- Kod: Zaznacz wszystko
ComboFix 08-06-09.7 - Piotr 2008-06-10 19:38:13.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.215 [GMT 2:00]
Running from: C:\Documents and Settings\Piotr\Pulpit\ComboFix.exe
* Created a new restore point
* Resident AV is active
[color=red][b]WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !![/b][/color]
.
((((((((((((((((((((((((( Files Created from 2008-05-10 to 2008-06-10 )))))))))))))))))))))))))))))))
.
2008-06-03 16:17 . 2008-06-03 16:17 <DIR> d-------- C:\Program Files\MoorHunt
2008-05-23 14:27 . 2008-05-23 14:27 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys
2008-05-23 14:27 . 2008-05-23 14:27 298,104 --a------ C:\WINDOWS\system32\imon.dll
2008-05-23 14:27 . 2008-05-23 14:27 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys
2008-05-23 09:27 . 2008-05-23 13:10 121 --a------ C:\WINDOWS\bdagent.INI
2008-05-23 09:19 . 2008-05-23 09:20 <DIR> d-------- C:\Program Files\Common Files\BitDefender
2008-05-22 21:06 . 2008-05-23 08:50 <DIR> d-------- C:\Program Files\Google
2008-05-21 20:32 . 2008-05-21 20:32 45 --a------ C:\WINDOWS\system32\initdebug.nfo
2008-05-21 19:50 . 2008-05-21 19:50 <DIR> d-------- C:\WINDOWS\system32\Futuremark
2008-05-21 19:50 . 2004-10-25 21:02 21,664 --a------ C:\WINDOWS\system32\drivers\Entech.sys
2008-05-21 19:50 . 2004-06-22 16:44 5,632 --a------ C:\WINDOWS\system32\drivers\Entech64.sys
2008-05-21 19:50 . 2001-11-19 20:05 3,972 --a------ C:\WINDOWS\system32\drivers\PciBus.sys
2008-05-20 15:35 . 2008-05-20 15:35 <DIR> d-------- C:\Documents and Settings\Piotr\Dane aplikacji\F-Secure
2008-05-20 15:18 . 2008-05-23 09:18 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\F-Secure
2008-05-20 15:17 . 2008-05-20 17:08 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\fssg
2008-05-12 21:02 . 2008-05-12 21:02 <DIR> d-------- C:\SOPHTEMP
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-10 17:38 --------- d-----w C:\Program Files\ESET
2008-06-10 17:35 1,214,072 ----a-w C:\WINDOWS\system32\drivers\kwfupper.log
2008-06-10 17:15 908,422 ----a-w C:\WINDOWS\system32\drivers\kwflower.log
2008-06-10 15:04 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help
2008-06-03 21:05 --------- d-----w C:\Program Files\NAPI-PROJEKT
2008-05-21 17:49 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-19 20:25 --------- d-----w C:\Program Files\Spybot - Search & Destroy
2008-05-19 20:06 --------- d-----w C:\Program Files\SkanerOnline
2008-05-19 20:06 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy
2008-05-19 20:05 --------- d-----w C:\Program Files\OpenOffice.org 2.4
2008-05-19 18:15 --------- d-----w C:\Program Files\Windows Media Connect 2
2008-05-19 18:15 --------- d-----w C:\Program Files\QuickTime
2008-05-19 18:15 --------- d-----w C:\Program Files\IrfanView
2008-05-19 18:15 --------- d-----w C:\Program Files\ImageMagick-6.3.3-Q16
2008-05-09 19:14 --------- d-----w C:\Documents and Settings\Piotr\Dane aplikacji\OpenOffice.org2
2008-05-08 17:24 --------- d-----w C:\Program Files\Kerio
2008-05-04 17:27 --------- d-----w C:\Program Files\Sophos
2008-05-04 15:47 --------- d-----w C:\Program Files\Bonjour
2008-05-04 15:46 --------- d-----w C:\Program Files\Apple Software Update
2008-05-04 15:46 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple Computer
2008-05-04 15:45 --------- d-----w C:\Program Files\Common Files\Apple
2008-05-04 15:45 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Apple
2008-04-28 17:06 --------- d-----w C:\Documents and Settings\Piotr\Dane aplikacji\Media Player Classic
2008-04-28 17:05 --------- d-----w C:\Program Files\K-Lite Codec Pack
2008-04-19 16:00 --------- d-----w C:\Documents and Settings\Piotr\Dane aplikacji\Spamihilator
2008-04-18 17:04 --------- d-----w C:\Program Files\Scribe
2008-04-13 16:45 --------- d-----w C:\Program Files\Microsoft Works
2008-04-08 16:14 737,280 ----a-w C:\WINDOWS\iun6002.exe
2008-04-08 16:04 691,545 ----a-w C:\WINDOWS\unins000.exe
2008-03-31 21:25 682,496 ----a-w C:\WINDOWS\system32\divx.dll
2008-03-28 17:41 7,680 ----a-w C:\WINDOWS\system32\ff_vfw.dll
2008-03-25 04:52 621,344 ----a-w C:\WINDOWS\system32\mswstr10.dll
2008-03-25 04:52 178,976 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-21 20:30 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 20:28 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2008-03-20 08:09 1,845,504 ----a-w C:\WINDOWS\system32\win32k.sys
.
((((((((((((((((((((((((((((( snapshot@2008-05-19_20.21.41.46 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-05-21 17:51:14 53,248 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll
+ 2008-05-21 17:51:14 12,800 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll
+ 2008-05-21 17:51:14 473,600 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll
+ 2008-05-21 17:51:14 567,296 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll
+ 2008-05-21 17:51:14 145,920 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll
+ 2008-05-21 17:51:14 159,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll
+ 2008-05-21 17:51:14 364,544 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll
+ 2008-05-21 17:51:14 178,176 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll
+ 2008-05-21 17:51:13 223,232 ----a-w C:\WINDOWS\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll
- 2008-05-19 17:56:40 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-06-10 17:15:44 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2006-10-26 17:48:14 434,528 ----a-r C:\WINDOWS\Installer\$PatchCache$\Managed\[u]0[/u]0002119F20000000000000000F01FEC\12.0.4518\DWTRIG20.EXE
+ 2008-05-21 16:01:52 7,406 ----a-r C:\WINDOWS\Installer\{2B6EC03E-6FA0-4D7C-9CCE-1B03819AB613}\DesktopStartPD9_2B6EC03E6FA04D7C9CCE1B03819AB613.exe
- 2008-05-14 21:20:30 593,920 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\accicons.exe
+ 2008-06-04 17:00:36 593,920 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\accicons.exe
- 2008-05-14 21:20:30 12,288 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\cagicon.exe
+ 2008-06-04 17:00:36 12,288 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\cagicon.exe
- 2008-05-14 21:20:30 86,016 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\inficon.exe
+ 2008-06-04 17:00:36 86,016 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\inficon.exe
- 2008-05-14 21:20:30 135,168 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\misc.exe
+ 2008-06-04 17:00:35 135,168 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\misc.exe
- 2008-05-14 21:20:30 11,264 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\mspicons.exe
+ 2008-06-04 17:00:36 11,264 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\mspicons.exe
- 2008-05-14 21:20:30 27,136 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\oisicon.exe
+ 2008-06-04 17:00:36 27,136 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\oisicon.exe
- 2008-05-14 21:20:30 4,096 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\opwicon.exe
+ 2008-06-04 17:00:36 4,096 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\opwicon.exe
- 2008-05-14 21:20:30 794,624 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\outicon.exe
+ 2008-06-04 17:00:36 794,624 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\outicon.exe
- 2008-05-14 21:20:30 249,856 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\pptico.exe
+ 2008-06-04 17:00:35 249,856 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\pptico.exe
- 2008-05-14 21:20:30 61,440 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\pubs.exe
+ 2008-06-04 17:00:35 61,440 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\pubs.exe
- 2008-05-14 21:20:30 23,040 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\unbndico.exe
+ 2008-06-04 17:00:37 23,040 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\unbndico.exe
- 2008-05-14 21:20:30 286,720 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\wordicon.exe
+ 2008-06-04 17:00:35 286,720 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\wordicon.exe
- 2008-05-14 21:20:30 409,600 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\xlicons.exe
+ 2008-06-04 17:00:34 409,600 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\xlicons.exe
- 2008-04-13 16:42:55 217,864 ----a-r C:\WINDOWS\Installer\{90120000-006E-0415-0000-0000000FF1CE}\misc.exe
+ 2008-06-03 20:11:59 217,864 ----a-r C:\WINDOWS\Installer\{90120000-006E-0415-0000-0000000FF1CE}\misc.exe
- 2008-05-14 21:20:14 20,240 ----a-r C:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe
+ 2008-06-10 15:04:09 20,240 ----a-r C:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\cagicon.exe
- 2008-05-14 21:20:14 184,080 ----a-r C:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe
+ 2008-06-10 15:04:09 184,080 ----a-r C:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\joticon.exe
- 2008-05-14 21:20:14 217,864 ----a-r C:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe
+ 2008-06-10 15:04:09 217,864 ----a-r C:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\misc.exe
- 2008-05-14 21:20:14 18,704 ----a-r C:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\mspicons.exe
+ 2008-06-10 15:04:09 18,704 ----a-r C:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\mspicons.exe
- 2008-05-14 21:20:14 35,088 ----a-r C:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe
+ 2008-06-10 15:04:09 35,088 ----a-r C:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\oisicon.exe
- 2008-05-14 21:20:14 922,384 ----a-r C:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe
+ 2008-06-10 15:04:09 922,384 ----a-r C:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\pptico.exe
- 2008-05-14 21:20:14 888,080 ----a-r C:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe
+ 2008-06-10 15:04:09 888,080 ----a-r C:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\wordicon.exe
- 2008-05-14 21:20:14 1,172,240 ----a-r C:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe
+ 2008-06-10 15:04:09 1,172,240 ----a-r C:\WINDOWS\Installer\{91120000-002F-0000-0000-0000000FF1CE}\xlicons.exe
+ 2005-03-18 15:23:10 53,248 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.AudioVideoPlayback.dll
+ 2005-03-18 15:23:10 12,800 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Diagnostics.dll
+ 2005-03-18 15:23:14 473,600 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3D.dll
+ 2005-03-18 15:23:10 145,920 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectDraw.dll
+ 2005-03-18 15:23:10 159,232 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectInput.dll
+ 2005-03-18 15:23:14 364,544 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectPlay.dll
+ 2005-03-18 15:23:12 178,176 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectSound.dll
+ 2005-03-18 15:23:14 223,232 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.dll
+ 2005-03-18 15:23:14 567,296 ----a-w C:\WINDOWS\Microsoft.NET\DirectX for Managed Code\1.0.2905.0\Microsoft.DirectX.Direct3DX.dll
+ 2008-06-10 15:00:38 4,788 ----a-w C:\WINDOWS\SoftwareDistribution\EventCache\{051ED7E2-BB6C-4A3F-BA94-15D289C2228C}.bin
+ 2005-03-18 15:19:58 2,337,488 ----a-w C:\WINDOWS\system32\d3dx9_25.dll
- 2004-12-06 22:55:11 297,472 -c--a-w C:\WINDOWS\system32\dllcache\msctf.dll
+ 2008-02-26 11:49:59 297,984 -c--a-w C:\WINDOWS\system32\dllcache\msctf.dll
- 2008-04-23 20:01:19 168,304 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2008-06-04 13:40:41 168,304 ----a-w C:\WINDOWS\system32\FNTCACHE.DAT
+ 2005-01-13 17:46:00 40,448 ----a-w C:\WINDOWS\system32\Futuremark\MSC\Direcpll.dll
+ 1996-04-03 19:33:26 5,248 ----a-w C:\WINDOWS\system32\giveio.sys
+ 2002-01-05 00:48:16 974,848 ----a-w C:\WINDOWS\system32\mfc70.dll
+ 2002-01-05 00:36:38 964,608 ----a-w C:\WINDOWS\system32\mfc70u.dll
+ 2003-03-18 18:20:00 1,060,864 ----a-w C:\WINDOWS\system32\mfc71.dll
+ 2003-03-18 18:12:12 1,047,552 ----a-w C:\WINDOWS\system32\mfc71u.dll
- 2004-12-06 22:55:11 297,472 ----a-w C:\WINDOWS\system32\msctf.dll
+ 2008-02-26 11:49:59 297,984 ----a-w C:\WINDOWS\system32\msctf.dll
+ 2002-01-05 00:38:38 54,784 ----a-w C:\WINDOWS\system32\msvci70.dll
+ 2002-01-05 00:40:20 487,424 ----a-w C:\WINDOWS\system32\msvcp70.dll
+ 2003-03-18 17:14:52 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
+ 2002-01-04 23:37:28 344,064 ----a-w C:\WINDOWS\system32\msvcr70.dll
- 2004-01-11 23:00:00 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
+ 2003-02-21 01:42:22 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
- 2008-05-19 18:01:01 71,308 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-06-10 17:28:26 73,056 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-05-19 18:01:01 88,946 ----a-w C:\WINDOWS\system32\perfc015.dat
+ 2008-06-10 17:28:26 90,694 ----a-w C:\WINDOWS\system32\perfc015.dat
- 2008-05-19 18:01:01 441,624 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-06-10 17:28:26 444,892 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-05-19 18:01:01 500,482 ----a-w C:\WINDOWS\system32\perfh015.dat
+ 2008-06-10 17:28:26 503,750 ----a-w C:\WINDOWS\system32\perfh015.dat
- 1998-03-24 20:54:08 15,872 ----a-w C:\WINDOWS\system32\SCP32.DLL
+ 2006-07-24 08:50:40 39,728 ----a-w C:\WINDOWS\system32\SCP32.DLL
+ 2005-06-15 14:55:53 4,096 ----a-w C:\WINDOWS\system32\speedfan.sys
- 2006-12-01 21:54:32 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
+ 2006-12-01 19:54:32 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
- 2006-12-01 21:54:34 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
+ 2006-12-01 19:54:34 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
- 2006-12-01 21:54:32 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
+ 2006-12-01 19:54:32 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
- 2006-12-01 23:25:52 1,101,824 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
+ 2006-12-01 21:25:52 1,101,824 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
- 2006-12-01 23:25:56 1,093,120 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
+ 2006-12-01 21:25:56 1,093,120 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
- 2006-12-01 23:25:58 69,632 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
+ 2006-12-01 21:25:58 69,632 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
- 2006-12-01 23:26:00 57,856 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
+ 2006-12-01 21:26:00 57,856 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
- 2006-12-01 23:08:00 40,960 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
+ 2006-12-01 21:08:00 40,960 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
- 2006-12-01 23:08:00 45,056 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
+ 2006-12-01 21:08:00 45,056 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
- 2006-12-01 23:08:00 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
+ 2006-12-01 21:08:00 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
- 2006-12-01 23:08:00 57,344 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
+ 2006-12-01 21:08:00 57,344 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
- 2006-12-01 23:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
+ 2006-12-01 21:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
- 2006-12-01 23:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
+ 2006-12-01 21:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
- 2006-12-01 23:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
+ 2006-12-01 21:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
- 2006-12-01 23:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
+ 2006-12-01 21:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
- 2006-12-01 23:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
+ 2006-12-01 21:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
.
-- Snapshot reset to current date --
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"WrCtrl"="C:\Program Files\Kerio\WinRoute Firewall\wrctrl.exe" [2007-12-07 13:11 124776]
"Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2007-11-14 12:54 2131392]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"nForce Tray Options"="sstray.exe" [2003-06-17 18:18 73728 C:\WINDOWS\system32\sstray.exe]
"SpeedTouch USB Diagnostics"="C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" [2004-01-26 12:38 866816]
"nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2008-05-23 14:27 949376]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"NoSecCpl"= 0 (0x0)
"DisableChangePassword"= 0 (0x0)
"DisableLockWorkstation"= 0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoStartMenuPinnedList"= 0 (0x0)
"NoStartMenuMFUprogramsList"= 0 (0x0)
"NoUserNameInStartMenu"= 0 (0x0)
"NoStartMenuSubFolders"= 0 (0x0)
"NoCommonGroups"= 0 (0x0)
"NoPrinterTabs"= 0 (0x0)
"NoDeletePrinter"= 0 (0x0)
"NoAddPrinter"= 0 (0x0)
"NoPrinters"= 0 (0x0)
"NoFavoritesMenu"= 0 (0x0)
"NoRecentDocsNetHood"= 0 (0x0)
"NoChangeAnimation"= 0 (0x0)
"NoChangeKeyboardNavigationIndicators"= 0 (0x0)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.YV12"= yv12vfw.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Color Calibration.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\Color Calibration.lnk
backup=C:\WINDOWS\pss\Color Calibration.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^hp psc 1000 series.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\hp psc 1000 series.lnk
backup=C:\WINDOWS\pss\hp psc 1000 series.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^hpoddt01.exe.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\hpoddt01.exe.lnk
backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^NaturalColorLoad.lnk]
path=C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\NaturalColorLoad.lnk
backup=C:\WINDOWS\pss\NaturalColorLoad.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^Piotr^Menu Start^Programy^Autostart^VirtuaGirl HD.LNK]
path=C:\Documents and Settings\Piotr\Menu Start\Programy\Autostart\VirtuaGirl HD.LNK
backup=C:\WINDOWS\pss\VirtuaGirl HD.LNKStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\'Ashampoo AntiSpyWare 2 Guard']
--a------ 2008-05-28 10:01 2316632 d:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ashampoo AntiSpyWare 2 Guard]
--a------ 2008-05-28 10:01 2316632 D:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWare2Guard.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ATIPTA]
--a------ 2004-04-21 22:10 335872 C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BitComet]
D:\Program Files\BitComet\BitComet.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DLD.EXE]
C:\Program Files\Download Direct\DLD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu]
--a------ 2007-11-14 12:54 2131392 C:\Program Files\Gadu-Gadu\gg.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
--a------ 2006-01-12 17:40 155648 C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-01-31 23:13 385024 C:\Program Files\QuickTime\QTTask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SandboxieControl]
d:\Program Files\Sandboxie\SbieCtrl.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer]
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
--a------ 2008-05-22 21:06 162744 C:\Program Files\Google\GoogleToolbarNotifier\1.2.911.3380\GoogleToolbarNotifier.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Uniblue Registry Booster]
--------- 2006-05-31 19:19 5660672 D:\Temp\RegistryBooster.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinBooter]
C:\Documents and Settings\Piotr\Moje dokumenty\BootTimerEN.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"Apple Mobile Device"=2 (0x2)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"D:\\gry\\UnrealTournament\\System\\UnrealTournament.exe"=
"D:\\Program Files\\BearShare\\BearShare.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"7290:TCP"= 7290:TCP:BitComet 7290 TCP
"7290:UDP"= 7290:UDP:BitComet 7290 UDP
"80:TCP"= 80:TCP:BitComet 80 TCP
"80:UDP"= 80:UDP:BitComet 80 UDP
R1 SAVRKBootTasks;Boot Tasks Driver;C:\WINDOWS\system32\SAVRKBootTasks.sys [2007-08-14 08:12]
R2 AASW2_Service;Ashampoo AntiSpyWare 2 Service;d:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe [2008-05-28 10:01]
R3 kvpndev;Kerio VPN adapter;C:\WINDOWS\system32\DRIVERS\kvpndrv.sys [2007-12-07 12:02]
R3 kwflower;Kerio WinRoute Firewall Driver - Lower Layer;C:\WINDOWS\system32\DRIVERS\kwflower.sys [2007-12-07 12:03]
S2 WinRoute;Kerio WinRoute Firewall;"C:\Program Files\Kerio\WinRoute Firewall\winroute.exe" [2007-12-07 13:11]
S3 kwfupper;Kerio WinRoute Firewall Driver - Upper Layer;C:\WINDOWS\system32\DRIVERS\kwfupper.sys [2007-12-07 13:04]
S3 MEMSWEEP2;MEMSWEEP2;C:\WINDOWS\system32\165.tmp []
S3 usbscan;Sterownik skanera USB;C:\WINDOWS\system32\DRIVERS\usbscan.sys [2004-08-03 23:58]
S3 USBSTOR;Sterownik magazynu masowego USB;C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 00:08]
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{21A9A23D-5D94-45B3-B61A-89824E5F2525}]
C:\WINDOWS\system32\host.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-05-04 15:46:04 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-05-30 17:27:04 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1100 series#1206897991.job"
- C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-10 19:40:24
Windows 5.1.2600 Dodatek Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\MEMSWEEP2]
"ImagePath"="\??\C:\WINDOWS\system32\165.tmp"
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\Ati2evxx.dll
.
Completion time: 2008-06-10 19:40:56
ComboFix-quarantined-files.txt 2008-06-10 17:40:53
ComboFix2.txt 2008-05-19 18:21:56
Pre-Run: 2,799,034,368 bajtów wolnych
Post-Run: 2,820,919,296 bajtów wolnych
334 --- E O F --- 2008-06-10 15:04:13
i to :
- Kod: Zaznacz wszystko
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 19:43:04, on 2008-06-10
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
d:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe
C:\Program Files\Eset\nod32krn.exe
d:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\sstray.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Eset\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\system32\notepad.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Opera\Opera.exe
D:\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 - HKLM\..\Run: [nForce Tray Options] sstray.exe /r
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [WrCtrl] "C:\Program Files\Kerio\WinRoute Firewall\wrctrl.exe"
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{E83489CC-9ADC-40AB-9CA4-648077BF0176}: NameServer = 194.204.159.1 217.98.63.164
O23 - Service: Ashampoo AntiSpyWare 2 Service (AASW2_Service) - Unknown owner - d:\Program Files\Ashampoo\Ashampoo AntiSpyWare 2\AntiSpyWareService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - d:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
O23 - Service: Kerio WinRoute Firewall (WinRoute) - Kerio Technologies - C:\Program Files\Kerio\WinRoute Firewall\winroute.exe
--
End of file - 3522 bytes
Za pomoc thx
