duuużo problemów

[zielona]

Od pewnego czasu komputer wariuje. Ciągle są jakieś wirusy, których usunięcie nie usuwa problemów. Kerio pokazuje ciągle komunikat: "próba ataku zablokowana". Komp się stale wiesza. Co jakiś czas pojawia sie niebieski ekran i zrzucanie pamięci na dysk (do niego doszło dziś jakieś głośne warczenie). Czasami jest stack overflow. Ustawienia giną. Strony nie chcą się wyświetlać. Nie mogę odinstalować Spyware doctora. Daję więc logi i błagam o pomoc!

ComboFix 08-07-14.2 - xp 2008-07-14 23:25:26.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.139 [GMT 2:00]
Running from: C:\Program Files\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Recycled\Recycled
C:\WINDOWS\system32\acleditf.exe
C:\WINDOWS\system32\mdm.exe
C:\WINDOWS\system32\ps1.dat
C:\WINDOWS\system32\rc.dat

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_MSISERVERVSS
-------\Service_MSIServerVSS


((((((((((((((((((((((((( Files Created from 2008-06-14 to 2008-07-14 )))))))))))))))))))))))))))))))
.

2008-07-14 23:23 . 2008-07-14 23:23 2,613,152 --a------ C:\Program Files\ComboFix.exe
2008-07-02 15:50 . 2008-07-02 15:50 45,056 --a------ C:\WINDOWS\system32\jzcom32.dll
2008-07-02 15:50 . 2008-07-02 15:54 2,733 --a------ C:\WINDOWS\system32\sklh.dat
2008-07-02 15:50 . 2008-07-04 08:30 32 --a-s---- C:\WINDOWS\system32\2168961456.dat
2008-06-18 20:36 . 2008-06-18 20:36 <DIR> d-------- C:\Documents and Settings\xp\PressService
2008-06-18 20:35 . 2008-06-18 20:35 881,896 --a------ C:\Program Files\cafenews.exe
2008-06-17 23:16 . 2008-07-14 12:16 <DIR> d-------- C:\Documents and Settings\xp\Dane aplikacji\skypePM
2008-06-17 23:16 . 2008-06-17 23:16 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-06-17 23:10 . 2008-06-17 23:10 <DIR> d-------- C:\Program Files\Skype
2008-06-17 23:10 . 2008-06-17 23:10 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-06-17 23:10 . 2008-07-14 12:17 <DIR> d-------- C:\Documents and Settings\xp\Dane aplikacji\Skype
2008-06-17 23:09 . 2008-06-17 23:10 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-06-17 23:08 . 2008-06-17 23:08 22,411,048 --a------ C:\Program Files\SkypeSetup.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-14 19:04 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-07-14 15:14 --------- d-----w C:\Documents and Settings\xp\Dane aplikacji\OpenOffice.ux.pl2
2008-07-14 10:03 --------- d-----w C:\Program Files\Spyware Doctor
2008-05-01 15:56 50,688 ----a-w C:\Program Files\ATF-Cleaner.exe
2008-05-01 10:11 812,344 ----a-w C:\Program Files\HJTInstall.exe
2008-05-01 10:11 401,720 ----a-w C:\Program Files\HiJackThis.exe
2008-05-01 10:11 318,369 ----a-w C:\Program Files\HiJackThis.zip
2008-01-03 16:48 6,575,800 ----a-w C:\Program Files\Sunbelt-Personal-Firewall.exe
2007-11-21 19:14 38,899 ----a-w C:\Program Files\SeconfigXP.zip
2007-11-21 18:51 51,232 ----a-w C:\Program Files\wwdc.exe
2007-11-19 20:57 15,374,248 ----a-w C:\Program Files\sdstart.exe
2007-11-19 20:17 5,361,888 ----a-w C:\Program Files\kerio.exe
2007-11-16 12:52 7,037,304 ----a-w C:\Program Files\DjVuBrowserPlugin.exe
2007-11-05 15:39 4,346,704 ----a-w C:\Program Files\gg77.exe
2007-02-15 03:51 56 --sh--r C:\WINDOWS\system32\59C80DF989.sys
2007-02-15 03:51 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

------- Sigcheck -------

2004-08-03 23:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\system32\dllcache\tcpip.sys
2004-08-03 23:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 01:55 1667584]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-14 21:33 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-08-24 00:22 110592]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-04-27 20:48 7561216]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-04-27 20:48 86016]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-10-22 00:26 761945]
"Wireless Console 2"="C:\Program Files\Wireless Console 2\wcourier.exe" [2005-10-17 18:09 987136]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-11-02 18:24 1065800]
"nwiz"="nwiz.exe" [2006-04-27 20:48 1519616 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-12 18:58 16264192 C:\WINDOWS\RTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [2006-05-16 20:04 2879488 C:\WINDOWS\SkyTel.exe]
"SMSERIAL"="sm56hlpr.exe" [2006-01-20 22:34 544768 C:\WINDOWS\sm56hlpr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2007-02-15 06:06:48 278528]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.xvid"= xvid.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\InterVideo\\DVD7\\WinDVD.exe"=
"C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 11:21]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 11:21]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 SPF4;Sunbelt Personal Firewall 4;C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe [2007-04-26 11:21]
R3 ASNDIS5;ASNDIS5 Protocol Driver;C:\WINDOWS\system32\ASNDIS5.SYS [2002-09-09 20:54]
R3 SynMini;USB2.0 1.3M Web Cam;C:\WINDOWS\system32\Drivers\SynMini.sys [2005-10-03 11:26]
R3 SynScan;USB2.0 1.3M Web Cam Still Image;C:\WINDOWS\system32\Drivers\SynScan.sys [2005-10-03 11:26]

.
- - - - ORPHANS REMOVED - - - -

HKLM-Run-CafeNews - C:\Program Files\CafeNews\CN.exe


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-14 23:32:07
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


C:\ComboFix\CreateC00
C:\ComboFix\CreateC00.bat

scan completed successfully
hidden files: 2

**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
.
**************************************************************************
.
Completion time: 2008-07-14 23:35:12 - machine was rebooted
ComboFix-quarantined-files.txt 2008-07-14 21:34:53

Pre-Run: 20,152,152,064 bajtów wolnych
Post-Run: 20,174,798,848 bajt˘w wolnych

135

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:43:42, on 2008-07-14
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Wireless Console 2\wcourier.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://slimak.onet.pl/_m/wirusy/ArcaOnline.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

--
End of file - 6330 bytes

[Magik]

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

+
to
http://forum.programosy.pl/program-szukajacy-trojanow-i-malware-vt97108.html

[zielona]

nie mogę pobrać SDFixa - ta strona nie otwiera mi się pomimo kilku prób

[ Dodano: Dzisiaj o 8:44 ]
dziś program się otworzył daję nowe logi

ComboFix 08-07-14.2 - xp 2008-07-15 9:29:56.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.116 [GMT 2:00]
Running from: C:\Program Files\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-06-15 to 2008-07-15 )))))))))))))))))))))))))))))))
.

2008-07-15 08:54 . 2008-07-15 09:24 <DIR> d-------- C:\SDFix
2008-07-15 08:53 . 2008-07-15 08:54 1,444,357 --a------ C:\Program Files\SDFix.exe
2008-07-14 23:23 . 2008-07-14 23:23 2,613,152 --a------ C:\Program Files\ComboFix.exe
2008-07-02 15:50 . 2008-07-04 08:30 32 --a-s---- C:\WINDOWS\system32\2168961456.dat
2008-06-18 20:36 . 2008-06-18 20:36 <DIR> d-------- C:\Documents and Settings\xp\PressService
2008-06-18 20:35 . 2008-06-18 20:35 881,896 --a------ C:\Program Files\cafenews.exe
2008-06-17 23:16 . 2008-07-14 12:16 <DIR> d-------- C:\Documents and Settings\xp\Dane aplikacji\skypePM
2008-06-17 23:16 . 2008-06-17 23:16 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-06-17 23:10 . 2008-06-17 23:10 <DIR> d-------- C:\Program Files\Skype
2008-06-17 23:10 . 2008-06-17 23:10 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-06-17 23:10 . 2008-07-14 12:17 <DIR> d-------- C:\Documents and Settings\xp\Dane aplikacji\Skype
2008-06-17 23:09 . 2008-06-17 23:10 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-06-17 23:08 . 2008-06-17 23:08 22,411,048 --a------ C:\Program Files\SkypeSetup.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-15 07:13 330 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
2008-07-14 21:47 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-07-14 15:14 --------- d-----w C:\Documents and Settings\xp\Dane aplikacji\OpenOffice.ux.pl2
2008-07-14 10:03 --------- d-----w C:\Program Files\Spyware Doctor
2008-05-01 15:56 50,688 ----a-w C:\Program Files\ATF-Cleaner.exe
2008-05-01 10:11 812,344 ----a-w C:\Program Files\HJTInstall.exe
2008-05-01 10:11 401,720 ----a-w C:\Program Files\HiJackThis.exe
2008-05-01 10:11 318,369 ----a-w C:\Program Files\HiJackThis.zip
2008-01-03 16:48 6,575,800 ----a-w C:\Program Files\Sunbelt-Personal-Firewall.exe
2007-11-21 19:14 38,899 ----a-w C:\Program Files\SeconfigXP.zip
2007-11-21 18:51 51,232 ----a-w C:\Program Files\wwdc.exe
2007-11-19 20:57 15,374,248 ----a-w C:\Program Files\sdstart.exe
2007-11-19 20:17 5,361,888 ----a-w C:\Program Files\kerio.exe
2007-11-16 12:52 7,037,304 ----a-w C:\Program Files\DjVuBrowserPlugin.exe
2007-11-05 15:39 4,346,704 ----a-w C:\Program Files\gg77.exe
2007-02-15 03:51 56 --sh--r C:\WINDOWS\system32\59C80DF989.sys
2007-02-15 03:51 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

------- Sigcheck -------

2004-08-03 23:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\system32\dllcache\tcpip.sys
2004-08-03 23:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((( snapshot@2008-07-14_23.33.51.90 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-07-13 04:11:01 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
- 2007-11-19 15:56:39 2,961,408 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\ntuser.dat
+ 2008-07-15 07:17:33 3,342,336 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\ntuser.dat
- 2007-11-19 15:56:39 147,456 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-07-15 07:17:33 167,936 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-07-13 04:11:01 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
- 2007-11-19 15:56:33 2,961,408 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\ntuser.dat
+ 2008-07-15 07:17:20 3,342,336 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\ntuser.dat
- 2007-11-19 15:56:33 147,456 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
+ 2008-07-15 07:17:21 167,936 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
- 2008-07-14 18:55:40 40,326 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-07-15 07:26:25 40,326 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-07-14 18:55:40 49,910 ----a-w C:\WINDOWS\system32\perfc015.dat
+ 2008-07-15 07:26:25 49,910 ----a-w C:\WINDOWS\system32\perfc015.dat
- 2008-07-14 18:55:40 311,938 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-07-15 07:26:25 311,938 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-07-14 18:55:40 356,068 ----a-w C:\WINDOWS\system32\perfh015.dat
+ 2008-07-15 07:26:25 356,068 ----a-w C:\WINDOWS\system32\perfh015.dat
+ 2008-07-15 07:21:58 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_114.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 01:55 1667584]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-14 21:33 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-08-24 00:22 110592]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-04-27 20:48 7561216]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-04-27 20:48 86016]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-10-22 00:26 761945]
"Wireless Console 2"="C:\Program Files\Wireless Console 2\wcourier.exe" [2005-10-17 18:09 987136]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-11-02 18:24 1065800]
"nwiz"="nwiz.exe" [2006-04-27 20:48 1519616 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-12 18:58 16264192 C:\WINDOWS\RTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [2006-05-16 20:04 2879488 C:\WINDOWS\SkyTel.exe]
"SMSERIAL"="sm56hlpr.exe" [2006-01-20 22:34 544768 C:\WINDOWS\sm56hlpr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2007-02-15 06:06:48 278528]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.xvid"= xvid.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\InterVideo\\DVD7\\WinDVD.exe"=
"C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 11:21]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 11:21]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 SPF4;Sunbelt Personal Firewall 4;C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe [2007-04-26 11:21]
R3 ASNDIS5;ASNDIS5 Protocol Driver;C:\WINDOWS\system32\ASNDIS5.SYS [2002-09-09 20:54]
R3 SynMini;USB2.0 1.3M Web Cam;C:\WINDOWS\system32\Drivers\SynMini.sys [2005-10-03 11:26]
R3 SynScan;USB2.0 1.3M Web Cam Still Image;C:\WINDOWS\system32\Drivers\SynScan.sys [2005-10-03 11:26]

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-15 09:34:12
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


C:\ComboFix\dollar_log.dat
C:\ComboFix\CreateC00
C:\ComboFix\CreateC00.bat

scan completed successfully
hidden files: 3

**************************************************************************
.
Completion time: 2008-07-15 9:36:25
ComboFix-quarantined-files.txt 2008-07-15 07:35:59
ComboFix2.txt 2008-07-14 21:35:16

Pre-Run: 20,161,744,896 bajtów wolnych
Post-Run: 20,158,611,456 bajtów wolnych

129

SDFix: Version 1.205
Run by xp on 2008-07-15 at 09:19

Microsoft Windows XP [Wersja 5.1.2600]
Running From: C:\SDFix

Checking Services :


Restoring Default Security Values
Restoring Default Hosts File

Rebooting


Checking Files :

Trojan Files Found:

C:\WINDOWS\system32\jzcom32.dll - Deleted
C:\WINDOWS\system32\sklh.dat - Deleted





Removing Temp Files

ADS Check :



Final Check :

catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-15 09:23:15
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

IPC error: 2 Nie można odnaleźć określonego pliku.
scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\a347scsi\Config\jdgg40]

scanning hidden registry entries ...

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{E9F81423-211E-46B6-9AE0-38568BC5CF6F}]
"DisplayName"="Alcohol 120%"

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services :




Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program główny"
"C:\\Program Files\\InterVideo\\DVD7\\WinDVD.exe"="C:\\Program Files\\InterVideo\\DVD7\\WinDVD.exe:*:Enabled:WinDVD"
"C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"="C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe:*:Enabled:Sunbelt Firewall GUI"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

Remaining Files :


File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes :

Thu 15 Feb 2007 56 ..SHR --- "C:\WINDOWS\system32\59C80DF989.sys"
Thu 15 Feb 2007 1,890 A.SH. --- "C:\WINDOWS\system32\KGyGaAvL.sys"
Wed 14 Nov 2007 46,080 ...H. --- "C:\Documents and Settings\xp\Moje dokumenty\Kasia\~WRL0754.tmp"
Thu 15 Nov 2007 72,192 ...H. --- "C:\Documents and Settings\xp\Moje dokumenty\Kasia\~WRL1172.tmp"
Fri 7 Dec 2007 22,528 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0003.tmp"
Fri 7 Dec 2007 23,040 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0029.tmp"
Wed 14 May 2008 33,792 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0032.tmp"
Fri 16 May 2008 74,752 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0105.tmp"
Fri 9 May 2008 58,368 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0109.tmp"
Fri 7 Mar 2008 71,680 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0119.tmp"
Fri 9 May 2008 60,416 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0157.tmp"
Fri 7 Mar 2008 75,264 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0164.tmp"
Fri 22 Feb 2008 152,064 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0170.tmp"
Fri 7 Mar 2008 76,288 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0185.tmp"
Wed 14 May 2008 44,032 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0226.tmp"
Fri 25 Apr 2008 53,248 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0229.tmp"
Sun 3 Feb 2008 6,116,864 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0250.tmp"
Wed 14 May 2008 39,424 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0258.tmp"
Fri 9 May 2008 60,928 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0261.tmp"
Wed 14 May 2008 38,400 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0289.tmp"
Fri 29 Feb 2008 21,504 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0293.tmp"
Fri 11 Apr 2008 256,000 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0297.tmp"
Fri 16 May 2008 78,336 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0343.tmp"
Fri 7 Mar 2008 70,656 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0368.tmp"
Wed 14 May 2008 44,032 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0425.tmp"
Fri 7 Dec 2007 24,064 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0442.tmp"
Fri 11 Apr 2008 256,512 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0446.tmp"
Fri 16 May 2008 73,728 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0448.tmp"
Fri 9 May 2008 57,344 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0454.tmp"
Fri 9 May 2008 61,952 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0455.tmp"
Fri 25 Apr 2008 59,904 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0456.tmp"
Wed 14 May 2008 48,128 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0457.tmp"
Fri 9 May 2008 53,248 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0471.tmp"
Fri 25 Jan 2008 143,360 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0486.tmp"
Fri 9 May 2008 62,464 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0508.tmp"
Fri 11 Apr 2008 169,984 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0512.tmp"
Fri 9 May 2008 57,856 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0573.tmp"
Fri 9 May 2008 62,464 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0575.tmp"
Fri 25 Jan 2008 145,408 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0596.tmp"
Thu 15 Nov 2007 69,120 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0620.tmp"
Fri 7 Mar 2008 74,752 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0627.tmp"
Fri 11 Apr 2008 171,008 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0646.tmp"
Thu 15 Nov 2007 47,616 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0649.tmp"
Fri 25 Apr 2008 54,272 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0673.tmp"
Fri 16 May 2008 73,728 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0703.tmp"
Wed 14 May 2008 38,912 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0718.tmp"
Wed 14 May 2008 34,816 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0722.tmp"
Fri 11 Apr 2008 177,664 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0749.tmp"
Fri 25 Jan 2008 144,384 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0770.tmp"
Fri 11 Apr 2008 169,984 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0773.tmp"
Fri 29 Feb 2008 19,456 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0777.tmp"
Fri 29 Feb 2008 21,504 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0780.tmp"
Wed 14 May 2008 38,400 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0784.tmp"
Wed 14 May 2008 39,936 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0793.tmp"
Thu 15 Nov 2007 86,528 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0794.tmp"
Fri 7 Mar 2008 70,144 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0800.tmp"
Fri 11 Apr 2008 171,008 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0808.tmp"
Fri 16 May 2008 72,192 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0809.tmp"
Fri 16 May 2008 74,752 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0823.tmp"
Thu 15 Nov 2007 72,192 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0850.tmp"
Fri 7 Mar 2008 73,216 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0870.tmp"
Fri 25 Apr 2008 58,368 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0877.tmp"
Fri 9 May 2008 61,440 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0882.tmp"
Thu 15 Nov 2007 68,608 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0902.tmp"
Fri 25 Apr 2008 55,296 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0917.tmp"
Fri 16 May 2008 80,384 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0924.tmp"
Fri 25 Jan 2008 144,896 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0925.tmp"
Fri 11 Apr 2008 256,000 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0927.tmp"
Fri 29 Feb 2008 19,456 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0967.tmp"
Fri 4 Apr 2008 144,896 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0975.tmp"
Wed 14 May 2008 38,912 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0991.tmp"
Fri 9 May 2008 57,856 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL0992.tmp"
Fri 7 Mar 2008 60,416 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1037.tmp"
Fri 11 Apr 2008 185,856 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1083.tmp"
Fri 25 Jan 2008 147,456 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1103.tmp"
Fri 7 Mar 2008 63,488 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1117.tmp"
Fri 25 Apr 2008 57,344 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1128.tmp"
Wed 14 May 2008 43,520 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1149.tmp"
Fri 25 Jan 2008 145,408 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1157.tmp"
Fri 9 May 2008 62,976 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1169.tmp"
Fri 22 Feb 2008 152,576 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1188.tmp"
Fri 9 May 2008 59,904 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1192.tmp"
Fri 9 May 2008 57,856 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1193.tmp"
Wed 14 May 2008 39,936 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1214.tmp"
Sun 3 Feb 2008 6,116,864 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1221.tmp"
Fri 16 May 2008 74,752 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1242.tmp"
Sun 3 Feb 2008 5,822,464 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1289.tmp"
Fri 25 Apr 2008 60,416 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1290.tmp"
Fri 29 Feb 2008 20,480 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1291.tmp"
Wed 14 May 2008 35,840 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1305.tmp"
Fri 16 May 2008 79,872 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1317.tmp"
Fri 11 Apr 2008 169,472 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1322.tmp"
Fri 25 Apr 2008 40,960 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1323.tmp"
Fri 22 Feb 2008 152,064 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1326.tmp"
Wed 14 May 2008 34,816 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1334.tmp"
Wed 14 May 2008 39,936 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1341.tmp"
Fri 16 May 2008 80,896 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1346.tmp"
Fri 7 Mar 2008 74,752 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1357.tmp"
Fri 11 Apr 2008 169,984 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1359.tmp"
Fri 7 Mar 2008 60,928 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1362.tmp"
Fri 29 Feb 2008 19,456 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1387.tmp"
Fri 9 May 2008 61,440 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1393.tmp"
Fri 16 May 2008 73,728 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1403.tmp"
Fri 11 Apr 2008 256,512 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1421.tmp"
Fri 7 Mar 2008 74,752 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1460.tmp"
Thu 15 Nov 2007 71,680 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1461.tmp"
Fri 16 May 2008 74,752 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1466.tmp"
Fri 9 May 2008 52,224 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1489.tmp"
Fri 29 Feb 2008 21,504 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1517.tmp"
Fri 11 Apr 2008 170,496 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1559.tmp"
Sun 3 Feb 2008 6,116,864 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1560.tmp"
Wed 14 May 2008 37,376 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1562.tmp"
Wed 14 May 2008 37,888 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1563.tmp"
Fri 25 Jan 2008 145,408 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1604.tmp"
Thu 15 Nov 2007 69,632 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1607.tmp"
Fri 7 Mar 2008 72,192 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1612.tmp"
Fri 25 Apr 2008 53,248 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1613.tmp"
Fri 22 Feb 2008 152,576 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1615.tmp"
Fri 7 Dec 2007 23,040 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1631.tmp"
Fri 9 May 2008 62,464 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1639.tmp"
Fri 25 Jan 2008 146,432 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1641.tmp"
Fri 29 Feb 2008 19,456 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1650.tmp"
Fri 11 Apr 2008 170,496 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1652.tmp"
Fri 25 Jan 2008 146,944 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1668.tmp"
Fri 9 May 2008 52,736 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1678.tmp"
Fri 7 Dec 2007 22,528 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1692.tmp"
Fri 25 Jan 2008 146,944 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1701.tmp"
Fri 16 May 2008 81,408 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1724.tmp"
Fri 9 May 2008 58,368 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1727.tmp"
Fri 25 Jan 2008 129,536 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1731.tmp"
Fri 22 Feb 2008 151,040 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1794.tmp"
Fri 7 Mar 2008 76,288 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1795.tmp"
Fri 25 Jan 2008 145,920 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1812.tmp"
Fri 9 May 2008 60,928 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1813.tmp"
Wed 14 May 2008 39,936 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1842.tmp"
Fri 11 Apr 2008 170,496 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1869.tmp"
Fri 16 May 2008 80,384 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1884.tmp"
Fri 29 Feb 2008 22,016 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1899.tmp"
Fri 16 May 2008 79,872 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1931.tmp"
Fri 11 Apr 2008 174,592 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1935.tmp"
Fri 22 Feb 2008 151,040 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL1993.tmp"
Fri 9 May 2008 60,928 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2046.tmp"
Fri 16 May 2008 74,240 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2114.tmp"
Wed 14 May 2008 39,424 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2124.tmp"
Fri 25 Apr 2008 54,784 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2126.tmp"
Fri 9 May 2008 52,736 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2148.tmp"
Fri 29 Feb 2008 21,504 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2156.tmp"
Fri 16 May 2008 72,192 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2166.tmp"
Fri 7 Mar 2008 68,096 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2174.tmp"
Fri 9 May 2008 52,736 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2193.tmp"
Fri 25 Jan 2008 146,944 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2195.tmp"
Fri 9 May 2008 52,736 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2198.tmp"
Fri 29 Feb 2008 19,456 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2209.tmp"
Fri 11 Apr 2008 172,032 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2210.tmp"
Fri 11 Apr 2008 174,592 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2242.tmp"
Fri 22 Feb 2008 149,504 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2258.tmp"
Thu 15 Nov 2007 61,440 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2261.tmp"
Thu 15 Nov 2007 61,440 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2276.tmp"
Sun 3 Feb 2008 6,116,864 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2314.tmp"
Thu 15 Nov 2007 68,608 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2319.tmp"
Fri 11 Apr 2008 172,032 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2325.tmp"
Fri 29 Feb 2008 22,016 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2343.tmp"
Fri 9 May 2008 62,976 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2346.tmp"
Wed 14 May 2008 38,912 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2347.tmp"
Fri 29 Feb 2008 21,504 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2366.tmp"
Thu 15 Nov 2007 61,952 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2379.tmp"
Fri 11 Apr 2008 170,496 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2426.tmp"
Wed 14 May 2008 41,472 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2442.tmp"
Fri 11 Apr 2008 170,496 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2453.tmp"
Fri 4 Apr 2008 143,872 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2461.tmp"
Fri 16 May 2008 73,728 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2482.tmp"
Fri 25 Jan 2008 143,872 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2485.tmp"
Thu 15 Nov 2007 70,144 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2514.tmp"
Fri 25 Jan 2008 143,872 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2528.tmp"
Fri 9 May 2008 63,488 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2550.tmp"
Fri 9 May 2008 55,296 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2555.tmp"
Fri 25 Apr 2008 60,416 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2557.tmp"
Wed 14 May 2008 40,448 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2579.tmp"
Fri 9 May 2008 58,368 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2586.tmp"
Fri 9 May 2008 59,392 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2618.tmp"
Fri 25 Apr 2008 60,416 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2627.tmp"
Fri 25 Apr 2008 55,808 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2636.tmp"
Fri 16 May 2008 79,872 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2662.tmp"
Fri 7 Mar 2008 61,440 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2677.tmp"
Fri 7 Mar 2008 62,976 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2686.tmp"
Fri 22 Feb 2008 152,576 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2694.tmp"
Fri 9 May 2008 52,736 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2730.tmp"
Fri 11 Apr 2008 171,520 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2733.tmp"
Fri 11 Apr 2008 173,056 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2734.tmp"
Fri 25 Apr 2008 40,960 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2735.tmp"
Fri 25 Jan 2008 144,384 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2736.tmp"
Fri 29 Feb 2008 20,480 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2813.tmp"
Fri 16 May 2008 80,384 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2816.tmp"
Wed 14 May 2008 37,376 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2827.tmp"
Fri 11 Apr 2008 170,496 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2835.tmp"
Fri 9 May 2008 52,224 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2861.tmp"
Fri 9 May 2008 61,952 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2862.tmp"
Fri 11 Apr 2008 169,984 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2864.tmp"
Fri 25 Jan 2008 144,896 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2883.tmp"
Wed 14 May 2008 39,424 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2895.tmp"
Fri 7 Mar 2008 69,120 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2943.tmp"
Fri 29 Feb 2008 22,016 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2958.tmp"
Fri 16 May 2008 77,824 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2974.tmp"
Fri 11 Apr 2008 171,008 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2978.tmp"
Fri 11 Apr 2008 256,000 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2984.tmp"
Thu 15 Nov 2007 61,440 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL2987.tmp"
Fri 9 May 2008 52,224 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3005.tmp"
Fri 9 May 2008 50,688 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3011.tmp"
Fri 29 Feb 2008 21,504 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3020.tmp"
Fri 9 May 2008 52,736 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3021.tmp"
Fri 29 Feb 2008 19,456 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3026.tmp"
Fri 29 Feb 2008 19,456 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3034.tmp"
Fri 7 Mar 2008 65,536 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3039.tmp"
Fri 16 May 2008 74,752 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3071.tmp"
Fri 9 May 2008 60,928 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3082.tmp"
Fri 16 May 2008 80,384 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3108.tmp"
Fri 9 May 2008 61,952 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3121.tmp"
Wed 14 May 2008 33,792 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3122.tmp"
Fri 11 Apr 2008 256,000 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3161.tmp"
Fri 11 Apr 2008 172,544 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3181.tmp"
Fri 11 Apr 2008 172,544 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3195.tmp"
Fri 25 Apr 2008 60,416 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3214.tmp"
Fri 9 May 2008 58,368 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3232.tmp"
Thu 15 Nov 2007 71,168 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3233.tmp"
Fri 29 Feb 2008 19,456 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3238.tmp"
Fri 25 Jan 2008 143,872 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3280.tmp"
Wed 14 May 2008 38,400 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3288.tmp"
Fri 25 Jan 2008 144,896 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3292.tmp"
Fri 11 Apr 2008 256,512 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3295.tmp"
Fri 9 May 2008 52,224 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3307.tmp"
Sun 3 Feb 2008 6,116,864 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3311.tmp"
Fri 9 May 2008 58,368 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3313.tmp"
Wed 14 May 2008 36,864 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3314.tmp"
Fri 16 May 2008 73,728 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3350.tmp"
Wed 14 May 2008 37,376 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3358.tmp"
Thu 15 Nov 2007 71,168 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3368.tmp"
Fri 9 May 2008 53,248 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3399.tmp"
Fri 11 Apr 2008 174,592 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3415.tmp"
Fri 7 Mar 2008 75,776 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3442.tmp"
Wed 14 May 2008 39,424 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3447.tmp"
Fri 11 Apr 2008 169,472 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3457.tmp"
Wed 14 May 2008 44,544 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3458.tmp"
Fri 16 May 2008 74,240 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3467.tmp"
Fri 25 Apr 2008 55,808 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3486.tmp"
Wed 14 May 2008 38,400 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3501.tmp"
Fri 29 Feb 2008 19,456 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3531.tmp"
Fri 7 Mar 2008 61,952 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3619.tmp"
Fri 29 Feb 2008 20,480 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3631.tmp"
Wed 14 May 2008 34,816 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3645.tmp"
Fri 29 Feb 2008 22,528 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3653.tmp"
Fri 29 Feb 2008 19,456 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3663.tmp"
Fri 7 Mar 2008 69,120 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3664.tmp"
Fri 16 May 2008 79,872 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3673.tmp"
Fri 11 Apr 2008 173,056 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3675.tmp"
Fri 16 May 2008 73,728 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3680.tmp"
Thu 15 Nov 2007 57,856 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3697.tmp"
Fri 11 Apr 2008 173,568 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3698.tmp"
Sun 3 Feb 2008 6,116,864 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3712.tmp"
Fri 7 Mar 2008 71,680 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3717.tmp"
Fri 4 Apr 2008 145,920 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3740.tmp"
Thu 15 Nov 2007 61,440 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3754.tmp"
Fri 29 Feb 2008 19,456 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3788.tmp"
Fri 29 Feb 2008 19,456 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3789.tmp"
Fri 9 May 2008 60,928 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3799.tmp"
Thu 15 Nov 2007 61,440 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3833.tmp"
Fri 9 May 2008 52,224 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3864.tmp"
Fri 9 May 2008 60,416 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3870.tmp"
Thu 15 Nov 2007 61,440 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3877.tmp"
Fri 29 Feb 2008 21,504 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3881.tmp"
Fri 25 Apr 2008 57,344 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3895.tmp"
Fri 25 Apr 2008 60,416 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3917.tmp"
Fri 25 Apr 2008 54,272 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3922.tmp"
Fri 29 Feb 2008 19,456 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3959.tmp"
Fri 22 Feb 2008 151,552 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3964.tmp"
Thu 15 Nov 2007 68,096 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3966.tmp"
Fri 11 Apr 2008 185,856 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3967.tmp"
Fri 9 May 2008 57,856 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3968.tmp"
Fri 16 May 2008 74,240 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL3988.tmp"
Fri 7 Dec 2007 23,040 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL4017.tmp"
Fri 9 May 2008 57,856 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL4028.tmp"
Fri 4 Apr 2008 143,872 ...H. --- "C:\Documents and Settings\xp\Dane aplikacji\Microsoft\Word\~WRL4099.tmp"

Finished!

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 09:36:57, on 2008-07-15
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Spyware Doctor\svcntaux.exe
C:\Program Files\Spyware Doctor\swdsvc.exe
C:\Program Files\Spyware Doctor\SDTrayApp.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe
C:\WINDOWS\ATK0100\HControl.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\sm56hlpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\ATK0100\ATKOSD.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\system32\CF8659.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://onet.pl/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0 CE\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [HControl] C:\WINDOWS\ATK0100\HControl.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [SMSERIAL] sm56hlpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [Wireless Console 2] C:\Program Files\Wireless Console 2\wcourier.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [SDTray] "C:\Program Files\Spyware Doctor\SDTrayApp.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {3D8700FB-86A4-4CB4-B738-6F0FC016AC7D} (MainControl Class) - http://slimak.onet.pl/_m/wirusy/ArcaOnline.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe
O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe

--
End of file - 6263 bytes

********************************************************************************
* *
* FixIEDef Log *
* Version 1.4.20.5985 *
* *
********************************************************************************

Created at 09:39:27 on Tuesday, July 15, 2008

Time Zone :

Logged On User : xp

Operating System : Microsoft Windows XP Professional Dodatek Service Pack 2
OS Version : 5.1.2600
System Langauge : Polish
Keyboard Layout : Polish
Processor : X86 Mobile AMD Sempron(tm) Processor 3400+

System Drive : C:\
Windows Directory : C:\WINDOWS
System Directory : C:\WINDOWS\system32

Total Physical Memory : 469024768 bytes
Free Physical Memory : 71932 bytes
Total Virtual Memory : 2097024 bytes
Free Virtual Memory : 2053632 bytes

Boot State : Normal boot

--------------------------------------------------------------------------------

!!! Files that have been deleted !!!

No malicious files found

--------------------------------------------------------------------------------

!!! Directories that have been removed !!!

No malicious directories to be removed

--------------------------------------------------------------------------------

!!! Registry entries that have been removed !!!

No malicious Registry entries found

================================================================================

All Done

ShadowPuterDude

Safe Surfing!!!

[Magik]

HJT czysty
Fix to samo
Sdfix to samo


wklej jeszcze raz z Combofix'a--->brak wpisow z rejestru

[zielona]

ComboFix 08-07-14.2 - xp 2008-07-15 21:56:17.3 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.139 [GMT 2:00]
Running from: C:\Program Files\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-06-15 to 2008-07-15 )))))))))))))))))))))))))))))))
.

2008-07-15 20:55 . 2008-07-15 20:55 <DIR> d-------- C:\Program Files\KlipFolio
2008-07-15 20:55 . 2008-07-15 21:53 <DIR> d-------- C:\Documents and Settings\xp\Dane aplikacji\KlipFolio
2008-07-15 20:54 . 2008-07-15 20:55 1,054,680 --a------ C:\Program Files\KlipFolio-Install.exe
2008-07-15 09:38 . 2008-07-15 09:39 451,121 --a------ C:\Program Files\FixIEDef.exe
2008-07-15 08:54 . 2008-07-15 09:24 <DIR> d-------- C:\SDFix
2008-07-15 08:53 . 2008-07-15 08:54 1,444,357 --a------ C:\Program Files\SDFix.exe
2008-07-14 23:23 . 2008-07-14 23:23 2,613,152 --a------ C:\Program Files\ComboFix.exe
2008-07-02 15:50 . 2008-07-04 08:30 32 --a-s---- C:\WINDOWS\system32\2168961456.dat
2008-06-18 20:36 . 2008-06-18 20:36 <DIR> d-------- C:\Documents and Settings\xp\PressService
2008-06-18 20:35 . 2008-06-18 20:35 881,896 --a------ C:\Program Files\cafenews.exe
2008-06-17 23:16 . 2008-07-14 12:16 <DIR> d-------- C:\Documents and Settings\xp\Dane aplikacji\skypePM
2008-06-17 23:16 . 2008-06-17 23:16 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat
2008-06-17 23:10 . 2008-06-17 23:10 <DIR> d-------- C:\Program Files\Skype
2008-06-17 23:10 . 2008-06-17 23:10 <DIR> d-------- C:\Program Files\Common Files\Skype
2008-06-17 23:10 . 2008-07-14 12:17 <DIR> d-------- C:\Documents and Settings\xp\Dane aplikacji\Skype
2008-06-17 23:09 . 2008-06-17 23:10 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Skype
2008-06-17 23:08 . 2008-06-17 23:08 22,411,048 --a------ C:\Program Files\SkypeSetup.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-15 18:35 --------- d---a-w C:\Documents and Settings\All Users\Dane aplikacji\TEMP
2008-07-15 07:13 330 ----a-w C:\WINDOWS\system32\drivers\fwdrv.err
2008-07-14 15:14 --------- d-----w C:\Documents and Settings\xp\Dane aplikacji\OpenOffice.ux.pl2
2008-07-14 10:03 --------- d-----w C:\Program Files\Spyware Doctor
2008-05-01 15:56 50,688 ----a-w C:\Program Files\ATF-Cleaner.exe
2008-05-01 10:11 812,344 ----a-w C:\Program Files\HJTInstall.exe
2008-05-01 10:11 401,720 ----a-w C:\Program Files\HiJackThis.exe
2008-05-01 10:11 318,369 ----a-w C:\Program Files\HiJackThis.zip
2008-01-03 16:48 6,575,800 ----a-w C:\Program Files\Sunbelt-Personal-Firewall.exe
2007-11-21 19:14 38,899 ----a-w C:\Program Files\SeconfigXP.zip
2007-11-21 18:51 51,232 ----a-w C:\Program Files\wwdc.exe
2007-11-19 20:57 15,374,248 ----a-w C:\Program Files\sdstart.exe
2007-11-19 20:17 5,361,888 ----a-w C:\Program Files\kerio.exe
2007-11-16 12:52 7,037,304 ----a-w C:\Program Files\DjVuBrowserPlugin.exe
2007-11-05 15:39 4,346,704 ----a-w C:\Program Files\gg77.exe
2007-02-15 03:51 56 --sh--r C:\WINDOWS\system32\59C80DF989.sys
2007-02-15 03:51 1,890 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.

------- Sigcheck -------

2004-08-03 23:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\system32\dllcache\tcpip.sys
2004-08-03 23:14 359040 1745b00fc1141404b28f4b94f69a8871 C:\WINDOWS\system32\drivers\tcpip.sys
.
((((((((((((((((((((((((((((( snapshot@2008-07-14_23.33.51.90 )))))))))))))))))))))))))))))))))))))))))
.
+ 2008-07-13 04:11:01 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX\ERDNT.EXE
- 2007-11-19 15:56:39 2,961,408 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\ntuser.dat
+ 2008-07-15 07:17:33 3,342,336 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000001\ntuser.dat
- 2007-11-19 15:56:39 147,456 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-07-15 07:17:33 167,936 ----a-w C:\WINDOWS\ERUNT\SDFIX\Users\00000002\UsrClass.dat
+ 2008-07-13 04:11:01 163,328 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\ERDNT.EXE
- 2007-11-19 15:56:33 2,961,408 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\ntuser.dat
+ 2008-07-15 07:17:20 3,342,336 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000001\ntuser.dat
- 2007-11-19 15:56:33 147,456 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
+ 2008-07-15 07:17:21 167,936 ----a-w C:\WINDOWS\ERUNT\SDFIX_First_Run\Users\00000002\UsrClass.dat
- 2008-07-14 18:55:40 40,326 ----a-w C:\WINDOWS\system32\perfc009.dat
+ 2008-07-15 18:21:57 40,326 ----a-w C:\WINDOWS\system32\perfc009.dat
- 2008-07-14 18:55:40 49,910 ----a-w C:\WINDOWS\system32\perfc015.dat
+ 2008-07-15 18:21:57 49,910 ----a-w C:\WINDOWS\system32\perfc015.dat
- 2008-07-14 18:55:40 311,938 ----a-w C:\WINDOWS\system32\perfh009.dat
+ 2008-07-15 18:21:57 311,938 ----a-w C:\WINDOWS\system32\perfh009.dat
- 2008-07-14 18:55:40 356,068 ----a-w C:\WINDOWS\system32\perfh015.dat
+ 2008-07-15 18:21:57 356,068 ----a-w C:\WINDOWS\system32\perfh015.dat
+ 2008-07-15 18:17:39 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_14c.dat
+ 2008-07-15 18:55:22 16,384 ----atw C:\WINDOWS\TEMP\Perflib_Perfdata_92c.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44 15360]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-08-04 01:55 1667584]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-11-14 21:33 68856]
"KlipFolio"="C:\Program Files\KlipFolio\KlipFolio.exe" [2008-07-15 20:55 1054680]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HControl"="C:\WINDOWS\ATK0100\HControl.exe" [2006-08-24 00:22 110592]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-04-27 20:48 7561216]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-04-27 20:48 86016]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-10-22 00:26 761945]
"Wireless Console 2"="C:\Program Files\Wireless Console 2\wcourier.exe" [2005-10-17 18:09 987136]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"SDTray"="C:\Program Files\Spyware Doctor\SDTrayApp.exe" [2007-11-02 18:24 1065800]
"nwiz"="nwiz.exe" [2006-04-27 20:48 1519616 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL"="RTHDCPL.EXE" [2006-09-12 18:58 16264192 C:\WINDOWS\RTHDCPL.EXE]
"SkyTel"="SkyTel.EXE" [2006-05-16 20:04 2879488 C:\WINDOWS\SkyTel.exe]
"SMSERIAL"="sm56hlpr.exe" [2006-01-20 22:34 544768 C:\WINDOWS\sm56hlpr.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 00:44 15360]

C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\
InterVideo WinCinema Manager.lnk - C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe [2007-02-15 06:06:48 278528]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56 65588]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.xvid"= xvid.dll

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\Gadu-Gadu\\gg.exe"=
"C:\\Program Files\\InterVideo\\DVD7\\WinDVD.exe"=
"C:\\Program Files\\Sunbelt Software\\Personal Firewall\\kpf4gui.exe"=
"C:\\Program Files\\Skype\\Phone\\Skype.exe"=

R1 aswSP;avast! Self Protection;C:\WINDOWS\system32\drivers\aswSP.sys [2008-05-16 01:20]
R1 fwdrv;Firewall Driver;C:\WINDOWS\system32\drivers\fwdrv.sys [2007-04-26 11:21]
R1 khips;Kerio HIPS Driver;C:\WINDOWS\system32\drivers\khips.sys [2007-04-26 11:21]
R2 aswFsBlk;aswFsBlk;C:\WINDOWS\system32\DRIVERS\aswFsBlk.sys [2008-05-16 01:16]
R2 SPF4;Sunbelt Personal Firewall 4;C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe [2007-04-26 11:21]
R3 ASNDIS5;ASNDIS5 Protocol Driver;C:\WINDOWS\system32\ASNDIS5.SYS [2002-09-09 20:54]
R3 SynMini;USB2.0 1.3M Web Cam;C:\WINDOWS\system32\Drivers\SynMini.sys [2005-10-03 11:26]
R3 SynScan;USB2.0 1.3M Web Cam Still Image;C:\WINDOWS\system32\Drivers\SynScan.sys [2005-10-03 11:26]

.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-15 22:00:44
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


C:\ComboFix\temp00

scan completed successfully
hidden files: 1

**************************************************************************
.
Completion time: 2008-07-15 22:02:59
ComboFix-quarantined-files.txt 2008-07-15 20:02:33
ComboFix2.txt 2008-07-15 07:36:28
ComboFix3.txt 2008-07-14 21:35:16

Pre-Run: 20,038,897,664 bajtów wolnych
Post-Run: 20,131,696,640 bajtów wolnych

134

[Okocza]

czysto jest...


Wykonaj to co jest podane w tym temacie

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem