpenOffice.org

2009-04-08 10:13 . 2009-04-08 10:13	--------	d-----w	c:\windows\Sun

2009-04-07 08:57 . 2009-04-07 08:57	--------	d-----w	c:\documents and settings\icserwis\Dane aplikacji\Windows Desktop Search

2009-04-07 08:56 . 2009-04-07 08:56	--------	d-sh--w	c:\documents and settings\LocalService\IETldCache

2009-04-07 08:55 . 2009-04-07 08:55	--------	d-----w	c:\windows\system32\GroupPolicy

2009-04-06 19:35 . 2009-04-17 10:03	--------	d-sh--w	c:\windows\system32\config\systemprofile\IETldCache

2009-04-06 19:28 . 2009-04-17 10:03	--------	d-----w	c:\windows\system32\pl


.

(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-04-18 20:37 . 2008-01-29 15:29	33808	----a-w	c:\windows\system32\drivers\klbg.sys

2009-04-18 20:15 . 2009-04-18 20:15	--------	d-----w	c:\program files\Kaspersky Lab

2009-04-18 19:28 . 2009-04-18 17:42	--------	d-----w	c:\program files\PDF Password Remover v2.5

2009-04-18 17:17 . 2009-04-18 16:14	--------	d-----w	c:\program files\ElcomSoft

2009-04-18 15:58 . 2009-04-18 15:34	--------	d-----w	c:\program files\Soliddocuments

2009-04-18 15:45 . 2009-04-18 15:45	--------	d-----w	c:\program files\Quark

2009-04-18 15:44 . 2009-04-04 16:49	--------	d--h--w	c:\program files\InstallShield Installation Information

2009-04-18 15:44 . 2009-04-18 15:43	--------	d-----w	c:\program files\QuickTime

2009-04-18 09:39 . 2009-04-12 14:52	--------	d-----w	c:\program files\psconvert

2009-04-18 09:04 . 2001-10-26 16:15	74648	----a-w	c:\windows\system32\perfc015.dat

2009-04-18 09:04 . 2001-10-26 16:15	448586	----a-w	c:\windows\system32\perfh015.dat

2009-04-17 11:27 . 2009-04-17 11:27	--------	d-----w	c:\program files\English Translator 3

2009-04-17 11:25 . 2009-04-04 18:52	--------	d-----w	c:\program files\Common Files\ACD Systems

2009-04-17 11:08 . 2004-08-03 22:44	219648	----a-w	c:\windows\system32\uxtheme.dll

2009-04-17 09:45 . 2009-04-04 18:32	--------	d-----w	c:\program files\Common Files\Adobe

2009-04-17 09:20 . 2009-04-17 09:20	--------	d-----w	c:\program files\HPQ

2009-04-17 08:58 . 2009-04-17 08:57	--------	d-----w	c:\program files\Winamp

2009-04-17 08:57 . 2009-04-17 08:57	--------	d-----w	c:\documents and settings\icservice\Dane aplikacji\Winamp

2009-04-17 08:57 . 2009-04-04 18:18	--------	d-----w	c:\program files\WinImage

2009-04-17 08:55 . 2009-04-17 08:55	--------	d-----w	c:\program files\XP Codec Pack

2009-04-17 08:55 . 2009-04-04 18:21	--------	d-----w	c:\program files\SubEdit-Player

2009-04-17 08:36 . 2009-04-17 08:34	--------	d-----w	c:\program files\viewsonic

2009-04-17 08:17 . 2009-04-17 08:17	86327	----a-w	c:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-04-17 07:00 . 2009-04-17 07:00	--------	d-----w	c:\program files\Common Files\Adobe Systems Shared

2009-04-17 06:31 . 2009-04-17 06:31	--------	d-----w	c:\program files\VeryPDF PDF2Word v3.0

2009-04-15 18:14 . 2009-04-15 18:14	--------	d-----w	c:\program files\Common Files\Borland Shared

2009-04-15 18:14 . 2009-04-15 18:14	--------	d-----w	c:\program files\Programer

2009-04-15 17:48 . 2009-04-04 18:52	--------	d-----w	c:\program files\ACD Systems

2009-04-15 15:30 . 2009-04-15 15:13	--------	d-----w	c:\program files\SpeedFan

2009-04-15 12:52 . 2009-04-15 12:52	--------	d-----w	c:\program files\Opera

2009-04-14 20:44 . 2009-04-06 06:56	--------	d-----w	c:\program files\eMule

2009-04-14 12:03 . 2009-04-04 16:20	--------	d-----w	c:\program files\Intel

2009-04-14 10:24 . 2009-04-14 10:23	--------	d-----w	c:\program files\CPUID

2009-04-12 14:52 . 2009-04-12 14:52	--------	d-----w	c:\program files\PDF-Convert

2009-04-10 07:24 . 2009-04-10 07:24	--------	d-----w	c:\program files\OpenOffice.org 3

2009-04-07 08:56 . 2009-04-07 08:55	--------	d-----w	c:\program files\Windows Desktop Search

2009-04-06 19:25 . 2004-08-04 12:00	251152	--sha-r	C:\ntldr

2009-04-06 16:10 . 2009-04-06 16:10	--------	d-----w	c:\program files\Microsoft Games

2009-04-06 07:11 . 2009-04-06 07:11	--------	d-----w	c:\program files\MSXML 4.0

2009-04-05 08:26 . 2009-04-05 08:22	--------	d-----w	c:\program files\Common Files\Nero

2009-04-05 08:22 . 2009-04-05 08:22	--------	d-----w	c:\program files\Nero

2009-04-04 19:00 . 2009-04-04 19:00	--------	d-----w	c:\program files\Microsoft Works

2009-04-04 18:59 . 2009-04-04 18:59	--------	d-----w	c:\program files\MSBuild

2009-04-04 18:59 . 2009-04-04 18:59	--------	d-----w	c:\program files\Microsoft.NET

2009-04-04 18:57 . 2009-04-04 18:57	--------	d-----w	c:\program files\Microsoft Visual Studio 8

2009-04-04 18:47 . 2009-04-04 16:49	--------	d-----w	c:\program files\Common Files\InstallShield

2009-04-04 18:31 . 2009-04-04 18:31	--------	d-----w	c:\program files\Lavalys

2009-04-04 18:28 . 2009-04-04 18:28	--------	d-----w	c:\program files\A4Tech

2009-04-04 18:27 . 2009-04-04 18:27	--------	d-----w	c:\program files\DAEMON Tools Lite

2009-04-04 18:22 . 2009-04-04 18:22	--------	d-----w	c:\program files\Alwil Software

2009-04-04 18:21 . 2009-04-04 18:21	--------	d-----w	c:\program files\K-Lite Codec Pack

2009-04-04 18:19 . 2009-04-04 18:19	--------	d-----w	c:\program files\CCleaner

2009-04-04 16:53 . 2009-04-04 16:49	--------	d-----w	c:\program files\Realtek

2009-04-04 15:23 . 2009-04-04 15:23	133	----a-w	c:\documents and settings\icserwis\Ustawienia lokalne\Dane aplikacji\fusioncache.dat

2009-04-04 15:17 . 2009-04-04 15:17	--------	d-----w	c:\program files\microsoft frontpage

2009-04-04 15:15 . 2009-04-04 15:15	--------	d-----w	c:\program files\Java

2009-04-04 15:15 . 2009-04-04 15:15	--------	d-----w	c:\program files\Common Files\Java

2009-04-04 15:10 . 2009-04-04 15:10	--------	d-----w	c:\program files\Usługi online

2009-03-06 14:47 . 2004-08-03 22:44	285184	----a-w	c:\windows\system32\pdh.dll

2009-02-20 08:32 . 2004-08-03 22:44	662016	----a-w	c:\windows\system32\wininet.dll

2009-02-20 08:32 . 2004-08-03 22:44	81920	----a-w	c:\windows\system32\ieencode.dll

2009-02-09 14:19 . 2004-08-03 22:37	1846528	----a-w	c:\windows\system32\win32k.sys

2009-02-09 11:52 . 2004-08-04 00:39	2017280	----a-w	c:\windows\system32\ntkrnlpa.exe

2009-02-09 11:52 . 2004-08-03 22:38	2137600	----a-w	c:\windows\system32\ntoskrnl.exe

2009-02-09 10:22 . 2004-08-03 22:44	399360	----a-w	c:\windows\system32\rpcss.dll

2009-02-09 10:22 . 2004-08-03 22:44	725504	----a-w	c:\windows\system32\lsasrv.dll

2009-02-09 10:22 . 2004-08-03 22:43	686080	----a-w	c:\windows\system32\advapi32.dll

2009-02-09 10:22 . 2004-08-03 22:43	722944	----a-w	c:\windows\system32\ntdll.dll

2009-02-09 10:10 . 2004-08-03 22:44	111104	----a-w	c:\windows\system32\services.exe

2009-02-06 16:54 . 2001-10-26 17:30	55808	----a-w	c:\windows\system32\sc.exe

2009-02-03 20:11 . 2004-08-03 22:44	55808	----a-w	c:\windows\system32\secur32.dll

2002-08-27 16:41 . 2009-04-17 08:34	75536	----a-w	c:\program files\viewsonicinstruct_xp.pdf

.


------- Sigcheck -------


[-] 2004-08-03 22:44	1054208	3AA83B14D5FFC0BFC66866B511AD7C4E	c:\windows\explorer.exe

[-] 2004-08-03 22:44	2136064	9220FE107D9EF8C2A011823733F4BF14	c:\windows\system32\dllcache\explorer.exe


[-] 2004-08-03 22:44	35840	8434709730E0228B2FF0BE30EB051620	c:\windows\system32\ctfmon.exe

[-] 2004-08-03 22:44	35840	934F863FFA7A3DDCD42FF7D1C8BE14B2	c:\windows\system32\dllcache\ctfmon.exe


[-] 2004-08-03 22:44	78336	F224AE72B312E3BC3B492B11010DD757	c:\windows\system32\spoolsv.exe

[-] 2004-08-03 22:44	78336	EC2C4D9473B9B12A0B6140B630A31ADC	c:\windows\system32\dllcache\spoolsv.exe


[-] 2004-08-03 22:44	45568	8725B450AB1254D1544029755D41FE3E	c:\windows\system32\userinit.exe

[-] 2004-08-03 22:44	45568	0172B0613D31568DA6B0A46AD3741728	c:\windows\system32\dllcache\userinit.exe


[-] 2008-05-12 11:51	1548288	64FF4E77CF31132734C42C90B4839FBA	c:\windows\system32\sfcfiles.dll

.

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane  

REGEDIT4


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 35840]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 114688]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 98304]

"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 139264]

"WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2007-05-15 225280]

"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-04-18 206088]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-04-17 16165376]

"SMSERIAL"="sm56hlpr.exe" - c:\windows\sm56hlpr.exe [2006-01-20 565248]


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 35840]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Userinit"="c:\windows\explorer.exe,"


[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]

path=c:\documents and settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk

backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup


[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]

path=c:\documents and settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup


[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Microsoft Office.lnk]

path=c:\documents and settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup


[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^WinZip Quick Pick.lnk]

path=c:\documents and settings\All Users.WINDOWS\Menu Start\Programy\Autostart\WinZip Quick Pick.lnk

backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup


[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009


S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-04-18 33808]

S0 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [2006-02-27 34880]

S0 O2SDRDR;O2SDRDR;c:\windows\system32\DRIVERS\o2sd.sys [2006-02-20 29056]

S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]

S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]


.

.

------- Skan uzupełniający -------

.

uStart Page = hxxp://www.google.pl/

IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\icservice\Dane aplikacji\Mozilla\Firefox\Profiles\tnouso92.default\

FF - prefs.js: browser.startup.homepage - www.google.pl

.


**************************************************************************


catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-04-19 23:00

Windows 5.1.2600 Dodatek Service Pack 2 NTFS


skanowanie ukrytych procesów ...  


skanowanie ukrytych wpisów autostartu ... 


skanowanie ukrytych plików ...  


skanowanie pomyślnie ukończone

ukryte pliki: 0


**************************************************************************

.

--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\WPAEvents]

@Denied: (Full) (LocalSystem)

.

Czas ukończenia: 2009-04-19 23:01

ComboFix-quarantined-files.txt 2009-04-19 21:01

ComboFix2.txt 2009-04-19 20:55

ComboFix3.txt 2009-04-19 20:50


Przed: 33 842 536 448 bajtów wolnych

Po: 33 830 477 824 bajtów wolnych


318	--- E O F ---	2009-04-18 11:25

(Leon$) #7

Wyłącz przywracanie systemu na wszystkich dyskach.http://support.microsoft.com/kb/310405/pl

Otwórz notatnik i wklej

zapisz jako CFScript.txt (zapisz by ikonka CFScript.txt była obok ikonki ComboFix.exe) >> Przeciągnij i upuść ikonkę CFScript.txt na ikonkę ComboFix.exe

Powinno rozpocząć się usuwanie

Potem log z usuwania Combofix

:slight_smile:


(Imperial_Dragon) #8
ComboFix 09-04-19.01 - icservice 2009-04-19 23:45.4 - NTFSx86

Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.1014.625 [GMT 2:00]

Uruchomiony z: c:\documents and settings\icservice\Pulpit\ComboFix.exe

Użyto następujących komend :: c:\documents and settings\icservice\Pulpit\CFScript.txt.txt

AV: Kaspersky Internet Security *On-access scanning disabled* (Updated)

FW: Kaspersky Internet Security *disabled*

 * Utworzono nowy punkt przywracania


FILE ::

c:\windows\system32\2.tmp

c:\windows\system32\3.tmp

c:\windows\system32\4.tmp

c:\windows\system32\5.tmp

c:\windows\system32\6.tmp

c:\windows\system32\7.tmp

.


((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))

.


c:\windows\system32\2.tmp

c:\windows\system32\3.tmp

c:\windows\system32\4.tmp

c:\windows\system32\5.tmp

c:\windows\system32\6.tmp

c:\windows\system32\7.tmp


[COLOR=RED] . . . jest zainfekowany!![/COLOR]


.

((((((((((((((((((((((((( Pliki utworzone od 2009-03-19 do 2009-04-19 )))))))))))))))))))))))))))))))

.


2009-04-18 20:16 . 2009-04-18 20:37	89601	----a-w	c:\windows\system32\drivers\klick.dat

2009-04-18 20:16 . 2009-04-18 20:37	101287	----a-w	c:\windows\system32\drivers\klin.dat

2009-04-18 20:15 . 2009-04-19 21:36	3192	--sha-w	c:\windows\system32\drivers\fidbox2.idx

2009-04-18 20:15 . 2009-04-19 21:36	311328	--sha-w	c:\windows\system32\drivers\fidbox2.dat

2009-04-18 20:15 . 2009-04-19 21:35	1157664	--sha-w	c:\windows\system32\drivers\fidbox.dat

2009-04-18 20:15 . 2009-04-19 21:35	11172	--sha-w	c:\windows\system32\drivers\fidbox.idx

2009-04-18 20:15 . 2009-04-19 21:30	--------	d-----w	c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Kaspersky Lab

2009-04-18 20:14 . 2009-04-18 20:14	--------	d-----w	c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Kaspersky Lab Setup Files

2009-04-18 17:47 . 2009-04-18 17:47	36	----a-w	c:\windows\verypdf.ini

2009-04-18 17:47 . 2009-04-18 17:47	1024	----a-w	c:\windows\system32\pwdremover.dat

2009-04-18 17:23 . 2009-04-18 17:23	--------	d-----w	c:\documents and settings\icservice\Dane aplikacji\Quark

2009-04-18 16:09 . 2009-04-18 17:55	167	----a-w	c:\windows\ConverterCore.INI

2009-04-18 15:58 . 2009-04-18 15:58	--------	d-----w	c:\documents and settings\All Users.WINDOWS\Dane aplikacji\SolidDocuments

2009-04-18 15:45 . 2009-04-18 15:45	--------	d-----w	c:\windows\system32\QuickTime

2009-04-18 15:45 . 2009-04-18 15:45	--------	d-----w	c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Quark

2009-04-18 15:44 . 2009-04-18 17:23	54156	---ha-w	c:\windows\QTFont.qfn

2009-04-18 15:44 . 2009-04-18 15:44	1409	----a-w	c:\windows\QTFont.for

2009-04-18 15:43 . 2009-04-18 15:43	--------	d-----w	c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Apple Computer

2009-04-18 15:34 . 2009-04-18 18:47	--------	d-----w	c:\documents and settings\icservice\Dane aplikacji\SolidDocuments

2009-04-18 09:48 . 2009-04-18 09:48	68520	----a-w	c:\documents and settings\icservice\Dane aplikacji\GDIPFONTCACHEV1.DAT

2009-04-18 09:44 . 2009-04-18 09:44	427	----a-w	c:\windows\ODBC.INI

2009-04-18 09:39 . 2005-01-24 08:52	65308	----a-w	c:\windows\system32\PSConvert.exe

2009-04-18 09:39 . 2005-01-24 08:36	137	----a-w	c:\windows\system32\psparam.ini

2009-04-18 09:39 . 2004-09-26 14:35	2768896	----a-w	c:\windows\system32\GSDLL32.dll

2009-04-18 09:39 . 2004-09-25 22:35	147456	----a-w	c:\windows\system32\gswin32c.exe

2009-04-17 19:01 . 2009-04-17 19:01	--------	d-----w	c:\documents and settings\icservice\Dane aplikacji\AdobeUM

2009-04-17 17:38 . 2009-04-17 17:38	--------	d-----w	c:\documents and settings\icservice\Ustawienia lokalne\Dane aplikacji\Ahead

2009-04-17 11:52 . 2009-04-17 11:52	--------	d-----w	c:\documents and settings\icservice\Dane aplikacji\Nero

2009-04-17 11:48 . 2009-04-17 11:48	--------	d-----w	c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Nero

2009-04-17 11:34 . 2008-06-14 18:01	273024	-c----w	c:\windows\system32\dllcache\bthport.sys

2009-04-17 11:34 . 2008-06-14 18:01	273024	------w	c:\windows\system32\drivers\bthport.sys

2009-04-17 11:30 . 2009-02-09 11:52	2017280	-c----w	c:\windows\system32\dllcache\ntkrpamp.exe

2009-04-17 11:30 . 2009-02-09 11:52	2059008	-c----w	c:\windows\system32\dllcache\ntkrnlpa.exe

2009-04-17 11:30 . 2009-02-09 11:52	2181760	-c----w	c:\windows\system32\dllcache\ntoskrnl.exe

2009-04-17 11:30 . 2009-02-09 11:52	2137600	-c----w	c:\windows\system32\dllcache\ntkrnlmp.exe

2009-04-17 11:27 . 2008-10-24 11:10	453632	-c----w	c:\windows\system32\dllcache\mrxsmb.sys

2009-04-17 11:26 . 2009-04-17 11:26	--------	d-----w	c:\documents and settings\icservice\Ustawienia lokalne\Dane aplikacji\ACD Systems

2009-04-17 11:26 . 2009-04-17 11:26	--------	d-----w	c:\documents and settings\icservice\Dane aplikacji\ACD Systems

2009-04-17 11:24 . 2009-04-17 11:24	--------	d-----w	c:\documents and settings\All Users.WINDOWS\Dane aplikacji\ACD Systems

2009-04-17 11:23 . 2009-04-17 11:23	--------	d-----w	c:\documents and settings\icservice\Ustawienia lokalne\Dane aplikacji\Downloaded Installations

2009-04-17 11:17 . 2009-04-19 21:35	69016	----a-w	c:\documents and settings\icservice\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT

2009-04-17 11:15 . 2003-03-18 19:20	1060864	----a-w	c:\windows\system32\MFC71.dll

2009-04-17 11:09 . 2009-04-17 11:09	--------	d-----w	c:\documents and settings\icservice\Ustawienia lokalne\Dane aplikacji\Stardock

2009-04-17 11:08 . 2009-04-17 11:08	46274	----a-w	c:\windows\BricoPackUninst.cmd

2009-04-17 11:07 . 2009-04-17 11:07	3932214	----a-w	c:\windows\BricoPack Wallpaper.bmp

2009-04-17 11:07 . 2009-04-17 11:08	2276	----a-w	c:\windows\BricoPackFoldersDelete.cmd

2009-04-17 10:13 . 2001-08-17 21:59	3072	----a-w	c:\windows\system32\drivers\audstub.sys

2009-04-17 10:12 . 2004-08-04 00:35	58624	----a-w	c:\windows\system32\drivers\redbook.sys

2009-04-17 10:12 . 2001-08-17 21:46	6400	----a-w	c:\windows\system32\drivers\enum1394.sys

2009-04-17 10:12 . 2004-08-03 22:31	20992	----a-w	c:\windows\system32\drivers\RTL8139.sys

2009-04-17 10:12 . 2004-08-03 22:44	77312	-c--a-w	c:\windows\system32\dllcache\usbui.dll

2009-04-17 10:12 . 2004-08-03 22:44	77312	----a-w	c:\windows\system32\usbui.dll

2009-04-17 10:12 . 2001-08-17 21:58	9344	----a-w	c:\windows\system32\drivers\compbatt.sys

2009-04-17 10:12 . 2001-08-17 21:57	14080	----a-w	c:\windows\system32\drivers\battc.sys

2009-04-17 10:12 . 2004-08-03 23:07	14080	----a-w	c:\windows\system32\drivers\CmBatt.sys

2009-04-17 10:09 . 2001-10-26 17:27	19968	-c--a-w	c:\windows\system32\dllcache\agt040e.dll

2009-04-17 10:08 . 2009-04-17 08:17	--------	d--h--w	c:\documents and settings\Default User.WINDOWS

2009-04-17 10:08 . 2009-04-17 08:16	--------	d-----w	c:\documents and settings\All Users.WINDOWS

2009-04-17 10:08 . 2009-04-17 08:22	686	----a-w	c:\windows\system32\$winnt$.inf

2009-04-17 10:03 . 2009-04-17 10:03	--------	d-----w	c:\windows\NLDRV

2009-04-17 09:58 . 2009-04-18 10:05	--------	d-----w	c:\documents and settings\icservice\Ustawienia lokalne\Dane aplikacji\Adobe

2009-04-17 09:55 . 2006-10-26 17:56	32592	----a-w	c:\windows\system32\msonpmon.dll

2009-04-17 09:51 . 2009-04-17 09:51	--------	d-----w	c:\documents and settings\icservice\Ustawienia lokalne\Dane aplikacji\Microsoft Help

2009-04-17 09:51 . 2009-04-19 21:27	--------	d-----w	c:\documents and settings\All Users.WINDOWS\Dane aplikacji\Microsoft Help

2009-04-17 09:45 . 2001-09-14 20:24	36864	----a-w	c:\windows\system32\RemoveFiles.exe

2009-04-17 09:33 . 2009-04-17 09:33	--------	d-----w	c:\documents and settings\icservice\Ustawienia lokalne\Dane aplikacji\Identities

2009-04-17 09:27 . 2009-04-17 09:27	940794	----a-w	c:\windows\system32\LoopyMusic.wav

2009-04-17 09:27 . 2009-04-17 09:27	146650	----a-w	c:\windows\system32\BuzzingBee.wav

2009-04-17 09:25 . 2005-04-16 20:20	487424	----a-w	c:\windows\RtlExUpd.dll

2009-04-17 09:20 . 2008-07-09 07:57	26488	----a-w	c:\windows\system32\spupdsvc.exe

2009-04-17 09:08 . 2009-04-17 09:08	0	----a-w	c:\windows\nsreg.dat

2009-04-17 09:04 . 2009-04-17 09:04	--------	d-s---w	c:\documents and settings\icservice\UserData

2009-04-17 09:03 . 2009-04-17 09:03	--------	d-----w	c:\documents and settings\icservice\Ustawienia lokalne\Dane aplikacji\Mozilla

2009-04-17 08:59 . 2009-04-17 08:59	717296	----a-w	c:\windows\system32\drivers\sptd.sys

2009-04-17 08:59 . 2009-04-17 08:59	--------	d-----w	c:\documents and settings\icservice\Dane aplikacji\DAEMON Tools

2009-04-17 08:55 . 2008-07-09 09:05	421888	----a-w	c:\windows\system32\ac3filter.acm

2009-04-17 08:46 . 2004-08-03 21:08	26496	-c--a-w	c:\windows\system32\dllcache\usbstor.sys

2009-04-17 08:38 . 2006-02-27 03:46	81408	----a-w	c:\windows\system32\drivers\Rtnicxp.sys

2009-04-17 08:34 . 2009-04-17 08:34	84	----a-w	c:\windows\VSWizard.ini

2009-04-17 08:33 . 2006-03-23 10:18	143360	----a-w	c:\windows\system32\igfxres.dll

2009-04-17 08:23 . 2009-04-19 21:47	--------	d--h--w	c:\documents and settings\LocalService.ZARZĄDZANIE NT\Ustawienia lokalne

2009-04-17 08:20 . 2004-08-03 22:44	4096	-c--a-w	c:\windows\system32\dllcache\rpcref.dll

2009-04-17 08:19 . 2004-08-03 21:04	106496	-c--a-w	c:\windows\system32\dllcache\imekrcic.dll

2009-04-17 08:18 . 2001-07-21 22:20	66082	-c--a-w	c:\windows\system32\dllcache\c_1145.nls

2009-04-17 08:17 . 2009-04-18 20:08	2596	----a-w	c:\windows\system32\CONFIG.NT

2009-04-17 08:17 . 2009-04-17 08:17	0	----a-w	c:\windows\control.ini

2009-04-17 08:17 . 2009-04-17 08:17	23392	----a-w	c:\windows\system32\nscompat.tlb

2009-04-17 08:17 . 2009-04-17 08:17	16832	----a-w	c:\windows\system32\amcompat.tlb

2009-04-17 08:17 . 2009-04-17 11:24	316640	----a-w	c:\windows\WMSysPr9.prx

2009-04-17 08:17 . 2009-04-17 08:17	--------	d-----w	c:\documents and settings\Default User.WINDOWS\Ustawienia lokalne\Dane aplikacji\Microsoft

2009-04-17 08:16 . 2009-04-17 08:58	--------	d-sh--w	c:\documents and settings\All Users.WINDOWS\DRM

2009-04-17 08:16 . 2009-04-17 08:16	488	---ha-r	c:\windows\system32\WindowsLogon.manifest

2009-04-17 08:16 . 2009-04-17 08:16	488	---ha-r	c:\windows\system32\logonui.exe.manifest

2009-04-17 08:16 . 2009-04-17 08:16	749	---ha-r	c:\windows\WindowsShell.Manifest

2009-04-17 08:16 . 2009-04-17 08:16	749	---ha-r	c:\windows\system32\wuaucpl.cpl.manifest

2009-04-17 08:16 . 2009-04-17 08:16	749	---ha-r	c:\windows\system32\sapi.cpl.manifest

2009-04-17 08:16 . 2009-04-17 08:16	749	---ha-r	c:\windows\system32\nwc.cpl.manifest

2009-04-17 08:16 . 2009-04-17 08:16	749	---ha-r	c:\windows\system32\ncpa.cpl.manifest

2009-04-17 08:16 . 2009-04-17 08:16	749	---ha-r	c:\windows\system32\cdplayer.exe.manifest

2009-04-17 08:16 . 2001-07-22 02:53	4399505	-c--a-w	c:\windows\system32\dllcache\nls302en.lex

2009-04-17 08:14 . 2009-04-17 08:14	21856	----a-w	c:\windows\system32\emptyregdb.dat

2009-04-17 08:13 . 2001-10-26 17:29	605696	-c--a-w	c:\windows\system32\dllcache\getuname.dll

2009-04-15 18:14 . 2009-04-15 18:14	--------	d-----w	c:\documents and settings\icserwis\Dane aplikacji\Programer

2009-04-15 12:52 . 2009-04-15 12:52	--------	d-----w	c:\documents and settings\icserwis\Ustawienia lokalne\Dane aplikacji\Opera

2009-04-14 17:51 . 2009-04-14 17:51	101840	----a-w	c:\documents and settings\icserwis\Dane aplikacji\GDIPFONTCACHEV1.DAT

2009-04-14 10:41 . 2009-04-14 10:41	--------	d-----w	c:\documents and settings\icserwis\Ustawienia lokalne\Dane aplikacji\eSupport.com

2009-04-12 14:52 . 2009-04-18 09:39	--------	d-----w	c:\windows\system32\lib

2009-04-12 14:52 . 2009-04-18 09:39	--------	d-----w	c:\windows\system32\fonts

2009-04-10 07:26 . 2009-04-10 07:26	--------	d-----w	c:\documents and settings\icserwis\Dane aplikacji\OpenOffice.org

2009-04-08 10:13 . 2009-04-08 10:13	--------	d-----w	c:\windows\Sun

2009-04-07 08:57 . 2009-04-07 08:57	--------	d-----w	c:\documents and settings\icserwis\Dane aplikacji\Windows Desktop Search

2009-04-07 08:56 . 2009-04-07 08:56	--------	d-sh--w	c:\documents and settings\LocalService\IETldCache

2009-04-07 08:55 . 2009-04-07 08:55	--------	d-----w	c:\windows\system32\GroupPolicy

2009-04-06 19:35 . 2009-04-17 10:03	--------	d-sh--w	c:\windows\system32\config\systemprofile\IETldCache

2009-04-06 19:28 . 2009-04-17 10:03	--------	d-----w	c:\windows\system32\pl

2009-04-06 19:28 . 2009-04-17 10:03	--------	d-----w	c:\windows\system32\bits

2009-04-06 19:28 . 2009-04-17 10:03	--------	d-----w	c:\windows\l2schemas

2009-04-06 19:26 . 2009-04-06 19:28	--------	d-----w	c:\windows\ServicePackFiles

2009-04-06 19:22 . 2009-04-17 10:06	--------	d-----w	c:\windows\EHome

2009-04-06 15:22 . 2009-04-06 15:22	--------	d-----w	c:\documents and settings\icserwis\Ustawienia lokalne\Dane aplikacji\Stardock

2009-04-06 07:05 . 2009-04-06 07:05	--------	d-sh--w	c:\documents and settings\icserwis\IECompatCache

2009-04-06 07:04 . 2009-04-06 07:04	--------	d-sh--w	c:\documents and settings\icserwis\PrivacIE

2009-04-06 07:03 . 2009-04-06 07:03	--------	d-sh--w	c:\documents and settings\icserwis\IETldCache

2009-04-06 07:02 . 2009-04-06 07:02	--------	d--h--w	c:\windows\msdownld.tmp

2009-04-06 07:02 . 2009-04-06 07:02	--------	d-----w	c:\windows\ie8updates


.

(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-04-19 21:31 . 2001-10-26 16:15	75904	----a-w	c:\windows\system32\perfc015.dat

2009-04-19 21:31 . 2001-10-26 16:15	451934	----a-w	c:\windows\system32\perfh015.dat

2009-04-19 21:25 . 2009-04-04 19:00	--------	d-----w	c:\program files\Microsoft Works

2009-04-19 21:24 . 2009-04-04 18:59	--------	d-----w	c:\program files\MSBuild

2009-04-18 20:37 . 2008-01-29 15:29	33808	----a-w	c:\windows\system32\drivers\klbg.sys

2009-04-18 20:15 . 2009-04-18 20:15	--------	d-----w	c:\program files\Kaspersky Lab

2009-04-18 19:28 . 2009-04-18 17:42	--------	d-----w	c:\program files\PDF Password Remover v2.5

2009-04-18 17:17 . 2009-04-18 16:14	--------	d-----w	c:\program files\ElcomSoft

2009-04-18 15:58 . 2009-04-18 15:34	--------	d-----w	c:\program files\Soliddocuments

2009-04-18 15:45 . 2009-04-18 15:45	--------	d-----w	c:\program files\Quark

2009-04-18 15:44 . 2009-04-04 16:49	--------	d--h--w	c:\program files\InstallShield Installation Information

2009-04-18 15:44 . 2009-04-18 15:43	--------	d-----w	c:\program files\QuickTime

2009-04-18 09:39 . 2009-04-12 14:52	--------	d-----w	c:\program files\psconvert

2009-04-17 11:27 . 2009-04-17 11:27	--------	d-----w	c:\program files\English Translator 3

2009-04-17 11:25 . 2009-04-04 18:52	--------	d-----w	c:\program files\Common Files\ACD Systems

2009-04-17 11:08 . 2004-08-03 22:44	219648	----a-w	c:\windows\system32\uxtheme.dll

2009-04-17 09:45 . 2009-04-04 18:32	--------	d-----w	c:\program files\Common Files\Adobe

2009-04-17 09:20 . 2009-04-17 09:20	--------	d-----w	c:\program files\HPQ

2009-04-17 08:58 . 2009-04-17 08:57	--------	d-----w	c:\program files\Winamp

2009-04-17 08:57 . 2009-04-17 08:57	--------	d-----w	c:\documents and settings\icservice\Dane aplikacji\Winamp

2009-04-17 08:57 . 2009-04-04 18:18	--------	d-----w	c:\program files\WinImage

2009-04-17 08:55 . 2009-04-17 08:55	--------	d-----w	c:\program files\XP Codec Pack

2009-04-17 08:55 . 2009-04-04 18:21	--------	d-----w	c:\program files\SubEdit-Player

2009-04-17 08:36 . 2009-04-17 08:34	--------	d-----w	c:\program files\viewsonic

2009-04-17 08:17 . 2009-04-17 08:17	86327	----a-w	c:\windows\pchealth\helpctr\OfflineCache\index.dat

2009-04-17 07:00 . 2009-04-17 07:00	--------	d-----w	c:\program files\Common Files\Adobe Systems Shared

2009-04-17 06:31 . 2009-04-17 06:31	--------	d-----w	c:\program files\VeryPDF PDF2Word v3.0

2009-04-15 18:14 . 2009-04-15 18:14	--------	d-----w	c:\program files\Common Files\Borland Shared

2009-04-15 18:14 . 2009-04-15 18:14	--------	d-----w	c:\program files\Programer

2009-04-15 17:48 . 2009-04-04 18:52	--------	d-----w	c:\program files\ACD Systems

2009-04-15 15:30 . 2009-04-15 15:13	--------	d-----w	c:\program files\SpeedFan

2009-04-15 12:52 . 2009-04-15 12:52	--------	d-----w	c:\program files\Opera

2009-04-14 20:44 . 2009-04-06 06:56	--------	d-----w	c:\program files\eMule

2009-04-14 12:03 . 2009-04-04 16:20	--------	d-----w	c:\program files\Intel

2009-04-14 10:24 . 2009-04-14 10:23	--------	d-----w	c:\program files\CPUID

2009-04-12 14:52 . 2009-04-12 14:52	--------	d-----w	c:\program files\PDF-Convert

2009-04-10 07:24 . 2009-04-10 07:24	--------	d-----w	c:\program files\OpenOffice.org 3

2009-04-07 08:56 . 2009-04-07 08:55	--------	d-----w	c:\program files\Windows Desktop Search

2009-04-06 19:25 . 2004-08-04 12:00	251152	--sha-r	C:\ntldr

2009-04-06 16:10 . 2009-04-06 16:10	--------	d-----w	c:\program files\Microsoft Games

2009-04-06 07:11 . 2009-04-06 07:11	--------	d-----w	c:\program files\MSXML 4.0

2009-04-05 08:26 . 2009-04-05 08:22	--------	d-----w	c:\program files\Common Files\Nero

2009-04-05 08:22 . 2009-04-05 08:22	--------	d-----w	c:\program files\Nero

2009-04-04 18:59 . 2009-04-04 18:59	--------	d-----w	c:\program files\Microsoft.NET

2009-04-04 18:57 . 2009-04-04 18:57	--------	d-----w	c:\program files\Microsoft Visual Studio 8

2009-04-04 18:47 . 2009-04-04 16:49	--------	d-----w	c:\program files\Common Files\InstallShield

2009-04-04 18:31 . 2009-04-04 18:31	--------	d-----w	c:\program files\Lavalys

2009-04-04 18:28 . 2009-04-04 18:28	--------	d-----w	c:\program files\A4Tech

2009-04-04 18:27 . 2009-04-04 18:27	--------	d-----w	c:\program files\DAEMON Tools Lite

2009-04-04 18:22 . 2009-04-04 18:22	--------	d-----w	c:\program files\Alwil Software

2009-04-04 18:21 . 2009-04-04 18:21	--------	d-----w	c:\program files\K-Lite Codec Pack

2009-04-04 18:19 . 2009-04-04 18:19	--------	d-----w	c:\program files\CCleaner

2009-04-04 16:53 . 2009-04-04 16:49	--------	d-----w	c:\program files\Realtek

2009-04-04 15:23 . 2009-04-04 15:23	133	----a-w	c:\documents and settings\icserwis\Ustawienia lokalne\Dane aplikacji\fusioncache.dat

2009-04-04 15:17 . 2009-04-04 15:17	--------	d-----w	c:\program files\microsoft frontpage

2009-04-04 15:15 . 2009-04-04 15:15	--------	d-----w	c:\program files\Java

2009-04-04 15:15 . 2009-04-04 15:15	--------	d-----w	c:\program files\Common Files\Java

2009-04-04 15:10 . 2009-04-04 15:10	--------	d-----w	c:\program files\Usługi online

2009-03-06 14:47 . 2004-08-03 22:44	285184	----a-w	c:\windows\system32\pdh.dll

2009-02-20 08:32 . 2004-08-03 22:44	662016	----a-w	c:\windows\system32\wininet.dll

2009-02-20 08:32 . 2004-08-03 22:44	81920	----a-w	c:\windows\system32\ieencode.dll

2009-02-09 14:19 . 2004-08-03 22:37	1846528	----a-w	c:\windows\system32\win32k.sys

2009-02-09 11:52 . 2004-08-04 00:39	2017280	----a-w	c:\windows\system32\ntkrnlpa.exe

2009-02-09 11:52 . 2004-08-03 22:38	2137600	----a-w	c:\windows\system32\ntoskrnl.exe

2009-02-09 10:22 . 2004-08-03 22:44	399360	----a-w	c:\windows\system32\rpcss.dll

2009-02-09 10:22 . 2004-08-03 22:44	725504	----a-w	c:\windows\system32\lsasrv.dll

2009-02-09 10:22 . 2004-08-03 22:43	686080	----a-w	c:\windows\system32\advapi32.dll

2009-02-09 10:22 . 2004-08-03 22:43	722944	----a-w	c:\windows\system32\ntdll.dll

2009-02-09 10:10 . 2004-08-03 22:44	111104	----a-w	c:\windows\system32\services.exe

2009-02-06 16:54 . 2001-10-26 17:30	55808	----a-w	c:\windows\system32\sc.exe

2009-02-03 20:11 . 2004-08-03 22:44	55808	----a-w	c:\windows\system32\secur32.dll

2002-08-27 16:41 . 2009-04-17 08:34	75536	----a-w	c:\program files\viewsonicinstruct_xp.pdf

.


------- Sigcheck -------


[-] 2004-08-03 22:44	1054208	3AA83B14D5FFC0BFC66866B511AD7C4E	c:\windows\explorer.exe

[-] 2004-08-03 22:44	2136064	9220FE107D9EF8C2A011823733F4BF14	c:\windows\system32\dllcache\explorer.exe


[-] 2004-08-03 22:44	35840	8434709730E0228B2FF0BE30EB051620	c:\windows\system32\ctfmon.exe

[-] 2004-08-03 22:44	35840	934F863FFA7A3DDCD42FF7D1C8BE14B2	c:\windows\system32\dllcache\ctfmon.exe


[-] 2004-08-03 22:44	78336	F224AE72B312E3BC3B492B11010DD757	c:\windows\system32\spoolsv.exe

[-] 2004-08-03 22:44	78336	EC2C4D9473B9B12A0B6140B630A31ADC	c:\windows\system32\dllcache\spoolsv.exe


[-] 2004-08-03 22:44	45568	8725B450AB1254D1544029755D41FE3E	c:\windows\system32\userinit.exe

[-] 2004-08-03 22:44	45568	0172B0613D31568DA6B0A46AD3741728	c:\windows\system32\dllcache\userinit.exe


[-] 2008-05-12 11:51	1548288	64FF4E77CF31132734C42C90B4839FBA	c:\windows\system32\sfcfiles.dll

.

((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane  

REGEDIT4


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2004-08-03 35840]

"MSMSGS"="c:\program files\Messenger\msmsgs.exe" [2004-08-03 1688064]


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"igfxtray"="c:\windows\system32\igfxtray.exe" [2006-03-23 114688]

"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2006-03-23 98304]

"igfxpers"="c:\windows\system32\igfxpers.exe" [2006-03-23 139264]

"WheelMouse"="c:\program files\A4Tech\Mouse\Amoumain.exe" [2007-05-15 225280]

"AVP"="c:\program files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe" [2009-04-18 206088]

"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2006-10-26 31016]

"RTHDCPL"="RTHDCPL.EXE" - c:\windows\RTHDCPL.exe [2006-04-17 16165376]

"SMSERIAL"="sm56hlpr.exe" - c:\windows\sm56hlpr.exe [2006-01-20 565248]


[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-03 35840]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]

"Userinit"="c:\windows\explorer.exe,"


[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk]

path=c:\documents and settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk

backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup


[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Adobe Reader Speed Launch.lnk]

path=c:\documents and settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Adobe Reader Speed Launch.lnk

backup=c:\windows\pss\Adobe Reader Speed Launch.lnkCommon Startup


[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^Microsoft Office.lnk]

path=c:\documents and settings\All Users.WINDOWS\Menu Start\Programy\Autostart\Microsoft Office.lnk

backup=c:\windows\pss\Microsoft Office.lnkCommon Startup


[HKLM\~\startupfolder\C:^Documents and Settings^All Users.WINDOWS^Menu Start^Programy^Autostart^WinZip Quick Pick.lnk]

path=c:\documents and settings\All Users.WINDOWS\Menu Start\Programy\Autostart\WinZip Quick Pick.lnk

backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup


[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]

"DisableMonitoring"=dword:00000001


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"%windir%\\system32\\sessmgr.exe"=

"c:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"=

"c:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=


[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]

"3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009


S0 klbg;Kaspersky Lab Boot Guard Driver;c:\windows\system32\drivers\klbg.sys [2009-04-18 33808]

S0 O2MDRDR;O2MDRDR;c:\windows\system32\DRIVERS\o2media.sys [2006-02-27 34880]

S0 O2SDRDR;O2SDRDR;c:\windows\system32\DRIVERS\o2sd.sys [2006-02-20 29056]

S3 KLFLTDEV;Kaspersky Lab KLFltDev;c:\windows\system32\DRIVERS\klfltdev.sys [2008-03-13 26640]

S3 klim5;Kaspersky Anti-Virus NDIS Filter;c:\windows\system32\DRIVERS\klim5.sys [2008-04-30 24592]


.

.

------- Skan uzupełniający -------

.

uStart Page = hxxp://www.google.pl/

IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000

IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000

FF - ProfilePath - c:\documents and settings\icservice\Dane aplikacji\Mozilla\Firefox\Profiles\tnouso92.default\

FF - prefs.js: browser.startup.homepage - www.google.pl

.


**************************************************************************


catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-04-19 23:47

Windows 5.1.2600 Dodatek Service Pack 2 NTFS


skanowanie ukrytych procesów ...  


skanowanie ukrytych wpisów autostartu ... 


skanowanie ukrytych plików ...  


skanowanie pomyślnie ukończone

ukryte pliki: 0


**************************************************************************

.

--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------


[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\WPAEvents]

@Denied: (Full) (LocalSystem)

.

Czas ukończenia: 2009-04-19 23:48

ComboFix-quarantined-files.txt 2009-04-19 21:48


Przed: 36 442 058 752 bajtów wolnych

Po: 36 430 176 256 bajtów wolnych


317	--- E O F ---	2009-04-19 21:08

(Leon$) #9

Pobierz program SDFix

-


(Imperial_Dragon) #10
[b]SDFix: Version 1.240 [/b]

Run by icservice on 2009-04-20 at 14:03


Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix


[b]Checking Services [/b]:



Restoring Default Security Values

Restoring Default Hosts File


Rebooting



[b]Checking Files [/b]: 


No Trojan Files Found







Removing Temp Files


[b]ADS Check [/b]:




                                 [b]Final Check [/b]:


catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-04-20 14:07:31

Windows 5.1.2600 Dodatek Service Pack 2 NTFS


scanning hidden processes ...


scanning hidden services & system hive ...


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]

"s1"=dword:2df9c43f

"s2"=dword:110480d0

"h0"=dword:00000001


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]

"p0"="C:\Program Files\DAEMON Tools Lite\"

"h0"=dword:00000000

"khjeh"=hex:4c,66,a9,3d,8c,6c,0a,16,3f,26,f3,db,43,99,32,ee,3f,6c,06,29,bf,..


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]

"a0"=hex:20,01,00,00,96,fe,e2,a3,be,39,32,b5,ca,e0,6c,bd,86,3f,80,c5,58,..

"khjeh"=hex:fb,ed,ec,84,58,2a,91,0e,08,a2,63,7e,45,62,a1,ea,0f,33,c8,ad,48,..


[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]

"khjeh"=hex:13,98,76,14,a9,87,e3,89,e2,49,93,b2,36,e8,29,2d,71,21,5f,83,c8,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]

"p0"="C:\Program Files\DAEMON Tools Lite\"

"h0"=dword:00000000

"khjeh"=hex:4c,66,a9,3d,8c,6c,0a,16,3f,26,f3,db,43,99,32,ee,3f,6c,06,29,bf,..


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]

"a0"=hex:20,01,00,00,96,fe,e2,a3,be,39,32,b5,ca,e0,6c,bd,86,3f,80,c5,58,..

"khjeh"=hex:fb,ed,ec,84,58,2a,91,0e,08,a2,63,7e,45,62,a1,ea,0f,33,c8,ad,48,..


[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]

"khjeh"=hex:13,98,76,14,a9,87,e3,89,e2,49,93,b2,36,e8,29,2d,71,21,5f,83,c8,..


scanning hidden registry entries ...


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]

"TracesProcessed"=dword:000000ad


scanning hidden files ...


scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 0



[b]Remaining Services [/b]:





Authorized Application Key Export:


[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook"

"C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE:*:Enabled:Microsoft Office Groove"

"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"="C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"

"\\??\\C:\\WINDOWS\\system32\\winlogon.exe"="\\??\\C:\\WINDOWS\\system32\\winlogon.exe:*:enabled:@shell32.dll,-1"


[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"


[b]Remaining Files [/b]:




[b]Files with Hidden Attributes [/b]:



[b]Finished![/b]

-- Dodane 19.04.2009 (N) 14:58 --

Malwarebytes' Anti-Malware 1.36

Wersja bazy definicji: 2009

Windows 5.1.2600 Dodatek Service Pack 2


2009-04-20 14:57:06

mbam-log-2009-04-20 (14-57-06).txt


Typ skanowania: Pełne skanowanie (C:\|D:\|)

Przeskanowane obiekty: 163196

Upłynęło: 38 minute(s), 40 second(s)


Zainfekowane procesy w pamięci: 0

Zainfekowane moduły pamięci: 0

Zainfekowane klucze rejestru: 0

Zainfekowane wartości rejestru: 0

Zainfekowane pliki rejestru: 0

Zainfekowane foldery: 0

Zainfekowane pliki: 5


Zainfekowane procesy w pamięci:

(Nie wykryto groźnych plików)


Zainfekowane moduły pamięci:

(Nie wykryto groźnych plików)


Zainfekowane klucze rejestru:

(Nie wykryto groźnych plików)


Zainfekowane wartości rejestru:

(Nie wykryto groźnych plików)


Zainfekowane pliki rejestru:

(Nie wykryto groźnych plików)


Zainfekowane foldery:

(Nie wykryto groźnych plików)


Zainfekowane pliki:

C:\RECYCLER\S-1-5-21-1004336348-1547161642-725345543-1003\Dc1\Quarantine\C\WINDOWS\system32\6to4v32.dll.vir (Dialer) -> Quarantined and deleted successfully.

C:\RECYCLER\S-1-5-21-1004336348-1547161642-725345543-1003\Dc1\Quarantine\C\WINDOWS\system32\at1394.sys.vir (Spyware.OnlineGames) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{0D4CE546-EA68-45AA-B0A7-3459855D16DF}\RP45\A0015251.dll (Dialer) -> Quarantined and deleted successfully.

C:\System Volume Information\_restore{0D4CE546-EA68-45AA-B0A7-3459855D16DF}\RP45\A0015252.sys (Spyware.OnlineGames) -> Quarantined and deleted successfully.

C:\WINDOWS\system32\3361\SVCHOST.EXE (Trojan.Agent) -> Quarantined and deleted successfully.