chyba nie jest do końca dobrze

[Bergmann]

Witam, mam pewne przypuszczenia co do stanu mojego komputera. Przez jakis czas nie miałem żadnego antywirusa i dopiero dzisiaj zainstalowałem sobie XXX, przeskanowałem nim dyski i niby jest wszystko OK ale jakoś mam wątpliwości. Uzywam też programu YYY do czyszczenia dysków ze śmieci różnego typu i mam ciekawe wyniki z jego skanowania. Jak trzeba bedzie to zamieszcze screeny.

Tak więc prosze o sprawdzenie loga:

Logfile of HijackThis v1.99.1
Scan saved at 20:12:21, on 2007-04-28
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\drivers\KodakCCS.exe
E:\Programy\Nod32\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
E:\Programy\Deamon tools\daemon.exe
E:\Programy\Nod32\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Neostrada TP\NeostradaTP.exe
C:\Program Files\Neostrada TP\ComComp.exe
C:\Program Files\Neostrada TP\Watch.exe
C:\WINDOWS\system32\wuauclt.exe
E:\Programy\forum programosy\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [autoclk] autoclk.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [adiras] adiras.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Programy\Deamon tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [nod32kui] "E:\Programy\Nod32\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\RunServices: [Office XP hack] c:\office_patch.exe hack
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Pobierz z &BitSpirit - E:\Programy\BitSpirit\instalka\bsurl.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{E4E68CD1-3FEF-440F-B06F-A0B844A8A6F4}: NameServer = 194.204.152.34 217.98.63.164
O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - E:\Programy\Nod32\nod32krn.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

mam przupuszczenia co do:

O4 - HKLM\..\Run: [autoclk] autoclk.exe
O4 - HKLM\..\Run: [adiras] adiras.exe

ale nie jestem pewien

[wojtas]

sciagnij killbox`a:

http://www.wiruskill.pl/forum/viewtopic.php?t=58

Odpalasz Killboxa zaznacz opcję Delete on Reboot następnie w polu Full Path of File to Delete wklej ścieżkę :

C:\WINDOWS\system32\rpcc.dll

i nacisnij x
Program będzie pytał o restart (oczywiście zgadzasz się)


potem skasuj te wpisy:

O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

potem nowe logi

[First]

O4 - HKLM\..\Run: [autoclk] autoclk.exe
O4 - HKLM\..\Run: [adiras] adiras.exe

Te wpisy sa ok poniewaz masz ok

C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe

Ale,masz trojana rozprzestrzeniajacego sie za pomoca linkow GG:

O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll

Sciagnij Killbox-a zaznacz opcje delete on reboot i w polu full patch of file to delete wklej:

C:\WINDOWS\system32\rpcc.dll

Klikasz X reset kompa,dajesz logi z Hijackthis,Silentrunners,Comboscan.

[Bergmann]

C:\WINDOWS\system32\rpcc.dll

już usunięte i przez killboxa i w Hijackthis

a oto logi:

Logfile of HijackThis v1.99.1
Scan saved at 11:45:51, on 2007-04-29
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\drivers\KodakCCS.exe
E:\Programy\Nod32\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
E:\Programy\Deamon tools\daemon.exe
E:\Programy\Nod32\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Neostrada TP\NeostradaTP.exe
C:\Program Files\Neostrada TP\ComComp.exe
C:\Program Files\Neostrada TP\Watch.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\NOTEPAD.EXE
E:\Programy\forum programosy\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [autoclk] autoclk.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [adiras] adiras.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Programy\Deamon tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [nod32kui] "E:\Programy\Nod32\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\RunServices: [Office XP hack] c:\office_patch.exe hack
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Pobierz z &BitSpirit - E:\Programy\BitSpirit\instalka\bsurl.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{E4E68CD1-3FEF-440F-B06F-A0B844A8A6F4}: NameServer = 194.204.152.34 217.98.63.164
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - E:\Programy\Nod32\nod32krn.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

"Silent Runners.vbs", revision 43, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"NvCplDaemon" = "RUNDLL32.EXE NvQTwk,NvCplDaemon initialize" [MS]
"nwiz" = "nwiz.exe /install" ["NVIDIA Corporation"]
"UpdReg" = "C:\WINDOWS\Updreg.exe" ["Creative Technology Ltd."]
"AHQInit" = "C:\Program Files\Creative\SBLive\Program\AHQInit.exe" ["Creative Technology Ltd"]
"AudioHQ" = "C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE" ["Creative Technology Ltd."]
"WooCnxMon" = "C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [empty string]
"autoclk" = "autoclk.exe" [file not found]
"WOOWATCH" = "C:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"]
"WOOTASKBARICON" = "C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" ["France Télécom R&D"]
"adiras" = "adiras.exe" [file not found]
"Easy-PrintToolBox" = "C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon" ["CANON INC."]
"QuickTime Task" = ""C:\Program Files\QuickTime\qttask.exe" -atboottime" ["Apple Computer, Inc."]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"DAEMON Tools-1033" = ""E:\Programy\Deamon tools\daemon.exe" -lang 1033" ["DAEMON'S HOME"]
"nod32kui" = ""E:\Programy\Nod32\nod32kui.exe" /WAITSERVICE" ["Eset "]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {CLSID}\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."]
"{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Eksplorator pulpitów"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"]
"{acb4a560-3606-11d3-aef4-00104bd0f92d}" = "KodakShellExtension"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Common Files\KODAK\IFSCore\kodakshx.dll" ["Eastman Kodak Company"]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{21569614-B795-46b1-85F4-E737A8DC09AD}" = "Shell Search Band"
-> {CLSID}\InProcServer32\(Default) = "C:\WINDOWS\system32\browseui.dll" [MS]
"{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\OLKFSTUB.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Microsoft Office\Office10\msohev.dll" [MS]
"{B089FE88-FB52-11D3-BDF1-0050DA34150D}" = "NOD32 Context Menu Shell Extension"
-> {CLSID}\InProcServer32\(Default) = "E:\Programy\Nod32\nodshex.dll" [null data]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"
-> {CLSID}\InProcServer32\(Default) = "E:\Programy\Nod32\nodshex.dll" [null data]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
NOD32 Context Menu Shell Extension\(Default) = "{B089FE88-FB52-11D3-BDF1-0050DA34150D}"
-> {CLSID}\InProcServer32\(Default) = "E:\Programy\Nod32\nodshex.dll" [null data]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\Paweł\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"


Startup items in "Paweł" & "All Users" startup folders:
-------------------------------------------------------

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart
"DSLMON" -> shortcut to: "C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe /W" [empty string]
"Kodak EasyShare software" -> shortcut to: "C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe -h" ["Eastman Kodak Company"]
"Kodak software updater" -> shortcut to: "C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe" [null data]
"Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office10\OSA.EXE -b -l" [MS]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
C:\WINDOWS\system32\imon.dll ["Eset "], 01 - 05, 21
%SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 11 - 20
%SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{327C2873-E90D-4C37-AA9D-10AC9BABA46C}" = "Easy-WebPrint"
-> {CLSID}\InProcServer32\(Default) = "C:\Program Files\Canon\Easy-WebPrint\Toolband.dll" [null data]


Miscellaneous IE Hijack Points
------------------------------

HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\

Missing lines (compared with English-language version):
"{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = "Search Class" [from CLSID]
-> {CLSID}\InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [empty string]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Creative Service for CDROM Access, Creative Service for CDROM Access, "C:\WINDOWS\system32\CTsvcCDA.EXE" ["Creative Technology Ltd"]
Kodak Camera Connection Software, KodakCCS, "C:\WINDOWS\system32\drivers\KodakCCS.exe" ["Eastman Kodak Company"]
NOD32 Kernel Service, NOD32krn, ""E:\Programy\Nod32\nod32krn.exe"" ["Eset "]
NVIDIA Driver Helper Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"]
WMDM PMSP Service, WMDM PMSP Service, "C:\WINDOWS\system32\MsPMSPSv.exe" [MS]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
Canon BJ Language Monitor PIXMA iP1000\Driver = "CNMLM6e.DLL" ["CANON INC."]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 35 seconds, including 18 seconds for message boxes)

ComboScan v20070306.20 run by Paweł on 2007-04-29 at 11:54:07
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

System Restore is disabled; attempting to re-enable...success.


-- Last 1 Restore Point(s) --
1: 2007-04-29 09:54:11 UTC - RP1 - Punkt kontrolny systemu


Performed disk cleanup.


-- HijackThis (run as Paweł.exe) -----------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 11:54:16, on 2007-04-29
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\drivers\KodakCCS.exe
E:\Programy\Nod32\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
E:\Programy\Deamon tools\daemon.exe
E:\Programy\Nod32\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\Program Files\Neostrada TP\NeostradaTP.exe
C:\Program Files\Neostrada TP\ComComp.exe
C:\Program Files\Neostrada TP\Watch.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\taskmgr.exe
E:\Programy\forum programosy\comboscan.exe
E:\Programy\FORUMP~1\Paweł.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [autoclk] autoclk.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [adiras] adiras.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Programy\Deamon tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [nod32kui] "E:\Programy\Nod32\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\RunServices: [Office XP hack] c:\office_patch.exe hack
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Pobierz z &BitSpirit - E:\Programy\BitSpirit\instalka\bsurl.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{E4E68CD1-3FEF-440F-B06F-A0B844A8A6F4}: NameServer = 194.204.152.34 217.98.63.164
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - E:\Programy\Nod32\nod32krn.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe


-- HijackThis Fixed Entries (E:\Programy\FORUMP~1\backups\) --------------------

backup-20060514-204525-594 O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
backup-20060514-204633-473 O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
backup-20070428-195734-481 O4 - HKLM\..\RunServices: [Dcom Helper] utorrent.exe
backup-20070428-195734-702 O4 - HKLM\..\Run: [tcpipmon] tcpipmon.exe
backup-20070428-195734-784 O4 - HKLM\..\Run: [Dcom Helper] utorrent.exe
backup-20070428-195734-877 O4 - HKCU\..\Run: [Dcom Helper] utorrent.exe
backup-20070428-211635-238 O20 - Winlogon Notify: rpcc - C:\WINDOWS\system32\rpcc.dll (file missing)
backup-20070428-211635-592 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\

-- File Associations -----------------------------------------------------------

.bat - batfile - "%1" %*
.chm - chm.file - "C:\WINDOWS\hh.exe" %1
.cmd - cmdfile - "%1" %*
.com - comfile - "%1" %*
.exe - exefile - "%1" %*
.hlp - hlpfile - %SystemRoot%\System32\winhlp32.exe %1
.inf - inffile - %SystemRoot%\System32\NOTEPAD.EXE %1
.ini - inifile - %SystemRoot%\System32\NOTEPAD.EXE %1
.js - JSFile - %SystemRoot%\System32\WScript.exe "%1" %*
.lnk - lnkfile - {00021401-0000-0000-C000-000000000046}
.pif - piffile - "%1" %*
.reg - regfile - regedit.exe "%1"
.scr - scrfile - "%1" /S
.txt - txtfile - %SystemRoot%\system32\NOTEPAD.EXE %1
.vbs - VBSFile - %SystemRoot%\System32\WScript.exe "%1" %*


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

2S ADILOADER (General Purpose USB Driver (adildr.sys)) - C:\WINDOWS\system32\drivers\adildr.sys
3R adiusbaw (USB ADSL WAN Adapter) - C:\WINDOWS\system32\drivers\adiusbaw.sys
1R AmdK7 (Sterownik procesora AMD K7) - C:\WINDOWS\system32\drivers\amdk7.sys
2R AMON - C:\WINDOWS\system32\drivers\amon.sys
3R ctljystk (Port gier dla karty Creative SB Live!) - C:\WINDOWS\system32\drivers\ctljystk.sys
1R DcCam (Kodak Camera Proxy) - C:\WINDOWS\system32\drivers\DcCam.sys
3S DcFpoint - C:\WINDOWS\system32\drivers\DcFpoint.sys
2R DCFS2K (Kodak DCFS2K Driver) - C:\WINDOWS\system32\drivers\DCFS2k.sys
3S DcLps (Legacy Polling Service) - C:\WINDOWS\system32\drivers\DcLps.sys
3S DcPTP - C:\WINDOWS\system32\drivers\DcPtp.sys
3R emu10k (Creative SB Live! Value (WDM)) - C:\WINDOWS\system32\drivers\emu10k1f.sys
3R emu10k1 (Creative Interface Manager Driver (WDM)) - C:\WINDOWS\system32\drivers\ctlface.sys
1S Exportit - C:\WINDOWS\system32\drivers\ExportIt.sys
3R FETNDIS (Sterownik NT karty VIA PCI 10/100Mb Fast Ethernet) - C:\WINDOWS\system32\drivers\fetnd5.sys
1R nod32drv - C:\WINDOWS\system32\drivers\nod32drv.sys
3R nv - C:\WINDOWS\system32\drivers\nv4_mini.sys
1R oreans32 - C:\WINDOWS\system32\drivers\oreans32.sys
2R PfModNT - C:\WINDOWS\system32\PfModNT.sys
0R pnpshark - C:\WINDOWS\system32\drivers\pnpshark.sys
0R PxHelp20 - C:\WINDOWS\system32\drivers\pxhelp20.sys
3R sfman (Creative SoundFont Manager Driver (WDM)) - C:\WINDOWS\system32\drivers\sfman.sys
0R st3shark - C:\WINDOWS\system32\drivers\st3shark.sys
0R uagp35 (Filtr AGPv3.5 firmy Microsoft) - C:\WINDOWS\system32\drivers\UAGP35.SYS
3R usbehci (Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft) - C:\WINDOWS\system32\drivers\usbehci.sys
3S usbprint (Klasa PRINTER USB Microsoft) - C:\WINDOWS\system32\drivers\usbprint.sys
3S USBSTOR (Sterownik magazynu masowego USB) - C:\WINDOWS\system32\drivers\USBSTOR.SYS
1R WS2IFSL (Środowisko wspomagające dostawcę usług innych niż IFS - Windows Socket 2.0) - C:\WINDOWS\system32\drivers\ws2ifsl.sys


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

2R Creative Service for CDROM Access - C:\WINDOWS\system32\CTsvcCDA.EXE
2R KodakCCS (Kodak Camera Connection Software) - C:\WINDOWS\system32\drivers\KodakCCS.exe
2R NOD32krn (NOD32 Kernel Service) - "E:\Programy\Nod32\nod32krn.exe"
2R NVSvc (NVIDIA Driver Helper Service) - C:\WINDOWS\system32\nvsvc32.exe
2R WMDM PMSP Service - C:\WINDOWS\system32\MsPMSPSv.exe


-- Files created between 2007-03-29 and 2007-04-29 -----------------------------

2007-04-28 21:12:30 0 d-------- C:\!KillBox
2007-04-28 18:58:41 298104 --a------ C:\WINDOWS\system32\imon.dll
2007-04-28 18:58:41 15424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys
2007-04-28 18:58:41 512096 --a------ C:\WINDOWS\system32\drivers\amon.sys
2007-04-28 18:37:55 30720 --a------ C:\WINDOWS\system32\tcpipmon.exe
2007-04-28 18:37:47 973312 --a------ C:\WINDOWS\system32\utorrent.exe
2007-04-28 18:37:45 33920 --a------ C:\WINDOWS\system32\drivers\oreans32.sys
2007-04-28 17:37:46 0 d-------- C:\Downloads<DOWNLO~1>
2007-04-28 17:32:48 0 d-------- C:\Program Files\Opera
2007-04-28 17:29:31 8262 --a------ C:\WINDOWS\unins000.dat
2007-04-24 16:46:15 0 d-------- C:\WINDOWS\ShellNew
2007-04-19 20:46:09 0 d-------- C:\WINDOWS\Profiles
2007-04-19 20:46:07 0 d-------- C:\Program Files\Common Files\Adobe
2007-04-19 07:38:36 0 d-------- C:\Program Files\MSXML 4.0<MSXML4~1.0>
2007-04-18 22:57:32 22752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-04-18 22:57:32 0 d-------- C:\WINDOWS\system32\PreInstall<PREINS~1>
2007-04-18 22:57:30 0 d--h----- C:\WINDOWS\$hf_mig$
2007-04-18 17:00:10 0 d-------- C:\WINDOWS\system32\SoftwareDistribution<SOFTWA~1>
2007-04-17 19:23:56 1581056 --a------ C:\WINDOWS\system32\mplvw7.dll
2007-04-17 19:23:56 1122304 --a------ C:\WINDOWS\system32\mplvpx.dll
2007-04-17 19:23:56 1552384 --a------ C:\WINDOWS\system32\mplvm6.dll
2007-04-17 19:23:56 1650688 --a------ C:\WINDOWS\system32\mplva6.dll
2007-04-17 19:23:56 77824 --a------ C:\WINDOWS\system32\mplaw7.dll
2007-04-17 19:23:56 65536 --a------ C:\WINDOWS\system32\mplapx.dll
2007-04-17 19:23:56 65536 --a------ C:\WINDOWS\system32\mplam6.dll
2007-04-17 19:23:56 77824 --a------ C:\WINDOWS\system32\mplaa6.dll
2007-04-17 19:23:56 19968 --a------ C:\WINDOWS\system32\cpuinf32.dll
2007-04-17 19:23:55 152064 --a------ C:\WINDOWS\system32\unrar.dll
2007-04-17 19:23:54 761856 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-04-17 19:23:51 0 d-------- C:\Program Files\ACE Mega CoDecS Pack<ACEMEG~1>
2007-04-17 17:40:04 171280 --a------ C:\WINDOWS\system32\jit.dll
2007-04-17 17:40:04 139536 --a------ C:\WINDOWS\system32\javaee.dll
2007-04-17 17:40:04 313856 --a------ C:\WINDOWS\system32\dx3j.dll
2007-04-17 17:40:04 46352 --a------ C:\WINDOWS\setdebug.exe
2007-04-17 17:40:04 6550 --a------ C:\WINDOWS\jautoexp.dat
2007-04-17 17:39:59 113 --a------ C:\WINDOWS\system32\zonedon.reg
2007-04-17 17:39:59 113 --a------ C:\WINDOWS\system32\zonedoff.reg
2007-04-17 17:39:59 171792 --a------ C:\WINDOWS\system32\wjview.exe
2007-04-17 17:39:59 286992 --a------ C:\WINDOWS\system32\vmhelper.dll
2007-04-17 17:39:59 21264 --a------ C:\WINDOWS\system32\msjdbc10.dll
2007-04-17 17:39:58 947472 --a------ C:\WINDOWS\system32\msjava.dll
2007-04-17 17:39:58 154384 --a------ C:\WINDOWS\system32\msawt.dll
2007-04-17 17:39:58 172304 --a------ C:\WINDOWS\system32\jview.exe
2007-04-17 17:39:58 15120 --a------ C:\WINDOWS\system32\jdbgmgr.exe
2007-04-17 17:39:58 404752 --a------ C:\WINDOWS\system32\javart.dll
2007-04-17 17:39:58 63248 --a------ C:\WINDOWS\system32\javaprxy.dll
2007-04-17 17:39:58 187152 --a------ C:\WINDOWS\system32\javacypt.dll
2007-04-17 17:39:57 49424 --a------ C:\WINDOWS\system32\clspack.exe
2007-04-17 17:33:26 0 d-------- C:\Program Files\Google
2007-04-17 15:51:58 6400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2007-04-17 15:51:56 142464 --a------ C:\WINDOWS\system32\drivers\aec.sys
2007-04-17 15:51:55 54272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2007-04-17 15:51:54 2944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys
2007-04-17 15:51:52 52864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2007-04-17 15:51:50 4992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys
2007-04-17 15:51:48 82944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2007-04-17 15:51:46 7552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys
2007-04-17 15:51:45 172416 --a------ C:\WINDOWS\system32\drivers\kmixer.sys
2007-04-17 15:51:42 5376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2007-04-17 15:51:41 60800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2007-04-17 15:51:37 3072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2007-04-17 15:50:44 58624 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2007-04-17 15:50:21 931882 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-04-17 15:50:20 3539018 --a------ C:\WINDOWS\system32\nv4_disp.dll
2007-04-17 15:50:06 51200 --a------ C:\WINDOWS\system32\sfman32.dll
2007-04-17 15:50:06 495616 --a------ C:\WINDOWS\system32\sblfx.dll
2007-04-17 15:50:06 36480 --a------ C:\WINDOWS\system32\drivers\sfmanm.sys
2007-04-17 15:50:06 283904 --a------ C:\WINDOWS\system32\drivers\emu10k1m.sys
2007-04-17 15:50:06 6912 --a------ C:\WINDOWS\system32\drivers\ctlfacem.sys
2007-04-17 15:50:06 25600 --a------ C:\WINDOWS\system32\devldr32.exe
2007-04-17 15:50:06 352256 --a------ C:\WINDOWS\system32\devcon32.dll
2007-04-17 15:50:06 3584 --a------ C:\WINDOWS\system32\ctwdm32.dll
2007-04-17 15:50:05 4096 --a------ C:\WINDOWS\system32\ksuser.dll
2007-04-17 15:50:05 145792 --a------ C:\WINDOWS\system32\drivers\portcls.sys
2007-04-17 15:50:05 60288 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2007-04-17 15:50:03 3712 --a------ C:\WINDOWS\system32\drivers\ctljystk.sys
2007-04-17 15:49:54 27165 --a------ C:\WINDOWS\system32\drivers\fetnd5.sys
2007-04-17 15:49:51 77312 --a------ C:\WINDOWS\system32\usbui.dll
2007-04-17 15:49:45 44672 --a------ C:\WINDOWS\system32\drivers\UAGP35.SYS
2007-04-17 15:49:43 10624 --a------ C:\WINDOWS\system32\drivers\gameenum.sys
2007-04-17 15:48:28 0 d--hs---- C:\WINDOWS\Installer<INSTAL~1>
2007-04-17 15:48:27 0 d-------- C:\Program Files\Common Files\ODBC
2007-04-17 15:48:24 0 d-------- C:\Program Files\Common Files\SpeechEngines<SPEECH~1>
2007-04-17 15:48:23 0 dr------- C:\Program Files<PROGRA~1>
2007-04-17 15:48:19 6144 -ra------ C:\WINDOWS\system32\kbdtuq.dll
2007-04-17 15:48:19 6144 -ra------ C:\WINDOWS\system32\kbdtuf.dll
2007-04-17 15:48:19 5632 -ra------ C:\WINDOWS\system32\kbdazel.dll
2007-04-17 15:48:18 5632 -ra------ C:\WINDOWS\system32\kbdmon.dll
2007-04-17 15:48:18 5632 -ra------ C:\WINDOWS\system32\kbdkyr.dll
2007-04-17 15:48:16 8192 -ra------ C:\WINDOWS\system32\kbdhept.dll
2007-04-17 15:48:16 6656 -ra------ C:\WINDOWS\system32\kbdhela3.dll
2007-04-17 15:48:16 6144 -ra------ C:\WINDOWS\system32\kbdhela2.dll
2007-04-17 15:48:16 5632 -ra------ C:\WINDOWS\system32\kbdhe319.dll
2007-04-17 15:48:16 5632 -ra------ C:\WINDOWS\system32\kbdhe220.dll
2007-04-17 15:48:16 5632 -ra------ C:\WINDOWS\system32\kbdhe.dll
2007-04-17 15:48:16 6144 -ra------ C:\WINDOWS\system32\kbdgkl.dll
2007-04-17 15:48:14 6144 -ra------ C:\WINDOWS\system32\kbdlv1.dll
2007-04-17 15:48:14 6144 -ra------ C:\WINDOWS\system32\kbdlv.dll
2007-04-17 15:48:14 5632 -ra------ C:\WINDOWS\system32\kbdlt1.dll
2007-04-17 15:48:14 5632 -ra------ C:\WINDOWS\system32\kbdlt.dll
2007-04-17 15:48:14 6144 -ra------ C:\WINDOWS\system32\kbdest.dll
2007-04-17 15:48:11 6656 --a------ C:\WINDOWS\system32\kbdycl.dll
2007-04-17 15:48:11 6656 --a------ C:\WINDOWS\system32\kbdsl1.dll
2007-04-17 15:48:11 6656 --a------ C:\WINDOWS\system32\kbdsl.dll
2007-04-17 15:48:11 5632 --a------ C:\WINDOWS\system32\kbdro.dll
2007-04-17 15:48:11 5632 --a------ C:\WINDOWS\system32\kbdhu1.dll
2007-04-17 15:48:11 6656 --a------ C:\WINDOWS\system32\kbdhu.dll
2007-04-17 15:48:11 6656 --a------ C:\WINDOWS\system32\kbdcz2.dll
2007-04-17 15:48:11 6656 --a------ C:\WINDOWS\system32\kbdcz1.dll
2007-04-17 15:48:11 7168 --a------ C:\WINDOWS\system32\kbdcz.dll
2007-04-17 15:48:11 6656 --a------ C:\WINDOWS\system32\kbdcr.dll
2007-04-17 15:48:11 6656 --a------ C:\WINDOWS\system32\KBDAL.DLL
2007-04-17 15:48:10 13312 --a------ C:\WINDOWS\system32\irclass.dll
2007-04-17 15:48:10 85532 --a------ C:\WINDOWS\system32\dgsetup.dll
2007-04-17 15:48:10 176157 --a------ C:\WINDOWS\system32\dgrpsetu.dll
2007-04-17 15:48:09 24661 --a------ C:\WINDOWS\system32\spxcoins.dll
2007-04-17 15:48:09 103424 --a------ C:\WINDOWS\system32\EqnClass.Dll
2007-04-17 15:48:09 9168 --a------ C:\WINDOWS\system\VER.DLL
2007-04-17 15:48:09 19200 --a------ C:\WINDOWS\system\TAPI.DLL
2007-04-17 15:48:08 5120 --a------ C:\WINDOWS\system\SHELL.DLL
2007-04-17 15:48:08 24064 --a------ C:\WINDOWS\system\OLESVR.DLL
2007-04-17 15:48:08 83456 --a------ C:\WINDOWS\system\OLECLI.DLL
2007-04-17 15:48:08 127008 --a------ C:\WINDOWS\system\MSVIDEO.DLL
2007-04-17 15:48:08 9936 --a------ C:\WINDOWS\system\LZEXPAND.DLL
2007-04-17 15:48:08 33376 --a------ C:\WINDOWS\system\COMMDLG.DLL
2007-04-17 15:48:07 15360 --a------ C:\WINDOWS\TASKMAN.EXE
2007-04-17 15:48:07 11264 --a------ C:\WINDOWS\system32\drivers\irenum.sys
2007-04-17 15:48:07 8704 --a------ C:\WINDOWS\system32\batt.dll
2007-04-17 15:48:07 109488 --a------ C:\WINDOWS\system\AVIFILE.DLL
2007-04-17 15:48:07 70096 --a------ C:\WINDOWS\system\AVICAP.DLL
2007-04-17 15:48:06 69552 --a------ C:\WINDOWS\system\MMSYSTEM.DLL
2007-04-17 15:48:06 70144 --a------ C:\WINDOWS\NOTEPAD.EXE
2007-04-17 15:48:05 75776 --a------ C:\WINDOWS\system32\storprop.dll
2007-04-17 15:47:42 0 d-------- C:\WINDOWS\system32\CatRoot2
2007-04-17 15:47:42 0 d-------- C:\WINDOWS\system32\CatRoot
2007-04-17 15:47:15 0 d-------- C:\Documents and Settings<DOCUME~1>
2007-04-17 15:47:14 0 d--hs---- C:\System Volume Information<SYSTEM~1>
2007-04-17 15:42:07 0 d-------- C:\WINDOWS
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\WinSxS
2007-04-17 15:42:07 0 dr------- C:\WINDOWS\Web
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\twain_32
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\wins
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\wbem
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\usmt
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\spool
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\ShellExt
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\Setup
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\ras
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\oobe
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\npp
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\mui
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\inetsrv
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\IME
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\icsxml
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\ias
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\export
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\drivers
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\drivers\etc
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\drivers\disdn
2007-04-17 15:42:07 0 dr-hs--c- C:\WINDOWS\system32\dllcache
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\dhcp
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\config
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\3com_dmi
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\3076
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\2052
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\1054
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\1045
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\1042
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\1041
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\1037
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\1033
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\1031
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\1028
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\1025
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\security
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\Resources<RESOUR~1>
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\repair
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\Provisioning<PROVIS~1>
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\PeerNet
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\pchealth
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\mui
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\msapps
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\msagent
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\Media
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\java
2007-04-17 15:42:07 0 d--h----- C:\WINDOWS\inf
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\ime
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\Help
2007-04-17 15:42:07 0 dr--s---- C:\WINDOWS\Fonts
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\ehome
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\Driver Cache<DRIVER~1>
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\Debug
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\Cursors
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\Connection Wizard<CONNEC~1>
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\Config
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\AppPatch
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\addins
2007-04-17 15:18:04 125184 -----n--- C:\WINDOWS\system32\drivers\imagesrv.sys
2007-04-17 15:18:04 5504 -----n--- C:\WINDOWS\system32\drivers\imagedrv.sys
2007-04-17 15:17:48 106496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2007-04-17 15:17:47 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe<NEROCH~1.EXE>
2007-04-17 15:17:47 471040 -----n--- C:\WINDOWS\system32\ImagXRA7.dll
2007-04-17 15:17:47 262144 -----n--- C:\WINDOWS\system32\ImagXR7.dll
2007-04-17 15:17:47 476320 -----n--- C:\WINDOWS\system32\ImagXpr7.dll
2007-04-17 15:17:47 1568768 -----n--- C:\WINDOWS\system32\ImagX7.dll
2007-04-17 15:17:46 0 d-------- C:\Program Files\Common Files\Ahead
2007-04-17 15:17:46 0 d-------- C:\Program Files\Ahead
2007-04-17 15:16:29 0 d-------- C:\WINDOWS\system32\appmgmt
2007-04-17 15:13:29 221184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-04-17 15:13:12 0 d-------- C:\WINDOWS\RegisteredPackages<REGIST~2>
2007-04-17 15:10:27 11776 -ra------ C:\office_patch.exe<OFFICE~1.EXE>
2007-04-17 14:57:24 0 d-------- C:\Program Files\Gadu-Gadu<GADU-G~1>
2007-04-17 14:54:19 86016 --a------ C:\WINDOWS\unvise32qt.exe<UNVISE~1.EXE>
2007-04-17 14:54:13 0 d-------- C:\WINDOWS\system32\QuickTime<QUICKT~1>
2007-04-17 14:54:13 0 d-------- C:\Program Files\QuickTime<QUICKT~1>
2007-04-17 14:53:57 0 d-------- C:\WINDOWS\system32\BWKDLogs
2007-04-17 14:53:43 0 d-------- C:\Program Files\Common Files\Kodak
2007-04-17 14:53:36 0 d-------- C:\KPCMS
2007-04-17 14:53:34 0 d-------- C:\WINDOWS\system32\color
2007-04-17 14:51:47 0 d-------- C:\Program Files\Kodak
2007-04-17 14:50:33 163840 --a------ C:\WINDOWS\BJPSUNST.EXE
2007-04-17 14:50:05 348160 --a------ C:\WINDOWS\system32\msvcr71.dll
2007-04-17 14:50:05 499712 --a------ C:\WINDOWS\system32\msvcp71.dll
2007-04-17 14:50:05 1060864 --a------ C:\WINDOWS\system32\MFC71.dll
2007-04-17 14:48:25 25856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-04-17 14:44:08 7680 --a------ C:\WINDOWS\system32\CNMVS6e.DLL
2007-04-17 14:44:08 116736 --a------ C:\WINDOWS\system32\CNMLM6e.DLL
2007-04-17 14:44:03 86016 -ra------ C:\WINDOWS\system32\CNMCP6e.exe
2007-04-17 14:43:52 0 d--h----- C:\BJPrinter<BJPRIN~1>
2007-04-17 14:43:38 0 d-------- C:\WINDOWS\StartHtmico<STARTH~1>
2007-04-17 14:43:38 0 d-------- C:\WINDOWS\IP1000
2007-04-17 14:42:53 0 d-------- C:\Program Files\Canon
2007-04-17 14:28:24 32768 --a------ C:\WINDOWS\system32\WooDial2000.dll<WOODIA~1.DLL>
2007-04-17 14:27:25 127456 --a------ C:\WINDOWS\system32\ipdetect.exe
2007-04-17 14:27:25 127065 --a------ C:\WINDOWS\system32\drivers\adiusbaw.sys
2007-04-17 14:27:25 155648 --a------ C:\WINDOWS\system32\adadix32.dll
2007-04-17 14:27:24 126976 --a------ C:\WINDOWS\system32\coclassfast.dll<COCLAS~1.DLL>
2007-04-17 14:27:23 114688 --a------ C:\WINDOWS\system32\unaddrv.exe
2007-04-17 14:27:23 50007 --a------ C:\WINDOWS\system32\drivers\adildr.sys
2007-04-17 14:27:23 4981 --a------ C:\WINDOWS\system32\adadix2k.dll
2007-04-17 14:27:23 46892 --a------ C:\WINDOWS\system32\adadix16.dll
2007-04-17 14:27:19 0 d-------- C:\Program Files\SAGEM
2007-04-17 14:27:06 0 d-------- C:\Program Files\Java Web Start<JAVAWE~1>
2007-04-17 14:26:59 41068 -----n--- C:\WINDOWS\system32\ActPanel.dll
2007-04-17 14:26:59 0 d-------- C:\Program Files\Java
2007-04-17 14:26:59 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-04-17 14:26:01 0 d-------- C:\Program Files\Neostrada TP<NEOSTR~1>
2007-04-17 14:25:44 0 d--hs---- C:\WINDOWS\ftpcache
2007-04-17 14:22:27 41984 --a------ C:\WINDOWS\CTREGRUN.EXE
2007-04-17 14:21:52 90112 --a------ C:\WINDOWS\Updreg.exe
2007-04-17 14:21:44 36992 --a------ C:\WINDOWS\system32\drivers\sfman.sys
2007-04-17 14:21:44 775296 --a------ C:\WINDOWS\system32\drivers\emu10k1f.sys
2007-04-17 14:21:43 6912 --a------ C:\WINDOWS\system32\drivers\ctlface.sys
2007-04-17 14:21:43 59392 --a------ C:\WINDOWS\system32\a3d.dll
2007-04-17 14:20:30 1048576 -----n--- C:\WINDOWS\system32\sfman.dat
2007-04-17 14:20:30 84992 -----n--- C:\WINDOWS\system32\sfcvrt32.dll
2007-04-17 14:20:30 108032 -----n--- C:\WINDOWS\system32\mfcuia32.dll
2007-04-17 14:20:30 149504 -----n--- C:\WINDOWS\system32\mfcans32.dll
2007-04-17 14:20:30 82432 -----n--- C:\WINDOWS\system32\Ctwflt32.dll
2007-04-17 14:20:30 26768 -----n--- C:\WINDOWS\system32\ctl3d.dll
2007-04-17 14:20:30 34816 -----n--- C:\WINDOWS\CTRes32.dll
2007-04-17 14:20:30 24976 -----n--- C:\WINDOWS\ctres.dll
2007-04-17 14:20:29 53552 -----n--- C:\WINDOWS\ctccw.dll
2007-04-17 14:18:56 3584 --a------ C:\WINDOWS\system32\Ahqcpres.dll
2007-04-17 14:18:31 0 d-------- C:\Media
2007-04-17 14:18:30 25088 --a------ C:\WINDOWS\system32\CTSVCCTL.EXE
2007-04-17 14:18:30 44032 --a------ C:\WINDOWS\system32\CTSVCCDA.EXE
2007-04-17 14:18:00 54784 -----n--- C:\WINDOWS\system32\Inetwh32.dll
2007-04-17 14:18:00 307200 -----n--- C:\WINDOWS\system32\CtMp3Lib.dll
2007-04-17 14:18:00 110592 -----n--- C:\WINDOWS\system32\ctmp3io2.dll
2007-04-17 14:18:00 24576 -----n--- C:\WINDOWS\system32\CTMERes.DLL
2007-04-17 14:18:00 393216 -----n--- C:\WINDOWS\system32\CTMedEng.dll
2007-04-17 14:18:00 28672 -----n--- C:\WINDOWS\system32\CTIntRes.dll
2007-04-17 14:18:00 155648 -----n--- C:\WINDOWS\system32\CTDrmUI.dll
2007-04-17 14:18:00 73728 -----n--- C:\WINDOWS\system32\CTDrmRes.dll
2007-04-17 14:18:00 57856 -----n--- C:\WINDOWS\system32\CTDETRES.DLL
2007-04-17 14:17:12 6752 -----n--- C:\WINDOWS\system32\PfModNT.sys
2007-04-17 14:17:12 0 d-------- C:\Program Files\Creative
2007-04-17 14:17:11 306688 --a------ C:\WINDOWS\IsUninst.exe
2007-04-17 14:10:05 0 d-------- C:\WINDOWS\nview
2007-04-17 14:10:02 0 d-------- C:\WINDOWS\system32\ReinstallBackups<REINST~1>
2007-04-17 14:09:57 0 d-------- C:\Program Files\Common Files\InstallShield<INSTAL~1>
2007-04-17 14:04:47 0 d-------- C:\WINDOWS\SoftwareDistribution<SOFTWA~1>
2007-04-17 14:04:45 0 d-------- C:\WINDOWS\Prefetch
2007-04-17 14:00:37 0 d-------- C:\WINDOWS\system32\xircom
2007-04-17 14:00:37 0 d-------- C:\Program Files\microsoft frontpage<MICROS~1>
2007-04-17 14:00:11 0 -rahs---- C:\MSDOS.SYS
2007-04-17 14:00:11 0 -rahs---- C:\IO.SYS
2007-04-17 14:00:11 0 --a------ C:\CONFIG.SYS
2007-04-17 14:00:11 0 --a------ C:\AUTOEXEC.BAT
2007-04-17 13:59:44 112128 --a------ C:\WINDOWS\system32\mapi32.dll
2007-04-17 13:58:45 0 dr------- C:\WINDOWS\Offline Web Pages<OFFLIN~1>
2007-04-17 13:58:45 0 d---s---- C:\WINDOWS\Downloaded Program Files<DOWNLO~1>
2007-04-17 13:58:32 0 d--h----- C:\Program Files\WindowsUpdate<WINDOW~3>
2007-04-17 13:58:28 0 d-------- C:\Program Files\Usługi online<USUGIO~1>
2007-04-17 13:58:11 0 d-------- C:\WINDOWS\system32\DirectX
2007-04-17 13:57:51 11264 --a------ C:\WINDOWS\system32\atrace.dll
2007-04-17 13:57:41 12288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2007-04-17 13:57:40 67584 --a------ C:\WINDOWS\system32\acctres.dll
2007-04-17 13:57:36 0 d---s---- C:\WINDOWS\Tasks
2007-04-17 13:57:36 16384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2007-04-17 13:57:35 0 d-------- C:\Program Files\Common Files\MSSoap
2007-04-17 13:57:31 0 d-------- C:\WINDOWS\srchasst
2007-04-17 13:57:30 0 d-------- C:\WINDOWS\system32\Macromed
2007-04-17 13:57:28 173536 --a------ C:\WINDOWS\system32\wuweb.dll
2007-04-17 13:57:28 128280 --a------ C:\WINDOWS\system32\wucltui.dll
2007-04-17 13:57:27 41240 --a------ C:\WINDOWS\system32\wups.dll
2007-04-17 13:57:27 6656 --a------ C:\WINDOWS\system32\wuauserv.dll
2007-04-17 13:57:27 195352 --a------ C:\WINDOWS\system32\wuaueng1.dll
2007-04-17 13:57:27 1343768 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-04-17 13:57:27 175384 --a------ C:\WINDOWS\system32\wuauclt1.exe
2007-04-17 13:57:27 125208 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-04-17 13:57:27 466200 --a------ C:\WINDOWS\system32\wuapi.dll
2007-04-17 13:57:26 18944 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2007-04-17 13:57:26 382464 --a------ C:\WINDOWS\system32\qmgr.dll
2007-04-17 13:57:26 7168 --a------ C:\WINDOWS\system32\bitsprx3.dll
2007-04-17 13:57:26 8192 --a------ C:\WINDOWS\system32\bitsprx2.dll
2007-04-17 13:57:23 0 d-------- C:\Program Files\Movie Maker<MOVIEM~1>
2007-04-17 13:57:19 45568 --a------ C:\WINDOWS\system32\safrslv.dll
2007-04-17 13:57:19 29696 --a------ C:\WINDOWS\system32\safrdm.dll
2007-04-17 13:57:19 43520 --a------ C:\WINDOWS\system32\safrcdlg.dll
2007-04-17 13:57:19 43520 --a------ C:\WINDOWS\system32\racpldlg.dll
2007-04-17 13:57:16 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2007-04-17 13:57:16 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2007-04-17 13:57:15 171008 --a------ C:\WINDOWS\system32\srsvc.dll
2007-04-17 13:57:15 240128 --a------ C:\WINDOWS\system32\srrstr.dll
2007-04-17 13:57:15 67584 --a------ C:\WINDOWS\system32\srclient.dll
2007-04-17 13:57:15 0 d-------- C:\WINDOWS\system32\Restore
2007-04-17 13:57:15 73472 --a------ C:\WINDOWS\system32\drivers\sr.sys
2007-04-17 13:57:15 128896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys
2007-04-17 13:57:14 28672 --a------ C:\WINDOWS\system32\nmmkcert.dll
2007-04-17 13:57:14 34560 --a------ C:\WINDOWS\system32\mnmdd.dll
2007-04-17 13:57:14 32768 --a------ C:\WINDOWS\system32\isrdbg32.dll
2007-04-17 13:57:14 81920 --a------ C:\WINDOWS\system32\ils.dll
2007-04-17 13:57:13 69632 --a------ C:\WINDOWS\system32\msconf.dll
2007-04-17 13:57:13 32768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2007-04-17 13:57:11 105984 --a------ C:\WINDOWS\system32\msoert2.dll
2007-04-17 13:57:11 252928 --a------ C:\WINDOWS\system32\msoeacct.dll
2007-04-17 13:57:09 49664 --a------ C:\WINDOWS\system32\inetres.dll
2007-04-17 13:57:09 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2007-04-17 13:57:05 192000 --a------ C:\WINDOWS\system32\schedsvc.dll
2007-04-17 13:57:05 12288 --a------ C:\WINDOWS\system32\mstinit.exe
2007-04-17 13:57:05 278528 --a------ C:\WINDOWS\system32\mstask.dll
2007-04-17 13:57:05 65536 --a------ C:\WINDOWS\system32\icwphbk.dll
2007-04-17 13:57:05 73728 --a------ C:\WINDOWS\system32\icwdial.dll
2007-04-17 13:57:04 86016 --a------ C:\WINDOWS\system32\isign32.dll
2007-04-17 13:57:04 278528 --a------ C:\WINDOWS\system32\inetcfg.dll
2007-04-17 13:56:22 21856 --a------ C:\WINDOWS\system32\emptyregdb.dat<EMPTYR~1.DAT>
2007-04-17 13:56:06 0 d-------- C:\WINDOWS\Registration<REGIST~1>
2007-04-17 13:55:52 0 d-------- C:\Program Files\Messenger<MESSEN~1>
2007-04-17 13:55:48 5632 --a------ C:\WINDOWS\system32\write.exe
2007-04-17 13:55:48 0 d-------- C:\Program Files\MSN Gaming Zone<MSNGAM~1>
2007-04-17 13:55:39 139264 --a------ C:\WINDOWS\system32\sndvol32.exe
2007-04-17 13:55:39 44544 --a------ C:\WINDOWS\system32\hticons.dll
2007-04-17 13:55:39 73216 --a------ C:\WINDOWS\system32\avwav.dll
2007-04-17 13:55:39 231424 --a------ C:\WINDOWS\system32\avtapi.dll
2007-04-17 13:55:39 16384 --a------ C:\WINDOWS\system32\avmeter.dll
2007-04-17 13:55:38 35328 --a------ C:\WINDOWS\system32\winchat.exe
2007-04-17 13:55:32 605696 --a------ C:\WINDOWS\system32\getuname.dll
2007-04-17 13:55:31 57344 --a------ C:\WINDOWS\system32\sol.exe
2007-04-17 13:55:31 80896 --a------ C:\WINDOWS\system32\charmap.exe
2007-04-17 13:55:31 115200 --a------ C:\WINDOWS\system32\calc.exe
2007-04-17 13:55:30 119808 --a------ C:\WINDOWS\system32\winmine.exe
2007-04-17 13:55:30 1225 --a------ C:\WINDOWS\system32\usrlogon.cmd
2007-04-17 13:55:30 16384 --a------ C:\WINDOWS\system32\tskill.exe
2007-04-17 13:55:30 9728 --a------ C:\WINDOWS\system32\reset.exe
2007-04-17 13:55:30 128000 --a------ C:\WINDOWS\system32\mshearts.exe
2007-04-17 13:55:30 55808 --a------ C:\WINDOWS\system32\freecell.exe
2007-04-17 13:55:29 17920 --a------ C:\WINDOWS\system32\tsshutdn.exe
2007-04-17 13:55:29 15360 --a------ C:\WINDOWS\system32\tsdiscon.exe
2007-04-17 13:55:29 15360 --a------ C:\WINDOWS\system32\tscon.exe
2007-04-17 13:55:29 15360 --a------ C:\WINDOWS\system32\shadow.exe
2007-04-17 13:55:29 16384 --a------ C:\WINDOWS\system32\rwinsta.exe
2007-04-17 13:55:29 33792 --a------ C:\WINDOWS\system32\regini.exe
2007-04-17 13:55:29 4608 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2007-04-17 13:55:29 22528 --a------ C:\WINDOWS\system32\qwinsta.exe
2007-04-17 13:55:29 17408 --a------ C:\WINDOWS\system32\qappsrv.exe
2007-04-17 13:55:29 22528 --a------ C:\WINDOWS\system32\msg.exe
2007-04-17 13:55:29 15872 --a------ C:\WINDOWS\system32\logoff.exe
2007-04-17 13:55:28 15872 --a------ C:\WINDOWS\system32\cdmodem.dll
2007-04-17 13:55:27 54272 --a------ C:\WINDOWS\system32\stclient.dll
2007-04-17 13:55:27 25088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2007-04-17 13:55:27 4096 --a------ C:\WINDOWS\system32\mtxex.dll
2007-04-17 13:55:27 20480 --a------ C:\WINDOWS\system32\mtxdm.dll
2007-04-17 13:55:27 5120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2007-04-17 13:55:27 147456 --a------ C:\WINDOWS\system32\comsnap.dll
2007-04-17 13:55:27 97792 --a------ C:\WINDOWS\system32\comrepl.dll
2007-04-17 13:55:27 25600 --a------ C:\WINDOWS\system32\comaddin.dll
2007-04-17 13:55:20 132608 --a------ C:\WINDOWS\system32\sndrec32.exe
2007-04-17 13:55:20 124928 --a------ C:\WINDOWS\system32\mplay32.exe
2007-04-17 13:55:20 351744 --a------ C:\WINDOWS\system32\hypertrm.dll
2007-04-17 13:55:20 187904 --a------ C:\WINDOWS\system32\accwiz.exe
2007-04-17 13:55:19 345088 --a------ C:\WINDOWS\system32\mspaint.exe
2007-04-17 13:55:19 103424 --a------ C:\WINDOWS\system32\clipbrd.exe
2007-04-17 13:55:19 0 d-------- C:\Program Files\Windows NT<WINDOW~1>
2007-04-17 13:55:18 94720 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2007-04-17 13:55:18 539136 --a------ C:\WINDOWS\system32\spider.exe
2007-04-17 13:55:18 655360 --a------ C:\WINDOWS\system32\mstscax.dll
2007-04-17 13:55:18 408576 --a------ C:\WINDOWS\system32\mstsc.exe
2007-04-17 13:55:18 21896 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys
2007-04-17 13:55:18 12040 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys
2007-04-17 13:55:18 139528 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys
2007-04-17 13:55:17 44544 --a------ C:\WINDOWS\system32\tscupgrd.exe
2007-04-17 13:55:17 296448 --a------ C:\WINDOWS\system32\termsrv.dll
2007-04-17 13:55:17 141824 --a------ C:\WINDOWS\system32\sessmgr.exe
2007-04-17 13:55:17 60928 --a------ C:\WINDOWS\system32\remotepg.dll
2007-04-17 13:55:17 67072 --a------ C:\WINDOWS\system32\rdshost.exe
2007-04-17 13:55:17 13824 --a------ C:\WINDOWS\system32\rdsaddin.exe
2007-04-17 13:55:17 87176 --a------ C:\WINDOWS\system32\rdpwsx.dll
2007-04-17 13:55:17 19968 --a------ C:\WINDOWS\system32\rdpsnd.dll
2007-04-17 13:55:17 62464 --a------ C:\WINDOWS\system32\rdpclip.exe
2007-04-17 13:55:17 147968 --a------ C:\WINDOWS\system32\rdchost.dll
2007-04-17 13:55:17 20992 --a------ C:\WINDOWS\system32\qprocess.exe
2007-04-17 13:55:16 91136 --a------ C:\WINDOWS\system32\mtxoci.dll
2007-04-17 13:55:16 161280 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2007-04-17 13:55:16 956416 --a------ C:\WINDOWS\system32\msdtctm.dll
2007-04-17 13:55:16 426496 --a------ C:\WINDOWS\system32\msdtcprx.dll
2007-04-17 13:55:16 0 d-------- C:\WINDOWS\system32\MsDtc
2007-04-17 13:55:16 11264 --a------ C:\WINDOWS\system32\icaapi.dll
2007-04-17 13:55:16 38912 --a------ C:\WINDOWS\system32\cfgbkend.dll
2007-04-17 13:55:15 11776 --a------ C:\WINDOWS\system32\xolehlp.dll
2007-04-17 13:55:15 58880 --a------ C:\WINDOWS\system32\msdtclog.dll
2007-04-17 13:55:15 6144 --a------ C:\WINDOWS\system32\msdtc.exe
2007-04-17 13:55:14 0 d-------- C:\WINDOWS\system32\Com
2007-04-17 13:55:14 60416 --a------ C:\WINDOWS\system32\colbact.dll
2007-04-17 13:55:14 110080 --a------ C:\WINDOWS\system32\clbcatex.dll
2007-04-17 13:55:14 625152 --a------ C:\WINDOWS\system32\catsrvut.dll
2007-04-17 13:55:14 85504 --a------ C:\WINDOWS\system32\catsrvps.dll
2007-04-17 13:55:14 225792 --a------ C:\WINDOWS\system32\catsrv.dll
2007-04-17 13:55:13 540160 --a------ C:\WINDOWS\system32\comuid.dll
2007-04-17 13:55:13 1267200 --a------ C:\WINDOWS\system32\comsvcs.dll
2007-04-17 13:55:13 498688 --a------ C:\WINDOWS\system32\clbcatq.dll
2007-04-17 13:55:07 56320 --a------ C:\WINDOWS\system32\servdeps.dll
2007-04-17 13:55:07 17920 --a------ C:\WINDOWS\system32\mmfutil.dll
2007-04-17 13:55:07 58880 --a------ C:\WINDOWS\system32\licwmi.dll
2007-04-17 13:55:06 187904 --a------ C:\WINDOWS\system32\cmprops.dll
2007-04-17 13:55:03 196864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys
2007-04-17 13:55:02 40840 --a------ C:\WINDOWS\system32\drivers\termdd.sys


-- Find3M Report ---------------------------------------------------------------

2007-04-28 21:33:34 0 d---s---- C:\Documents and Settings\Paweł\Dane aplikacji\Microsoft<MICROS~1>
2007-04-28 17:35:23 0 d-------- C:\Documents and Settings\Paweł\Dane aplikacji\Opera
2007-04-28 17:33:42 0 d-------- C:\Documents and Settings\Paweł\Dane aplikacji\Macromedia<MACROM~1>
2007-04-28 17:29:32 75791 --a------ C:\WINDOWS\unins000.exe
2007-04-28 17:18:32 0 d-------- C:\Documents and Settings\Paweł\Dane aplikacji\Google
2007-04-26 09:45:14 0 d-------- C:\Documents and Settings\Paweł\Dane aplikacji\Identities<IDENTI~1>
2007-04-19 07:38:17 355486 --a------ C:\WINDOWS\system32\perfh015.dat
2007-04-19 07:38:17 49492 --a------ C:\WINDOWS\system32\perfc015.dat
2007-04-17 15:47:56 62 --ahs---- C:\Documents and Settings\Paweł\Dane aplikacji\desktop.ini
2007-03-17 15:45:36 293376 --a------ C:\WINDOWS\system32\winsrv.dll
2007-03-08 17:38:47 579072 --a------ C:\WINDOWS\system32\user32.dll
2007-03-08 17:38:47 40960 --a------ C:\WINDOWS\system32\mf3216.dll
2007-03-08 17:38:47 281600 --a------ C:\WINDOWS\system32\gdi32.dll
2007-03-08 17:37:33 1843840 --a------ C:\WINDOWS\system32\win32k.sys
2007-02-05 22:19:48 185856 --a------ C:\WINDOWS\system32\upnphost.dll
2007-01-29 10:58:06 60416 -----n--- C:\WINDOWS\system32\tzchange.exe


-- Registry Dump ---------------------------------------------------------------


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NvCplDaemon"="RUNDLL32.EXE NvQTwk,NvCplDaemon initialize"
"nwiz"="nwiz.exe /install"
"UpdReg"="C:\\WINDOWS\\Updreg.exe"
"AHQInit"="C:\\Program Files\\Creative\\SBLive\\Program\\AHQInit.exe"
"AudioHQ"="C:\\Program Files\\Creative\\SBLive\\AudioHQ\\AHQTB.EXE"
"WooCnxMon"="C:\\PROGRA~1\\NEOSTR~1\\CnxMon.exe"
"autoclk"="autoclk.exe"
"WOOWATCH"="C:\\PROGRA~1\\NEOSTR~1\\Watch.exe"
"WOOTASKBARICON"="C:\\PROGRA~1\\NEOSTR~1\\TaskbarIcon.exe"
"adiras"="adiras.exe"
"Easy-PrintToolBox"="C:\\Program Files\\Canon\\Easy-PrintToolBox\\BJPSMAIN.EXE /logon"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"DAEMON Tools-1033"="\"E:\\Programy\\Deamon tools\\daemon.exe\" -lang 1033"
"nod32kui"="\"E:\\Programy\\Nod32\\nod32kui.exe\" /WAITSERVICE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
"Office XP hack"="c:\\office_patch.exe hack"


[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0



-- End of ComboScan: finished at 2007-04-29 at 11:54:45 ------------------------

[wojtas]

te pliki skasuj w awaryjnym z wyłączonym przywracaniem systemu:

C:\WINDOWS\system32\tcpipmon.exe
C:\WINDOWS\system32\utorrent.exe

[Bergmann]

Jak usunąć?? Ręcznie??

[Poldek]

Ręcznie??

tak wywal pogrubione recznie

[Bergmann]

OK nie ma już

C:\WINDOWS\system32\tcpipmon.exe
C:\WINDOWS\system32\utorrent.exe

coś jeszcze jest do usunięcia lub poprawienia??

[wojtas]

daj nowy log z combo i 2 z gmera

sciagnij gmera:

http://gmer.net/gmer.zip

1. Zakładka Rootkit >>> zaznaczone wszystko oprócz Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta
2. Zakładka Rootkit >>> zaznaczone tylko Usługi i Pokazuj wszystko >>> kliknij Szukaj >>> czekaj cierpliwie aż skończy >>> Kopiuj >>> wklej do posta


wrzuc 3 logi na rapida lub na cos innego bo sie nie zmieszcza

[Bergmann]

gmer szukanie 1:

GMER 1.0.12.12244 - http://www.gmer.net
Rootkit scan 2007-04-29 23:01:05
Windows 5.1.2600 Dodatek Service Pack 2


---- Kernel code sections - GMER 1.0.12 ----

? C:\WINDOWS\system32\DRIVERS\update.sys

---- Devices - GMER 1.0.12 ----

Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_NAMED_PIPE 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLOSE 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_READ 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_WRITE 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_INFORMATION 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_INFORMATION 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_EA 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_EA 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FLUSH_BUFFERS 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_VOLUME_INFORMATION 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_VOLUME_INFORMATION 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DIRECTORY_CONTROL 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_FILE_SYSTEM_CONTROL 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CONTROL 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_INTERNAL_DEVICE_CONTROL 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SHUTDOWN 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_LOCK_CONTROL 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CLEANUP 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_CREATE_MAILSLOT 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_SECURITY 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_SECURITY 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_POWER 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SYSTEM_CONTROL 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_DEVICE_CHANGE 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_QUERY_QUOTA 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_SET_QUOTA 82CCA378
Device \Driver\Cdrom \Device\CdRom0 IRP_MJ_PNP 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_NAMED_PIPE 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLOSE 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_READ 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_WRITE 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_INFORMATION 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_INFORMATION 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_EA 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_EA 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FLUSH_BUFFERS 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_VOLUME_INFORMATION 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_VOLUME_INFORMATION 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DIRECTORY_CONTROL 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_FILE_SYSTEM_CONTROL 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CONTROL 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_INTERNAL_DEVICE_CONTROL 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SHUTDOWN 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_LOCK_CONTROL 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CLEANUP 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_CREATE_MAILSLOT 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_SECURITY 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_SECURITY 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_POWER 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SYSTEM_CONTROL 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_DEVICE_CHANGE 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_QUERY_QUOTA 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_SET_QUOTA 82CCA378
Device \Driver\Cdrom \Device\CdRom1 IRP_MJ_PNP 82CCA378
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CREATE 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CREATE_NAMED_PIPE 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CLOSE 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_READ 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_WRITE 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_INFORMATION 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_INFORMATION 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_EA 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_EA 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_FLUSH_BUFFERS 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_VOLUME_INFORMATION 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_VOLUME_INFORMATION 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_DIRECTORY_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_FILE_SYSTEM_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_DEVICE_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_INTERNAL_DEVICE_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SHUTDOWN 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_LOCK_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CLEANUP 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_CREATE_MAILSLOT 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_SECURITY 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_SECURITY 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_POWER 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SYSTEM_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_DEVICE_CHANGE 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_QUERY_QUOTA 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_SET_QUOTA 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 IRP_MJ_PNP 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE_NAMED_PIPE 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLOSE 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_READ 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_WRITE 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_INFORMATION 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_INFORMATION 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_EA 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_EA 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_FLUSH_BUFFERS 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_VOLUME_INFORMATION 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_VOLUME_INFORMATION 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DIRECTORY_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_FILE_SYSTEM_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DEVICE_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_INTERNAL_DEVICE_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SHUTDOWN 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_LOCK_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CLEANUP 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_CREATE_MAILSLOT 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_SECURITY 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_SECURITY 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_POWER 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SYSTEM_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_DEVICE_CHANGE 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_QUERY_QUOTA 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_SET_QUOTA 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort0 IRP_MJ_PNP 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE_NAMED_PIPE 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CLOSE 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_READ 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_WRITE 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_INFORMATION 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_INFORMATION 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_EA 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_EA 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_FLUSH_BUFFERS 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_VOLUME_INFORMATION 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_VOLUME_INFORMATION 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DIRECTORY_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_FILE_SYSTEM_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DEVICE_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_INTERNAL_DEVICE_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SHUTDOWN 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_LOCK_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CLEANUP 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_CREATE_MAILSLOT 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_SECURITY 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_SECURITY 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_POWER 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SYSTEM_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_DEVICE_CHANGE 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_QUERY_QUOTA 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_SET_QUOTA 82CCA4E0
Device \Driver\atapi \Device\Ide\IdePort1 IRP_MJ_PNP 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_CREATE 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_CREATE_NAMED_PIPE 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_CLOSE 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_READ 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_WRITE 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_QUERY_INFORMATION 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_SET_INFORMATION 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_QUERY_EA 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_SET_EA 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_FLUSH_BUFFERS 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_QUERY_VOLUME_INFORMATION 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_SET_VOLUME_INFORMATION 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_DIRECTORY_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_FILE_SYSTEM_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_DEVICE_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_INTERNAL_DEVICE_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_SHUTDOWN 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_LOCK_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_CLEANUP 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_CREATE_MAILSLOT 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_QUERY_SECURITY 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_SET_SECURITY 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_POWER 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_SYSTEM_CONTROL 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_DEVICE_CHANGE 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_QUERY_QUOTA 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_SET_QUOTA 82CCA4E0
Device \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-e IRP_MJ_PNP 82CCA4E0
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_CREATE 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_CREATE_NAMED_PIPE 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_CLOSE 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_READ 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_WRITE 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_QUERY_INFORMATION 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_SET_INFORMATION 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_QUERY_EA 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_SET_EA 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_FLUSH_BUFFERS 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_QUERY_VOLUME_INFORMATION 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_SET_VOLUME_INFORMATION 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_DIRECTORY_CONTROL 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_FILE_SYSTEM_CONTROL 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_DEVICE_CONTROL 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_INTERNAL_DEVICE_CONTROL 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_SHUTDOWN 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_LOCK_CONTROL 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_CLEANUP 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_CREATE_MAILSLOT 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_QUERY_SECURITY 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_SET_SECURITY 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_POWER 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_SYSTEM_CONTROL 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_DEVICE_CHANGE 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_QUERY_QUOTA 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_SET_QUOTA 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1 IRP_MJ_PNP 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_CREATE 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_CREATE_NAMED_PIPE 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_CLOSE 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_READ 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_WRITE 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_QUERY_INFORMATION 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_SET_INFORMATION 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_QUERY_EA 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_SET_EA 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_FLUSH_BUFFERS 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_QUERY_VOLUME_INFORMATION 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_SET_VOLUME_INFORMATION 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_DIRECTORY_CONTROL 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_FILE_SYSTEM_CONTROL 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_DEVICE_CONTROL 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_INTERNAL_DEVICE_CONTROL 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_SHUTDOWN 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_LOCK_CONTROL 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_CLEANUP 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_CREATE_MAILSLOT 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_QUERY_SECURITY 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_SET_SECURITY 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_POWER 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_SYSTEM_CONTROL 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_DEVICE_CHANGE 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_QUERY_QUOTA 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_SET_QUOTA 82CCD590
Device \Driver\st3shark \Device\Scsi\st3shark1Port2Path0Target0Lun0 IRP_MJ_PNP 82CCD590

---- Modules - GMER 1.0.12 ----

Module _________ F7453000-F746B000 (98304 bytes)

---- Files - GMER 1.0.12 ----

ADS C:\Documents and Settings\Pawe:KAVICHS
ADS C:\Documents and Settings\Pawe:KAVICHS
ADS C:\Documents and Settings\Pawe:KAVICHS
ADS D:\format\Pawe:KAVICHS
ADS D:\format\Pawe:KAVICHS
ADS D:\format\Pawe:KAVICHS
ADS D:\Zdj:KAVICHS
ADS E:\plecak swe, str[1]. tytu:KAVICHS
ADS E:\plecak z ksi±:KAVICHS
ADS F:\Paw:KAVICHS
ADS F:\Paw:KAVICHS
ADS F:\Paw:KAVICHS
ADS F:\Paw:KAVICHS
ADS F:\Paw:KAVICHS
ADS F:\Paw:KAVICHS
ADS F:\Paw:KAVICHS
ADS F:\Paw:KAVICHS
ADS F:\Paw:KAVICHS
ADS F:\Paw:KAVICHS
ADS F:\Paw:KAVICHS
ADS F:\Paw:KAVICHS

---- EOF - GMER 1.0.12 ----

gmer szukanie 2:

GMER 1.0.12.12244 - http://www.gmer.net
Rootkit scan 2007-04-29 23:02:29
Windows 5.1.2600 Dodatek Service Pack 2


---- Services - GMER 1.0.12 ----

Service [DISABLED] Abiosdsk
Service [DISABLED] abp480n5
Service C:\WINDOWS\system32\DRIVERS\ACPI.sys [BOOT] ACPI
Service [DISABLED] ACPIEC
Service C:\WINDOWS\System32\Drivers\adildr.sys [AUTO] ADILOADER
Service C:\WINDOWS\system32\DRIVERS\adiusbaw.sys [MANUAL] adiusbaw
Service [DISABLED] adpu160m
Service C:\WINDOWS\system32\drivers\aec.sys [MANUAL] aec
Service C:\WINDOWS\System32\drivers\afd.sys [SYSTEM] AFD
Service [DISABLED] Aha154x
Service [DISABLED] aic78u2
Service [DISABLED] aic78xx
Service C:\WINDOWS\system32\svchost.exe [DISABLED] Alerter
Service C:\WINDOWS\System32\alg.exe [MANUAL] ALG
Service [DISABLED] AliIde
Service C:\WINDOWS\system32\DRIVERS\amdk7.sys [SYSTEM] AmdK7
Service C:\WINDOWS\system32\drivers\amon.sys [AUTO] AMON
Service [DISABLED] amsint
Service C:\WINDOWS\system32\svchost.exe [MANUAL] AppMgmt
Service [DISABLED] asc
Service [DISABLED] asc3350p
Service [DISABLED] asc3550
Service C:\WINDOWS\system32\DRIVERS\asyncmac.sys [MANUAL] AsyncMac
Service C:\WINDOWS\system32\DRIVERS\atapi.sys [BOOT] atapi
Service [DISABLED] Atdisk
Service C:\WINDOWS\system32\DRIVERS\atmarpc.sys [MANUAL] Atmarpc
Service C:\WINDOWS\System32\svchost.exe [AUTO] AudioSrv
Service C:\WINDOWS\system32\DRIVERS\audstub.sys [MANUAL] audstub
Service BattC
Service [SYSTEM] Beep
Service C:\WINDOWS\system32\svchost.exe [AUTO] BITS
Service C:\WINDOWS\system32\svchost.exe [AUTO] Browser
Service [DISABLED] cbidf2k
Service [DISABLED] cd20xrnt
Service [SYSTEM] Cdaudio
Service [DISABLED] Cdfs
Service C:\WINDOWS\system32\DRIVERS\cdrom.sys [SYSTEM] Cdrom
Service [SYSTEM] Changer
Service C:\WINDOWS\system32\cisvc.exe [MANUAL] CiSvc
Service C:\WINDOWS\system32\clipsrv.exe [DISABLED] ClipSrv
Service [DISABLED] CmdIde
Service C:\WINDOWS\system32\dllhost.exe [MANUAL] COMSysApp
Service ContentFilter
Service ContentIndex
Service [DISABLED] Cpqarray
Service C:\WINDOWS\system32\CTsvcCDA.EXE [AUTO] Creative Service for CDROM Access
Service C:\WINDOWS\system32\svchost.exe [AUTO] CryptSvc
Service C:\WINDOWS\system32\DRIVERS\ctljystk.sys [MANUAL] ctljystk
Service ctlntsvc
Service [DISABLED] dac2w2k
Service [DISABLED] dac960nt
Service C:\WINDOWS\system32\DRIVERS\DcCam.sys [SYSTEM] DcCam
Service C:\WINDOWS\system32\DRIVERS\DcFpoint.sys [MANUAL] DcFpoint
Service C:\WINDOWS\system32\drivers\dcfs2k.sys [AUTO] DCFS2K
Service C:\WINDOWS\system32\DRIVERS\DcLps.sys [MANUAL] DcLps
Service C:\WINDOWS\system32\svchost.exe [AUTO] DcomLaunch
Service C:\WINDOWS\system32\DRIVERS\DcPTP.sys [MANUAL] DcPTP
Service C:\WINDOWS\system32\svchost.exe [AUTO] Dhcp
Service C:\WINDOWS\system32\DRIVERS\disk.sys [BOOT] Disk
Service C:\WINDOWS\System32\dmadmin.exe [MANUAL] dmadmin
Service C:\WINDOWS\System32\drivers\dmboot.sys [DISABLED] dmboot
Service C:\WINDOWS\System32\drivers\dmio.sys [BOOT] dmio
Service C:\WINDOWS\System32\drivers\dmload.sys [BOOT] dmload
Service C:\WINDOWS\System32\svchost.exe [AUTO] dmserver
Service C:\WINDOWS\system32\drivers\DMusic.sys [MANUAL] DMusic
Service C:\WINDOWS\system32\svchost.exe [AUTO] Dnscache
Service [DISABLED] dpti2o
Service C:\WINDOWS\system32\drivers\drmkaud.sys [MANUAL] drmkaud
Service C:\WINDOWS\system32\drivers\emu10k1f.sys [MANUAL] emu10k
Service C:\WINDOWS\system32\drivers\ctlface.sys [MANUAL] emu10k1
Service C:\WINDOWS\System32\svchost.exe [AUTO] ERSvc
Service C:\WINDOWS\system32\services.exe [AUTO] Eventlog
Service C:\WINDOWS\system32\svchost.exe [MANUAL] EventSystem
Service C:\WINDOWS\system32\DRIVERS\exportit.sys [SYSTEM] Exportit
Service [DISABLED] Fastfat
Service C:\WINDOWS\System32\svchost.exe [MANUAL] FastUserSwitchingCompatibility
Service C:\WINDOWS\system32\DRIVERS\fdc.sys [MANUAL] Fdc
Service C:\WINDOWS\system32\DRIVERS\fetnd5.sys [MANUAL] FETNDIS
Service [SYSTEM] Fips
Service C:\WINDOWS\system32\DRIVERS\flpydisk.sys [MANUAL] Flpydisk
Service C:\WINDOWS\system32\DRIVERS\fltMgr.sys [BOOT] FltMgr
Service [SYSTEM] Fs_Rec
Service C:\WINDOWS\system32\DRIVERS\ftdisk.sys [BOOT] Ftdisk
Service C:\WINDOWS\system32\DRIVERS\gameenum.sys [MANUAL] gameenum
Service C:\WINDOWS\System32\DRIVERS\gmer.sys [MANUAL] gmer
Service C:\WINDOWS\system32\DRIVERS\msgpc.sys [MANUAL] Gpc
Service C:\WINDOWS\System32\svchost.exe [AUTO] helpsvc
Service C:\WINDOWS\System32\svchost.exe [DISABLED] HidServ
Service [DISABLED] hpn
Service C:\WINDOWS\System32\Drivers\HTTP.sys [MANUAL] HTTP
Service C:\WINDOWS\System32\svchost.exe [MANUAL] HTTPFilter
Service [SYSTEM] i2omgmt
Service [DISABLED] i2omp
Service C:\WINDOWS\system32\DRIVERS\i8042prt.sys [SYSTEM] i8042prt
Service C:\WINDOWS\system32\DRIVERS\imapi.sys [SYSTEM] Imapi
Service C:\WINDOWS\system32\imapi.exe [MANUAL] ImapiService
Service inetaccs
Service [DISABLED] ini910u
Service Inport
Service [DISABLED] IntelIde
Service C:\WINDOWS\system32\DRIVERS\Ip6Fw.sys [MANUAL] Ip6Fw
Service C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys [MANUAL] IpFilterDriver
Service C:\WINDOWS\system32\DRIVERS\ipinip.sys [MANUAL] IpInIp
Service C:\WINDOWS\system32\DRIVERS\ipnat.sys [MANUAL] IpNat
Service C:\WINDOWS\system32\DRIVERS\ipsec.sys [SYSTEM] IPSec
Service C:\WINDOWS\system32\DRIVERS\irenum.sys [MANUAL] IRENUM
Service ISAPISearch
Service C:\WINDOWS\system32\DRIVERS\isapnp.sys [BOOT] isapnp
Service C:\WINDOWS\system32\DRIVERS\kbdclass.sys [SYSTEM] Kbdclass
Service C:\WINDOWS\system32\drivers\kmixer.sys [MANUAL] kmixer
Service C:\WINDOWS\system32\drivers\KodakCCS.exe [AUTO] KodakCCS
Service [BOOT] KSecDD
Service C:\WINDOWS\system32\svchost.exe [AUTO] lanmanserver
Service C:\WINDOWS\system32\svchost.exe [AUTO] lanmanworkstation
Service [SYSTEM] lbrtfdc
Service ldap
Service LicenseService
Service C:\WINDOWS\system32\svchost.exe [AUTO] LmHosts
Service C:\WINDOWS\system32\svchost.exe [DISABLED] Messenger
Service [SYSTEM] mnmdd
Service C:\WINDOWS\system32\mnmsrvc.exe [MANUAL] mnmsrvc
Service [MANUAL] Modem
Service C:\WINDOWS\system32\DRIVERS\mouclass.sys [SYSTEM] Mouclass
Service [BOOT] MountMgr
Service [DISABLED] mraid35x
Service C:\WINDOWS\system32\DRIVERS\mrxdav.sys [MANUAL] MRxDAV
Service C:\WINDOWS\system32\DRIVERS\mrxsmb.sys [SYSTEM] MRxSmb
Service C:\WINDOWS\system32\msdtc.exe [MANUAL] MSDTC
Service [SYSTEM] Msfs
Service C:\WINDOWS\system32\msiexec.exe [MANUAL] MSIServer
Service C:\WINDOWS\system32\drivers\MSKSSRV.sys [MANUAL] MSKSSRV
Service C:\WINDOWS\system32\drivers\MSPCLOCK.sys [MANUAL] MSPCLOCK
Service C:\WINDOWS\system32\drivers\MSPQM.sys [MANUAL] MSPQM
Service C:\WINDOWS\system32\DRIVERS\mssmbios.sys [MANUAL] mssmbios
Service [BOOT] Mup
Service [BOOT] NDIS
Service C:\WINDOWS\system32\DRIVERS\ndistapi.sys [MANUAL] NdisTapi
Service C:\WINDOWS\system32\DRIVERS\ndisuio.sys [MANUAL] Ndisuio
Service C:\WINDOWS\system32\DRIVERS\ndiswan.sys [MANUAL] NdisWan
Service [MANUAL] NDProxy
Service C:\WINDOWS\system32\DRIVERS\netbios.sys [SYSTEM] NetBIOS
Service C:\WINDOWS\system32\DRIVERS\netbt.sys [SYSTEM] NetBT
Service C:\WINDOWS\system32\netdde.exe [DISABLED] NetDDE
Service C:\WINDOWS\system32\netdde.exe [DISABLED] NetDDEdsdm
Service C:\WINDOWS\system32\lsass.exe [MANUAL] Netlogon
Service C:\WINDOWS\System32\svchost.exe [MANUAL] Netman
Service C:\WINDOWS\system32\svchost.exe [MANUAL] Nla
Service C:\WINDOWS\system32\drivers\nod32drv.sys [SYSTEM] nod32drv
Service E:\Programy\Nod32\nod32krn.exe [AUTO] NOD32krn
Service [SYSTEM] Npfs
Service [DISABLED] Ntfs
Service C:\WINDOWS\system32\lsass.exe [MANUAL] NtLmSsp
Service C:\WINDOWS\system32\svchost.exe [MANUAL] NtmsSvc
Service [SYSTEM] Null
Service C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [MANUAL] nv
Service C:\WINDOWS\system32\nvsvc32.exe [AUTO] NVSvc
Service C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys [MANUAL] NwlnkFlt
Service C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys [MANUAL] NwlnkFwd
Service C:\WINDOWS\system32\drivers\oreans32.sys [SYSTEM] oreans32
Service C:\WINDOWS\system32\DRIVERS\parport.sys [MANUAL] Parport
Service [BOOT] PartMgr
Service [AUTO] ParVdm
Service C:\WINDOWS\system32\DRIVERS\pci.sys [BOOT] PCI
Service [SYSTEM] PCIDump
Service [DISABLED] PCIIde
Service [DISABLED] Pcmcia
Service [MANUAL] PDCOMP
Service [MANUAL] PDFRAME
Service [MANUAL] PDRELI
Service [MANUAL] PDRFRAME
Service [DISABLED] perc2
Service [DISABLED] perc2hib
Service PerfDisk
Service PerfNet
Service PerfOS
Service PerfProc
Service C:\WINDOWS\system32\PfModNT.sys [AUTO] PfModNT
Service C:\WINDOWS\system32\services.exe [AUTO] PlugPlay
Service C:\WINDOWS\system32\DRIVERS\pnpshark.sys [BOOT] pnpshark
Service C:\WINDOWS\system32\lsass.exe [AUTO] PolicyAgent
Service C:\WINDOWS\system32\DRIVERS\raspptp.sys [MANUAL] PptpMiniport
Service C:\WINDOWS\system32\lsass.exe [AUTO] ProtectedStorage
Service C:\WINDOWS\system32\DRIVERS\psched.sys [MANUAL] PSched
Service C:\WINDOWS\system32\DRIVERS\ptilink.sys [MANUAL] Ptilink
Service C:\WINDOWS\system32\DRIVERS\PxHelp20.sys [BOOT] PxHelp20
Service [DISABLED] ql1080
Service [DISABLED] Ql10wnt
Service [DISABLED] ql12160
Service [DISABLED] ql1240
Service [DISABLED] ql1280
Service C:\WINDOWS\system32\DRIVERS\rasacd.sys [SYSTEM] RasAcd
Service C:\WINDOWS\system32\svchost.exe [MANUAL] RasAuto
Service C:\WINDOWS\system32\DRIVERS\rasl2tp.sys [MANUAL] Rasl2tp
Service C:\WINDOWS\system32\svchost.exe [MANUAL] RasMan
Service C:\WINDOWS\system32\DRIVERS\raspppoe.sys [MANUAL] RasPppoe
Service C:\WINDOWS\system32\DRIVERS\raspti.sys [MANUAL] Raspti
Service C:\WINDOWS\system32\DRIVERS\rdbss.sys [SYSTEM] Rdbss
Service C:\WINDOWS\System32\DRIVERS\RDPCDD.sys [SYSTEM] RDPCDD
Service RDPDD
Service C:\WINDOWS\system32\DRIVERS\rdpdr.sys [MANUAL] rdpdr
Service RDPNP
Service [MANUAL] RDPWD
Service C:\WINDOWS\system32\sessmgr.exe [MANUAL] RDSessMgr
Service C:\WINDOWS\system32\DRIVERS\redbook.sys [SYSTEM] redbook
Service C:\WINDOWS\system32\svchost.exe [DISABLED] RemoteAccess
Service C:\WINDOWS\system32\svchost.exe [AUTO] RemoteRegistry
Service C:\WINDOWS\system32\locator.exe [MANUAL] RpcLocator
Service C:\WINDOWS\system32\svchost.exe [AUTO] RpcSs
Service C:\WINDOWS\system32\rsvp.exe [MANUAL] RSVP
Service C:\WINDOWS\system32\lsass.exe [AUTO] SamSs
Service C:\WINDOWS\System32\SCardSvr.exe [MANUAL] SCardSvr
Service C:\WINDOWS\System32\svchost.exe [AUTO] Schedule
Service C:\WINDOWS\system32\DRIVERS\secdrv.sys [MANUAL] Secdrv
Service C:\WINDOWS\System32\svchost.exe [AUTO] seclogon
Service C:\WINDOWS\system32\svchost.exe [AUTO] SENS
Service C:\WINDOWS\system32\DRIVERS\serenum.sys [MANUAL] serenum
Service C:\WINDOWS\system32\DRIVERS\serial.sys [SYSTEM] Serial
Service [SYSTEM] Sfloppy
Service C:\WINDOWS\system32\drivers\sfman.sys [MANUAL] sfman
Service C:\WINDOWS\system32\svchost.exe [AUTO] SharedAccess
Service C:\WINDOWS\System32\svchost.exe [AUTO] ShellHWDetection
Service [DISABLED] Simbad
Service [DISABLED] Sparrow
Service C:\WINDOWS\system32\drivers\splitter.sys [MANUAL] splitter
Service C:\WINDOWS\system32\spoolsv.exe [AUTO] Spooler
Service C:\WINDOWS\system32\DRIVERS\sr.sys [DISABLED] sr
Service C:\WINDOWS\system32\svchost.exe [AUTO] srservice
Service C:\WINDOWS\system32\DRIVERS\srv.sys [MANUAL] Srv
Service C:\WINDOWS\system32\svchost.exe [MANUAL] SSDPSRV
Service C:\WINDOWS\system32\DRIVERS\st3shark.sys [BOOT] st3shark
Service C:\WINDOWS\system32\svchost.exe [MANUAL] stisvc
Service C:\WINDOWS\system32\DRIVERS\swenum.sys [MANUAL] swenum
Service C:\WINDOWS\system32\drivers\swmidi.sys [MANUAL] swmidi
Service C:\WINDOWS\system32\dllhost.exe [MANUAL] SwPrv
Service [DISABLED] symc810
Service [DISABLED] symc8xx
Service [DISABLED] sym_hi
Service [DISABLED] sym_u3
Service C:\WINDOWS\system32\drivers\sysaudio.sys [MANUAL] sysaudio
Service C:\WINDOWS\system32\smlogsvc.exe [MANUAL] SysmonLog
Service C:\WINDOWS\System32\svchost.exe [MANUAL] TapiSrv
Service C:\WINDOWS\system32\DRIVERS\tcpip.sys [SYSTEM] Tcpip
Service [MANUAL] TDPIPE
Service [MANUAL] TDTCP
Service C:\WINDOWS\system32\DRIVERS\termdd.sys [SYSTEM] TermDD
Service C:\WINDOWS\System32\svchost.exe [MANUAL] TermService
Service C:\WINDOWS\System32\svchost.exe [AUTO] Themes
Service C:\WINDOWS\system32\tlntsvr.exe [DISABLED] TlntSvr
Service [DISABLED] TosIde
Service C:\WINDOWS\system32\svchost.exe [AUTO] TrkWks
Service TSDDD
Service C:\WINDOWS\system32\DRIVERS\uagp35.sys [BOOT] uagp35
Service [DISABLED] Udfs
Service [DISABLED] ultra
Service C:\WINDOWS\system32\DRIVERS\update.sys [MANUAL] Update
Service C:\WINDOWS\system32\svchost.exe [MANUAL] upnphost
Service C:\WINDOWS\System32\ups.exe [MANUAL] UPS
Service C:\WINDOWS\system32\DRIVERS\usbehci.sys [MANUAL] usbehci
Service C:\WINDOWS\system32\DRIVERS\usbhub.sys [MANUAL] usbhub
Service C:\WINDOWS\system32\DRIVERS\usbprint.sys [MANUAL] usbprint
Service C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [MANUAL] USBSTOR
Service C:\WINDOWS\system32\DRIVERS\usbuhci.sys [MANUAL] usbuhci
Service C:\WINDOWS\System32\drivers\vga.sys [SYSTEM] VgaSave
Service C:\WINDOWS\system32\DRIVERS\viaide.sys [BOOT] ViaIde
Service [BOOT] VolSnap
Service C:\WINDOWS\System32\vssvc.exe [MANUAL] VSS
Service VXD
Service C:\WINDOWS\System32\svchost.exe [AUTO] W32Time
Service W3SVC
Service C:\WINDOWS\system32\DRIVERS\wanarp.sys [MANUAL] Wanarp
Service [MANUAL] WDICA
Service C:\WINDOWS\system32\drivers\wdmaud.sys [MANUAL] wdmaud
Service C:\WINDOWS\system32\svchost.exe [AUTO] WebClient
Service C:\WINDOWS\system32\svchost.exe [AUTO] winmgmt
Service [MANUAL] Winsock
Service WinSock2
Service WinTrust
Service C:\WINDOWS\system32\MsPMSPSv.exe [AUTO] WMDM PMSP Service
Service C:\WINDOWS\System32\svchost.exe [MANUAL] WmdmPmSN
Service C:\WINDOWS\System32\svchost.exe [MANUAL] Wmi
Service WmiApRpl
Service C:\WINDOWS\system32\wbem\wmiapsrv.exe [MANUAL] WmiApSrv
Service C:\WINDOWS\System32\drivers\ws2ifsl.sys [SYSTEM] WS2IFSL
Service C:\WINDOWS\System32\svchost.exe [AUTO] wscsvc
Service C:\WINDOWS\system32\svchost.exe [AUTO] wuauserv
Service C:\WINDOWS\System32\svchost.exe [AUTO] WZCSVC
Service C:\WINDOWS\System32\svchost.exe [MANUAL] xmlprov
Service {1C3DA613-2A16-4456-8F47-6A6CA29AE49B}

---- EOF - GMER 1.0.12 ----

wojtas19162 daj jakąś odpowiedź to zamieszcze loga z combo

[wojtas]

tu jest ok

[Bergmann]

log z comboscan:

ComboScan v20070306.20 run by Paweł on 2007-04-29 at 23:03:46
Computer is in Normal Mode.
--------------------------------------------------------------------------------



-- HijackThis (run as Paweł.exe) -----------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 23:04:26, on 2007-04-29
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\WINDOWS\system32\drivers\KodakCCS.exe
E:\Programy\Nod32\nod32krn.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
C:\PROGRA~1\NEOSTR~1\CnxMon.exe
E:\Programy\Deamon tools\daemon.exe
E:\Programy\Nod32\nod32kui.exe
C:\WINDOWS\system32\ctfmon.exe
E:\Programy\Gadu-Gadu\gg.exe
C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Neostrada TP\NeostradaTP.exe
C:\Program Files\Neostrada TP\ComComp.exe
C:\Program Files\Neostrada TP\Watch.exe
C:\Program Files\Opera\Opera.exe
C:\WINDOWS\system32\svchost.exe
E:\Programy\forum programosy\Combo Scan\comboscan.exe
E:\Programy\FORUMP~1\HIJACK~1\Paweł.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\Updreg.exe
O4 - HKLM\..\Run: [AHQInit] C:\Program Files\Creative\SBLive\Program\AHQInit.exe
O4 - HKLM\..\Run: [AudioHQ] C:\Program Files\Creative\SBLive\AudioHQ\AHQTB.EXE
O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe
O4 - HKLM\..\Run: [autoclk] autoclk.exe
O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe
O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe
O4 - HKLM\..\Run: [adiras] adiras.exe
O4 - HKLM\..\Run: [Easy-PrintToolBox] C:\Program Files\Canon\Easy-PrintToolBox\BJPSMAIN.EXE /logon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Programy\Deamon tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [nod32kui] "E:\Programy\Nod32\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\RunServices: [Office XP hack] c:\office_patch.exe hack
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "E:\Programy\Gadu-Gadu\gg.exe" /tray
O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe
O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare Software\bin\EasyShare.exe
O4 - Global Startup: Kodak software updater.lnk = C:\Program Files\Kodak\KODAK Software Updater\7288971\Program\Kodak Software Updater.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Pobierz z &BitSpirit - E:\Programy\BitSpirit\instalka\bsurl.htm
O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E4E68CD1-3FEF-440F-B06F-A0B844A8A6F4}: NameServer = 194.204.152.34 217.98.63.164
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - E:\Programy\Nod32\nod32krn.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe


-- Files created between 2007-03-29 and 2007-04-29 -----------------------------

2007-04-29 22:51:58 80 --a------ C:\WINDOWS\gmer_uninstall.cmd<GMER_U~1.CMD>
2007-04-28 21:12:30 0 d-------- C:\!KillBox
2007-04-28 18:58:41 298104 --a------ C:\WINDOWS\system32\imon.dll
2007-04-28 18:58:41 15424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys
2007-04-28 18:58:41 512096 --a------ C:\WINDOWS\system32\drivers\amon.sys
2007-04-28 18:37:45 33920 --a------ C:\WINDOWS\system32\drivers\oreans32.sys
2007-04-28 17:37:46 0 d-------- C:\Downloads<DOWNLO~1>
2007-04-28 17:32:48 0 d-------- C:\Program Files\Opera
2007-04-28 17:29:31 8262 --a------ C:\WINDOWS\unins000.dat
2007-04-24 16:46:15 0 d-------- C:\WINDOWS\ShellNew
2007-04-19 20:46:09 0 d-------- C:\WINDOWS\Profiles
2007-04-19 20:46:07 0 d-------- C:\Program Files\Common Files\Adobe
2007-04-19 07:38:36 0 d-------- C:\Program Files\MSXML 4.0<MSXML4~1.0>
2007-04-18 22:57:32 22752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-04-18 22:57:32 0 d-------- C:\WINDOWS\system32\PreInstall<PREINS~1>
2007-04-18 22:57:30 0 d--h----- C:\WINDOWS\$hf_mig$
2007-04-18 17:00:10 0 d-------- C:\WINDOWS\system32\SoftwareDistribution<SOFTWA~1>
2007-04-17 19:23:56 1581056 --a------ C:\WINDOWS\system32\mplvw7.dll
2007-04-17 19:23:56 1122304 --a------ C:\WINDOWS\system32\mplvpx.dll
2007-04-17 19:23:56 1552384 --a------ C:\WINDOWS\system32\mplvm6.dll
2007-04-17 19:23:56 1650688 --a------ C:\WINDOWS\system32\mplva6.dll
2007-04-17 19:23:56 77824 --a------ C:\WINDOWS\system32\mplaw7.dll
2007-04-17 19:23:56 65536 --a------ C:\WINDOWS\system32\mplapx.dll
2007-04-17 19:23:56 65536 --a------ C:\WINDOWS\system32\mplam6.dll
2007-04-17 19:23:56 77824 --a------ C:\WINDOWS\system32\mplaa6.dll
2007-04-17 19:23:56 19968 --a------ C:\WINDOWS\system32\cpuinf32.dll
2007-04-17 19:23:55 152064 --a------ C:\WINDOWS\system32\unrar.dll
2007-04-17 19:23:54 761856 --a------ C:\WINDOWS\system32\xvidcore.dll
2007-04-17 19:23:51 0 d-------- C:\Program Files\ACE Mega CoDecS Pack<ACEMEG~1>
2007-04-17 17:40:04 171280 --a------ C:\WINDOWS\system32\jit.dll
2007-04-17 17:40:04 139536 --a------ C:\WINDOWS\system32\javaee.dll
2007-04-17 17:40:04 313856 --a------ C:\WINDOWS\system32\dx3j.dll
2007-04-17 17:40:04 46352 --a------ C:\WINDOWS\setdebug.exe
2007-04-17 17:40:04 6550 --a------ C:\WINDOWS\jautoexp.dat
2007-04-17 17:39:59 113 --a------ C:\WINDOWS\system32\zonedon.reg
2007-04-17 17:39:59 113 --a------ C:\WINDOWS\system32\zonedoff.reg
2007-04-17 17:39:59 171792 --a------ C:\WINDOWS\system32\wjview.exe
2007-04-17 17:39:59 286992 --a------ C:\WINDOWS\system32\vmhelper.dll
2007-04-17 17:39:59 21264 --a------ C:\WINDOWS\system32\msjdbc10.dll
2007-04-17 17:39:58 947472 --a------ C:\WINDOWS\system32\msjava.dll
2007-04-17 17:39:58 154384 --a------ C:\WINDOWS\system32\msawt.dll
2007-04-17 17:39:58 172304 --a------ C:\WINDOWS\system32\jview.exe
2007-04-17 17:39:58 15120 --a------ C:\WINDOWS\system32\jdbgmgr.exe
2007-04-17 17:39:58 404752 --a------ C:\WINDOWS\system32\javart.dll
2007-04-17 17:39:58 63248 --a------ C:\WINDOWS\system32\javaprxy.dll
2007-04-17 17:39:58 187152 --a------ C:\WINDOWS\system32\javacypt.dll
2007-04-17 17:39:57 49424 --a------ C:\WINDOWS\system32\clspack.exe
2007-04-17 17:33:26 0 d-------- C:\Program Files\Google
2007-04-17 15:51:58 6400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2007-04-17 15:51:56 142464 --a------ C:\WINDOWS\system32\drivers\aec.sys
2007-04-17 15:51:55 54272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2007-04-17 15:51:54 2944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys
2007-04-17 15:51:52 52864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2007-04-17 15:51:50 4992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys
2007-04-17 15:51:48 82944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2007-04-17 15:51:46 7552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys
2007-04-17 15:51:45 172416 --a------ C:\WINDOWS\system32\drivers\kmixer.sys
2007-04-17 15:51:42 5376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2007-04-17 15:51:41 60800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2007-04-17 15:51:37 3072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2007-04-17 15:50:44 58624 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2007-04-17 15:50:21 931882 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys
2007-04-17 15:50:20 3539018 --a------ C:\WINDOWS\system32\nv4_disp.dll
2007-04-17 15:50:06 51200 --a------ C:\WINDOWS\system32\sfman32.dll
2007-04-17 15:50:06 495616 --a------ C:\WINDOWS\system32\sblfx.dll
2007-04-17 15:50:06 36480 --a------ C:\WINDOWS\system32\drivers\sfmanm.sys
2007-04-17 15:50:06 283904 --a------ C:\WINDOWS\system32\drivers\emu10k1m.sys
2007-04-17 15:50:06 6912 --a------ C:\WINDOWS\system32\drivers\ctlfacem.sys
2007-04-17 15:50:06 25600 --a------ C:\WINDOWS\system32\devldr32.exe
2007-04-17 15:50:06 352256 --a------ C:\WINDOWS\system32\devcon32.dll
2007-04-17 15:50:06 3584 --a------ C:\WINDOWS\system32\ctwdm32.dll
2007-04-17 15:50:05 4096 --a------ C:\WINDOWS\system32\ksuser.dll
2007-04-17 15:50:05 145792 --a------ C:\WINDOWS\system32\drivers\portcls.sys
2007-04-17 15:50:05 60288 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2007-04-17 15:50:03 3712 --a------ C:\WINDOWS\system32\drivers\ctljystk.sys
2007-04-17 15:49:54 27165 --a------ C:\WINDOWS\system32\drivers\fetnd5.sys
2007-04-17 15:49:51 77312 --a------ C:\WINDOWS\system32\usbui.dll
2007-04-17 15:49:45 44672 --a------ C:\WINDOWS\system32\drivers\UAGP35.SYS
2007-04-17 15:49:43 10624 --a------ C:\WINDOWS\system32\drivers\gameenum.sys
2007-04-17 15:48:28 0 d--hs---- C:\WINDOWS\Installer<INSTAL~1>
2007-04-17 15:48:27 0 d-------- C:\Program Files\Common Files\ODBC
2007-04-17 15:48:24 0 d-------- C:\Program Files\Common Files\SpeechEngines<SPEECH~1>
2007-04-17 15:48:23 0 dr------- C:\Program Files<PROGRA~1>
2007-04-17 15:48:19 6144 -ra------ C:\WINDOWS\system32\kbdtuq.dll
2007-04-17 15:48:19 6144 -ra------ C:\WINDOWS\system32\kbdtuf.dll
2007-04-17 15:48:19 5632 -ra------ C:\WINDOWS\system32\kbdazel.dll
2007-04-17 15:48:18 5632 -ra------ C:\WINDOWS\system32\kbdmon.dll
2007-04-17 15:48:18 5632 -ra------ C:\WINDOWS\system32\kbdkyr.dll
2007-04-17 15:48:16 8192 -ra------ C:\WINDOWS\system32\kbdhept.dll
2007-04-17 15:48:16 6656 -ra------ C:\WINDOWS\system32\kbdhela3.dll
2007-04-17 15:48:16 6144 -ra------ C:\WINDOWS\system32\kbdhela2.dll
2007-04-17 15:48:16 5632 -ra------ C:\WINDOWS\system32\kbdhe319.dll
2007-04-17 15:48:16 5632 -ra------ C:\WINDOWS\system32\kbdhe220.dll
2007-04-17 15:48:16 5632 -ra------ C:\WINDOWS\system32\kbdhe.dll
2007-04-17 15:48:16 6144 -ra------ C:\WINDOWS\system32\kbdgkl.dll
2007-04-17 15:48:14 6144 -ra------ C:\WINDOWS\system32\kbdlv1.dll
2007-04-17 15:48:14 6144 -ra------ C:\WINDOWS\system32\kbdlv.dll
2007-04-17 15:48:14 5632 -ra------ C:\WINDOWS\system32\kbdlt1.dll
2007-04-17 15:48:14 5632 -ra------ C:\WINDOWS\system32\kbdlt.dll
2007-04-17 15:48:14 6144 -ra------ C:\WINDOWS\system32\kbdest.dll
2007-04-17 15:48:11 6656 --a------ C:\WINDOWS\system32\kbdycl.dll
2007-04-17 15:48:11 6656 --a------ C:\WINDOWS\system32\kbdsl1.dll
2007-04-17 15:48:11 6656 --a------ C:\WINDOWS\system32\kbdsl.dll
2007-04-17 15:48:11 5632 --a------ C:\WINDOWS\system32\kbdro.dll
2007-04-17 15:48:11 5632 --a------ C:\WINDOWS\system32\kbdhu1.dll
2007-04-17 15:48:11 6656 --a------ C:\WINDOWS\system32\kbdhu.dll
2007-04-17 15:48:11 6656 --a------ C:\WINDOWS\system32\kbdcz2.dll
2007-04-17 15:48:11 6656 --a------ C:\WINDOWS\system32\kbdcz1.dll
2007-04-17 15:48:11 7168 --a------ C:\WINDOWS\system32\kbdcz.dll
2007-04-17 15:48:11 6656 --a------ C:\WINDOWS\system32\kbdcr.dll
2007-04-17 15:48:11 6656 --a------ C:\WINDOWS\system32\KBDAL.DLL
2007-04-17 15:48:10 13312 --a------ C:\WINDOWS\system32\irclass.dll
2007-04-17 15:48:10 85532 --a------ C:\WINDOWS\system32\dgsetup.dll
2007-04-17 15:48:10 176157 --a------ C:\WINDOWS\system32\dgrpsetu.dll
2007-04-17 15:48:09 24661 --a------ C:\WINDOWS\system32\spxcoins.dll
2007-04-17 15:48:09 103424 --a------ C:\WINDOWS\system32\EqnClass.Dll
2007-04-17 15:48:09 9168 --a------ C:\WINDOWS\system\VER.DLL
2007-04-17 15:48:09 19200 --a------ C:\WINDOWS\system\TAPI.DLL
2007-04-17 15:48:08 5120 --a------ C:\WINDOWS\system\SHELL.DLL
2007-04-17 15:48:08 24064 --a------ C:\WINDOWS\system\OLESVR.DLL
2007-04-17 15:48:08 83456 --a------ C:\WINDOWS\system\OLECLI.DLL
2007-04-17 15:48:08 127008 --a------ C:\WINDOWS\system\MSVIDEO.DLL
2007-04-17 15:48:08 9936 --a------ C:\WINDOWS\system\LZEXPAND.DLL
2007-04-17 15:48:08 33376 --a------ C:\WINDOWS\system\COMMDLG.DLL
2007-04-17 15:48:07 15360 --a------ C:\WINDOWS\TASKMAN.EXE
2007-04-17 15:48:07 11264 --a------ C:\WINDOWS\system32\drivers\irenum.sys
2007-04-17 15:48:07 8704 --a------ C:\WINDOWS\system32\batt.dll
2007-04-17 15:48:07 109488 --a------ C:\WINDOWS\system\AVIFILE.DLL
2007-04-17 15:48:07 70096 --a------ C:\WINDOWS\system\AVICAP.DLL
2007-04-17 15:48:06 69552 --a------ C:\WINDOWS\system\MMSYSTEM.DLL
2007-04-17 15:48:06 70144 --a------ C:\WINDOWS\NOTEPAD.EXE
2007-04-17 15:48:05 75776 --a------ C:\WINDOWS\system32\storprop.dll
2007-04-17 15:47:42 0 d-------- C:\WINDOWS\system32\CatRoot2
2007-04-17 15:47:42 0 d-------- C:\WINDOWS\system32\CatRoot
2007-04-17 15:47:15 0 d-------- C:\Documents and Settings<DOCUME~1>
2007-04-17 15:47:14 0 d--hs---- C:\System Volume Information<SYSTEM~1>
2007-04-17 15:42:07 0 d-------- C:\WINDOWS
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\WinSxS
2007-04-17 15:42:07 0 dr------- C:\WINDOWS\Web
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\twain_32
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\wins
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\wbem
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\usmt
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\spool
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\ShellExt
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\Setup
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\ras
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\oobe
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\npp
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\mui
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\inetsrv
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\IME
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\icsxml
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\ias
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\export
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\drivers
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\drivers\etc
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\drivers\disdn
2007-04-17 15:42:07 0 dr-hs--c- C:\WINDOWS\system32\dllcache
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\dhcp
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\config
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\3com_dmi
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\3076
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\2052
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\1054
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\1045
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\1042
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\1041
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\1037
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\1033
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\1031
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\1028
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system32\1025
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\system
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\security
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\Resources<RESOUR~1>
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\repair
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\Provisioning<PROVIS~1>
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\PeerNet
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\pchealth
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\mui
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\msapps
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\msagent
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\Media
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\java
2007-04-17 15:42:07 0 d--h----- C:\WINDOWS\inf
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\ime
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\Help
2007-04-17 15:42:07 0 dr--s---- C:\WINDOWS\Fonts
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\ehome
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\Driver Cache<DRIVER~1>
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\Debug
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\Cursors
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\Connection Wizard<CONNEC~1>
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\Config
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\AppPatch
2007-04-17 15:42:07 0 d-------- C:\WINDOWS\addins
2007-04-17 15:18:04 125184 -----n--- C:\WINDOWS\system32\drivers\imagesrv.sys
2007-04-17 15:18:04 5504 -----n--- C:\WINDOWS\system32\drivers\imagedrv.sys
2007-04-17 15:17:48 106496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2007-04-17 15:17:47 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe<NEROCH~1.EXE>
2007-04-17 15:17:47 471040 -----n--- C:\WINDOWS\system32\ImagXRA7.dll
2007-04-17 15:17:47 262144 -----n--- C:\WINDOWS\system32\ImagXR7.dll
2007-04-17 15:17:47 476320 -----n--- C:\WINDOWS\system32\ImagXpr7.dll
2007-04-17 15:17:47 1568768 -----n--- C:\WINDOWS\system32\ImagX7.dll
2007-04-17 15:17:46 0 d-------- C:\Program Files\Common Files\Ahead
2007-04-17 15:17:46 0 d-------- C:\Program Files\Ahead
2007-04-17 15:16:29 0 d-------- C:\WINDOWS\system32\appmgmt
2007-04-17 15:13:29 221184 --a------ C:\WINDOWS\system32\wmpns.dll
2007-04-17 15:13:12 0 d-------- C:\WINDOWS\RegisteredPackages<REGIST~2>
2007-04-17 15:10:27 11776 -ra------ C:\office_patch.exe<OFFICE~1.EXE>
2007-04-17 14:57:24 0 d-------- C:\Program Files\Gadu-Gadu<GADU-G~1>
2007-04-17 14:54:19 86016 --a------ C:\WINDOWS\unvise32qt.exe<UNVISE~1.EXE>
2007-04-17 14:54:13 0 d-------- C:\WINDOWS\system32\QuickTime<QUICKT~1>
2007-04-17 14:54:13 0 d-------- C:\Program Files\QuickTime<QUICKT~1>
2007-04-17 14:53:57 0 d-------- C:\WINDOWS\system32\BWKDLogs
2007-04-17 14:53:43 0 d-------- C:\Program Files\Common Files\Kodak
2007-04-17 14:53:36 0 d-------- C:\KPCMS
2007-04-17 14:53:34 0 d-------- C:\WINDOWS\system32\color
2007-04-17 14:51:47 0 d-------- C:\Program Files\Kodak
2007-04-17 14:50:33 163840 --a------ C:\WINDOWS\BJPSUNST.EXE
2007-04-17 14:50:05 348160 --a------ C:\WINDOWS\system32\msvcr71.dll
2007-04-17 14:50:05 499712 --a------ C:\WINDOWS\system32\msvcp71.dll
2007-04-17 14:50:05 1060864 --a------ C:\WINDOWS\system32\MFC71.dll
2007-04-17 14:48:25 25856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
2007-04-17 14:44:08 7680 --a------ C:\WINDOWS\system32\CNMVS6e.DLL
2007-04-17 14:44:08 116736 --a------ C:\WINDOWS\system32\CNMLM6e.DLL
2007-04-17 14:44:03 86016 -ra------ C:\WINDOWS\system32\CNMCP6e.exe
2007-04-17 14:43:52 0 d--h----- C:\BJPrinter<BJPRIN~1>
2007-04-17 14:43:38 0 d-------- C:\WINDOWS\StartHtmico<STARTH~1>
2007-04-17 14:43:38 0 d-------- C:\WINDOWS\IP1000
2007-04-17 14:42:53 0 d-------- C:\Program Files\Canon
2007-04-17 14:28:24 32768 --a------ C:\WINDOWS\system32\WooDial2000.dll<WOODIA~1.DLL>
2007-04-17 14:27:25 127456 --a------ C:\WINDOWS\system32\ipdetect.exe
2007-04-17 14:27:25 127065 --a------ C:\WINDOWS\system32\drivers\adiusbaw.sys
2007-04-17 14:27:25 155648 --a------ C:\WINDOWS\system32\adadix32.dll
2007-04-17 14:27:24 126976 --a------ C:\WINDOWS\system32\coclassfast.dll<COCLAS~1.DLL>
2007-04-17 14:27:23 114688 --a------ C:\WINDOWS\system32\unaddrv.exe
2007-04-17 14:27:23 50007 --a------ C:\WINDOWS\system32\drivers\adildr.sys
2007-04-17 14:27:23 4981 --a------ C:\WINDOWS\system32\adadix2k.dll
2007-04-17 14:27:23 46892 --a------ C:\WINDOWS\system32\adadix16.dll
2007-04-17 14:27:19 0 d-------- C:\Program Files\SAGEM
2007-04-17 14:27:06 0 d-------- C:\Program Files\Java Web Start<JAVAWE~1>
2007-04-17 14:26:59 41068 -----n--- C:\WINDOWS\system32\ActPanel.dll
2007-04-17 14:26:59 0 d-------- C:\Program Files\Java
2007-04-17 14:26:59 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-04-17 14:26:01 0 d-------- C:\Program Files\Neostrada TP<NEOSTR~1>
2007-04-17 14:25:44 0 d--hs---- C:\WINDOWS\ftpcache
2007-04-17 14:22:27 41984 --a------ C:\WINDOWS\CTREGRUN.EXE
2007-04-17 14:21:52 90112 --a------ C:\WINDOWS\Updreg.exe
2007-04-17 14:21:44 36992 --a------ C:\WINDOWS\system32\drivers\sfman.sys
2007-04-17 14:21:44 775296 --a------ C:\WINDOWS\system32\drivers\emu10k1f.sys
2007-04-17 14:21:43 6912 --a------ C:\WINDOWS\system32\drivers\ctlface.sys
2007-04-17 14:21:43 59392 --a------ C:\WINDOWS\system32\a3d.dll
2007-04-17 14:20:30 1048576 -----n--- C:\WINDOWS\system32\sfman.dat
2007-04-17 14:20:30 84992 -----n--- C:\WINDOWS\system32\sfcvrt32.dll
2007-04-17 14:20:30 108032 -----n--- C:\WINDOWS\system32\mfcuia32.dll
2007-04-17 14:20:30 149504 -----n--- C:\WINDOWS\system32\mfcans32.dll
2007-04-17 14:20:30 82432 -----n--- C:\WINDOWS\system32\Ctwflt32.dll
2007-04-17 14:20:30 26768 -----n--- C:\WINDOWS\system32\ctl3d.dll
2007-04-17 14:20:30 34816 -----n--- C:\WINDOWS\CTRes32.dll
2007-04-17 14:20:30 24976 -----n--- C:\WINDOWS\ctres.dll
2007-04-17 14:20:29 53552 -----n--- C:\WINDOWS\ctccw.dll
2007-04-17 14:18:56 3584 --a------ C:\WINDOWS\system32\Ahqcpres.dll
2007-04-17 14:18:31 0 d-------- C:\Media
2007-04-17 14:18:30 25088 --a------ C:\WINDOWS\system32\CTSVCCTL.EXE
2007-04-17 14:18:30 44032 --a------ C:\WINDOWS\system32\CTSVCCDA.EXE
2007-04-17 14:18:00 54784 -----n--- C:\WINDOWS\system32\Inetwh32.dll
2007-04-17 14:18:00 307200 -----n--- C:\WINDOWS\system32\CtMp3Lib.dll
2007-04-17 14:18:00 110592 -----n--- C:\WINDOWS\system32\ctmp3io2.dll
2007-04-17 14:18:00 24576 -----n--- C:\WINDOWS\system32\CTMERes.DLL
2007-04-17 14:18:00 393216 -----n--- C:\WINDOWS\system32\CTMedEng.dll
2007-04-17 14:18:00 28672 -----n--- C:\WINDOWS\system32\CTIntRes.dll
2007-04-17 14:18:00 155648 -----n--- C:\WINDOWS\system32\CTDrmUI.dll
2007-04-17 14:18:00 73728 -----n--- C:\WINDOWS\system32\CTDrmRes.dll
2007-04-17 14:18:00 57856 -----n--- C:\WINDOWS\system32\CTDETRES.DLL
2007-04-17 14:17:12 6752 -----n--- C:\WINDOWS\system32\PfModNT.sys
2007-04-17 14:17:12 0 d-------- C:\Program Files\Creative
2007-04-17 14:17:11 306688 --a------ C:\WINDOWS\IsUninst.exe
2007-04-17 14:10:05 0 d-------- C:\WINDOWS\nview
2007-04-17 14:10:02 0 d-------- C:\WINDOWS\system32\ReinstallBackups<REINST~1>
2007-04-17 14:09:57 0 d-------- C:\Program Files\Common Files\InstallShield<INSTAL~1>
2007-04-17 14:04:47 0 d-------- C:\WINDOWS\SoftwareDistribution<SOFTWA~1>
2007-04-17 14:04:45 0 d-------- C:\WINDOWS\Prefetch
2007-04-17 14:00:37 0 d-------- C:\WINDOWS\system32\xircom
2007-04-17 14:00:37 0 d-------- C:\Program Files\microsoft frontpage<MICROS~1>
2007-04-17 14:00:11 0 -rahs---- C:\MSDOS.SYS
2007-04-17 14:00:11 0 -rahs---- C:\IO.SYS
2007-04-17 14:00:11 0 --a------ C:\CONFIG.SYS
2007-04-17 14:00:11 0 --a------ C:\AUTOEXEC.BAT
2007-04-17 13:59:44 112128 --a------ C:\WINDOWS\system32\mapi32.dll
2007-04-17 13:58:45 0 dr------- C:\WINDOWS\Offline Web Pages<OFFLIN~1>
2007-04-17 13:58:45 0 d---s---- C:\WINDOWS\Downloaded Program Files<DOWNLO~1>
2007-04-17 13:58:32 0 d--h----- C:\Program Files\WindowsUpdate<WINDOW~3>
2007-04-17 13:58:28 0 d-------- C:\Program Files\Usługi online<USUGIO~1>
2007-04-17 13:58:11 0 d-------- C:\WINDOWS\system32\DirectX
2007-04-17 13:57:51 11264 --a------ C:\WINDOWS\system32\atrace.dll
2007-04-17 13:57:41 12288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2007-04-17 13:57:40 67584 --a------ C:\WINDOWS\system32\acctres.dll
2007-04-17 13:57:36 0 d---s---- C:\WINDOWS\Tasks
2007-04-17 13:57:36 16384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2007-04-17 13:57:35 0 d-------- C:\Program Files\Common Files\MSSoap
2007-04-17 13:57:31 0 d-------- C:\WINDOWS\srchasst
2007-04-17 13:57:30 0 d-------- C:\WINDOWS\system32\Macromed
2007-04-17 13:57:28 173536 --a------ C:\WINDOWS\system32\wuweb.dll
2007-04-17 13:57:28 128280 --a------ C:\WINDOWS\system32\wucltui.dll
2007-04-17 13:57:27 41240 --a------ C:\WINDOWS\system32\wups.dll
2007-04-17 13:57:27 6656 --a------ C:\WINDOWS\system32\wuauserv.dll
2007-04-17 13:57:27 195352 --a------ C:\WINDOWS\system32\wuaueng1.dll
2007-04-17 13:57:27 1343768 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-04-17 13:57:27 175384 --a------ C:\WINDOWS\system32\wuauclt1.exe
2007-04-17 13:57:27 125208 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-04-17 13:57:27 466200 --a------ C:\WINDOWS\system32\wuapi.dll
2007-04-17 13:57:26 18944 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2007-04-17 13:57:26 382464 --a------ C:\WINDOWS\system32\qmgr.dll
2007-04-17 13:57:26 7168 --a------ C:\WINDOWS\system32\bitsprx3.dll
2007-04-17 13:57:26 8192 --a------ C:\WINDOWS\system32\bitsprx2.dll
2007-04-17 13:57:23 0 d-------- C:\Program Files\Movie Maker<MOVIEM~1>
2007-04-17 13:57:19 45568 --a------ C:\WINDOWS\system32\safrslv.dll
2007-04-17 13:57:19 29696 --a------ C:\WINDOWS\system32\safrdm.dll
2007-04-17 13:57:19 43520 --a------ C:\WINDOWS\system32\safrcdlg.dll
2007-04-17 13:57:19 43520 --a------ C:\WINDOWS\system32\racpldlg.dll
2007-04-17 13:57:16 23040 --a------ C:\WINDOWS\system32\fltmc.exe
2007-04-17 13:57:16 16896 --a------ C:\WINDOWS\system32\fltlib.dll
2007-04-17 13:57:15 171008 --a------ C:\WINDOWS\system32\srsvc.dll
2007-04-17 13:57:15 240128 --a------ C:\WINDOWS\system32\srrstr.dll
2007-04-17 13:57:15 67584 --a------ C:\WINDOWS\system32\srclient.dll
2007-04-17 13:57:15 0 d-------- C:\WINDOWS\system32\Restore
2007-04-17 13:57:15 73472 --a------ C:\WINDOWS\system32\drivers\sr.sys
2007-04-17 13:57:15 128896 --a------ C:\WINDOWS\system32\drivers\fltmgr.sys
2007-04-17 13:57:14 28672 --a------ C:\WINDOWS\system32\nmmkcert.dll
2007-04-17 13:57:14 34560 --a------ C:\WINDOWS\system32\mnmdd.dll
2007-04-17 13:57:14 32768 --a------ C:\WINDOWS\system32\isrdbg32.dll
2007-04-17 13:57:14 81920 --a------ C:\WINDOWS\system32\ils.dll
2007-04-17 13:57:13 69632 --a------ C:\WINDOWS\system32\msconf.dll
2007-04-17 13:57:13 32768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2007-04-17 13:57:11 105984 --a------ C:\WINDOWS\system32\msoert2.dll
2007-04-17 13:57:11 252928 --a------ C:\WINDOWS\system32\msoeacct.dll
2007-04-17 13:57:09 49664 --a------ C:\WINDOWS\system32\inetres.dll
2007-04-17 13:57:09 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2007-04-17 13:57:05 192000 --a------ C:\WINDOWS\system32\schedsvc.dll
2007-04-17 13:57:05 12288 --a------ C:\WINDOWS\system32\mstinit.exe
2007-04-17 13:57:05 278528 --a------ C:\WINDOWS\system32\mstask.dll
2007-04-17 13:57:05 65536 --a------ C:\WINDOWS\system32\icwphbk.dll
2007-04-17 13:57:05 73728 --a------ C:\WINDOWS\system32\icwdial.dll
2007-04-17 13:57:04 86016 --a------ C:\WINDOWS\system32\isign32.dll
2007-04-17 13:57:04 278528 --a------ C:\WINDOWS\system32\inetcfg.dll
2007-04-17 13:56:22 21856 --a------ C:\WINDOWS\system32\emptyregdb.dat<EMPTYR~1.DAT>
2007-04-17 13:56:06 0 d-------- C:\WINDOWS\Registration<REGIST~1>
2007-04-17 13:55:52 0 d-------- C:\Program Files\Messenger<MESSEN~1>
2007-04-17 13:55:48 5632 --a------ C:\WINDOWS\system32\write.exe
2007-04-17 13:55:48 0 d-------- C:\Program Files\MSN Gaming Zone<MSNGAM~1>
2007-04-17 13:55:39 139264 --a------ C:\WINDOWS\system32\sndvol32.exe
2007-04-17 13:55:39 44544 --a------ C:\WINDOWS\system32\hticons.dll
2007-04-17 13:55:39 73216 --a------ C:\WINDOWS\system32\avwav.dll
2007-04-17 13:55:39 231424 --a------ C:\WINDOWS\system32\avtapi.dll
2007-04-17 13:55:39 16384 --a------ C:\WINDOWS\system32\avmeter.dll
2007-04-17 13:55:38 35328 --a------ C:\WINDOWS\system32\winchat.exe
2007-04-17 13:55:32 605696 --a------ C:\WINDOWS\system32\getuname.dll
2007-04-17 13:55:31 57344 --a------ C:\WINDOWS\system32\sol.exe
2007-04-17 13:55:31 80896 --a------ C:\WINDOWS\system32\charmap.exe
2007-04-17 13:55:31 115200 --a------ C:\WINDOWS\system32\calc.exe
2007-04-17 13:55:30 119808 --a------ C:\WINDOWS\system32\winmine.exe
2007-04-17 13:55:30 1225 --a------ C:\WINDOWS\system32\usrlogon.cmd
2007-04-17 13:55:30 16384 --a------ C:\WINDOWS\system32\tskill.exe
2007-04-17 13:55:30 9728 --a------ C:\WINDOWS\system32\reset.exe
2007-04-17 13:55:30 128000 --a------ C:\WINDOWS\system32\mshearts.exe
2007-04-17 13:55:30 55808 --a------ C:\WINDOWS\system32\freecell.exe
2007-04-17 13:55:29 17920 --a------ C:\WINDOWS\system32\tsshutdn.exe
2007-04-17 13:55:29 15360 --a------ C:\WINDOWS\system32\tsdiscon.exe
2007-04-17 13:55:29 15360 --a------ C:\WINDOWS\system32\tscon.exe
2007-04-17 13:55:29 15360 --a------ C:\WINDOWS\system32\shadow.exe
2007-04-17 13:55:29 16384 --a------ C:\WINDOWS\system32\rwinsta.exe
2007-04-17 13:55:29 33792 --a------ C:\WINDOWS\system32\regini.exe
2007-04-17 13:55:29 4608 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2007-04-17 13:55:29 22528 --a------ C:\WINDOWS\system32\qwinsta.exe
2007-04-17 13:55:29 17408 --a------ C:\WINDOWS\system32\qappsrv.exe
2007-04-17 13:55:29 22528 --a------ C:\WINDOWS\system32\msg.exe
2007-04-17 13:55:29 15872 --a------ C:\WINDOWS\system32\logoff.exe
2007-04-17 13:55:28 15872 --a------ C:\WINDOWS\system32\cdmodem.dll
2007-04-17 13:55:27 54272 --a------ C:\WINDOWS\system32\stclient.dll
2007-04-17 13:55:27 25088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2007-04-17 13:55:27 4096 --a------ C:\WINDOWS\system32\mtxex.dll
2007-04-17 13:55:27 20480 --a------ C:\WINDOWS\system32\mtxdm.dll
2007-04-17 13:55:27 5120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2007-04-17 13:55:27 147456 --a------ C:\WINDOWS\system32\comsnap.dll
2007-04-17 13:55:27 97792 --a------ C:\WINDOWS\system32\comrepl.dll
2007-04-17 13:55:27 25600 --a------ C:\WINDOWS\system32\comaddin.dll
2007-04-17 13:55:20 132608 --a------ C:\WINDOWS\system32\sndrec32.exe
2007-04-17 13:55:20 124928 --a------ C:\WINDOWS\system32\mplay32.exe
2007-04-17 13:55:20 351744 --a------ C:\WINDOWS\system32\hypertrm.dll
2007-04-17 13:55:20 187904 --a------ C:\WINDOWS\system32\accwiz.exe
2007-04-17 13:55:19 345088 --a------ C:\WINDOWS\system32\mspaint.exe
2007-04-17 13:55:19 103424 --a------ C:\WINDOWS\system32\clipbrd.exe
2007-04-17 13:55:19 0 d-------- C:\Program Files\Windows NT<WINDOW~1>
2007-04-17 13:55:18 94720 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2007-04-17 13:55:18 539136 --a------ C:\WINDOWS\system32\spider.exe
2007-04-17 13:55:18 655360 --a------ C:\WINDOWS\system32\mstscax.dll
2007-04-17 13:55:18 408576 --a------ C:\WINDOWS\system32\mstsc.exe
2007-04-17 13:55:18 21896 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys
2007-04-17 13:55:18 12040 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys
2007-04-17 13:55:18 139528 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys
2007-04-17 13:55:17 44544 --a------ C:\WINDOWS\system32\tscupgrd.exe
2007-04-17 13:55:17 296448 --a------ C:\WINDOWS\system32\termsrv.dll
2007-04-17 13:55:17 141824 --a------ C:\WINDOWS\system32\sessmgr.exe
2007-04-17 13:55:17 60928 --a------ C:\WINDOWS\system32\remotepg.dll
2007-04-17 13:55:17 67072 --a------ C:\WINDOWS\system32\rdshost.exe
2007-04-17 13:55:17 13824 --a------ C:\WINDOWS\system32\rdsaddin.exe
2007-04-17 13:55:17 87176 --a------ C:\WINDOWS\system32\rdpwsx.dll
2007-04-17 13:55:17 19968 --a------ C:\WINDOWS\system32\rdpsnd.dll
2007-04-17 13:55:17 62464 --a------ C:\WINDOWS\system32\rdpclip.exe
2007-04-17 13:55:17 147968 --a------ C:\WINDOWS\system32\rdchost.dll
2007-04-17 13:55:17 20992 --a------ C:\WINDOWS\system32\qprocess.exe
2007-04-17 13:55:16 91136 --a------ C:\WINDOWS\system32\mtxoci.dll
2007-04-17 13:55:16 161280 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2007-04-17 13:55:16 956416 --a------ C:\WINDOWS\system32\msdtctm.dll
2007-04-17 13:55:16 426496 --a------ C:\WINDOWS\system32\msdtcprx.dll
2007-04-17 13:55:16 0 d-------- C:\WINDOWS\system32\MsDtc
2007-04-17 13:55:16 11264 --a------ C:\WINDOWS\system32\icaapi.dll
2007-04-17 13:55:16 38912 --a------ C:\WINDOWS\system32\cfgbkend.dll
2007-04-17 13:55:15 11776 --a------ C:\WINDOWS\system32\xolehlp.dll
2007-04-17 13:55:15 58880 --a------ C:\WINDOWS\system32\msdtclog.dll
2007-04-17 13:55:15 6144 --a------ C:\WINDOWS\system32\msdtc.exe
2007-04-17 13:55:14 0 d-------- C:\WINDOWS\system32\Com
2007-04-17 13:55:14 60416 --a------ C:\WINDOWS\system32\colbact.dll
2007-04-17 13:55:14 110080 --a------ C:\WINDOWS\system32\clbcatex.dll
2007-04-17 13:55:14 625152 --a------ C:\WINDOWS\system32\catsrvut.dll
2007-04-17 13:55:14 85504 --a------ C:\WINDOWS\system32\catsrvps.dll
2007-04-17 13:55:14 225792 --a------ C:\WINDOWS\system32\catsrv.dll
2007-04-17 13:55:13 540160 --a------ C:\WINDOWS\system32\comuid.dll
2007-04-17 13:55:13 1267200 --a------ C:\WINDOWS\system32\comsvcs.dll
2007-04-17 13:55:13 498688 --a------ C:\WINDOWS\system32\clbcatq.dll
2007-04-17 13:55:07 56320 --a------ C:\WINDOWS\system32\servdeps.dll
2007-04-17 13:55:07 17920 --a------ C:\WINDOWS\system32\mmfutil.dll
2007-04-17 13:55:07 58880 --a------ C:\WINDOWS\system32\licwmi.dll
2007-04-17 13:55:06 187904 --a------ C:\WINDOWS\system32\cmprops.dll
2007-04-17 13:55:03 196864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys
2007-04-17 13:55:02 40840 --a------ C:\WINDOWS\system32\drivers\termdd.sys


-- Find3M Report ---------------------------------------------------------------

2007-04-29 12:03:32 0 d---s---- C:\Documents and Settings\Paweł\Dane aplikacji\Microsoft<MICROS~1>
2007-04-28 17:35:23 0 d-------- C:\Documents and Settings\Paweł\Dane aplikacji\Opera
2007-04-28 17:33:42 0 d-------- C:\Documents and Settings\Paweł\Dane aplikacji\Macromedia<MACROM~1>
2007-04-28 17:29:32 75791 --a------ C:\WINDOWS\unins000.exe
2007-04-28 17:18:32 0 d-------- C:\Documents and Settings\Paweł\Dane aplikacji\Google
2007-04-26 09:45:14 0 d-------- C:\Documents and Settings\Paweł\Dane aplikacji\Identities<IDENTI~1>
2007-04-19 07:38:17 355486 --a------ C:\WINDOWS\system32\perfh015.dat
2007-04-19 07:38:17 49492 --a------ C:\WINDOWS\system32\perfc015.dat
2007-04-17 15:47:56 62 --ahs---- C:\Documents and Settings\Paweł\Dane aplikacji\desktop.ini
2007-03-17 15:45:36 293376 --a------ C:\WINDOWS\system32\winsrv.dll
2007-03-08 17:38:47 579072 --a------ C:\WINDOWS\system32\user32.dll
2007-03-08 17:38:47 40960 --a------ C:\WINDOWS\system32\mf3216.dll
2007-03-08 17:38:47 281600 --a------ C:\WINDOWS\system32\gdi32.dll
2007-03-08 17:37:33 1843840 --a------ C:\WINDOWS\system32\win32k.sys
2007-02-05 22:19:48 185856 --a------ C:\WINDOWS\system32\upnphost.dll
2007-01-29 10:58:06 60416 -----n--- C:\WINDOWS\system32\tzchange.exe


-- Registry Dump ---------------------------------------------------------------


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"Gadu-Gadu"="\"E:\\Programy\\Gadu-Gadu\\gg.exe\" /tray"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"NvCplDaemon"="RUNDLL32.EXE NvQTwk,NvCplDaemon initialize"
"nwiz"="nwiz.exe /install"
"UpdReg"="C:\\WINDOWS\\Updreg.exe"
"AHQInit"="C:\\Program Files\\Creative\\SBLive\\Program\\AHQInit.exe"
"AudioHQ"="C:\\Program Files\\Creative\\SBLive\\AudioHQ\\AHQTB.EXE"
"WooCnxMon"="C:\\PROGRA~1\\NEOSTR~1\\CnxMon.exe"
"autoclk"="autoclk.exe"
"WOOWATCH"="C:\\PROGRA~1\\NEOSTR~1\\Watch.exe"
"WOOTASKBARICON"="C:\\PROGRA~1\\NEOSTR~1\\TaskbarIcon.exe"
"adiras"="adiras.exe"
"Easy-PrintToolBox"="C:\\Program Files\\Canon\\Easy-PrintToolBox\\BJPSMAIN.EXE /logon"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"DAEMON Tools-1033"="\"E:\\Programy\\Deamon tools\\daemon.exe\" -lang 1033"
"nod32kui"="\"E:\\Programy\\Nod32\\nod32kui.exe\" /WAITSERVICE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runonceex]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\runservices]
"Office XP hack"="c:\\office_patch.exe hack"


[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ HTTPFilter\0\0
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0



-- End of ComboScan: finished at 2007-04-29 at 23:04:49 ------------------------

[wojtas]

skasuj:

C:\!KillBox

i bedzie ok

Autor postu otrzymał pochwałę

[Bergmann]

C:\!KillBox

usunięte. Dzięki za pomoc