Campanula

Bardzo jestem wdzięczna za okazaną mi tutaj, nie pierwszy raz zresztą i tak szybko, pomoc! Jestem pełna podziwu a jednocześnie zdumiona tym, że ogarniacie to wszystko praktycznie we Dwójkę... Chylę czoła, jeszcze raz dziękując za poświęcony mojemu problemowi czas. Dotacja dla forum jako wyraz mojej wdzięczności, na pewno pójdzie w poniedziałek. Pozdrawiam.

Dziękuję za skrypt - wykonany. Plik HOSTS zresetowany. Oto nowy log: OTL.Txt

Sorry, że nie podałam wcześniej - 32 bit, Windows XP Home Udało mi się coś zdziałać. Włączyłam normalnie PC i zdążyłam uruchomić menadżera zadań. Zabiłam proces explorer.exe. Uruchomiłam nowe zadanie i wyszukałam swój proces explorer.exe (C:\Windows\explorer.exe) Następnie poprzez CCleanera odszukałam w autostarcie nieznane mi procesy, były dwa i wyłączyłam je a potem usunęłam wpisy. Odpaliłam Malwarebytes AntiMalware, przeskanował i znalazł Trojan.Agent Gen 0.18942000461232944.exe Usunął go. Avast już nic nie znalazł. Zrobiłam logi OTL i wdzięczna będę za sprawdzenie ich OTL.Txt Extras.Txt

Witam. Mam zablokowanego peceta wirusem ukash Po przejściu do trybu awaryjnego trzeba wybrać za pomocą strzałek sposób uruchamiania Moja klawiatura pokazuje jednak na wyświetlaczu brak połączenia (F8 jakoś się udało...) i strzałki góra - dół nie reagują Podpięłam starą klawiaturę ale niestety też brak reakcji... Czy jest jeszcze jakiś inny sposób wybrania trybu awaryjnego z dostępem do sieci, którym ktoś skłonny byłby się podzielić?

Cieszę się wobec tego, że i ja się na coś przydałam..... Zalecenia końcowe oczywiście wykonałam. Bardzo dziękuję za pomoc i pozdrawiam :-)

Bardzo dziękuję Log: 07072011_212443.txt Zrzutu nie mogłam zrobić ale mam foto:

Dzięki picasso za wszystkie wskazówki, nawiasem mówiąc ratowałaś mój tyłek juz nie jeden raz, jeszcze na poprzednim forum na literę s....... sorki za offtop MbrFix załatwił sprawę i windows zastartował bezproblemowo. Od razu ze skanowaniem uruchomił sie Avast i poinformował o zarażeniu pliku b0818-ebr4-0.dat przez trojana Win32:MBRoot-J Rekomendował usunięcie, co zatwierdziłam. Wdzięczna będę za rzut oka na logi: gmer log.txt OTL.Txt Extras.Txt btw:na pulpicie, który wyświetla się po zastosowaniu OTLPENet jest skrót do narzędzia MbrFix no ale ja zastosowałam sie ściśle do Twojej instrukcji.

Witam Wczoraj Avast przy przeglądaniu neta, ostrzegł, że jakiś program próbuje "wejść" do autostartu. Nie zezwoliłam i opuściłam tę stronę. Po jakimś czasie, tego samego dnia, Avast zawiadomił, ze wykrył rootkita w bootsektorze, usunął go. Rekomendował też, żeby uruchomić ponownie kompa w celu skanu sektora rozruchowego. Tak zrobiłam. Na czarnym ekranie otrzymałam kilka możliwości uruchomienia windowsa (awaryjny, awaryjny z siecią, z wierszem itd...) Żaden nie przyniósł efektu. Wypaliłam więc płytę z Avira Antivir Rescue System. Dostępu do sieci nie było (korzystam przez router ale wi-fi się wyłączyło bez mego udziału), więc nie mogłam aktualizować baz. Skaner znalazł: Dldr.Tharra.E, Crypt.ZPACK.Gen2 i Rootkit.Gen2 i usunął. Nie jestem pewna, czy skanowanie się zakończyło bo komp się nagle wyłączył. Uruchomiłam narzędzie raz jeszcze. Wymienionych wirusów już w skanie nie było ale historia z wyłączeniem powtórzyła się. Utworzyłam więc kolejną płytę z OTLPENet.exe Wdzięczna będę za pomoc przy rozwiązaniu mojego problemu. Oto log: OTL logfile created on: 7/6/2011 7:27:55 PM - Run OTLPE by OldTimer - Version 3.1.47.1 Folder = X:\Programs\OTLPE Microsoft Windows XP Dodatek Service Pack 3 (Version = 5.1.2600) - Type = SYSTEM Internet Explorer (Version = 8.0.6001.18702) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 503.00 Mb Total Physical Memory | 313.00 Mb Available Physical Memory | 62.00% Memory free 455.00 Mb Paging File | 331.00 Mb Available in Paging File | 73.00% Paging File free Paging file location(s): C:\pagefile.sys 756 1512 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 55.89 Gb Total Space | 8.91 Gb Free Space | 15.95% Space Free | Partition Type: NTFS Drive X: | 436.60 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: REATOGO | User Name: SYSTEM Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days Using ControlSet: ControlSet001 ========== Win32 Services (SafeList) ========== SRV - [2011/05/10 08:10:57 | 000,042,184 | ---- | M] (AVAST Software) [Auto] -- C:\Program Files\Alwil Software\Avast5\AvastSvc.exe -- (avast! Antivirus) SRV - [2004/08/10 18:46:56 | 000,483,328 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Windows Media Connect\mswmccds.exe -- (WmcCds) Windows Media Connect (WMC) SRV - [2004/08/10 15:50:42 | 000,028,160 | ---- | M] (Microsoft Corporation) [On_Demand] -- C:\Program Files\Windows Media Connect\mswmcls.exe -- (WmcCdsLs) Pomocnik programu Windows Media Connect (WMC) SRV - [2002/09/20 08:50:10 | 000,045,056 | ---- | M] (Analog Devices, Inc.) [Auto] -- C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- (SoundMAX Agent Service (default)) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand] -- -- (xpsec) DRV - File not found [Kernel | On_Demand] -- -- (xcpip) DRV - File not found [Kernel | On_Demand] -- -- (WDICA) DRV - File not found [Kernel | On_Demand] -- -- (SYMIDSCO) DRV - File not found [Kernel | On_Demand] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand] -- -- (PDCOMP) DRV - File not found [Kernel | System] -- -- (PCIDump) DRV - File not found [Kernel | On_Demand] -- -- (LMouKE) DRV - File not found [Kernel | On_Demand] -- -- (LHidUsbK) DRV - File not found [Kernel | System] -- -- (lbrtfdc) DRV - File not found [Kernel | System] -- -- (i2omgmt) DRV - File not found [Kernel | System] -- -- (Changer) DRV - [2011/05/10 08:03:54 | 000,441,176 | ---- | M] (AVAST Software) [File_System | System] -- C:\WINDOWS\System32\drivers\aswSnx.sys -- (aswSnx) DRV - [2011/05/10 08:03:44 | 000,307,928 | ---- | M] (AVAST Software) [Kernel | System] -- C:\WINDOWS\System32\drivers\aswSP.sys -- (aswSP) DRV - [2011/05/10 08:02:37 | 000,049,240 | ---- | M] (AVAST Software) [Kernel | System] -- C:\WINDOWS\System32\drivers\aswTdi.sys -- (aswTdi) DRV - [2011/05/10 08:02:25 | 000,102,616 | ---- | M] (AVAST Software) [File_System | Auto] -- C:\WINDOWS\System32\drivers\aswmon2.sys -- (aswMon2) DRV - [2011/05/10 07:59:56 | 000,025,432 | ---- | M] (AVAST Software) [Kernel | System] -- C:\WINDOWS\System32\drivers\aswRdr.sys -- (aswRdr) DRV - [2011/05/10 07:59:37 | 000,030,808 | ---- | M] (AVAST Software) [Kernel | System] -- C:\WINDOWS\System32\drivers\aavmker4.sys -- (Aavmker4) DRV - [2011/05/10 07:59:35 | 000,019,544 | ---- | M] (AVAST Software) [File_System | Auto] -- C:\WINDOWS\System32\drivers\aswFsBlk.sys -- (aswFsBlk) DRV - [2007/07/25 12:44:28 | 002,210,048 | ---- | M] (Intel® Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\w29n51.sys -- (w29n51) Sterownik karty Intel® DRV - [2007/02/05 12:23:07 | 000,271,360 | ---- | M] () [Kernel | Auto] -- C:\WINDOWS\system32\drivers\atksgt.sys -- (atksgt) DRV - [2007/02/05 12:23:07 | 000,018,048 | ---- | M] () [Kernel | Auto] -- C:\WINDOWS\system32\drivers\lirsgt.sys -- (lirsgt) DRV - [2005/02/11 05:24:24 | 000,079,488 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\k750obex.sys -- (k750obex) DRV - [2005/02/11 05:22:48 | 000,081,728 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\k750mgmt.sys -- (k750mgmt) DRV - [2005/02/11 05:21:10 | 000,089,872 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\k750mdm.sys -- (k750mdm) DRV - [2005/02/11 05:21:02 | 000,006,576 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\k750mdfl.sys -- (k750mdfl) DRV - [2005/02/11 05:19:20 | 000,055,216 | R--- | M] (MCCI) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\k750bus.sys -- (k750bus) Sony Ericsson 750 driver (WDM) DRV - [2005/02/10 20:52:36 | 000,157,056 | ---- | M] (Texas Instruments) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\tifm21.sys -- (tifm21) DRV - [2004/11/04 06:24:12 | 000,055,320 | ---- | M] (Broadcom Corporation.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\btwusb.sys -- (BTWUSB) DRV - [2004/09/29 19:27:00 | 000,016,880 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\ctpdusb.sys -- (Jukebox3) DRV - [2004/09/23 21:01:02 | 000,044,928 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\bcm4sbxp.sys -- (bcm4sbxp) DRV - [2004/08/24 07:20:08 | 001,268,204 | ---- | M] (Agere Systems) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\AGRSM.sys -- (AgereSoftModem) DRV - [2004/08/01 19:34:58 | 000,190,336 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\b57xp32.sys -- (b57w2k) DRV - [2004/06/16 04:19:58 | 000,046,080 | ---- | M] (SMSC) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\smcirda.sys -- (SMCIRDA) DRV - [2004/05/03 12:26:16 | 000,080,384 | ---- | M] (Texas Instruments) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\gtipci21.sys -- (GTIPCI21) DRV - [2004/04/14 01:36:50 | 000,007,432 | ---- | M] (Hewlett-Packard Company) [Kernel | System] -- C:\WINDOWS\system32\drivers\eabfiltr.sys -- (eabfiltr) DRV - [2004/02/20 04:35:28 | 000,059,044 | R--- | M] (Hewlett-Packard) [Kernel | System] -- C:\WINDOWS\System32\Drivers\ClntMgmt.sys -- (ClntMgmt.sys) DRV - [2003/06/06 05:46:16 | 000,005,220 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand] -- C:\WINDOWS\system32\drivers\EabUsb.sys -- (eabusb) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.com IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultName = Google IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,SearchMigratedDefaultURL = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8 IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.onet.pl/ IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie IE - HKU\Administrator_ON_C\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie IE - HKU\Administrator_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 [2011/03/30 02:11:50 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Administrator\Dane aplikacji\Mozilla\Extensions O1 HOSTS File: ([2006/05/22 12:34:45 | 000,317,779 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 0-2u.com O1 - Hosts: 127.0.0.1 0-days.net O1 - Hosts: 127.0.0.1 000info.com O1 - Hosts: 127.0.0.1 007arcadegames.com O1 - Hosts: 127.0.0.1 008i.com O1 - Hosts: 127.0.0.1 008k.com O1 - Hosts: 127.0.0.1 00fun.com O1 - Hosts: 127.0.0.1 00hq.com O1 - Hosts: 127.0.0.1 00z70az77mnsa-00swj1zzprh.com O1 - Hosts: 127.0.0.1 01.sharedsource.org O1 - Hosts: 127.0.0.1 010402.com O1 - Hosts: 127.0.0.1 0202search.com O1 - Hosts: 127.0.0.1 02kmky1xgzbmsdfx.com O1 - Hosts: 127.0.0.1 03.sharedsource.org O1 - Hosts: 127.0.0.1 05.sharedsource.org O1 - Hosts: 127.0.0.1 0503.pass.as O1 - Hosts: 127.0.0.1 09.sharedsource.org O1 - Hosts: 127.0.0.1 0cat.com O1 - Hosts: 127.0.0.1 0cj.net O1 - Hosts: 127.0.0.1 0dp.com O1 - Hosts: 127.0.0.1 0ml.net O1 - Hosts: 127.0.0.1 0mm.com O1 - Hosts: 127.0.0.1 0online-casino.net O1 - Hosts: 127.0.0.1 0ptonline.net O1 - Hosts: 10407 more lines... O2 - BHO: (DriveLetterAccess) - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll (Sonic Solutions) O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software) O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\Alwil Software\Avast5\aswWebRepIE.dll (AVAST Software) O3 - HKU\Administrator_ON_C\..\Toolbar\ShellBrowser: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - No CLSID value found. O4 - HKLM..\Run: [avast5] C:\Program Files\Alwil Software\Avast5\avastUI.exe (AVAST Software) O4 - HKU\Administrator_ON_C..\Run: [RocketDock] C:\Documents and Settings\Administrator\Moje dokumenty\RocketDockPortable\RocketDock.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoCDBurning = 0 O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\Administrator_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\LocalService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\NetworkService_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\WINDOWS\System32\GPhotos.scr (Google Inc.) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1308838201156 (MUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 212.76.34.49 212.76.34.50 O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - Winlogon\Notify\igfxcui: DllName - igfxsrvc.dll - C:\WINDOWS\System32\igfxsrvc.dll (Intel Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: O24 - Desktop BackupWallPaper: O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2005/08/09 17:58:02 | 000,000,057 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found O34 - HKLM BootExecute: (aswBoot.exe /A:"*" /L:"1045" /KBD:2 /dir:"C:\Program Files\Alwil Software\Avast5") - C:\WINDOWS\System32\aswBoot.exe (AVAST Software) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011/07/05 12:44:15 | 000,000,000 | ---D | C] -- C:\spoolerlogs [2011/07/05 07:28:48 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Administrator\Recent [2011/07/03 17:02:47 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Moje dokumenty\The Borgias [2011/07/03 08:14:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Moje dokumenty\game_of_thrones [2011/07/02 07:16:00 | 000,000,000 | -HSD | C] -- C:\Documents and Settings\LocalService\IETldCache [2011/06/29 10:37:53 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Moje dokumenty\Siostra J [2011/06/26 08:37:16 | 000,040,960 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ndproxy.sys [2011/06/26 08:36:40 | 000,105,472 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mup.sys [2011/06/26 08:32:33 | 000,590,848 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rpcrt4.dll [2011/06/26 08:31:30 | 003,558,912 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\moviemk.exe [2011/06/26 08:30:40 | 000,692,736 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\inetcomm.dll [2011/06/26 08:27:02 | 000,045,568 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\wab.exe [2011/06/26 08:11:27 | 000,274,288 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll [2011/06/26 08:11:27 | 000,017,776 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\mucltui.dll.mui [2011/06/23 12:34:36 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\ODBC [2011/06/23 12:11:34 | 000,273,024 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\bthport.sys [2011/06/23 12:09:17 | 002,150,400 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlmp.exe [2011/06/23 12:09:16 | 002,070,656 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrnlpa.exe [2011/06/23 12:09:11 | 002,028,544 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntkrpamp.exe [2011/06/23 12:09:06 | 002,194,048 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\ntoskrnl.exe [2011/06/23 12:08:19 | 000,203,136 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\rmcast.sys [2011/06/23 12:08:15 | 000,456,320 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\mrxsmb.sys [2011/06/23 12:08:05 | 000,357,888 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\srv.sys [2011/06/23 12:06:46 | 000,337,408 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\System32\dllcache\netapi32.dll [2011/06/23 12:04:46 | 000,404,640 | ---- | C] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2011/06/23 11:59:50 | 000,000,000 | ---D | C] -- C:\WINDOWS\Prefetch [2011/06/23 11:43:35 | 000,000,000 | ---D | C] -- C:\WINDOWS\l2schemas [2011/06/23 11:43:33 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\pl [2011/06/23 11:43:32 | 000,000,000 | ---D | C] -- C:\WINDOWS\System32\bits [2011/06/23 11:39:15 | 000,000,000 | ---D | C] -- C:\WINDOWS\ServicePackFiles [2011/06/23 11:35:37 | 000,000,000 | ---D | C] -- C:\WINDOWS\network diagnostic [2011/06/23 11:28:50 | 000,000,000 | -H-D | C] -- C:\WINDOWS\$NtServicePackUninstall$ [2011/06/23 11:03:34 | 000,025,471 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\watv10nt.sys [2011/06/23 11:03:34 | 000,022,271 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\watv06nt.sys [2011/06/23 11:03:34 | 000,011,935 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\wadv11nt.sys [2011/06/23 11:03:33 | 000,011,871 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\wadv09nt.sys [2011/06/23 11:03:33 | 000,011,807 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\wadv07nt.sys [2011/06/23 11:03:33 | 000,011,295 | ---- | C] (Intel® Corporation) -- C:\WINDOWS\System32\drivers\wadv08nt.sys [2011/06/23 11:03:27 | 000,404,990 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\slntamr.sys [2011/06/23 11:03:27 | 000,095,424 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\slnthal.sys [2011/06/23 11:03:27 | 000,013,240 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\slwdmsup.sys [2011/06/23 11:03:26 | 000,166,912 | ---- | C] (S3 Graphics, Inc.) -- C:\WINDOWS\System32\drivers\s3gnbm.sys [2011/06/23 11:03:26 | 000,129,535 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\slnt7554.sys [2011/06/23 11:03:25 | 000,013,776 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\recagent.sys [2011/06/23 11:03:24 | 000,180,360 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\ntmtlfax.sys [2011/06/23 11:03:21 | 001,309,184 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\mtlstrm.sys [2011/06/23 11:03:21 | 000,452,736 | ---- | C] (Matrox Graphics Inc.) -- C:\WINDOWS\System32\drivers\mtxparhm.sys [2011/06/23 11:03:21 | 000,126,686 | ---- | C] (Smart Link) -- C:\WINDOWS\System32\drivers\mtlmnt5.sys [2011/06/23 11:00:18 | 000,701,440 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati2mtag.sys [2011/06/23 11:00:18 | 000,327,040 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati2mtaa.sys [2011/06/23 11:00:18 | 000,104,960 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinrvxx.sys [2011/06/23 11:00:18 | 000,073,216 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atintuxx.sys [2011/06/23 11:00:18 | 000,063,663 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1rvxx.sys [2011/06/23 11:00:18 | 000,063,488 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinxsxx.sys [2011/06/23 11:00:18 | 000,057,856 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinbtxx.sys [2011/06/23 11:00:18 | 000,056,623 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1btxx.sys [2011/06/23 11:00:18 | 000,052,224 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinraxx.sys [2011/06/23 11:00:18 | 000,036,463 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1tuxx.sys [2011/06/23 11:00:18 | 000,034,735 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1xsxx.sys [2011/06/23 11:00:18 | 000,031,744 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinxbxx.sys [2011/06/23 11:00:18 | 000,030,671 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1raxx.sys [2011/06/23 11:00:18 | 000,029,455 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1xbxx.sys [2011/06/23 11:00:18 | 000,028,672 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinsnxx.sys [2011/06/23 11:00:18 | 000,026,367 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1snxx.sys [2011/06/23 11:00:18 | 000,021,343 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1ttxx.sys [2011/06/23 11:00:18 | 000,014,336 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinpdxx.sys [2011/06/23 11:00:18 | 000,013,824 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinttxx.sys [2011/06/23 11:00:18 | 000,013,824 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\atinmdxx.sys [2011/06/23 11:00:18 | 000,012,047 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1pdxx.sys [2011/06/23 11:00:18 | 000,011,615 | ---- | C] (ATI Technologies Inc.) -- C:\WINDOWS\System32\drivers\ati1mdxx.sys [2011/06/23 08:48:37 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\Malwarebytes [2011/06/23 08:48:19 | 000,039,984 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbamswissarmy.sys [2011/06/23 08:48:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\Malwarebytes' Anti-Malware [2011/06/23 08:48:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Dane aplikacji\Malwarebytes [2011/06/23 08:48:15 | 000,022,712 | ---- | C] (Malwarebytes Corporation) -- C:\WINDOWS\System32\drivers\mbam.sys [2011/06/23 08:48:15 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2011/06/23 08:27:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Menu Start\Programy\Revo Uninstaller [2011/06/23 07:48:18 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Administrator\Dane aplikacji\InfraRecorder [2011/06/23 07:48:15 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Menu Start\Programy\InfraRecorder [2011/06/23 07:48:13 | 000,000,000 | ---D | C] -- C:\Program Files\InfraRecorder [2011/06/23 07:32:48 | 000,441,176 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys [2008/05/19 01:27:14 | 000,047,360 | ---- | C] (VSO Software) -- C:\Documents and Settings\Administrator\Dane aplikacji\pcouffin.sys [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011/07/06 06:43:35 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2011/07/06 06:09:36 | 000,001,158 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2011/07/06 06:06:24 | 527,880,192 | -HS- | M] () -- C:\hiberfil.sys [2011/07/05 09:00:58 | 000,059,255 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\c5991cab8b9f531815495f6d76d60e1d.jpg [2011/07/05 07:27:32 | 000,243,200 | ---- | M] () -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2011/07/04 15:07:40 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Menu Start\Programy\Electronic Arts [2011/07/04 14:59:54 | 000,000,000 | R--D | M] -- C:\Documents and Settings\All Users\Menu Start\Programy\Autostart [2011/07/04 11:59:55 | 002,091,467 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\504e3f7933fccb9731097bc280106ddc.gif [2011/07/03 15:26:38 | 000,064,893 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\512b475759d2e22856c25526e5c4c9b7.jpg [2011/07/03 15:26:16 | 000,049,695 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\cb3801ad90c479bc84480daaa4db7960.jpg [2011/07/03 14:39:13 | 000,051,859 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\7a43927a325002a532d5e5e3dbfe0a22.jpg [2011/07/03 14:29:14 | 000,042,664 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\b88f584ab9cc091e16def77f3a1dad91.jpg [2011/07/03 14:26:16 | 000,076,715 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\f237cdfbbf4b6a2837c135fe329512d4.jpg [2011/07/03 14:24:18 | 000,028,408 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\7a6da6fb25e563db30f055c87ba9c49c.jpg [2011/07/02 15:32:27 | 000,266,598 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\green-and-blue.jpg [2011/07/02 15:31:17 | 002,642,122 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\dark-scenery-blue-wallpapers_991_1920x1200.jpg [2011/07/02 15:30:10 | 002,983,209 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\The_Deep_Blue_Nothing_by_An_Unsure_Thing.png [2011/07/02 15:29:17 | 000,073,319 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\blue-sky-nature-1440x900.jpg [2011/07/02 15:27:52 | 000,300,417 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\white-sailboat-on-blue-ocean-beach-background-1920x1200.jpg [2011/07/02 15:24:57 | 000,271,464 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\blue-wallpaper-light-and-airy.jpg [2011/07/02 15:22:31 | 001,990,580 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Abstract_blue_background7.jpg [2011/07/02 14:38:11 | 000,500,540 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2011/07/02 14:38:10 | 000,441,458 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2011/07/02 14:38:10 | 000,089,036 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2011/07/02 14:38:10 | 000,071,394 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2011/07/02 13:12:42 | 000,142,704 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\0969a935061b6a7f46481f40410ad847.gif [2011/07/02 08:08:11 | 000,038,058 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\36381460e93816985b4f75cdb81f6294.jpg [2011/07/02 08:04:44 | 000,028,693 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\9a4c2e97a6db95adb60c3d0b7a08f230.jpg [2011/07/01 17:56:03 | 000,076,962 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\7d9d9ff9a328aca4cdfff7f295920086.png [2011/07/01 17:48:56 | 000,076,076 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\1c14dfa1c70a8650cf5a3a149f3da6c9.jpg [2011/06/29 10:18:08 | 000,136,022 | ---- | M] () -- C:\Documents and Settings\Administrator\Moje dokumenty\28.pdf [2011/06/28 16:28:46 | 000,041,719 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\68914-usmiech.jpg [2011/06/28 14:21:05 | 000,030,921 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\e8a1ccf2f602aef739281b0456352805.jpg [2011/06/28 14:18:31 | 000,008,108 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\5088a4b0dad2589f1243dbcca08e6d40.png [2011/06/28 14:11:28 | 002,090,964 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\7f892e33c1863d4cc8f7d7617cec3e37.gif [2011/06/28 10:08:21 | 000,212,080 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2011/06/27 08:38:24 | 000,029,929 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\1309042586_by_mateoj6_500.jpg [2011/06/27 08:17:59 | 000,027,463 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\d3bf649ffcb2023602d342e7e085c81a.jpg [2011/06/27 08:16:22 | 002,227,905 | ---- | M] () -- C:\Documents and Settings\Administrator\Pulpit\b4679376a1ba5eb98513d133de9cc23a.gif [2011/06/23 12:04:46 | 000,404,640 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2011/06/23 12:00:46 | 000,316,640 | ---- | M] () -- C:\WINDOWS\WMSysPr9.prx [2011/06/23 11:44:44 | 000,000,000 | R--D | M] -- C:\Documents and Settings\All Users\Menu Start\Programy\Akcesoria [2011/06/23 11:35:01 | 000,251,152 | -HS- | M] () -- C:\NTLDR [2011/06/23 08:48:19 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Menu Start\Programy\Malwarebytes' Anti-Malware [2011/06/23 07:48:16 | 000,000,760 | ---- | M] () -- C:\Documents and Settings\Administrator\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\InfraRecorder.lnk [2011/06/23 07:48:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Menu Start\Programy\InfraRecorder [2011/06/23 07:32:47 | 000,002,645 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT [4 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ] [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2011/07/05 09:00:57 | 000,059,255 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\c5991cab8b9f531815495f6d76d60e1d.jpg [2011/07/04 11:59:55 | 002,091,467 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\504e3f7933fccb9731097bc280106ddc.gif [2011/07/03 15:26:38 | 000,064,893 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\512b475759d2e22856c25526e5c4c9b7.jpg [2011/07/03 15:26:16 | 000,049,695 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\cb3801ad90c479bc84480daaa4db7960.jpg [2011/07/03 14:39:13 | 000,051,859 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\7a43927a325002a532d5e5e3dbfe0a22.jpg [2011/07/03 14:29:14 | 000,042,664 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\b88f584ab9cc091e16def77f3a1dad91.jpg [2011/07/03 14:26:16 | 000,076,715 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\f237cdfbbf4b6a2837c135fe329512d4.jpg [2011/07/03 14:24:18 | 000,028,408 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\7a6da6fb25e563db30f055c87ba9c49c.jpg [2011/07/02 15:32:27 | 000,266,598 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\green-and-blue.jpg [2011/07/02 15:31:16 | 002,642,122 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\dark-scenery-blue-wallpapers_991_1920x1200.jpg [2011/07/02 15:30:09 | 002,983,209 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\The_Deep_Blue_Nothing_by_An_Unsure_Thing.png [2011/07/02 15:29:17 | 000,073,319 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\blue-sky-nature-1440x900.jpg [2011/07/02 15:27:52 | 000,300,417 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\white-sailboat-on-blue-ocean-beach-background-1920x1200.jpg [2011/07/02 15:24:57 | 000,271,464 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\blue-wallpaper-light-and-airy.jpg [2011/07/02 15:22:31 | 001,990,580 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\Abstract_blue_background7.jpg [2011/07/02 13:12:41 | 000,142,704 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\0969a935061b6a7f46481f40410ad847.gif [2011/07/02 08:08:11 | 000,038,058 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\36381460e93816985b4f75cdb81f6294.jpg [2011/07/02 08:04:44 | 000,028,693 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\9a4c2e97a6db95adb60c3d0b7a08f230.jpg [2011/07/01 17:56:03 | 000,076,962 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\7d9d9ff9a328aca4cdfff7f295920086.png [2011/07/01 17:48:56 | 000,076,076 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\1c14dfa1c70a8650cf5a3a149f3da6c9.jpg [2011/06/29 10:18:08 | 000,136,022 | ---- | C] () -- C:\Documents and Settings\Administrator\Moje dokumenty\28.pdf [2011/06/28 16:28:46 | 000,041,719 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\68914-usmiech.jpg [2011/06/28 14:21:05 | 000,030,921 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\e8a1ccf2f602aef739281b0456352805.jpg [2011/06/28 14:18:30 | 000,008,108 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\5088a4b0dad2589f1243dbcca08e6d40.png [2011/06/28 14:11:28 | 002,090,964 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\7f892e33c1863d4cc8f7d7617cec3e37.gif [2011/06/27 08:38:24 | 000,029,929 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\1309042586_by_mateoj6_500.jpg [2011/06/27 08:17:59 | 000,027,463 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\d3bf649ffcb2023602d342e7e085c81a.jpg [2011/06/27 08:16:21 | 002,227,905 | ---- | C] () -- C:\Documents and Settings\Administrator\Pulpit\b4679376a1ba5eb98513d133de9cc23a.gif [2011/06/23 11:03:22 | 000,067,866 | ---- | C] () -- C:\WINDOWS\System32\drivers\netwlan5.img [2011/06/23 11:02:52 | 000,129,045 | ---- | C] () -- C:\WINDOWS\System32\drivers\cxthsfs2.cty [2011/06/23 11:00:18 | 000,064,352 | ---- | C] () -- C:\WINDOWS\System32\drivers\ativmc20.cod [2011/06/23 07:48:16 | 000,000,760 | ---- | C] () -- C:\Documents and Settings\Administrator\Dane aplikacji\Microsoft\Internet Explorer\Quick Launch\InfraRecorder.lnk [2011/01/23 18:44:40 | 000,245,592 | ---- | C] () -- C:\Documents and Settings\LocalService\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat [2011/01/21 07:30:06 | 000,311,296 | ---- | C] () -- C:\WINDOWS\System32\EMRegSys.dll [2008/09/15 20:14:24 | 003,596,288 | ---- | C] () -- C:\WINDOWS\System32\qt-dx331.dll [2008/09/15 20:11:10 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\DivXWMPExtType.dll [2008/08/02 10:47:15 | 000,000,664 | ---- | C] () -- C:\WINDOWS\System32\d3d9caps.dat [2008/07/07 17:01:56 | 000,081,920 | ---- | C] () -- C:\Documents and Settings\Administrator\Dane aplikacji\ezpinst.exe [2008/06/25 07:29:50 | 000,000,182 | ---- | C] () -- C:\WINDOWS\System32\EBPPORT4.DAT [2008/06/25 07:27:32 | 000,000,025 | ---- | C] () -- C:\WINDOWS\CDEC66SeriesEuro.ini [2008/06/14 09:28:55 | 000,031,396 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat [2008/06/13 05:57:17 | 000,000,043 | ---- | C] () -- C:\WINDOWS\iltwain.ini [2008/06/03 07:49:49 | 000,000,754 | ---- | C] () -- C:\WINDOWS\WORDPAD.INI [2008/05/19 01:27:14 | 000,087,608 | ---- | C] () -- C:\Documents and Settings\Administrator\Dane aplikacji\inst.exe [2008/05/19 01:27:14 | 000,007,176 | ---- | C] () -- C:\Documents and Settings\Administrator\Dane aplikacji\pcouffin.cat [2007/07/16 14:18:49 | 000,000,089 | ---- | C] () -- C:\Documents and Settings\Administrator\.gtk-bookmarks [2007/06/24 12:00:05 | 000,212,825 | ---- | C] () -- C:\Documents and Settings\Administrator\.fonts.cache-1 [2007/02/05 12:23:07 | 000,271,360 | ---- | C] () -- C:\WINDOWS\System32\drivers\atksgt.sys [2007/02/05 12:23:07 | 000,018,048 | ---- | C] () -- C:\WINDOWS\System32\drivers\lirsgt.sys [2007/02/03 15:14:51 | 000,000,039 | ---- | C] () -- C:\WINDOWS\pamlicCls.dll [2006/12/27 17:00:47 | 000,000,222 | ---- | C] () -- C:\WINDOWS\VOGEL.INI [2006/09/04 12:22:46 | 000,000,032 | ---- | C] () -- C:\WINDOWS\CD-Start.INI [2006/08/16 08:24:51 | 000,069,632 | ---- | C] () -- C:\WINDOWS\System32\xmltok.dll [2006/08/16 08:24:51 | 000,036,864 | ---- | C] () -- C:\WINDOWS\System32\xmlparse.dll [2006/07/12 10:15:15 | 000,001,237 | ---- | C] () -- C:\WINDOWS\unins000.dat [2006/07/04 15:59:50 | 000,028,672 | ---- | C] () -- C:\WINDOWS\System32\PdeSrvps.dll [2006/07/04 15:59:47 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE [2006/05/22 12:28:24 | 000,000,620 | ---- | C] () -- C:\WINDOWS\wlist.dat [2006/05/09 17:18:25 | 000,000,000 | ---- | C] () -- C:\WINDOWS\stduser.ini [2006/02/19 19:40:18 | 000,000,116 | ---- | C] () -- C:\WINDOWS\homeDVD-Zdjecia4.INI [2006/02/19 19:09:27 | 000,019,968 | ---- | C] () -- C:\WINDOWS\System32\cpuinf32.dll [2006/02/19 19:03:53 | 000,001,103 | ---- | C] () -- C:\WINDOWS\mgxoschk.ini [2006/02/12 17:33:44 | 000,765,952 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2006/02/12 17:33:43 | 000,180,224 | ---- | C] () -- C:\WINDOWS\System32\xvidvfw.dll [2006/02/11 17:29:11 | 000,034,308 | ---- | C] () -- C:\WINDOWS\System32\BASSMOD.dll [2005/12/22 06:13:02 | 000,010,752 | ---- | C] () -- C:\WINDOWS\System32\ff_vfw.dll [2005/10/23 12:21:52 | 000,000,139 | ---- | C] () -- C:\Documents and Settings\NetworkService\Ustawienia lokalne\Dane aplikacji\fusioncache.dat [2005/10/07 14:46:55 | 000,000,155 | ---- | C] () -- C:\WINDOWS\winamp.ini [2005/09/17 07:03:53 | 000,021,840 | ---- | C] () -- C:\WINDOWS\System32\SIntfNT.dll [2005/09/17 07:03:53 | 000,017,212 | ---- | C] () -- C:\WINDOWS\System32\SIntf32.dll [2005/09/17 07:03:53 | 000,012,067 | ---- | C] () -- C:\WINDOWS\System32\SIntf16.dll [2005/09/17 06:56:55 | 000,010,240 | ---- | C] () -- C:\WINDOWS\System32\vidx16.dll [2005/08/09 18:00:34 | 000,000,634 | ---- | C] () -- C:\WINDOWS\ODBC.INI [2005/08/09 17:57:55 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat [2005/08/09 17:57:31 | 000,081,920 | ---- | C] () -- C:\WINDOWS\asr3232.dll [2005/07/09 16:26:01 | 000,243,200 | ---- | C] () -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2005/06/23 10:51:48 | 000,077,900 | ---- | C] () -- C:\WINDOWS\uinst001.exe [2005/06/22 10:47:54 | 000,204,800 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeW7.dll [2005/06/22 10:47:54 | 000,200,704 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeA6.dll [2005/06/22 10:47:54 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeP6.dll [2005/06/22 10:47:54 | 000,192,512 | ---- | C] () -- C:\WINDOWS\System32\IVIresizeM6.dll [2005/06/22 10:47:54 | 000,188,416 | ---- | C] () -- C:\WINDOWS\System32\IVIresizePX.dll [2005/06/22 10:47:54 | 000,020,480 | ---- | C] () -- C:\WINDOWS\System32\IVIresize.dll [2005/04/19 10:20:12 | 000,000,138 | ---- | C] () -- C:\WINDOWS\wininit.ini [2005/04/19 10:01:09 | 000,000,138 | ---- | C] () -- C:\Documents and Settings\Administrator\Ustawienia lokalne\Dane aplikacji\fusioncache.dat [2004/10/26 14:30:14 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini [2004/09/20 02:24:06 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2004/09/20 02:23:56 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini [2004/09/20 02:20:08 | 000,500,540 | ---- | C] () -- C:\WINDOWS\System32\perfh015.dat [2004/09/20 02:20:08 | 000,441,458 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat [2004/09/20 02:20:08 | 000,089,036 | ---- | C] () -- C:\WINDOWS\System32\perfc015.dat [2004/09/20 02:20:08 | 000,071,394 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat [2004/09/20 02:14:12 | 000,212,080 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2004/09/20 02:09:14 | 000,004,293 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2004/09/20 02:06:22 | 000,021,856 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat [2004/08/04 04:00:00 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat [2004/08/04 04:00:00 | 000,313,828 | ---- | C] () -- C:\WINDOWS\System32\perfi015.dat [2004/08/04 04:00:00 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat [2004/08/04 04:00:00 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat [2004/08/04 04:00:00 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin [2004/08/04 04:00:00 | 000,034,990 | ---- | C] () -- C:\WINDOWS\System32\perfd015.dat [2004/08/04 04:00:00 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat [2004/08/04 04:00:00 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat [2004/08/04 04:00:00 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin [2004/08/04 04:00:00 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat [2004/06/01 05:39:56 | 000,094,274 | ---- | C] () -- C:\WINDOWS\System32\HPBHEALR.DLL [2002/05/28 04:55:42 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin [2002/05/28 04:54:40 | 000,004,605 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat ========== LOP Check ========== [2011/01/23 18:14:36 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Engelmann Media [2007/07/16 14:40:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\gtk-2.0 [2011/06/23 07:59:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\InfraRecorder [2005/06/22 16:04:12 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\InterVideo [2009/07/15 14:16:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Leadertech [2011/01/03 16:36:03 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Opera [2007/08/21 14:16:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Teleca [2008/05/12 15:44:33 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Ulead Systems [2011/01/13 14:58:21 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Vso [2007/09/27 05:58:58 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\VSO_HWE [2011/01/23 18:57:14 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Alwil Software [2011/07/04 15:08:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Electronic Arts [2011/01/23 18:22:41 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Licenses [2007/07/30 15:47:53 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Phenomedia ========== Purity Check ========== < End of report >

Posprzątane. Bardzo dziękuję za skuteczną pomoc i pozdrawiam.

Rzeczywiście - przepraszam za to. Wszystkie polecenia wykonałam. OTL2.Txt mbam-log-2011-02-09 (21-26-31).txt dziękuję za wskazówki

Witam, to mój debiut na tym forum i jednocześnie prośba o pomoc. Córka wczoraj zainfekowała komputer (Win XP HomeEd) przez kliknięcie linka na Facebooku. System Tool informował migającym dymkiem w trayu i niby (?) skanował komputer. Znajdywał też 38 wirusów i robaków. Monitował o kupno oprogramowania antywirusowego. Uruchomiłam (dało się) skanowanie Avastem ale nic nie znajdował. HijackThis nie chciał się uruchomić. Nie można było przywołać Menadżera Zadań bo chciałam zamknąć nieznane mi procesy. Do trybu awaryjnego nie mogłam wejść bo moja bezprzewodowa klawiatura "odłączyła się" i nie mogłam strzałkami dokonać wyboru uruchomienia kompa. Komputer raz się sam zrestartował, poczym zmienił tapetę z wielkimi na cały pulpit, ostrzegawczymi napisami. Ja jeszcze zrobiłam to 2x i zanim System Tool się uruchomił zdążyłam w MZ zabić 2 obce procesy (jeden zdaje się wulxi.exe). To pomogło. Zrobiłam skan HijackThisem i zafiksowałam 2 wpisy z nazwami tych procesów (w kluczu HKCU). Skorzystałam z Przywracania Systemu - miałam tylko jeden punkt z tego samego dnia. W folderze Documents&Settings/User/Dane Aplikacji znalazłam dwa pliki wykonywalne tego System Tool'a. Jeden dał się normalnie usunąć, drugi dopiero Unlockerem. Wyłączyłam Przywracanie Systemu. Bardzo proszę o sprawdzenie logów, bo nie mam pewności, czy coś nie pozostało. Dziękuję za wszelką pomoc! gmer 9.02.txt OTL.Txt Extras.Txt