Gerwazy napisał(a):Tu sciezka do tego scierwa
spokojnie nie wyrazaj sie tak to podaj ta sciezke
potem nowy log z silent runners i comboscan
Aktualizacje na programosy.pl:
DVDFab HD Decrypter • NTLite Free Portable • NTLite Free • n-Track Studio • Spotify • Chromium • Kaspersky Rescue Disk • Vim • WYSIWYG Web Builder
-
- Ogłoszenie:
internet,virus-.^
32 posty(ów) • Strona 2 z 2 • 1, 2
przez wojtas 23 Kwi 2007, 23:08
spokojnie nie wyrazaj sie tak to podaj ta sciezke
potem nowy log z silent runners i comboscan
-
wojtas - *mod
- Posty: 18165
- Dołączenie: 13 Sty 2006, 16:00
- Miejscowość: Krzeszyce
- Pochwały: 1656
przez Gerwazy 23 Kwi 2007, 23:12
c:\documents and settings\user\ustawienia lokalne\dane aplikacji\mozilla\firefox\profiles\7du0ayj8.default\cache\2f3ea5f8d01/Evolutions-XML.exe
Link do comboscana?/Ok juz mam
Przepraszam na slownicto
[ Dodano: Dzisiaj o 23:25 ]
Link do comboscana?/Ok juz mam
Przepraszam na slownicto
[ Dodano: Dzisiaj o 23:25 ]
ComboScan v20070306.20 run by USER on 2007-04-23 at 23:06:55
Computer is in Normal Mode.
---------------------------------------------------------------------------------- System Restore --------------------------------------------------------------
Successfully created ComboScan Restore Point.
-- Last 5 Restore Point(s) --
10: 2007-04-23 21:06:56 UTC - RP10 - ComboScan Restore Point
9: 2007-04-23 21:05:26 UTC - RP9 - ComboScan Restore Point
8: 2007-04-23 21:02:22 UTC - RP8 - ComboScan Restore Point
7: 2007-04-19 18:53:47 UTC - RP7 - Zainstalowany Kaspersky Anti-Virus 6.0.
6: 2007-04-19 18:49:54 UTC - RP6 - Removed Kaspersky Anti-Virus 6.0.
-- First Restore Point --
1: 2007-04-15 19:10:40 UTC - RP1 - Punkt kontrolny systemu
Performed disk cleanup.
-- HijackThis (run as USER.exe) ------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 23:06:57, on 2007-04-23
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
C:\Documents and Settings\USER\Pulpit\comboscan.exe
C:\PROGRA~1\HIJACK~1\USER.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-fGadu\gg.exe" /tray
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{F707E3E3-10A7-4FB6-BA4E-BB0A3B46D17C}: NameServer = 213.241.79.37 83.238.255.76
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
-- File Associations -----------------------------------------------------------
.bat - batfile - "%1" %*
.chm - chm.file - "C:\WINDOWS\hh.exe" %1
.cmd - cmdfile - "%1" %*
.com - comfile - "%1" %*
.exe - exefile - "%1" %*
.hlp - hlpfile - %SystemRoot%\System32\winhlp32.exe %1
.inf - inffile - %SystemRoot%\System32\NOTEPAD.EXE %1
.ini - inifile - %SystemRoot%\System32\NOTEPAD.EXE %1
.js - JSFile - %SystemRoot%\System32\WScript.exe "%1" %*
.lnk - lnkfile - {00021401-0000-0000-C000-000000000046}
.pif - piffile - "%1" %*
.reg - regfile - regedit.exe "%1"
.scr - scrfile - "%1" /S
.txt - txtfile - %SystemRoot%\system32\NOTEPAD.EXE %1
.vbs - VBSFile - %SystemRoot%\System32\WScript.exe "%1" %*
-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------
3R alcan5wn (SpeedTouch USB ADSL PPP Networking Driver (NDISWAN)) - C:\WINDOWS\system32\drivers\alcan5wn.sys
3R alcaudsl (SpeedTouch ADSL Modem ATM Transport) - C:\WINDOWS\system32\drivers\alcaudsl.sys
3R ALCXWDM (Service for Realtek AC97 Audio (WDM)) - C:\WINDOWS\system32\drivers\alcxwdm.sys
1R AmdK7 (Sterownik procesora AMD K7) - C:\WINDOWS\system32\drivers\amdk7.sys
3R ati2mtag - C:\WINDOWS\system32\drivers\ati2mtag.sys
3R FETNDIS (Sterownik NT karty VIA PCI 10/100Mb Fast Ethernet) - C:\WINDOWS\system32\drivers\fetnd5.sys
0R kl1 - C:\WINDOWS\system32\drivers\kl1.sys
1R klif - C:\WINDOWS\system32\drivers\klif.sys
0R PxHelp20 - C:\WINDOWS\system32\drivers\PxHelp20.sys
3R usbehci (Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft) - C:\WINDOWS\system32\drivers\usbehci.sys
3R WS2IFSL (Środowisko wspomagające dostawcę usług innych niż IFS - Windows Socket 2.0) - C:\WINDOWS\system32\drivers\ws2ifsl.sys
-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------
2R Ati HotKey Poller - C:\WINDOWS\System32\Ati2evxx.exe
2S ATI Smart - C:\WINDOWS\system32\ati2sgag.exe
2R AVP (Kaspersky Anti-Virus 6.0) - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe -r
3S SCardDrv (Pomocnik karty inteligentnej) - C:\WINDOWS\System32\SCardSvr.exe
2R uploadmgr (Menedżer przekazywania) - C:\WINDOWS\System32\svchost.exe -k netsvcs
2R WmdmPmSp (Numer seryjny nośnika przenośnego) - C:\WINDOWS\System32\svchost.exe -k netsvcs
-- Files created between 2007-03-23 and 2007-04-23 -----------------------------
2007-04-23 21:01:54 0 --ahs---- C:\WINDOWS\System32\.exe<EXE~1>
2007-04-23 19:18:44 0 d-------- C:\Program Files\MyGlobalSearch<MYGLOB~1>
2007-04-23 19:18:43 0 d-------- C:\My Downloads<MYDOWN~1>
2007-04-23 19:18:42 0 d-------- C:\Program Files\BearShare<BEARSH~1>
2007-04-23 15:32:12 0 d-------- C:\WINDOWS\speech
2007-04-23 15:32:03 0 d-------- C:\Program Files\ivo
2007-04-22 16:54:14 0 --a------ C:\WINDOWS\System32\lnternat.exe
2007-04-19 20:54:15 74396 --a------ C:\WINDOWS\System32\drivers\klin.dat
2007-04-19 20:54:15 75932 --a------ C:\WINDOWS\System32\drivers\klick.dat
2007-04-19 20:53:54 0 d-------- C:\Program Files\Kaspersky Lab<KASPER~1>
2007-04-19 20:53:52 64800 --ahs---- C:\WINDOWS\System32\drivers\fidbox2.dat
2007-04-19 20:53:52 1675552 --ahs---- C:\WINDOWS\System32\drivers\fidbox.dat
2007-04-19 20:53:21 0 d-------- C:\KAV
2007-04-18 21:22:38 0 d-------- C:\Program Files\Tibia Auto<TIBIAA~1>
2007-04-18 21:21:36 0 d-------- C:\Python24
2007-04-17 16:50:59 115880 -----n--- C:\WINDOWS\System32\pxinsi64.exe
2007-04-17 16:50:59 129784 -----n--- C:\WINDOWS\System32\pxafs.dll
2007-04-17 16:50:59 36528 -----n--- C:\WINDOWS\System32\drivers\PxHelp20.sys
2007-04-17 16:50:59 2560 -----n--- C:\WINDOWS\System32\drivers\cdralw2k.sys
2007-04-17 16:50:59 2432 -----n--- C:\WINDOWS\System32\drivers\cdr4_xp.sys
2007-04-17 16:50:49 0 d-------- C:\Program Files\Winamp
2007-04-17 07:15:04 442967 ---hs---- C:\WINDOWS\System32\ehkmp.ini2<EHKMP~1.INI>
2007-04-15 20:08:27 137216 --a------ C:\WINDOWS\REGEDIT.COM
2007-04-15 17:59:08 461402 ---hs---- C:\WINDOWS\System32\ehkmp.bak2<EHKMP~2.BAK>
2007-04-15 16:53:07 5606 --a------ C:\WINDOWS\System32\stci.dll
2007-04-15 16:53:07 5280 --a------ C:\WINDOWS\System32\drivers\alcawh.sys
2007-04-15 16:53:07 70688 --a------ C:\WINDOWS\System32\drivers\alcaudsl.sys
2007-04-15 16:53:07 3968 --a------ C:\WINDOWS\System32\drivers\alcacr.sys
2007-04-15 16:53:04 0 d-------- C:\Program Files\Thomson
2007-04-15 13:55:44 48 --a------ C:\WINDOWS\System32\imon1.dat
2007-04-15 13:34:43 0 d--h----- C:\WINDOWS\PIF
2007-04-13 22:38:12 348160 --a------ C:\WINDOWS\System32\MSVCR71.dll
2007-04-13 22:38:12 499712 --a------ C:\WINDOWS\System32\MSVCP71.dll
2007-04-13 22:38:12 1060864 --a------ C:\WINDOWS\System32\MFC71.dll
2007-04-13 21:06:54 41474 --ahs---- C:\WINDOWS\System32\smsc.exe
2007-04-12 19:24:45 0 d-------- C:\Program Files\Tibia
2007-04-12 17:38:02 0 d-------- C:\WINDOWS\pss
2007-04-12 17:28:27 0 d-------- C:\Program Files\Gadu-fGadu<GADU-F~1>
2007-04-12 17:20:59 458750 ---hs---- C:\WINDOWS\System32\ehkmp.bak1<EHKMP~1.BAK>
2007-04-12 17:12:26 1137664 -ra------ C:\WINDOWS\System32\mswLp.exe
2007-04-12 17:11:07 53600 --a------ C:\WINDOWS\System32\drivers\alcan5wn.sys
2007-04-12 17:03:28 0 d-------- C:\WINDOWS
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\WinSxS
2007-04-12 17:03:28 0 dr------- C:\WINDOWS\Web
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\twain_32
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\system32
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\wins
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\wbem
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\usmt
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\spool
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\ShellExt
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\Setup
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\ras
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\oobe
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\npp
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\mui
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\inetsrv
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\IME
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\icsxml
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\ias
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\export
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\drivers
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\drivers\etc
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\drivers\disdn
2007-04-12 17:03:28 0 dr-hs--c- C:\WINDOWS\System32\dllcache
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\dhcp
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\config
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\3com_dmi
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\3076
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\2052
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\1054
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\1045
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\1042
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\1041
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\1037
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\1033
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\1031
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\1028
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\1025
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\system
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\security
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\Resources<RESOUR~1>
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\repair
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\mui
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\msapps
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\msagent
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\Media
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\java
2007-04-12 17:03:28 0 d--h----- C:\WINDOWS\inf
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\ime
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\Help
2007-04-12 17:03:28 0 dr--s---- C:\WINDOWS\Fonts
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\Driver Cache<DRIVER~1>
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\Debug
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\Cursors
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\Connection Wizard<CONNEC~1>
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\Config
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\AppPatch
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\addins
2007-04-12 16:32:39 0 d-------- C:\Program Files\ToniArts
2007-04-12 16:31:12 1168 --a------ C:\WINDOWS\mozver.dat
2007-04-12 16:10:50 3072 --a------ C:\WINDOWS\System32\drivers\audstub.sys
2007-04-12 16:10:13 57856 --a------ C:\WINDOWS\System32\drivers\redbook.sys
2007-04-12 16:09:53 9856 --a------ C:\WINDOWS\System32\drivers\gameenum.sys
2007-04-12 16:09:37 27165 --a------ C:\WINDOWS\System32\drivers\fetnd5.sys
2007-04-12 16:09:32 70144 --a------ C:\WINDOWS\System32\usbui.dll
2007-04-12 16:08:33 0 d-------- C:\Program Files\Common Files\ODBC
2007-04-12 16:08:30 0 dr------- C:\Program Files<PROGRA~1>
2007-04-12 16:08:30 0 d-------- C:\Program Files\Common Files\SpeechEngines<SPEECH~1>
2007-04-12 16:08:28 6144 -ra------ C:\WINDOWS\System32\kbdtuq.dll
2007-04-12 16:08:28 6144 -ra------ C:\WINDOWS\System32\kbdtuf.dll
2007-04-12 16:08:28 5632 -ra------ C:\WINDOWS\System32\kbdazel.dll
2007-04-12 16:08:27 5632 -ra------ C:\WINDOWS\System32\kbdmon.dll
2007-04-12 16:08:27 5632 -ra------ C:\WINDOWS\System32\kbdkyr.dll
2007-04-12 16:08:25 8192 -ra------ C:\WINDOWS\System32\kbdhept.dll
2007-04-12 16:08:25 6656 -ra------ C:\WINDOWS\System32\kbdhela3.dll
2007-04-12 16:08:25 6144 -ra------ C:\WINDOWS\System32\kbdhela2.dll
2007-04-12 16:08:25 5632 -ra------ C:\WINDOWS\System32\kbdhe319.dll
2007-04-12 16:08:25 5632 -ra------ C:\WINDOWS\System32\kbdhe220.dll
2007-04-12 16:08:25 5632 -ra------ C:\WINDOWS\System32\kbdhe.dll
2007-04-12 16:08:25 6144 -ra------ C:\WINDOWS\System32\kbdgkl.dll
2007-04-12 16:08:24 6144 -ra------ C:\WINDOWS\System32\kbdlv1.dll
2007-04-12 16:08:24 6144 -ra------ C:\WINDOWS\System32\kbdlv.dll
2007-04-12 16:08:24 5632 -ra------ C:\WINDOWS\System32\kbdlt1.dll
2007-04-12 16:08:24 5632 -ra------ C:\WINDOWS\System32\kbdlt.dll
2007-04-12 16:08:24 6144 -ra------ C:\WINDOWS\System32\kbdest.dll
2007-04-12 16:08:22 6656 --a------ C:\WINDOWS\System32\kbdycl.dll
2007-04-12 16:08:22 6656 --a------ C:\WINDOWS\System32\kbdsl1.dll
2007-04-12 16:08:22 6656 --a------ C:\WINDOWS\System32\kbdsl.dll
2007-04-12 16:08:22 5632 --a------ C:\WINDOWS\System32\kbdro.dll
2007-04-12 16:08:22 5632 --a------ C:\WINDOWS\System32\kbdhu1.dll
2007-04-12 16:08:22 6656 --a------ C:\WINDOWS\System32\kbdhu.dll
2007-04-12 16:08:22 6656 --a------ C:\WINDOWS\System32\kbdcz2.dll
2007-04-12 16:08:22 6656 --a------ C:\WINDOWS\System32\kbdcz1.dll
2007-04-12 16:08:22 7168 --a------ C:\WINDOWS\System32\kbdcz.dll
2007-04-12 16:08:22 6656 --a------ C:\WINDOWS\System32\kbdcr.dll
2007-04-12 16:08:22 6656 --a------ C:\WINDOWS\System32\KBDAL.DLL
2007-04-12 16:08:21 24661 --a------ C:\WINDOWS\System32\spxcoins.dll
2007-04-12 16:08:21 13312 --a------ C:\WINDOWS\System32\irclass.dll
2007-04-12 16:08:21 103424 --a------ C:\WINDOWS\System32\EqnClass.Dll
2007-04-12 16:08:21 10496 --a------ C:\WINDOWS\System32\drivers\irenum.sys
2007-04-12 16:08:21 85532 --a------ C:\WINDOWS\System32\dgsetup.dll
2007-04-12 16:08:21 176157 --a------ C:\WINDOWS\System32\dgrpsetu.dll
2007-04-12 16:08:20 9168 --a------ C:\WINDOWS\system\VER.DLL
2007-04-12 16:08:20 19200 --a------ C:\WINDOWS\system\TAPI.DLL
2007-04-12 16:08:20 5120 --a------ C:\WINDOWS\system\SHELL.DLL
2007-04-12 16:08:20 24064 --a------ C:\WINDOWS\system\OLESVR.DLL
2007-04-12 16:08:20 83456 --a------ C:\WINDOWS\system\OLECLI.DLL
2007-04-12 16:08:20 127008 --a------ C:\WINDOWS\system\MSVIDEO.DLL
2007-04-12 16:08:20 69712 --a------ C:\WINDOWS\system\MMSYSTEM.DLL
2007-04-12 16:08:20 9936 --a------ C:\WINDOWS\system\LZEXPAND.DLL
2007-04-12 16:08:20 33376 --a------ C:\WINDOWS\system\COMMDLG.DLL
2007-04-12 16:08:20 109488 --a------ C:\WINDOWS\system\AVIFILE.DLL
2007-04-12 16:08:19 15360 --a------ C:\WINDOWS\TASKMAN.EXE
2007-04-12 16:08:19 72192 --a------ C:\WINDOWS\System32\storprop.dll
2007-04-12 16:08:19 6656 --a------ C:\WINDOWS\System32\batt.dll
2007-04-12 16:08:19 70096 --a------ C:\WINDOWS\system\AVICAP.DLL
2007-04-12 16:08:19 67072 --a------ C:\WINDOWS\NOTEPAD.EXE
2007-04-12 16:07:59 0 d-------- C:\WINDOWS\System32\CatRoot2
2007-04-12 16:07:59 0 d-------- C:\WINDOWS\System32\CatRoot
2007-04-12 16:07:40 0 d-------- C:\Documents and Settings<DOCUME~1>
2007-04-12 15:55:51 270336 --a------ C:\WINDOWS\System32\imon.dll
2007-04-12 15:54:47 0 --a------ C:\WINDOWS\nsreg.dat
2007-04-12 15:54:40 0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1>
2007-04-12 15:54:03 0 d-------- C:\Program Files\Lavasoft
2007-04-12 15:51:35 516096 -----n--- C:\WINDOWS\System32\ati2sgag.exe
2007-04-12 15:51:21 0 d-------- C:\Program Files\ATI Technologies<ATITEC~1>
2007-04-12 15:50:56 0 d-------- C:\ATI
2007-04-12 15:48:49 5888 --a------ C:\WINDOWS\System32\drivers\splitter.sys
2007-04-12 15:48:48 77440 --a------ C:\WINDOWS\System32\drivers\wdmaud.sys
2007-04-12 15:48:46 50048 --a------ C:\WINDOWS\System32\drivers\DMusic.sys
2007-04-12 15:48:46 40960 --a------ C:\WINDOWS\System32\ChCfg.exe
2007-04-12 15:48:43 54272 --a------ C:\WINDOWS\System32\drivers\swmidi.sys
2007-04-12 15:48:40 142208 --a------ C:\WINDOWS\System32\drivers\aec.sys
2007-04-12 15:48:38 159360 --a------ C:\WINDOWS\System32\drivers\kmixer.sys
2007-04-12 15:48:37 2816 --a------ C:\WINDOWS\System32\drivers\drmkaud.sys
2007-04-12 15:48:36 56832 --a------ C:\WINDOWS\System32\drivers\sysaudio.sys
2007-04-12 15:48:23 7040 --a------ C:\WINDOWS\System32\drivers\MSKSSRV.sys
2007-04-12 15:48:22 4608 --a------ C:\WINDOWS\System32\drivers\MSPQM.sys
2007-04-12 15:48:21 5120 --a------ C:\WINDOWS\System32\drivers\MSPCLOCK.sys
2007-04-12 15:48:15 4096 --a------ C:\WINDOWS\System32\ksuser.dll
2007-04-12 15:48:15 44416 --a------ C:\WINDOWS\System32\drivers\stream.sys
2007-04-12 15:48:15 134272 --a------ C:\WINDOWS\System32\drivers\portcls.sys
2007-04-12 15:48:15 131712 --a------ C:\WINDOWS\System32\drivers\ks.sys
2007-04-12 15:48:15 57856 --a------ C:\WINDOWS\System32\drivers\drmk.sys
2007-04-12 15:48:07 10527744 --a------ C:\WINDOWS\System32\RTLCPL.exe
2007-04-12 15:48:07 0 d-------- C:\Program Files\Realtek AC97<REALTE~1>
2007-04-12 15:48:05 143360 --a------ C:\WINDOWS\System32\RtlCPAPI.dll
2007-04-12 15:48:05 3972672 --a------ C:\WINDOWS\System32\drivers\alcxwdm.sys
2007-04-12 15:48:05 577536 --a------ C:\WINDOWS\soundman.exe
2007-04-12 15:48:04 315392 --a------ C:\WINDOWS\alcupd.exe
2007-04-12 15:48:04 217088 --a------ C:\WINDOWS\Alcrmv.exe
2007-04-12 15:48:04 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-04-12 15:47:29 0 d-------- C:\Program Files\Common Files\InstallShield<INSTAL~1>
2007-04-12 15:43:43 545 --a------ C:\WINDOWS\UC.PIF
2007-04-12 15:43:43 545 --a------ C:\WINDOWS\RAR.PIF
2007-04-12 15:43:43 545 --a------ C:\WINDOWS\PKZIP.PIF
2007-04-12 15:43:43 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2007-04-12 15:43:43 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2007-04-12 15:43:43 545 --a------ C:\WINDOWS\LHA.PIF
2007-04-12 15:43:43 545 --a------ C:\WINDOWS\ARJ.PIF
2007-04-12 15:43:43 0 d-------- C:\totalcmd
2007-04-12 15:28:26 0 d--hs---- C:\WINDOWS\Installer<INSTAL~1>
2007-04-12 15:27:21 0 d-------- C:\WINDOWS\Prefetch
2007-04-12 15:27:21 0 d--hs---- C:\System Volume Information<SYSTEM~1>
2007-04-12 15:18:00 0 d-------- C:\WINDOWS\System32\xircom
2007-04-12 15:18:00 0 d-------- C:\Program Files\microsoft frontpage<MICROS~1>
2007-04-12 15:17:40 0 -rahs---- C:\MSDOS.SYS
2007-04-12 15:17:40 0 -rahs---- C:\IO.SYS
2007-04-12 15:17:40 0 --a------ C:\CONFIG.SYS
2007-04-12 15:17:40 0 --a------ C:\AUTOEXEC.BAT
2007-04-12 15:17:27 112128 --a------ C:\WINDOWS\System32\mapi32.dll
2007-04-12 15:16:31 0 dr------- C:\WINDOWS\Offline Web Pages<OFFLIN~1>
2007-04-12 15:16:31 0 d---s---- C:\WINDOWS\Downloaded Program Files<DOWNLO~1>
2007-04-12 15:16:05 0 d-------- C:\WINDOWS\System32\DirectX
2007-04-12 15:15:41 40960 --a------ C:\WINDOWS\System32\safrslv.dll
2007-04-12 15:15:41 26624 --a------ C:\WINDOWS\System32\safrdm.dll
2007-04-12 15:15:41 39424 --a------ C:\WINDOWS\System32\safrcdlg.dll
2007-04-12 15:15:41 33792 --a------ C:\WINDOWS\System32\racpldlg.dll
2007-04-12 15:15:40 11264 --a------ C:\WINDOWS\System32\atrace.dll
2007-04-12 15:15:33 12288 --a------ C:\WINDOWS\System32\nmevtmsg.dll
2007-04-12 15:15:33 32768 --a------ C:\WINDOWS\System32\mnmsrvc.exe
2007-04-12 15:15:33 28672 --a------ C:\WINDOWS\System32\isrdbg32.dll
2007-04-12 15:15:32 67584 --a------ C:\WINDOWS\System32\acctres.dll
2007-04-12 15:15:30 49152 --a------ C:\WINDOWS\System32\inetres.dll
2007-04-12 15:15:27 0 d---s---- C:\WINDOWS\Tasks
2007-04-12 15:15:27 81920 --a------ C:\WINDOWS\System32\isign32.dll
2007-04-12 15:15:27 270336 --a------ C:\WINDOWS\System32\inetcfg.dll
2007-04-12 15:15:27 61440 --a------ C:\WINDOWS\System32\icwphbk.dll
2007-04-12 15:15:27 69632 --a------ C:\WINDOWS\System32\icwdial.dll
2007-04-12 15:15:27 16384 --a------ C:\WINDOWS\System32\icfgnt5.dll
2007-04-12 15:15:24 0 d-------- C:\Program Files\Common Files\MSSoap
2007-04-12 15:15:21 0 d-------- C:\WINDOWS\srchasst
2007-04-12 15:15:20 17408 --a------ C:\WINDOWS\System32\qmgrprxy.dll
2007-04-12 15:15:20 221696 --a------ C:\WINDOWS\System32\qmgr.dll
2007-04-12 15:15:20 0 d-------- C:\WINDOWS\System32\Macromed
2007-04-12 15:15:19 0 d-------- C:\Program Files\Movie Maker<MOVIEM~1>
2007-04-12 15:15:16 159232 --a------ C:\WINDOWS\System32\srsvc.dll
2007-04-12 15:15:16 227328 --a------ C:\WINDOWS\System32\srrstr.dll
2007-04-12 15:15:16 63488 --a------ C:\WINDOWS\System32\srclient.dll
2007-04-12 15:15:16 0 d-------- C:\WINDOWS\System32\Restore
2007-04-12 15:15:16 73728 --a------ C:\WINDOWS\System32\ils.dll
2007-04-12 15:15:16 69248 --a------ C:\WINDOWS\System32\drivers\sr.sys
2007-04-12 15:15:16 0 d-------- C:\WINDOWS\PCHealth
2007-04-12 15:15:15 24576 --a------ C:\WINDOWS\System32\nmmkcert.dll
2007-04-12 15:15:15 65536 --a------ C:\WINDOWS\System32\msconf.dll
2007-04-12 15:15:15 32256 --a------ C:\WINDOWS\System32\mnmdd.dll
2007-04-12 15:15:14 81408 --a------ C:\WINDOWS\System32\msoert2.dll
2007-04-12 15:15:14 228864 --a------ C:\WINDOWS\System32\msoeacct.dll
2007-04-12 15:15:11 160256 --a------ C:\WINDOWS\System32\schedsvc.dll
2007-04-12 15:15:11 9728 --a------ C:\WINDOWS\System32\mstinit.exe
2007-04-12 15:15:11 587776 --a------ C:\WINDOWS\System32\inetcomm.dll
2007-04-12 15:15:10 253952 --a------ C:\WINDOWS\System32\mstask.dll
2007-04-12 15:14:39 21856 --a------ C:\WINDOWS\System32\emptyregdb.dat<EMPTYR~1.DAT>
2007-04-12 15:14:24 0 d-------- C:\WINDOWS\Registration<REGIST~1>
2007-04-12 15:14:19 0 d--h----- C:\Program Files\WindowsUpdate<WINDOW~3>
2007-04-12 15:14:19 0 d-------- C:\Program Files\Usługi online<USUGIO~1>
2007-04-12 15:14:12 0 d-------- C:\Program Files\Messenger<MESSEN~1>
2007-04-12 15:14:08 5632 --a------ C:\WINDOWS\System32\write.exe
2007-04-12 15:14:08 0 d-------- C:\Program Files\MSN Gaming Zone<MSNGAM~1>
2007-04-12 15:14:02 139264 --a------ C:\WINDOWS\System32\sndvol32.exe
2007-04-12 15:14:02 125440 --a------ C:\WINDOWS\System32\sndrec32.exe
2007-04-12 15:14:02 494592 --a------ C:\WINDOWS\System32\hypertrm.dll
2007-04-12 15:14:02 44544 --a------ C:\WINDOWS\System32\hticons.dll
2007-04-12 15:14:02 73216 --a------ C:\WINDOWS\System32\avwav.dll
2007-04-12 15:14:02 231424 --a------ C:\WINDOWS\System32\avtapi.dll
2007-04-12 15:14:02 16384 --a------ C:\WINDOWS\System32\avmeter.dll
2007-04-12 15:14:02 183296 --a------ C:\WINDOWS\System32\accwiz.exe
2007-04-12 15:14:01 35328 --a------ C:\WINDOWS\System32\winchat.exe
2007-04-12 15:13:57 605696 --a------ C:\WINDOWS\System32\getuname.dll
2007-04-12 15:13:57 80896 --a------ C:\WINDOWS\System32\charmap.exe
2007-04-12 15:13:56 119808 --a------ C:\WINDOWS\System32\winmine.exe
2007-04-12 15:13:56 57344 --a------ C:\WINDOWS\System32\sol.exe
2007-04-12 15:13:56 128000 --a------ C:\WINDOWS\System32\mshearts.exe
2007-04-12 15:13:56 55808 --a------ C:\WINDOWS\System32\freecell.exe
2007-04-12 15:13:56 115200 --a------ C:\WINDOWS\System32\calc.exe
2007-04-12 15:13:54 1225 --a------ C:\WINDOWS\System32\usrlogon.cmd
2007-04-12 15:13:54 17920 --a------ C:\WINDOWS\System32\tsshutdn.exe
2007-04-12 15:13:54 16384 --a------ C:\WINDOWS\System32\tskill.exe
2007-04-12 15:13:54 15360 --a------ C:\WINDOWS\System32\tsdiscon.exe
2007-04-12 15:13:54 15360 --a------ C:\WINDOWS\System32\tscon.exe
2007-04-12 15:13:54 15360 --a------ C:\WINDOWS\System32\shadow.exe
2007-04-12 15:13:54 9728 --a------ C:\WINDOWS\System32\reset.exe
2007-04-12 15:13:54 61952 --a------ C:\WINDOWS\System32\rdshost.exe
2007-04-12 15:13:54 20232 --a------ C:\WINDOWS\System32\drivers\tdtcp.sys
2007-04-12 15:13:54 11144 --a------ C:\WINDOWS\System32\drivers\tdpipe.sys
2007-04-12 15:13:52 16384 --a------ C:\WINDOWS\System32\rwinsta.exe
2007-04-12 15:13:52 33792 --a------ C:\WINDOWS\System32\regini.exe
2007-04-12 15:13:52 4608 --a------ C:\WINDOWS\System32\rdpcfgex.dll
2007-04-12 15:13:52 22528 --a------ C:\WINDOWS\System32\qwinsta.exe
2007-04-12 15:13:52 19456 --a------ C:\WINDOWS\System32\qprocess.exe
2007-04-12 15:13:51 9728 --a------ C:\WINDOWS\System32\xolehlp.dll
2007-04-12 15:13:51 17408 --a------ C:\WINDOWS\System32\qappsrv.exe
2007-04-12 15:13:51 83968 --a------ C:\WINDOWS\System32\mtxoci.dll
2007-04-12 15:13:51 22528 --a------ C:\WINDOWS\System32\msg.exe
2007-04-12 15:13:51 151040 --a------ C:\WINDOWS\System32\msdtcuiu.dll
2007-04-12 15:13:51 869376 --a------ C:\WINDOWS\System32\msdtctm.dll
2007-04-12 15:13:51 54784 --a------ C:\WINDOWS\System32\msdtclog.dll
2007-04-12 15:13:51 6144 --a------ C:\WINDOWS\System32\msdtc.exe
2007-04-12 15:13:51 15872 --a------ C:\WINDOWS\System32\logoff.exe
2007-04-12 15:13:51 15872 --a------ C:\WINDOWS\System32\cdmodem.dll
2007-04-12 15:13:50 25088 --a------ C:\WINDOWS\System32\mtxlegih.dll
2007-04-12 15:13:50 4096 --a------ C:\WINDOWS\System32\mtxex.dll
2007-04-12 15:13:50 20480 --a------ C:\WINDOWS\System32\mtxdm.dll
2007-04-12 15:13:50 5120 --a------ C:\WINDOWS\System32\dcomcnfg.exe
2007-04-12 15:13:50 82432 --a------ C:\WINDOWS\System32\comrepl.dll
2007-04-12 15:13:50 25600 --a------ C:\WINDOWS\System32\comaddin.dll
2007-04-12 15:13:50 56832 --a------ C:\WINDOWS\System32\colbact.dll
2007-04-12 15:13:49 54272 --a------ C:\WINDOWS\System32\stclient.dll
2007-04-12 15:13:49 495616 --a------ C:\WINDOWS\System32\comuid.dll
2007-04-12 15:13:49 147456 --a------ C:\WINDOWS\System32\comsnap.dll
2007-04-12 15:13:49 468480 --a------ C:\WINDOWS\System32\clbcatq.dll
2007-04-12 15:13:49 100864 --a------ C:\WINDOWS\System32\clbcatex.dll
2007-04-12 15:13:49 85504 --a------ C:\WINDOWS\System32\catsrvps.dll
2007-04-12 15:13:49 215040 --a------ C:\WINDOWS\System32\catsrv.dll
2007-04-12 15:13:41 53248 --a------ C:\WINDOWS\System32\servdeps.dll
2007-04-12 15:13:41 16896 --a------ C:\WINDOWS\System32\mmfutil.dll
2007-04-12 15:13:41 177152 --a------ C:\WINDOWS\System32\cmprops.dll
2007-04-12 15:13:37 9216 --a------ C:\WINDOWS\System32\wuauserv.dll
2007-04-12 15:13:37 189440 --a------ C:\WINDOWS\System32\wuaueng.dll
2007-04-12 15:13:37 142336 --a------ C:\WINDOWS\System32\wuauclt.exe
2007-04-12 15:13:37 534016 --a------ C:\WINDOWS\System32\spider.exe
2007-04-12 15:13:37 342016 --a------ C:\WINDOWS\System32\mspaint.exe
2007-04-12 15:13:37 118272 --a------ C:\WINDOWS\System32\mplay32.exe
2007-04-12 15:13:37 115976 --a------ C:\WINDOWS\System32\drivers\rdpwd.sys
2007-04-12 15:13:37 99328 --a------ C:\WINDOWS\System32\clipbrd.exe
2007-04-12 15:13:37 0 d-------- C:\Program Files\Windows NT<WINDOW~1>
2007-04-12 15:13:36 89088 --a------ C:\WINDOWS\System32\tscfgwmi.dll
2007-04-12 15:13:36 130048 --a------ C:\WINDOWS\System32\sessmgr.exe
2007-04-12 15:13:36 56832 --a------ C:\WINDOWS\System32\remotepg.dll
2007-04-12 15:13:36 12288 --a------ C:\WINDOWS\System32\rdsaddin.exe
2007-04-12 15:13:36 135680 --a------ C:\WINDOWS\System32\rdchost.dll
2007-04-12 15:13:36 598016 --a------ C:\WINDOWS\System32\mstscax.dll
2007-04-12 15:13:36 390144 --a------ C:\WINDOWS\System32\mstsc.exe
2007-04-12 15:13:34 40960 --a------ C:\WINDOWS\System32\tscupgrd.exe
2007-04-12 15:13:34 201216 --a------ C:\WINDOWS\System32\termsrv.dll
2007-04-12 15:13:34 75912 --a------ C:\WINDOWS\System32\rdpwsx.dll
2007-04-12 15:13:34 14848 --a------ C:\WINDOWS\System32\rdpsnd.dll
2007-04-12 15:13:34 44032 --a------ C:\WINDOWS\System32\rdpclip.exe
2007-04-12 15:13:33 359936 --a------ C:\WINDOWS\System32\msdtcprx.dll
2007-04-12 15:13:33 0 d-------- C:\WINDOWS\System32\MsDtc
2007-04-12 15:13:33 9216 --a------ C:\WINDOWS\System32\icaapi.dll
2007-04-12 15:13:33 0 d-------- C:\WINDOWS\System32\Com
2007-04-12 15:13:33 32768 --a------ C:\WINDOWS\System32\cfgbkend.dll
2007-04-12 15:13:33 582656 --a------ C:\WINDOWS\System32\catsrvut.dll
2007-04-12 15:13:32 1172992 --a------ C:\WINDOWS\System32\comsvcs.dll
2007-04-12 15:13:29 57856 --a------ C:\WINDOWS\System32\licwmi.dll
2007-04-12 15:13:24 38024 --a------ C:\WINDOWS\System32\drivers\termdd.sys
2007-04-12 15:13:24 182400 --a------ C:\WINDOWS\System32\drivers\rdpdr.sys
-- Find3M Report ---------------------------------------------------------------
2007-04-23 18:13:01 0 d---s---- C:\Documents and Settings\USER\Dane aplikacji\Microsoft<MICROS~1>
2007-04-17 11:59:49 355486 --a------ C:\WINDOWS\System32\perfh015.dat
2007-04-17 11:59:49 49492 --a------ C:\WINDOWS\System32\perfc015.dat
2007-04-16 12:00:36 0 d-------- C:\Documents and Settings\USER\Dane aplikacji\PC Tools<PCTOOL~1>
2007-04-13 13:13:01 0 d-------- C:\Documents and Settings\USER\Dane aplikacji\Help
2007-04-12 16:31:21 0 d-------- C:\Documents and Settings\USER\Dane aplikacji\Macromedia<MACROM~1>
2007-04-12 16:23:28 0 d-------- C:\Documents and Settings\USER\Dane aplikacji\Lavasoft
2007-04-12 16:08:12 62 --ahs---- C:\Documents and Settings\USER\Dane aplikacji\desktop.ini
2007-04-12 15:54:45 0 d-------- C:\Documents and Settings\USER\Dane aplikacji\Mozilla
2007-04-12 15:28:24 0 d-------- C:\Documents and Settings\USER\Dane aplikacji\Identities<IDENTI~1>
2007-03-09 20:52:52 200768 --a------ C:\WINDOWS\System32\klogon.dll
-- Registry Dump ---------------------------------------------------------------
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Gadu-Gadu"="\"C:\\Program Files\\Gadu-fGadu\\gg.exe\" /tray"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SpeedTouch USB Diagnostics"="\"C:\\Program Files\\Thomson\\SpeedTouch USB\\Dragdiag.exe\" /icon"
"AVP"="\"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe\""
"BearShare"="\"C:\\Program Files\\BearShare\\BearShare.exe\" /pause"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Development Environment]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="devenv"
"hkey"="HKLM"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nod32 Service]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="nod64"
"hkey"="HKLM"
"command"="nod64.exe"
"inimapping"="0"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{2354A369-FB71-4D46-AE6D-701001F6D987}"=""
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
-- End of ComboScan: finished at 2007-04-23 at 23:07:19 ------------------------
"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"Gadu-Gadu" = ""C:\Program Files\Gadu-fGadu\gg.exe" /tray" ["Gadu-Gadu S.A."]
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"]
"AVP" = ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"" ["Kaspersky Lab"]
"BearShare" = ""C:\Program Files\BearShare\BearShare.exe" /pause" ["Free Peers, Inc."]
HKLM\Software\Microsoft\Active Setup\Installed Components\
{306D6C21-C1B6-4629-986C-E59E1875B8AF}\(Default) = (no title provided)
\StubPath = ""C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Messenger\msgsc.dll",ShowIconsUser" [MS]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{85E0B171-04FA-11D1-B7DA-00A0C90348D6}" = "Statystyki ochrony WWW"
-> {HKLM...CLSID} = "Statystyki ochrony WWW"
\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll" ["Kaspersky Lab"]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]
<<!>> klogon\DLLName = "C:\WINDOWS\System32\klogon.dll" ["Kaspersky Lab"]
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\ShellEx.dll" ["Kaspersky Lab"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\ShellEx.dll" ["Kaspersky Lab"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------
Note: detected settings may not have any effect.
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\
"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}
"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}
Active Desktop and Wallpaper:
-----------------------------
Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\Documents and Settings\USER\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"
Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\USER\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"
Winsock2 Service Provider DLLs:
-------------------------------
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
C:\WINDOWS\System32\imon.dll ["Eset "], 01 - 05, 11
%SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 12 - 21
%SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10
Toolbars, Explorer Bars, Extensions:
------------------------------------
Toolbars
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{37B85A29-692B-4205-9CAD-2626E4993404}"
-> {HKLM...CLSID} = "My Global Search Bar"
\InProcServer32\(Default) = "C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL" ["My Global Search"]
Explorer Bars
HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
HKLM\Software\Classes\CLSID\{85E0B171-04FA-11D1-B7DA-00A0C90348D6}\(Default) = "Statystyki ochrony WWW"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll" ["Kaspersky Lab"]
Extensions (Tools menu items, main toolbar menu buttons)
HKLM\Software\Microsoft\Internet Explorer\Extensions\
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\
"ButtonText" = "Statystyki ochrony WWW"
Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------
Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\System32\Ati2evxx.exe" ["ATI Technologies Inc."]
----------
<<!>>: Suspicious data at a malware launch point.
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 52 seconds, including 2 seconds for message boxes)
przez wojtas 24 Kwi 2007, 15:30
Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:
Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
wklejasz do notatnika:
w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG
Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru...
Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z comboscana oraz silent
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:
Files to delete:
C:\WINDOWS\System32\.exe
C:\WINDOWS\System32\lnternat.exe
Folders to delete:
C:\Program Files\MyGlobalSearch
Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
wklejasz do notatnika:
Windows Registry Editor Version 5.00
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Nod32 Service]
[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Development Environment]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{2354A369-FB71-4D46-AE6D-701001F6D987}"=-
[HKEY_CURRENT_USER\Software\Microsoft\Internet\Explorer\Toolbar\WebBrowser]
"{37B85A29-692B-4205-9CAD-2626E4993404}"=-
w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG
Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru...
Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z comboscana oraz silent
-
wojtas - *mod
- Posty: 18165
- Dołączenie: 13 Sty 2006, 16:00
- Miejscowość: Krzeszyce
- Pochwały: 1656
-
przez Gerwazy 24 Kwi 2007, 16:50
"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows XP
Output limited to non-default values, except where indicated by "{++}"
Startup items buried in registry:
---------------------------------
HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"Gadu-Gadu" = ""C:\Program Files\Gadu-fGadu\gg.exe" /tray" ["Gadu-Gadu S.A."]
HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"]
"AVP" = ""C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"" ["Kaspersky Lab"]
"BearShare" = ""C:\Program Files\BearShare\BearShare.exe" /pause" ["Free Peers, Inc."]
HKLM\Software\Microsoft\Active Setup\Installed Components\
{306D6C21-C1B6-4629-986C-E59E1875B8AF}\(Default) = (no title provided)
\StubPath = ""C:\WINDOWS\System32\rundll32.exe" "C:\Program Files\Messenger\msgsc.dll",ShowIconsUser" [MS]
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{37B85A21-692B-4205-9CAD-2626E4993404}\(Default) = "My Global Search Bar BHO"
-> {HKLM...CLSID} = "My Global Search Bar BHO"
\InProcServer32\(Default) = "C:\Program Files\MyGlobalSearch\bar\2.bin\MGSBAR.DLL" ["My Global Search"]
HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{85E0B171-04FA-11D1-B7DA-00A0C90348D6}" = "Statystyki ochrony WWW"
-> {HKLM...CLSID} = "Statystyki ochrony WWW"
\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll" ["Kaspersky Lab"]
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]
<<!>> klogon\DLLName = "C:\WINDOWS\System32\klogon.dll" ["Kaspersky Lab"]
HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\ShellEx.dll" ["Kaspersky Lab"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\ShellEx.dll" ["Kaspersky Lab"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------
Note: detected settings may not have any effect.
HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\
"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}
"undockwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Devices: Allow undock without having to log on}
Active Desktop and Wallpaper:
-----------------------------
Active Desktop may be disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState
Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\Documents and Settings\USER\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"
Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\Documents and Settings\USER\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp"
Winsock2 Service Provider DLLs:
-------------------------------
Namespace Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
Transport Service Providers
HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
C:\WINDOWS\System32\imon.dll ["Eset "], 01 - 05, 11
%SystemRoot%\system32\mswsock.dll [MS], 06 - 08, 12 - 21
%SystemRoot%\system32\rsvpsp.dll [MS], 09 - 10
Toolbars, Explorer Bars, Extensions:
------------------------------------
Toolbars
HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{37B85A29-692B-4205-9CAD-2626E4993404}"
-> {HKLM...CLSID} = "My Global Search Bar"
\InProcServer32\(Default) = "C:\Program Files\MyGlobalSearch\bar\2.bin\MGSBAR.DLL" ["My Global Search"]
HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{37B85A29-692B-4205-9CAD-2626E4993404}" = (no title provided)
-> {HKLM...CLSID} = "My Global Search Bar"
\InProcServer32\(Default) = "C:\Program Files\MyGlobalSearch\bar\2.bin\MGSBAR.DLL" ["My Global Search"]
Explorer Bars
HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\
HKLM\Software\Classes\CLSID\{85E0B171-04FA-11D1-B7DA-00A0C90348D6}\(Default) = "Statystyki ochrony WWW"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll" ["Kaspersky Lab"]
Extensions (Tools menu items, main toolbar menu buttons)
HKLM\Software\Microsoft\Internet Explorer\Extensions\
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\
"ButtonText" = "Statystyki ochrony WWW"
Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------
Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\System32\Ati2evxx.exe" ["ATI Technologies Inc."]
Kaspersky Anti-Virus 6.0, AVP, "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe -r" ["Kaspersky Lab"]
----------
<<!>>: Suspicious data at a malware launch point.
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 61 seconds, including 2 seconds for message boxes)
ComboScan v20070306.20 run by USER on 2007-04-24 at 16:35:46
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- HijackThis (run as USER.exe) ------------------------------------------------
Logfile of HijackThis v1.99.1
Scan saved at 16:35:49, on 2007-04-24
Platform: Windows XP Dodatek SP. 1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\USER\Pulpit\comboscan.exe
C:\PROGRA~1\HIJACK~1\USER.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://google.bearshare.com/pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\2.bin\MGSBAR.DLL
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\2.bin\MGSBAR.DLL
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe"
O4 - HKLM\..\Run: [BearShare] "C:\Program Files\BearShare\BearShare.exe" /pause
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-fGadu\gg.exe" /tray
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\scieplugin.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{F707E3E3-10A7-4FB6-BA4E-BB0A3B46D17C}: NameServer = 213.241.79.37 83.238.255.76
O20 - Winlogon Notify: klogon - C:\WINDOWS\System32\klogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Kaspersky Anti-Virus 6.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 6.0\avp.exe
-- Files created between 2007-03-24 and 2007-04-24 -----------------------------
2007-04-24 14:42:06 0 d-------- C:\Program Files\MyGlobalSearch<MYGLOB~1>
2007-04-24 14:42:05 0 d-------- C:\Program Files\BearShare<BEARSH~1>
2007-04-24 14:42:05 0 d-------- C:\My Downloads<MYDOWN~1>
2007-04-24 11:26:56 0 d-a------ C:\WINDOWS\zts2.exe
2007-04-24 11:26:56 0 d-a------ C:\WINDOWS\System32\vcmgcd32.dll
2007-04-24 11:26:56 0 d-a------ C:\WINDOWS\System32\iifgfgf.dll
2007-04-24 11:26:56 0 d-a------ C:\WINDOWS\rundll16.exe
2007-04-24 11:26:56 0 d-a------ C:\WINDOWS\rundl132.dll
2007-04-24 11:26:56 0 d-a------ C:\WINDOWS\logo1_.exe
2007-04-24 11:25:03 132608 --a------ C:\WINDOWS\System32\TASKMGR.COM
2007-04-24 11:25:03 132608 --a------ C:\WINDOWS\System32\T.COM
2007-04-24 11:25:03 137216 --a------ C:\WINDOWS\R.COM
2007-04-23 21:01:54 0 --ahs---- C:\WINDOWS\System32\.exe<EXE~1>
2007-04-23 15:32:12 0 d-------- C:\WINDOWS\speech
2007-04-23 15:32:03 0 d-------- C:\Program Files\ivo
2007-04-22 16:54:14 0 --a------ C:\WINDOWS\System32\lnternat.exe
2007-04-19 20:54:15 74396 --a------ C:\WINDOWS\System32\drivers\klin.dat
2007-04-19 20:54:15 75932 --a------ C:\WINDOWS\System32\drivers\klick.dat
2007-04-19 20:53:54 0 d-------- C:\Program Files\Kaspersky Lab<KASPER~1>
2007-04-19 20:53:52 64800 --ahs---- C:\WINDOWS\System32\drivers\fidbox2.dat
2007-04-19 20:53:52 1797408 --ahs---- C:\WINDOWS\System32\drivers\fidbox.dat
2007-04-19 20:53:21 0 d-------- C:\KAV
2007-04-18 21:22:38 0 d-------- C:\Program Files\Tibia Auto<TIBIAA~1>
2007-04-18 21:21:36 0 d-------- C:\Python24
2007-04-17 16:50:59 115880 -----n--- C:\WINDOWS\System32\pxinsi64.exe
2007-04-17 16:50:59 129784 -----n--- C:\WINDOWS\System32\pxafs.dll
2007-04-17 16:50:59 36528 -----n--- C:\WINDOWS\System32\drivers\PxHelp20.sys
2007-04-17 16:50:59 2560 -----n--- C:\WINDOWS\System32\drivers\cdralw2k.sys
2007-04-17 16:50:59 2432 -----n--- C:\WINDOWS\System32\drivers\cdr4_xp.sys
2007-04-17 16:50:49 0 d-------- C:\Program Files\Winamp
2007-04-17 07:15:04 442967 ---hs---- C:\WINDOWS\System32\ehkmp.ini2<EHKMP~1.INI>
2007-04-15 20:08:27 137216 --a------ C:\WINDOWS\REGEDIT.COM
2007-04-15 17:59:08 461402 ---hs---- C:\WINDOWS\System32\ehkmp.bak2<EHKMP~2.BAK>
2007-04-15 16:53:07 5606 --a------ C:\WINDOWS\System32\stci.dll
2007-04-15 16:53:07 5280 --a------ C:\WINDOWS\System32\drivers\alcawh.sys
2007-04-15 16:53:07 70688 --a------ C:\WINDOWS\System32\drivers\alcaudsl.sys
2007-04-15 16:53:07 3968 --a------ C:\WINDOWS\System32\drivers\alcacr.sys
2007-04-15 16:53:04 0 d-------- C:\Program Files\Thomson
2007-04-15 13:55:44 48 --a------ C:\WINDOWS\System32\imon1.dat
2007-04-15 13:34:43 0 d--h----- C:\WINDOWS\PIF
2007-04-13 22:38:12 348160 --a------ C:\WINDOWS\System32\MSVCR71.dll
2007-04-13 22:38:12 499712 --a------ C:\WINDOWS\System32\MSVCP71.dll
2007-04-13 22:38:12 1060864 --a------ C:\WINDOWS\System32\MFC71.dll
2007-04-13 21:06:54 41474 --ahs---- C:\WINDOWS\System32\smsc.exe
2007-04-12 19:24:45 0 d-------- C:\Program Files\Tibia
2007-04-12 17:38:02 0 d-------- C:\WINDOWS\pss
2007-04-12 17:28:27 0 d-------- C:\Program Files\Gadu-fGadu<GADU-F~1>
2007-04-12 17:20:59 458750 ---hs---- C:\WINDOWS\System32\ehkmp.bak1<EHKMP~1.BAK>
2007-04-12 17:12:26 1137664 -ra------ C:\WINDOWS\System32\mswLp.exe
2007-04-12 17:11:07 53600 --a------ C:\WINDOWS\System32\drivers\alcan5wn.sys
2007-04-12 17:03:28 0 d-------- C:\WINDOWS
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\WinSxS
2007-04-12 17:03:28 0 dr------- C:\WINDOWS\Web
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\twain_32
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\system32
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\wins
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\wbem
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\usmt
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\spool
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\ShellExt
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\Setup
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\ras
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\oobe
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\npp
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\mui
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\inetsrv
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\IME
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\icsxml
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\ias
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\export
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\drivers
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\drivers\etc
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\drivers\disdn
2007-04-12 17:03:28 0 dr-hs--c- C:\WINDOWS\System32\dllcache
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\dhcp
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\config
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\3com_dmi
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\3076
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\2052
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\1054
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\1045
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\1042
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\1041
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\1037
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\1033
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\1031
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\1028
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\System32\1025
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\system
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\security
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\Resources<RESOUR~1>
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\repair
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\mui
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\msapps
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\msagent
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\Media
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\java
2007-04-12 17:03:28 0 d--h----- C:\WINDOWS\inf
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\ime
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\Help
2007-04-12 17:03:28 0 dr--s---- C:\WINDOWS\Fonts
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\Driver Cache<DRIVER~1>
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\Debug
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\Cursors
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\Connection Wizard<CONNEC~1>
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\Config
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\AppPatch
2007-04-12 17:03:28 0 d-------- C:\WINDOWS\addins
2007-04-12 16:32:39 0 d-------- C:\Program Files\ToniArts
2007-04-12 16:31:12 1168 --a------ C:\WINDOWS\mozver.dat
2007-04-12 16:10:50 3072 --a------ C:\WINDOWS\System32\drivers\audstub.sys
2007-04-12 16:10:13 57856 --a------ C:\WINDOWS\System32\drivers\redbook.sys
2007-04-12 16:09:53 9856 --a------ C:\WINDOWS\System32\drivers\gameenum.sys
2007-04-12 16:09:37 27165 --a------ C:\WINDOWS\System32\drivers\fetnd5.sys
2007-04-12 16:09:32 70144 --a------ C:\WINDOWS\System32\usbui.dll
2007-04-12 16:08:33 0 d-------- C:\Program Files\Common Files\ODBC
2007-04-12 16:08:30 0 dr------- C:\Program Files<PROGRA~1>
2007-04-12 16:08:30 0 d-------- C:\Program Files\Common Files\SpeechEngines<SPEECH~1>
2007-04-12 16:08:28 6144 -ra------ C:\WINDOWS\System32\kbdtuq.dll
2007-04-12 16:08:28 6144 -ra------ C:\WINDOWS\System32\kbdtuf.dll
2007-04-12 16:08:28 5632 -ra------ C:\WINDOWS\System32\kbdazel.dll
2007-04-12 16:08:27 5632 -ra------ C:\WINDOWS\System32\kbdmon.dll
2007-04-12 16:08:27 5632 -ra------ C:\WINDOWS\System32\kbdkyr.dll
2007-04-12 16:08:25 8192 -ra------ C:\WINDOWS\System32\kbdhept.dll
2007-04-12 16:08:25 6656 -ra------ C:\WINDOWS\System32\kbdhela3.dll
2007-04-12 16:08:25 6144 -ra------ C:\WINDOWS\System32\kbdhela2.dll
2007-04-12 16:08:25 5632 -ra------ C:\WINDOWS\System32\kbdhe319.dll
2007-04-12 16:08:25 5632 -ra------ C:\WINDOWS\System32\kbdhe220.dll
2007-04-12 16:08:25 5632 -ra------ C:\WINDOWS\System32\kbdhe.dll
2007-04-12 16:08:25 6144 -ra------ C:\WINDOWS\System32\kbdgkl.dll
2007-04-12 16:08:24 6144 -ra------ C:\WINDOWS\System32\kbdlv1.dll
2007-04-12 16:08:24 6144 -ra------ C:\WINDOWS\System32\kbdlv.dll
2007-04-12 16:08:24 5632 -ra------ C:\WINDOWS\System32\kbdlt1.dll
2007-04-12 16:08:24 5632 -ra------ C:\WINDOWS\System32\kbdlt.dll
2007-04-12 16:08:24 6144 -ra------ C:\WINDOWS\System32\kbdest.dll
2007-04-12 16:08:22 6656 --a------ C:\WINDOWS\System32\kbdycl.dll
2007-04-12 16:08:22 6656 --a------ C:\WINDOWS\System32\kbdsl1.dll
2007-04-12 16:08:22 6656 --a------ C:\WINDOWS\System32\kbdsl.dll
2007-04-12 16:08:22 5632 --a------ C:\WINDOWS\System32\kbdro.dll
2007-04-12 16:08:22 5632 --a------ C:\WINDOWS\System32\kbdhu1.dll
2007-04-12 16:08:22 6656 --a------ C:\WINDOWS\System32\kbdhu.dll
2007-04-12 16:08:22 6656 --a------ C:\WINDOWS\System32\kbdcz2.dll
2007-04-12 16:08:22 6656 --a------ C:\WINDOWS\System32\kbdcz1.dll
2007-04-12 16:08:22 7168 --a------ C:\WINDOWS\System32\kbdcz.dll
2007-04-12 16:08:22 6656 --a------ C:\WINDOWS\System32\kbdcr.dll
2007-04-12 16:08:22 6656 --a------ C:\WINDOWS\System32\KBDAL.DLL
2007-04-12 16:08:21 24661 --a------ C:\WINDOWS\System32\spxcoins.dll
2007-04-12 16:08:21 13312 --a------ C:\WINDOWS\System32\irclass.dll
2007-04-12 16:08:21 103424 --a------ C:\WINDOWS\System32\EqnClass.Dll
2007-04-12 16:08:21 10496 --a------ C:\WINDOWS\System32\drivers\irenum.sys
2007-04-12 16:08:21 85532 --a------ C:\WINDOWS\System32\dgsetup.dll
2007-04-12 16:08:21 176157 --a------ C:\WINDOWS\System32\dgrpsetu.dll
2007-04-12 16:08:20 9168 --a------ C:\WINDOWS\system\VER.DLL
2007-04-12 16:08:20 19200 --a------ C:\WINDOWS\system\TAPI.DLL
2007-04-12 16:08:20 5120 --a------ C:\WINDOWS\system\SHELL.DLL
2007-04-12 16:08:20 24064 --a------ C:\WINDOWS\system\OLESVR.DLL
2007-04-12 16:08:20 83456 --a------ C:\WINDOWS\system\OLECLI.DLL
2007-04-12 16:08:20 127008 --a------ C:\WINDOWS\system\MSVIDEO.DLL
2007-04-12 16:08:20 69712 --a------ C:\WINDOWS\system\MMSYSTEM.DLL
2007-04-12 16:08:20 9936 --a------ C:\WINDOWS\system\LZEXPAND.DLL
2007-04-12 16:08:20 33376 --a------ C:\WINDOWS\system\COMMDLG.DLL
2007-04-12 16:08:20 109488 --a------ C:\WINDOWS\system\AVIFILE.DLL
2007-04-12 16:08:19 15360 --a------ C:\WINDOWS\TASKMAN.EXE
2007-04-12 16:08:19 72192 --a------ C:\WINDOWS\System32\storprop.dll
2007-04-12 16:08:19 6656 --a------ C:\WINDOWS\System32\batt.dll
2007-04-12 16:08:19 70096 --a------ C:\WINDOWS\system\AVICAP.DLL
2007-04-12 16:08:19 67072 --a------ C:\WINDOWS\NOTEPAD.EXE
2007-04-12 16:07:59 0 d-------- C:\WINDOWS\System32\CatRoot2
2007-04-12 16:07:59 0 d-------- C:\WINDOWS\System32\CatRoot
2007-04-12 16:07:40 0 d-------- C:\Documents and Settings<DOCUME~1>
2007-04-12 15:55:51 270336 --a------ C:\WINDOWS\System32\imon.dll
2007-04-12 15:54:47 0 --a------ C:\WINDOWS\nsreg.dat
2007-04-12 15:54:40 0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1>
2007-04-12 15:54:03 0 d-------- C:\Program Files\Lavasoft
2007-04-12 15:51:35 516096 -----n--- C:\WINDOWS\System32\ati2sgag.exe
2007-04-12 15:51:21 0 d-------- C:\Program Files\ATI Technologies<ATITEC~1>
2007-04-12 15:50:56 0 d-------- C:\ATI
2007-04-12 15:48:49 5888 --a------ C:\WINDOWS\System32\drivers\splitter.sys
2007-04-12 15:48:48 77440 --a------ C:\WINDOWS\System32\drivers\wdmaud.sys
2007-04-12 15:48:46 50048 --a------ C:\WINDOWS\System32\drivers\DMusic.sys
2007-04-12 15:48:46 40960 --a------ C:\WINDOWS\System32\ChCfg.exe
2007-04-12 15:48:43 54272 --a------ C:\WINDOWS\System32\drivers\swmidi.sys
2007-04-12 15:48:40 142208 --a------ C:\WINDOWS\System32\drivers\aec.sys
2007-04-12 15:48:38 159360 --a------ C:\WINDOWS\System32\drivers\kmixer.sys
2007-04-12 15:48:37 2816 --a------ C:\WINDOWS\System32\drivers\drmkaud.sys
2007-04-12 15:48:36 56832 --a------ C:\WINDOWS\System32\drivers\sysaudio.sys
2007-04-12 15:48:23 7040 --a------ C:\WINDOWS\System32\drivers\MSKSSRV.sys
2007-04-12 15:48:22 4608 --a------ C:\WINDOWS\System32\drivers\MSPQM.sys
2007-04-12 15:48:21 5120 --a------ C:\WINDOWS\System32\drivers\MSPCLOCK.sys
2007-04-12 15:48:15 4096 --a------ C:\WINDOWS\System32\ksuser.dll
2007-04-12 15:48:15 44416 --a------ C:\WINDOWS\System32\drivers\stream.sys
2007-04-12 15:48:15 134272 --a------ C:\WINDOWS\System32\drivers\portcls.sys
2007-04-12 15:48:15 131712 --a------ C:\WINDOWS\System32\drivers\ks.sys
2007-04-12 15:48:15 57856 --a------ C:\WINDOWS\System32\drivers\drmk.sys
2007-04-12 15:48:07 10527744 --a------ C:\WINDOWS\System32\RTLCPL.exe
2007-04-12 15:48:07 0 d-------- C:\Program Files\Realtek AC97<REALTE~1>
2007-04-12 15:48:05 143360 --a------ C:\WINDOWS\System32\RtlCPAPI.dll
2007-04-12 15:48:05 3972672 --a------ C:\WINDOWS\System32\drivers\alcxwdm.sys
2007-04-12 15:48:05 577536 --a------ C:\WINDOWS\soundman.exe
2007-04-12 15:48:04 315392 --a------ C:\WINDOWS\alcupd.exe
2007-04-12 15:48:04 217088 --a------ C:\WINDOWS\Alcrmv.exe
2007-04-12 15:48:04 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1>
2007-04-12 15:47:29 0 d-------- C:\Program Files\Common Files\InstallShield<INSTAL~1>
2007-04-12 15:43:43 545 --a------ C:\WINDOWS\UC.PIF
2007-04-12 15:43:43 545 --a------ C:\WINDOWS\RAR.PIF
2007-04-12 15:43:43 545 --a------ C:\WINDOWS\PKZIP.PIF
2007-04-12 15:43:43 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2007-04-12 15:43:43 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2007-04-12 15:43:43 545 --a------ C:\WINDOWS\LHA.PIF
2007-04-12 15:43:43 545 --a------ C:\WINDOWS\ARJ.PIF
2007-04-12 15:43:43 0 d-------- C:\totalcmd
2007-04-12 15:28:26 0 d--hs---- C:\WINDOWS\Installer<INSTAL~1>
2007-04-12 15:27:21 0 d-------- C:\WINDOWS\Prefetch
2007-04-12 15:27:21 0 d--hs---- C:\System Volume Information<SYSTEM~1>
2007-04-12 15:18:00 0 d-------- C:\WINDOWS\System32\xircom
2007-04-12 15:18:00 0 d-------- C:\Program Files\microsoft frontpage<MICROS~1>
2007-04-12 15:17:40 0 -rahs---- C:\MSDOS.SYS
2007-04-12 15:17:40 0 -rahs---- C:\IO.SYS
2007-04-12 15:17:40 0 --a------ C:\CONFIG.SYS
2007-04-12 15:17:40 0 -----n--- C:\AUTOEXEC.BAT
2007-04-12 15:17:27 112128 --a------ C:\WINDOWS\System32\mapi32.dll
2007-04-12 15:16:31 0 dr------- C:\WINDOWS\Offline Web Pages<OFFLIN~1>
2007-04-12 15:16:31 0 d---s---- C:\WINDOWS\Downloaded Program Files<DOWNLO~1>
2007-04-12 15:16:05 0 d-------- C:\WINDOWS\System32\DirectX
2007-04-12 15:15:41 40960 --a------ C:\WINDOWS\System32\safrslv.dll
2007-04-12 15:15:41 26624 --a------ C:\WINDOWS\System32\safrdm.dll
2007-04-12 15:15:41 39424 --a------ C:\WINDOWS\System32\safrcdlg.dll
2007-04-12 15:15:41 33792 --a------ C:\WINDOWS\System32\racpldlg.dll
2007-04-12 15:15:40 11264 --a------ C:\WINDOWS\System32\atrace.dll
2007-04-12 15:15:33 12288 --a------ C:\WINDOWS\System32\nmevtmsg.dll
2007-04-12 15:15:33 32768 --a------ C:\WINDOWS\System32\mnmsrvc.exe
2007-04-12 15:15:33 28672 --a------ C:\WINDOWS\System32\isrdbg32.dll
2007-04-12 15:15:32 67584 --a------ C:\WINDOWS\System32\acctres.dll
2007-04-12 15:15:30 49152 --a------ C:\WINDOWS\System32\inetres.dll
2007-04-12 15:15:27 0 d---s---- C:\WINDOWS\Tasks
2007-04-12 15:15:27 81920 --a------ C:\WINDOWS\System32\isign32.dll
2007-04-12 15:15:27 270336 --a------ C:\WINDOWS\System32\inetcfg.dll
2007-04-12 15:15:27 61440 --a------ C:\WINDOWS\System32\icwphbk.dll
2007-04-12 15:15:27 69632 --a------ C:\WINDOWS\System32\icwdial.dll
2007-04-12 15:15:27 16384 --a------ C:\WINDOWS\System32\icfgnt5.dll
2007-04-12 15:15:24 0 d-------- C:\Program Files\Common Files\MSSoap
2007-04-12 15:15:21 0 d-------- C:\WINDOWS\srchasst
2007-04-12 15:15:20 17408 --a------ C:\WINDOWS\System32\qmgrprxy.dll
2007-04-12 15:15:20 221696 --a------ C:\WINDOWS\System32\qmgr.dll
2007-04-12 15:15:20 0 d-------- C:\WINDOWS\System32\Macromed
2007-04-12 15:15:19 0 d-------- C:\Program Files\Movie Maker<MOVIEM~1>
2007-04-12 15:15:16 159232 --a------ C:\WINDOWS\System32\srsvc.dll
2007-04-12 15:15:16 227328 --a------ C:\WINDOWS\System32\srrstr.dll
2007-04-12 15:15:16 63488 --a------ C:\WINDOWS\System32\srclient.dll
2007-04-12 15:15:16 0 d-------- C:\WINDOWS\System32\Restore
2007-04-12 15:15:16 73728 --a------ C:\WINDOWS\System32\ils.dll
2007-04-12 15:15:16 69248 --a------ C:\WINDOWS\System32\drivers\sr.sys
2007-04-12 15:15:16 0 d-------- C:\WINDOWS\PCHealth
2007-04-12 15:15:15 24576 --a------ C:\WINDOWS\System32\nmmkcert.dll
2007-04-12 15:15:15 65536 --a------ C:\WINDOWS\System32\msconf.dll
2007-04-12 15:15:15 32256 --a------ C:\WINDOWS\System32\mnmdd.dll
2007-04-12 15:15:14 81408 --a------ C:\WINDOWS\System32\msoert2.dll
2007-04-12 15:15:14 228864 --a------ C:\WINDOWS\System32\msoeacct.dll
2007-04-12 15:15:11 160256 --a------ C:\WINDOWS\System32\schedsvc.dll
2007-04-12 15:15:11 9728 --a------ C:\WINDOWS\System32\mstinit.exe
2007-04-12 15:15:11 587776 --a------ C:\WINDOWS\System32\inetcomm.dll
2007-04-12 15:15:10 253952 --a------ C:\WINDOWS\System32\mstask.dll
2007-04-12 15:14:39 21856 --a------ C:\WINDOWS\System32\emptyregdb.dat<EMPTYR~1.DAT>
2007-04-12 15:14:24 0 d-------- C:\WINDOWS\Registration<REGIST~1>
2007-04-12 15:14:19 0 d--h----- C:\Program Files\WindowsUpdate<WINDOW~3>
2007-04-12 15:14:19 0 d-------- C:\Program Files\Usługi online<USUGIO~1>
2007-04-12 15:14:12 0 d-------- C:\Program Files\Messenger<MESSEN~1>
2007-04-12 15:14:08 5632 --a------ C:\WINDOWS\System32\write.exe
2007-04-12 15:14:08 0 d-------- C:\Program Files\MSN Gaming Zone<MSNGAM~1>
2007-04-12 15:14:02 139264 --a------ C:\WINDOWS\System32\sndvol32.exe
2007-04-12 15:14:02 125440 --a------ C:\WINDOWS\System32\sndrec32.exe
2007-04-12 15:14:02 494592 --a------ C:\WINDOWS\System32\hypertrm.dll
2007-04-12 15:14:02 44544 --a------ C:\WINDOWS\System32\hticons.dll
2007-04-12 15:14:02 73216 --a------ C:\WINDOWS\System32\avwav.dll
2007-04-12 15:14:02 231424 --a------ C:\WINDOWS\System32\avtapi.dll
2007-04-12 15:14:02 16384 --a------ C:\WINDOWS\System32\avmeter.dll
2007-04-12 15:14:02 183296 --a------ C:\WINDOWS\System32\accwiz.exe
2007-04-12 15:14:01 35328 --a------ C:\WINDOWS\System32\winchat.exe
2007-04-12 15:13:57 605696 --a------ C:\WINDOWS\System32\getuname.dll
2007-04-12 15:13:57 80896 --a------ C:\WINDOWS\System32\charmap.exe
2007-04-12 15:13:56 119808 --a------ C:\WINDOWS\System32\winmine.exe
2007-04-12 15:13:56 57344 --a------ C:\WINDOWS\System32\sol.exe
2007-04-12 15:13:56 128000 --a------ C:\WINDOWS\System32\mshearts.exe
2007-04-12 15:13:56 55808 --a------ C:\WINDOWS\System32\freecell.exe
2007-04-12 15:13:56 115200 --a------ C:\WINDOWS\System32\calc.exe
2007-04-12 15:13:54 1225 --a------ C:\WINDOWS\System32\usrlogon.cmd
2007-04-12 15:13:54 17920 --a------ C:\WINDOWS\System32\tsshutdn.exe
2007-04-12 15:13:54 16384 --a------ C:\WINDOWS\System32\tskill.exe
2007-04-12 15:13:54 15360 --a------ C:\WINDOWS\System32\tsdiscon.exe
2007-04-12 15:13:54 15360 --a------ C:\WINDOWS\System32\tscon.exe
2007-04-12 15:13:54 15360 --a------ C:\WINDOWS\System32\shadow.exe
2007-04-12 15:13:54 9728 --a------ C:\WINDOWS\System32\reset.exe
2007-04-12 15:13:54 61952 --a------ C:\WINDOWS\System32\rdshost.exe
2007-04-12 15:13:54 20232 --a------ C:\WINDOWS\System32\drivers\tdtcp.sys
2007-04-12 15:13:54 11144 --a------ C:\WINDOWS\System32\drivers\tdpipe.sys
2007-04-12 15:13:52 16384 --a------ C:\WINDOWS\System32\rwinsta.exe
2007-04-12 15:13:52 33792 --a------ C:\WINDOWS\System32\regini.exe
2007-04-12 15:13:52 4608 --a------ C:\WINDOWS\System32\rdpcfgex.dll
2007-04-12 15:13:52 22528 --a------ C:\WINDOWS\System32\qwinsta.exe
2007-04-12 15:13:52 19456 --a------ C:\WINDOWS\System32\qprocess.exe
2007-04-12 15:13:51 9728 --a------ C:\WINDOWS\System32\xolehlp.dll
2007-04-12 15:13:51 17408 --a------ C:\WINDOWS\System32\qappsrv.exe
2007-04-12 15:13:51 83968 --a------ C:\WINDOWS\System32\mtxoci.dll
2007-04-12 15:13:51 22528 --a------ C:\WINDOWS\System32\msg.exe
2007-04-12 15:13:51 151040 --a------ C:\WINDOWS\System32\msdtcuiu.dll
2007-04-12 15:13:51 869376 --a------ C:\WINDOWS\System32\msdtctm.dll
2007-04-12 15:13:51 54784 --a------ C:\WINDOWS\System32\msdtclog.dll
2007-04-12 15:13:51 6144 --a------ C:\WINDOWS\System32\msdtc.exe
2007-04-12 15:13:51 15872 --a------ C:\WINDOWS\System32\logoff.exe
2007-04-12 15:13:51 15872 --a------ C:\WINDOWS\System32\cdmodem.dll
2007-04-12 15:13:50 25088 --a------ C:\WINDOWS\System32\mtxlegih.dll
2007-04-12 15:13:50 4096 --a------ C:\WINDOWS\System32\mtxex.dll
2007-04-12 15:13:50 20480 --a------ C:\WINDOWS\System32\mtxdm.dll
2007-04-12 15:13:50 5120 --a------ C:\WINDOWS\System32\dcomcnfg.exe
2007-04-12 15:13:50 82432 --a------ C:\WINDOWS\System32\comrepl.dll
2007-04-12 15:13:50 25600 --a------ C:\WINDOWS\System32\comaddin.dll
2007-04-12 15:13:50 56832 --a------ C:\WINDOWS\System32\colbact.dll
2007-04-12 15:13:49 54272 --a------ C:\WINDOWS\System32\stclient.dll
2007-04-12 15:13:49 495616 --a------ C:\WINDOWS\System32\comuid.dll
2007-04-12 15:13:49 147456 --a------ C:\WINDOWS\System32\comsnap.dll
2007-04-12 15:13:49 468480 --a------ C:\WINDOWS\System32\clbcatq.dll
2007-04-12 15:13:49 100864 --a------ C:\WINDOWS\System32\clbcatex.dll
2007-04-12 15:13:49 85504 --a------ C:\WINDOWS\System32\catsrvps.dll
2007-04-12 15:13:49 215040 --a------ C:\WINDOWS\System32\catsrv.dll
2007-04-12 15:13:41 53248 --a------ C:\WINDOWS\System32\servdeps.dll
2007-04-12 15:13:41 16896 --a------ C:\WINDOWS\System32\mmfutil.dll
2007-04-12 15:13:41 177152 --a------ C:\WINDOWS\System32\cmprops.dll
2007-04-12 15:13:37 9216 --a------ C:\WINDOWS\System32\wuauserv.dll
2007-04-12 15:13:37 189440 --a------ C:\WINDOWS\System32\wuaueng.dll
2007-04-12 15:13:37 142336 --a------ C:\WINDOWS\System32\wuauclt.exe
2007-04-12 15:13:37 534016 --a------ C:\WINDOWS\System32\spider.exe
2007-04-12 15:13:37 342016 --a------ C:\WINDOWS\System32\mspaint.exe
2007-04-12 15:13:37 118272 --a------ C:\WINDOWS\System32\mplay32.exe
2007-04-12 15:13:37 115976 --a------ C:\WINDOWS\System32\drivers\rdpwd.sys
2007-04-12 15:13:37 99328 --a------ C:\WINDOWS\System32\clipbrd.exe
2007-04-12 15:13:37 0 d-------- C:\Program Files\Windows NT<WINDOW~1>
2007-04-12 15:13:36 89088 --a------ C:\WINDOWS\System32\tscfgwmi.dll
2007-04-12 15:13:36 130048 --a------ C:\WINDOWS\System32\sessmgr.exe
2007-04-12 15:13:36 56832 --a------ C:\WINDOWS\System32\remotepg.dll
2007-04-12 15:13:36 12288 --a------ C:\WINDOWS\System32\rdsaddin.exe
2007-04-12 15:13:36 135680 --a------ C:\WINDOWS\System32\rdchost.dll
2007-04-12 15:13:36 598016 --a------ C:\WINDOWS\System32\mstscax.dll
2007-04-12 15:13:36 390144 --a------ C:\WINDOWS\System32\mstsc.exe
2007-04-12 15:13:34 40960 --a------ C:\WINDOWS\System32\tscupgrd.exe
2007-04-12 15:13:34 201216 --a------ C:\WINDOWS\System32\termsrv.dll
2007-04-12 15:13:34 75912 --a------ C:\WINDOWS\System32\rdpwsx.dll
2007-04-12 15:13:34 14848 --a------ C:\WINDOWS\System32\rdpsnd.dll
2007-04-12 15:13:34 44032 --a------ C:\WINDOWS\System32\rdpclip.exe
2007-04-12 15:13:33 359936 --a------ C:\WINDOWS\System32\msdtcprx.dll
2007-04-12 15:13:33 0 d-------- C:\WINDOWS\System32\MsDtc
2007-04-12 15:13:33 9216 --a------ C:\WINDOWS\System32\icaapi.dll
2007-04-12 15:13:33 0 d-------- C:\WINDOWS\System32\Com
2007-04-12 15:13:33 32768 --a------ C:\WINDOWS\System32\cfgbkend.dll
2007-04-12 15:13:33 582656 --a------ C:\WINDOWS\System32\catsrvut.dll
2007-04-12 15:13:32 1172992 --a------ C:\WINDOWS\System32\comsvcs.dll
2007-04-12 15:13:29 57856 --a------ C:\WINDOWS\System32\licwmi.dll
2007-04-12 15:13:24 38024 --a------ C:\WINDOWS\System32\drivers\termdd.sys
2007-04-12 15:13:24 182400 --a------ C:\WINDOWS\System32\drivers\rdpdr.sys
-- Find3M Report ---------------------------------------------------------------
2007-04-23 18:13:01 0 d---s---- C:\Documents and Settings\USER\Dane aplikacji\Microsoft<MICROS~1>
2007-04-17 11:59:49 355486 --a------ C:\WINDOWS\System32\perfh015.dat
2007-04-17 11:59:49 49492 --a------ C:\WINDOWS\System32\perfc015.dat
2007-04-16 12:00:36 0 d-------- C:\Documents and Settings\USER\Dane aplikacji\PC Tools<PCTOOL~1>
2007-04-13 13:13:01 0 d-------- C:\Documents and Settings\USER\Dane aplikacji\Help
2007-04-12 16:31:21 0 d-------- C:\Documents and Settings\USER\Dane aplikacji\Macromedia<MACROM~1>
2007-04-12 16:23:28 0 d-------- C:\Documents and Settings\USER\Dane aplikacji\Lavasoft
2007-04-12 16:08:12 62 --ahs---- C:\Documents and Settings\USER\Dane aplikacji\desktop.ini
2007-04-12 15:54:45 0 d-------- C:\Documents and Settings\USER\Dane aplikacji\Mozilla
2007-04-12 15:28:24 0 d-------- C:\Documents and Settings\USER\Dane aplikacji\Identities<IDENTI~1>
2007-03-09 20:52:52 200768 --a------ C:\WINDOWS\System32\klogon.dll
-- Registry Dump ---------------------------------------------------------------
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Gadu-Gadu"="\"C:\\Program Files\\Gadu-fGadu\\gg.exe\" /tray"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SpeedTouch USB Diagnostics"="\"C:\\Program Files\\Thomson\\SpeedTouch USB\\Dragdiag.exe\" /icon"
"AVP"="\"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe\""
"BearShare"="\"C:\\Program Files\\BearShare\\BearShare.exe\" /pause"
[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\System32\\CTFMON.EXE"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
-- End of ComboScan: finished at 2007-04-24 at 16:36:07 ------------------------
przez prog 24 Kwi 2007, 17:02
Zrobiłeś akcję z the avenger? Bo pliki nadal są...
C2D E8400 3GHZ + Pentagram Freezone HP-120 ALCu, Asus P5Q SE /intel P45/, A-Data 2x2GB CL4 Extreme Edition, Sapphire Radeon HD4870 512mb/256bit DDR5, WD 640GB SATA, Lite-ON Super AllWrite DVD SATA, Chieftec 500W, Samsung 2032BW Black 20', Vista Ultimate x64
Exoriare aliquis nostris ex ossibus ultor...
Exoriare aliquis nostris ex ossibus ultor...
-
prog - ~user
- Posty: 4043
- Dołączenie: 23 Mar 2005, 22:02
- Miejscowość: /home/prog/
- Pochwały: 232
przez wojtas 24 Kwi 2007, 17:20
uzyj:
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
i daj z tego loga
http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe
i daj z tego loga
-
wojtas - *mod
- Posty: 18165
- Dołączenie: 13 Sty 2006, 16:00
- Miejscowość: Krzeszyce
- Pochwały: 1656
-
przez Gerwazy 24 Kwi 2007, 17:30
- Kod: Zaznacz wszystko
"USER" - 07-04-24 17:15:45 Dodatek Service Pack. 1
ComboFix 07-04-24.2V - Running from: "C:\Documents and Settings\USER\Pulpit\"
(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\.exe
C:\WINDOWS\system32\taskmgr.com
C:\WINDOWS\regedit.com
((((((((((((((((((((((((((((((( Files Created from 2007-03-24 to 2007-04-24 ))))))))))))))))))))))))))))))))))
2007-04-24 14:42 <DIR> d-------- C:\Program Files\MyGlobalSearch
2007-04-24 14:42 <DIR> d-------- C:\Program Files\BearShare
2007-04-24 14:42 <DIR> d-------- C:\My Downloads
2007-04-24 11:26 <DIR> d-a------ C:\WINDOWS\zts2.exe
2007-04-24 11:26 <DIR> d-a------ C:\WINDOWS\system32\vcmgcd32.dll
2007-04-24 11:26 <DIR> d-a------ C:\WINDOWS\system32\iifgfgf.dll
2007-04-24 11:26 <DIR> d-a------ C:\WINDOWS\rundll16.exe
2007-04-24 11:26 <DIR> d-a------ C:\WINDOWS\rundl132.dll
2007-04-24 11:26 <DIR> d-a------ C:\WINDOWS\logo1_.exe
2007-04-24 11:25 137,216 --a------ C:\WINDOWS\R.COM
2007-04-24 11:25 132,608 --a------ C:\WINDOWS\system32\T.COM
2007-04-23 15:32 <DIR> d-------- C:\WINDOWS\speech
2007-04-23 15:32 <DIR> d-------- C:\Program Files\ivo
2007-04-22 16:54 0 --a------ C:\WINDOWS\system32\lnternat.exe
2007-04-19 20:54 75,932 --a------ C:\WINDOWS\system32\drivers\klick.dat
2007-04-19 20:54 74,396 --a------ C:\WINDOWS\system32\drivers\klin.dat
2007-04-19 20:53 64,800 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2007-04-19 20:53 1,817,120 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-04-19 20:53 <DIR> d-------- C:\Program Files\Kaspersky Lab
2007-04-19 20:53 <DIR> d-------- C:\KAV
2007-04-18 21:22 <DIR> d-------- C:\Program Files\Tibia Auto
2007-04-18 21:21 <DIR> d-------- C:\Python24
2007-04-17 16:50 36,528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-04-17 16:50 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-04-17 16:50 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-04-17 16:50 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2007-04-17 16:50 115,880 --------- C:\WINDOWS\system32\pxinsi64.exe
2007-04-17 16:50 <DIR> d-------- C:\Program Files\Winamp
2007-04-17 07:15 442,967 ---hs---- C:\WINDOWS\system32\ehkmp.ini2
2007-04-16 21:35 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Kaspersky Lab
2007-04-16 12:00 <DIR> d-------- C:\DOCUME~1\USER\DANEAP~1\PC Tools
2007-04-15 20:17 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-04-15 20:17 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-04-15 20:17 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start
2007-04-15 20:17 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-04-15 20:17 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony
2007-04-15 20:17 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione
2007-04-15 20:17 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit
2007-04-15 20:17 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-04-15 17:59 461,402 ---hs---- C:\WINDOWS\system32\ehkmp.bak2
2007-04-15 16:53 70,688 --a------ C:\WINDOWS\system32\drivers\alcaudsl.sys
2007-04-15 16:53 5,606 --a------ C:\WINDOWS\system32\stci.dll
2007-04-15 16:53 5,280 --a------ C:\WINDOWS\system32\drivers\alcawh.sys
2007-04-15 16:53 3,968 --a------ C:\WINDOWS\system32\drivers\alcacr.sys
2007-04-15 16:53 <DIR> d-------- C:\Program Files\Thomson
2007-04-15 13:34 <DIR> d--h----- C:\WINDOWS\PIF
2007-04-13 22:38 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2007-04-13 22:38 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2007-04-13 22:38 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2007-04-13 21:06 41,474 --ahs---- C:\WINDOWS\system32\smsc.exe
2007-04-13 13:13 <DIR> d-------- C:\DOCUME~1\USER\DANEAP~1\Help
2007-04-12 19:24 <DIR> d-------- C:\Program Files\Tibia
2007-04-12 17:38 <DIR> d-------- C:\WINDOWS\pss
2007-04-12 17:28 <DIR> d-------- C:\Program Files\Gadu-fGadu
2007-04-12 17:28 <DIR> d-------- C:\DOCUME~1\USER\Gadu-Gadu
2007-04-12 17:20 458,750 ---hs---- C:\WINDOWS\system32\ehkmp.bak1
2007-04-12 17:12 1,137,664 -ra------ C:\WINDOWS\system32\mswLp.exe
2007-04-12 17:11 53,600 --a------ C:\WINDOWS\system32\drivers\alcan5wn.sys
2007-04-12 17:03 <DIR> dr-hsc--- C:\WINDOWS\system32\dllcache
2007-04-12 17:03 <DIR> dr--s---- C:\WINDOWS\Fonts
2007-04-12 17:03 <DIR> dr------- C:\WINDOWS\Web
2007-04-12 17:03 <DIR> d--h----- C:\WINDOWS\inf
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\WinSxS
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\twain_32
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\wins
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\wbem
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\usmt
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\spool
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\ShellExt
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\Setup
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\ras
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\oobe
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\npp
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\mui
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\inetsrv
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\IME
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\icsxml
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\ias
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\export
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\drivers\etc
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\drivers\disdn
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\drivers
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\dhcp
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\config
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\3com_dmi
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\3076
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\2052
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1054
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1045
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1042
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1041
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1037
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1033
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1031
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1028
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1025
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\security
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Resources
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\repair
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\mui
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\msapps
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\msagent
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Media
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\ime
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Help
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Driver Cache
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Debug
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Cursors
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Connection Wizard
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Config
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\AppPatch
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\addins
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS
2007-04-12 16:33 <DIR> d--hs---- C:\RECYCLER
2007-04-12 16:32 <DIR> d-------- C:\Program Files\ToniArts
2007-04-12 16:31 1,168 --a------ C:\WINDOWS\mozver.dat
2007-04-12 16:23 <DIR> d-------- C:\DOCUME~1\USER\DANEAP~1\Lavasoft
2007-04-12 16:10 57,856 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2007-04-12 16:10 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2007-04-12 16:09 9,856 --a------ C:\WINDOWS\system32\drivers\gameenum.sys
2007-04-12 16:09 70,144 --a------ C:\WINDOWS\system32\usbui.dll
2007-04-12 16:09 27,165 --a------ C:\WINDOWS\system32\drivers\fetnd5.sys
2007-04-12 16:08 9,936 --a------ C:\WINDOWS\system\LZEXPAND.DLL
2007-04-12 16:08 9,168 --a------ C:\WINDOWS\system\VER.DLL
2007-04-12 16:08 85,532 --a------ C:\WINDOWS\system32\dgsetup.dll
2007-04-12 16:08 83,456 --a------ C:\WINDOWS\system\OLECLI.DLL
2007-04-12 16:08 8,192 -ra------ C:\WINDOWS\system32\kbdhept.dll
2007-04-12 16:08 72,192 --a------ C:\WINDOWS\system32\storprop.dll
2007-04-12 16:08 70,096 --a------ C:\WINDOWS\system\AVICAP.DLL
2007-04-12 16:08 7,168 --a------ C:\WINDOWS\system32\kbdcz.dll
2007-04-12 16:08 69,712 --a------ C:\WINDOWS\system\MMSYSTEM.DLL
2007-04-12 16:08 67,072 --a------ C:\WINDOWS\NOTEPAD.EXE
2007-04-12 16:08 6,656 -ra------ C:\WINDOWS\system32\kbdhela3.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\kbdycl.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\kbdsl1.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\kbdsl.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\kbdhu.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\kbdcz2.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\kbdcz1.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\kbdcr.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\KBDAL.DLL
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\batt.dll
2007-04-12 16:08 6,144 -ra------ C:\WINDOWS\system32\kbdtuq.dll
2007-04-12 16:08 6,144 -ra------ C:\WINDOWS\system32\kbdtuf.dll
2007-04-12 16:08 6,144 -ra------ C:\WINDOWS\system32\kbdlv1.dll
2007-04-12 16:08 6,144 -ra------ C:\WINDOWS\system32\kbdlv.dll
2007-04-12 16:08 6,144 -ra------ C:\WINDOWS\system32\kbdhela2.dll
2007-04-12 16:08 6,144 -ra------ C:\WINDOWS\system32\kbdgkl.dll
2007-04-12 16:08 6,144 -ra------ C:\WINDOWS\system32\kbdest.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdmon.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdlt1.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdlt.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdkyr.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdhe319.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdhe220.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdhe.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdazel.dll
2007-04-12 16:08 5,632 --a------ C:\WINDOWS\system32\kbdro.dll
2007-04-12 16:08 5,632 --a------ C:\WINDOWS\system32\kbdhu1.dll
2007-04-12 16:08 5,120 --a------ C:\WINDOWS\system\SHELL.DLL
2007-04-12 16:08 33,376 --a------ C:\WINDOWS\system\COMMDLG.DLL
2007-04-12 16:08 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2007-04-12 16:08 24,064 --a------ C:\WINDOWS\system\OLESVR.DLL
2007-04-12 16:08 19,200 --a------ C:\WINDOWS\system\TAPI.DLL
2007-04-12 16:08 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll
2007-04-12 16:08 15,360 --a------ C:\WINDOWS\TASKMAN.EXE
2007-04-12 16:08 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2007-04-12 16:08 127,008 --a------ C:\WINDOWS\system\MSVIDEO.DLL
2007-04-12 16:08 109,488 --a------ C:\WINDOWS\system\AVIFILE.DLL
2007-04-12 16:08 103,424 --a------ C:\WINDOWS\system32\EqnClass.Dll
2007-04-12 16:08 10,496 --a------ C:\WINDOWS\system32\drivers\irenum.sys
2007-04-12 16:08 <DIR> dr-h----- C:\DOCUME~1\DEFAUL~1\Ustawienia lokalne
2007-04-12 16:08 <DIR> dr------- C:\Program Files
2007-04-12 16:08 <DIR> dr------- C:\DOCUME~1\DEFAUL~1\Menu Start
2007-04-12 16:08 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Menu Start
2007-04-12 16:08 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Dokumenty
2007-04-12 16:08 <DIR> d--h----- C:\DOCUME~1\DEFAUL~1\Szablony
2007-04-12 16:08 <DIR> d--h----- C:\DOCUME~1\ALLUSE~1\Szablony
2007-04-12 16:08 <DIR> d-------- C:\Program Files\Common Files\SpeechEngines
2007-04-12 16:08 <DIR> d-------- C:\Program Files\Common Files\ODBC
2007-04-12 16:08 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Ulubione
2007-04-12 16:08 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Pulpit
2007-04-12 16:08 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Moje dokumenty
2007-04-12 16:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Ulubione
2007-04-12 16:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Pulpit
2007-04-12 16:07 <DIR> dr-h----- C:\DOCUME~1\DEFAUL~1\Dane aplikacji
2007-04-12 16:07 <DIR> dr-h----- C:\DOCUME~1\ALLUSE~1\Dane aplikacji
2007-04-12 16:07 <DIR> d-------- C:\WINDOWS\system32\CatRoot2
2007-04-12 16:07 <DIR> d-------- C:\WINDOWS\system32\CatRoot
2007-04-12 16:07 <DIR> d-------- C:\Documents and Settings
2007-04-12 15:55 270,336 --a------ C:\WINDOWS\system32\imon.dll
2007-04-12 15:54 0 --a------ C:\WINDOWS\nsreg.dat
2007-04-12 15:54 <DIR> d-------- C:\Program Files\Lavasoft
2007-04-12 15:51 516,096 --------- C:\WINDOWS\system32\ati2sgag.exe
2007-04-12 15:51 <DIR> d-------- C:\Program Files\ATI Technologies
2007-04-12 15:50 <DIR> d-------- C:\ATI
2007-04-12 15:48 77,440 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2007-04-12 15:48 7,040 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys
2007-04-12 15:48 577,536 --a------ C:\WINDOWS\soundman.exe
2007-04-12 15:48 57,856 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2007-04-12 15:48 56,832 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2007-04-12 15:48 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2007-04-12 15:48 50,048 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2007-04-12 15:48 5,888 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2007-04-12 15:48 5,120 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2007-04-12 15:48 44,416 --a------ C:\WINDOWS\system32\drivers\stream.sys
2007-04-12 15:48 40,960 --a------ C:\WINDOWS\system32\ChCfg.exe
2007-04-12 15:48 4,608 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys
2007-04-12 15:48 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2007-04-12 15:48 315,392 --a------ C:\WINDOWS\alcupd.exe
2007-04-12 15:48 3,972,672 --a------ C:\WINDOWS\system32\drivers\alcxwdm.sys
2007-04-12 15:48 217,088 --a------ C:\WINDOWS\Alcrmv.exe
2007-04-12 15:48 2,816 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys
2007-04-12 15:48 159,360 --a------ C:\WINDOWS\system32\drivers\kmixer.sys
2007-04-12 15:48 143,360 --a------ C:\WINDOWS\system32\RtlCPAPI.dll
2007-04-12 15:48 142,208 --a------ C:\WINDOWS\system32\drivers\aec.sys
2007-04-12 15:48 134,272 --a------ C:\WINDOWS\system32\drivers\portcls.sys
2007-04-12 15:48 131,712 --a------ C:\WINDOWS\system32\drivers\ks.sys
2007-04-12 15:48 10,527,744 --a------ C:\WINDOWS\system32\RTLCPL.exe
2007-04-12 15:48 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-04-12 15:48 <DIR> d-------- C:\Program Files\Realtek AC97
2007-04-12 15:47 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2007-04-12 15:43 545 --a------ C:\WINDOWS\UC.PIF
2007-04-12 15:43 545 --a------ C:\WINDOWS\RAR.PIF
2007-04-12 15:43 545 --a------ C:\WINDOWS\PKZIP.PIF
2007-04-12 15:43 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2007-04-12 15:43 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2007-04-12 15:43 545 --a------ C:\WINDOWS\LHA.PIF
2007-04-12 15:43 545 --a------ C:\WINDOWS\ARJ.PIF
2007-04-12 15:43 <DIR> d-------- C:\totalcmd
2007-04-12 15:28 2,097,152 --ah----- C:\DOCUME~1\USER\NTUSER.DAT
2007-04-12 15:28 <DIR> dr-h----- C:\DOCUME~1\USER\Dane aplikacji
2007-04-12 15:28 <DIR> dr------- C:\DOCUME~1\USER\Ulubione
2007-04-12 15:28 <DIR> dr------- C:\DOCUME~1\USER\Moje dokumenty
2007-04-12 15:28 <DIR> dr------- C:\DOCUME~1\USER\Menu Start
2007-04-12 15:28 <DIR> d--hs---- C:\WINDOWS\Installer
2007-04-12 15:28 <DIR> d--h----- C:\DOCUME~1\USER\Ustawienia lokalne
2007-04-12 15:28 <DIR> d--h----- C:\DOCUME~1\USER\Szablony
2007-04-12 15:28 <DIR> d-------- C:\DOCUME~1\USER\Pulpit
2007-04-12 15:27 262,144 --ah----- C:\DOCUME~1\NETWOR~1\NTUSER.DAT
2007-04-12 15:27 229,376 --ah----- C:\DOCUME~1\LOCALS~1\NTUSER.DAT
2007-04-12 15:27 <DIR> d--hs---- C:\System Volume Information
2007-04-12 15:27 <DIR> d--h----- C:\DOCUME~1\NETWOR~1\Ustawienia lokalne
2007-04-12 15:27 <DIR> d--h----- C:\DOCUME~1\LOCALS~1\Ustawienia lokalne
2007-04-12 15:27 <DIR> d-------- C:\WINDOWS\Prefetch
2007-04-12 15:27 <DIR> d-------- C:\DOCUME~1\NETWOR~1\Dane aplikacji
2007-04-12 15:27 <DIR> d-------- C:\DOCUME~1\LOCALS~1\Dane aplikacji
2007-04-12 15:18 <DIR> d-------- C:\WINDOWS\system32\xircom
2007-04-12 15:18 <DIR> d-------- C:\Program Files\microsoft frontpage
2007-04-12 15:17 229,376 ---h----- C:\DOCUME~1\DEFAUL~1\NTUSER.DAT
2007-04-12 15:17 112,128 --a------ C:\WINDOWS\system32\mapi32.dll
2007-04-12 15:17 0 -rahs---- C:\MSDOS.SYS
2007-04-12 15:17 0 -rahs---- C:\IO.SYS
2007-04-12 15:17 0 --a------ C:\CONFIG.SYS
2007-04-12 15:17 0 --------- C:\AUTOEXEC.BAT
2007-04-12 15:16 <DIR> dr------- C:\WINDOWS\Offline Web Pages
2007-04-12 15:16 <DIR> d--hs---- C:\DOCUME~1\ALLUSE~1\DRM
2007-04-12 15:16 <DIR> d---s---- C:\WINDOWS\Downloaded Program Files
2007-04-12 15:16 <DIR> d-------- C:\WINDOWS\system32\DirectX
2007-04-12 15:15 9,728 --a------ C:\WINDOWS\system32\mstinit.exe
2007-04-12 15:15 81,920 --a------ C:\WINDOWS\system32\isign32.dll
2007-04-12 15:15 81,408 --a------ C:\WINDOWS\system32\msoert2.dll
2007-04-12 15:15 73,728 --a------ C:\WINDOWS\system32\ils.dll
2007-04-12 15:15 69,632 --a------ C:\WINDOWS\system32\icwdial.dll
2007-04-12 15:15 69,248 --a------ C:\WINDOWS\system32\drivers\sr.sys
2007-04-12 15:15 67,584 --a------ C:\WINDOWS\system32\acctres.dll
2007-04-12 15:15 65,536 --a------ C:\WINDOWS\system32\msconf.dll
2007-04-12 15:15 63,488 --a------ C:\WINDOWS\system32\srclient.dll
2007-04-12 15:15 61,440 --a------ C:\WINDOWS\system32\icwphbk.dll
2007-04-12 15:15 587,776 --a------ C:\WINDOWS\system32\inetcomm.dll
2007-04-12 15:15 49,152 --a------ C:\WINDOWS\system32\inetres.dll
2007-04-12 15:15 40,960 --a------ C:\WINDOWS\system32\safrslv.dll
2007-04-12 15:15 39,424 --a------ C:\WINDOWS\system32\safrcdlg.dll
2007-04-12 15:15 33,792 --a------ C:\WINDOWS\system32\racpldlg.dll
2007-04-12 15:15 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2007-04-12 15:15 32,256 --a------ C:\WINDOWS\system32\mnmdd.dll
2007-04-12 15:15 28,672 --a------ C:\WINDOWS\system32\isrdbg32.dll
2007-04-12 15:15 270,336 --a------ C:\WINDOWS\system32\inetcfg.dll
2007-04-12 15:15 26,624 --a------ C:\WINDOWS\system32\safrdm.dll
2007-04-12 15:15 253,952 --a------ C:\WINDOWS\system32\mstask.dll
2007-04-12 15:15 24,576 --a------ C:\WINDOWS\system32\nmmkcert.dll
2007-04-12 15:15 228,864 --a------ C:\WINDOWS\system32\msoeacct.dll
2007-04-12 15:15 227,328 --a------ C:\WINDOWS\system32\srrstr.dll
2007-04-12 15:15 221,696 --a------ C:\WINDOWS\system32\qmgr.dll
2007-04-12 15:15 17,408 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2007-04-12 15:15 160,256 --a------ C:\WINDOWS\system32\schedsvc.dll
2007-04-12 15:15 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2007-04-12 15:15 159,232 --a------ C:\WINDOWS\system32\srsvc.dll
2007-04-12 15:15 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2007-04-12 15:15 11,264 --a------ C:\WINDOWS\system32\atrace.dll
2007-04-12 15:15 <DIR> d---s---- C:\WINDOWS\Tasks
2007-04-12 15:15 <DIR> d-------- C:\WINDOWS\system32\Restore
2007-04-12 15:15 <DIR> d-------- C:\WINDOWS\system32\Macromed
2007-04-12 15:15 <DIR> d-------- C:\WINDOWS\srchasst
2007-04-12 15:15 <DIR> d-------- C:\WINDOWS\PCHealth
2007-04-12 15:15 <DIR> d-------- C:\Program Files\Movie Maker
2007-04-12 15:15 <DIR> d-------- C:\Program Files\Common Files\MSSoap
2007-04-12 15:14 73,216 --a------ C:\WINDOWS\system32\avwav.dll
2007-04-12 15:14 5,632 --a------ C:\WINDOWS\system32\write.exe
2007-04-12 15:14 494,592 --a------ C:\WINDOWS\system32\hypertrm.dll
2007-04-12 15:14 44,544 --a------ C:\WINDOWS\system32\hticons.dll
2007-04-12 15:14 35,328 --a------ C:\WINDOWS\system32\winchat.exe
2007-04-12 15:14 231,424 --a------ C:\WINDOWS\system32\avtapi.dll
2007-04-12 15:14 21,856 --a------ C:\WINDOWS\system32\emptyregdb.dat
2007-04-12 15:14 183,296 --a------ C:\WINDOWS\system32\accwiz.exe
2007-04-12 15:14 16,384 --a------ C:\WINDOWS\system32\avmeter.dll
2007-04-12 15:14 139,264 --a------ C:\WINDOWS\system32\sndvol32.exe
2007-04-12 15:14 125,440 --a------ C:\WINDOWS\system32\sndrec32.exe
2007-04-12 15:14 <DIR> d--h----- C:\Program Files\WindowsUpdate
2007-04-12 15:14 <DIR> d-------- C:\WINDOWS\Registration
2007-04-12 15:14 <DIR> d-------- C:\Program Files\Usˆugi online
2007-04-12 15:14 <DIR> d-------- C:\Program Files\MSN Gaming Zone
2007-04-12 15:14 <DIR> d-------- C:\Program Files\Messenger
2007-04-12 15:13 99,328 --a------ C:\WINDOWS\system32\clipbrd.exe
2007-04-12 15:13 9,728 --a------ C:\WINDOWS\system32\xolehlp.dll
2007-04-12 15:13 9,728 --a------ C:\WINDOWS\system32\reset.exe
2007-04-12 15:13 9,216 --a------ C:\WINDOWS\system32\wuauserv.dll
2007-04-12 15:13 9,216 --a------ C:\WINDOWS\system32\icaapi.dll
2007-04-12 15:13 89,088 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2007-04-12 15:13 869,376 --a------ C:\WINDOWS\system32\msdtctm.dll
2007-04-12 15:13 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll
2007-04-12 15:13 83,968 --a------ C:\WINDOWS\system32\mtxoci.dll
2007-04-12 15:13 82,432 --a------ C:\WINDOWS\system32\comrepl.dll
2007-04-12 15:13 80,896 --a------ C:\WINDOWS\system32\charmap.exe
2007-04-12 15:13 75,912 --a------ C:\WINDOWS\system32\rdpwsx.dll
2007-04-12 15:13 61,952 --a------ C:\WINDOWS\system32\rdshost.exe
2007-04-12 15:13 605,696 --a------ C:\WINDOWS\system32\getuname.dll
2007-04-12 15:13 6,144 --a------ C:\WINDOWS\system32\msdtc.exe
2007-04-12 15:13 598,016 --a------ C:\WINDOWS\system32\mstscax.dll
2007-04-12 15:13 582,656 --a------ C:\WINDOWS\system32\catsrvut.dll
2007-04-12 15:13 57,856 --a------ C:\WINDOWS\system32\licwmi.dll
2007-04-12 15:13 57,344 --a------ C:\WINDOWS\system32\sol.exe
2007-04-12 15:13 56,832 --a------ C:\WINDOWS\system32\remotepg.dll
2007-04-12 15:13 56,832 --a------ C:\WINDOWS\system32\colbact.dll
2007-04-12 15:13 55,808 --a------ C:\WINDOWS\system32\freecell.exe
2007-04-12 15:13 54,784 --a------ C:\WINDOWS\system32\msdtclog.dll
2007-04-12 15:13 54,272 --a------ C:\WINDOWS\system32\stclient.dll
2007-04-12 15:13 534,016 --a------ C:\WINDOWS\system32\spider.exe
2007-04-12 15:13 53,248 --a------ C:\WINDOWS\system32\servdeps.dll
2007-04-12 15:13 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2007-04-12 15:13 495,616 --a------ C:\WINDOWS\system32\comuid.dll
2007-04-12 15:13 468,480 --a------ C:\WINDOWS\system32\clbcatq.dll
2007-04-12 15:13 44,032 --a------ C:\WINDOWS\system32\rdpclip.exe
2007-04-12 15:13 40,960 --a------ C:\WINDOWS\system32\tscupgrd.exe
2007-04-12 15:13 4,608 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2007-04-12 15:13 4,096 --a------ C:\WINDOWS\system32\mtxex.dll
2007-04-12 15:13 390,144 --a------ C:\WINDOWS\system32\mstsc.exe
2007-04-12 15:13 38,024 --a------ C:\WINDOWS\system32\drivers\termdd.sys
2007-04-12 15:13 359,936 --a------ C:\WINDOWS\system32\msdtcprx.dll
2007-04-12 15:13 342,016 --a------ C:\WINDOWS\system32\mspaint.exe
2007-04-12 15:13 33,792 --a------ C:\WINDOWS\system32\regini.exe
2007-04-12 15:13 32,768 --a------ C:\WINDOWS\system32\cfgbkend.dll
2007-04-12 15:13 25,600 --a------ C:\WINDOWS\system32\comaddin.dll
2007-04-12 15:13 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2007-04-12 15:13 22,528 --a------ C:\WINDOWS\system32\qwinsta.exe
2007-04-12 15:13 22,528 --a------ C:\WINDOWS\system32\msg.exe
2007-04-12 15:13 215,040 --a------ C:\WINDOWS\system32\catsrv.dll
2007-04-12 15:13 201,216 --a------ C:\WINDOWS\system32\termsrv.dll
2007-04-12 15:13 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll
2007-04-12 15:13 20,232 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys
2007-04-12 15:13 19,456 --a------ C:\WINDOWS\system32\qprocess.exe
2007-04-12 15:13 189,440 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-04-12 15:13 182,400 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys
2007-04-12 15:13 177,152 --a------ C:\WINDOWS\system32\cmprops.dll
2007-04-12 15:13 17,920 --a------ C:\WINDOWS\system32\tsshutdn.exe
2007-04-12 15:13 17,408 --a------ C:\WINDOWS\system32\qappsrv.exe
2007-04-12 15:13 16,896 --a------ C:\WINDOWS\system32\mmfutil.dll
2007-04-12 15:13 16,384 --a------ C:\WINDOWS\system32\tskill.exe
2007-04-12 15:13 16,384 --a------ C:\WINDOWS\system32\rwinsta.exe
2007-04-12 15:13 151,040 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2007-04-12 15:13 15,872 --a------ C:\WINDOWS\system32\logoff.exe
2007-04-12 15:13 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll
2007-04-12 15:13 15,360 --a------ C:\WINDOWS\system32\tsdiscon.exe
2007-04-12 15:13 15,360 --a------ C:\WINDOWS\system32\tscon.exe
2007-04-12 15:13 15,360 --a------ C:\WINDOWS\system32\shadow.exe
2007-04-12 15:13 147,456 --a------ C:\WINDOWS\system32\comsnap.dll
2007-04-12 15:13 142,336 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-04-12 15:13 14,848 --a------ C:\WINDOWS\system32\rdpsnd.dll
2007-04-12 15:13 135,680 --a------ C:\WINDOWS\system32\rdchost.dll
2007-04-12 15:13 130,048 --a------ C:\WINDOWS\system32\sessmgr.exe
2007-04-12 15:13 128,000 --a------ C:\WINDOWS\system32\mshearts.exe
2007-04-12 15:13 12,288 --a------ C:\WINDOWS\system32\rdsaddin.exe
2007-04-12 15:13 119,808 --a------ C:\WINDOWS\system32\winmine.exe
2007-04-12 15:13 118,272 --a------ C:\WINDOWS\system32\mplay32.exe
2007-04-12 15:13 115,976 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys
2007-04-12 15:13 115,200 --a------ C:\WINDOWS\system32\calc.exe
2007-04-12 15:13 11,144 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys
2007-04-12 15:13 100,864 --a------ C:\WINDOWS\system32\clbcatex.dll
2007-04-12 15:13 1,225 --a------ C:\WINDOWS\system32\usrlogon.cmd
2007-04-12 15:13 1,172,992 --a------ C:\WINDOWS\system32\comsvcs.dll
2007-04-12 15:13 <DIR> d-------- C:\WINDOWS\system32\MsDtc
2007-04-12 15:13 <DIR> d-------- C:\WINDOWS\system32\Com
2007-04-12 15:13 <DIR> d-------- C:\Program Files\Windows NT
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-04-17 11:59 49492 --a------ C:\WINDOWS\system32\perfc015.dat
2007-04-17 11:59 355486 --a------ C:\WINDOWS\system32\perfh015.dat
2007-04-12 16:08 62 --ahs---- C:\DOCUME~1\USER\DANEAP~1\desktop.ini
2007-04-12 15:16 -------- d-------- C:\Program Files\usˆugi online
2007-03-09 20:52 200768 --a------ C:\WINDOWS\system32\klogon.dll
2007-03-03 21:39 110360 --a------ C:\WINDOWS\system32\drivers\kl1.sys
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{37B85A21-692B-4205-9CAD-2626E4993404} C:\Program Files\MyGlobalSearch\bar\2.bin\MGSBAR.DLL
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SpeedTouch USB Diagnostics"="\"C:\\Program Files\\Thomson\\SpeedTouch USB\\Dragdiag.exe\" /icon"
"AVP"="\"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe\""
"BearShare"="\"C:\\Program Files\\BearShare\\BearShare.exe\" /pause"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Gadu-Gadu"="\"C:\\Program Files\\Gadu-fGadu\\gg.exe\" /tray"
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
********************************************************************
catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-04-24 17:16:36
Windows 5.1.2600 Dodatek Service Pack. 1 NTFS
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
********************************************************************
Completion time: 07-04-24 17:16:37
C:\ComboFix-quarantined-files.txt ... 07-04-24 17:16
przez wojtas 24 Kwi 2007, 17:45
Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg
Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:
Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combofix
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg
Pobierz i uruchom narzędzie : The Avenger
http://swandog46.geekstogo.com/avenger.zip
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:
Files to delete:
C:\WINDOWS\zts2.exe
C:\WINDOWS\system32\vcmgcd32.dll
C:\WINDOWS\system32\iifgfgf.dll
C:\WINDOWS\rundll16.exe
C:\WINDOWS\logo1_.exe
C:\WINDOWS\R.COM
C:\WINDOWS\system32\T.COM
C:\WINDOWS\system32\lnternat.exe
C:\WINDOWS\system32\ehkmp.bak
C:\WINDOWS\system32\ehkmp.ini2
C:\WINDOWS\system32\ehkmp.bak1
C:\WINDOWS\system32\mswLp.exe
Folders to delete:
C:\Program Files\MyGlobalSearch
Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.
Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combofix
-
wojtas - *mod
- Posty: 18165
- Dołączenie: 13 Sty 2006, 16:00
- Miejscowość: Krzeszyce
- Pochwały: 1656
-
przez Gerwazy 24 Kwi 2007, 18:06
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\nxdehpup
*******************
Script file located at: \??\C:\WINDOWS\System32\iipxgiuc.txt
Script file opened successfully.
Script file read successfully
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
Error: C:\WINDOWS\zts2.exe is a folder, not a file!
Deletion of file C:\WINDOWS\zts2.exe failed!
Could not process line:
C:\WINDOWS\zts2.exe
Status: 0xc00000ba
Error: C:\WINDOWS\system32\vcmgcd32.dll is a folder, not a file!
Deletion of file C:\WINDOWS\system32\vcmgcd32.dll failed!
Could not process line:
C:\WINDOWS\system32\vcmgcd32.dll
Status: 0xc00000ba
Error: C:\WINDOWS\system32\iifgfgf.dll is a folder, not a file!
Deletion of file C:\WINDOWS\system32\iifgfgf.dll failed!
Could not process line:
C:\WINDOWS\system32\iifgfgf.dll
Status: 0xc00000ba
Error: C:\WINDOWS\rundll16.exe is a folder, not a file!
Deletion of file C:\WINDOWS\rundll16.exe failed!
Could not process line:
C:\WINDOWS\rundll16.exe
Status: 0xc00000ba
Error: C:\WINDOWS\logo1_.exe is a folder, not a file!
Deletion of file C:\WINDOWS\logo1_.exe failed!
Could not process line:
C:\WINDOWS\logo1_.exe
Status: 0xc00000ba
File C:\WINDOWS\R.COM deleted successfully.
File C:\WINDOWS\system32\T.COM deleted successfully.
File C:\WINDOWS\system32\lnternat.exe deleted successfully.
File C:\WINDOWS\system32\ehkmp.bak not found!
Deletion of file C:\WINDOWS\system32\ehkmp.bak failed!
Could not process line:
C:\WINDOWS\system32\ehkmp.bak
Status: 0xc0000034
File C:\WINDOWS\system32\ehkmp.ini2 deleted successfully.
File C:\WINDOWS\system32\ehkmp.bak1 deleted successfully.
File C:\WINDOWS\system32\mswLp.exe deleted successfully.
Folder C:\Program Files\MyGlobalSearch deleted successfully.
Completed script processing.
*******************
Finished! Terminate.
"USER" - 07-04-24 17:51:22 Dodatek Service Pack. 1
ComboFix 07-04-24.2V - Running from: "C:\Documents and Settings\USER\Pulpit\"
((((((((((((((((((((((((((((((( Files Created from 2007-03-24 to 2007-04-24 ))))))))))))))))))))))))))))))))))
2007-04-24 17:16 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-04-24 14:42 <DIR> d-------- C:\Program Files\BearShare
2007-04-24 14:42 <DIR> d-------- C:\My Downloads
2007-04-24 11:26 <DIR> d-a------ C:\WINDOWS\zts2.exe
2007-04-24 11:26 <DIR> d-a------ C:\WINDOWS\system32\vcmgcd32.dll
2007-04-24 11:26 <DIR> d-a------ C:\WINDOWS\system32\iifgfgf.dll
2007-04-24 11:26 <DIR> d-a------ C:\WINDOWS\rundll16.exe
2007-04-24 11:26 <DIR> d-a------ C:\WINDOWS\rundl132.dll
2007-04-24 11:26 <DIR> d-a------ C:\WINDOWS\logo1_.exe
2007-04-23 15:32 <DIR> d-------- C:\WINDOWS\speech
2007-04-23 15:32 <DIR> d-------- C:\Program Files\ivo
2007-04-19 20:54 75,932 --a------ C:\WINDOWS\system32\drivers\klick.dat
2007-04-19 20:54 74,396 --a------ C:\WINDOWS\system32\drivers\klin.dat
2007-04-19 20:53 67,872 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2007-04-19 20:53 1,849,376 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-04-19 20:53 <DIR> d-------- C:\Program Files\Kaspersky Lab
2007-04-19 20:53 <DIR> d-------- C:\KAV
2007-04-18 21:22 <DIR> d-------- C:\Program Files\Tibia Auto
2007-04-18 21:21 <DIR> d-------- C:\Python24
2007-04-17 16:50 36,528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-04-17 16:50 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-04-17 16:50 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-04-17 16:50 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2007-04-17 16:50 115,880 --------- C:\WINDOWS\system32\pxinsi64.exe
2007-04-17 16:50 <DIR> d-------- C:\Program Files\Winamp
2007-04-16 21:35 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Kaspersky Lab
2007-04-16 12:00 <DIR> d-------- C:\DOCUME~1\USER\DANEAP~1\PC Tools
2007-04-15 20:17 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-04-15 20:17 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-04-15 20:17 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start
2007-04-15 20:17 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-04-15 20:17 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony
2007-04-15 20:17 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione
2007-04-15 20:17 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit
2007-04-15 20:17 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-04-15 17:59 461,402 ---hs---- C:\WINDOWS\system32\ehkmp.bak2
2007-04-15 16:53 70,688 --a------ C:\WINDOWS\system32\drivers\alcaudsl.sys
2007-04-15 16:53 5,606 --a------ C:\WINDOWS\system32\stci.dll
2007-04-15 16:53 5,280 --a------ C:\WINDOWS\system32\drivers\alcawh.sys
2007-04-15 16:53 3,968 --a------ C:\WINDOWS\system32\drivers\alcacr.sys
2007-04-15 16:53 <DIR> d-------- C:\Program Files\Thomson
2007-04-15 13:34 <DIR> d--h----- C:\WINDOWS\PIF
2007-04-13 22:38 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2007-04-13 22:38 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2007-04-13 22:38 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2007-04-13 21:06 41,474 --ahs---- C:\WINDOWS\system32\smsc.exe
2007-04-13 13:13 <DIR> d-------- C:\DOCUME~1\USER\DANEAP~1\Help
2007-04-12 19:24 <DIR> d-------- C:\Program Files\Tibia
2007-04-12 17:38 <DIR> d-------- C:\WINDOWS\pss
2007-04-12 17:28 <DIR> d-------- C:\Program Files\Gadu-fGadu
2007-04-12 17:28 <DIR> d-------- C:\DOCUME~1\USER\Gadu-Gadu
2007-04-12 17:11 53,600 --a------ C:\WINDOWS\system32\drivers\alcan5wn.sys
2007-04-12 17:03 <DIR> dr-hsc--- C:\WINDOWS\system32\dllcache
2007-04-12 17:03 <DIR> dr--s---- C:\WINDOWS\Fonts
2007-04-12 17:03 <DIR> dr------- C:\WINDOWS\Web
2007-04-12 17:03 <DIR> d--h----- C:\WINDOWS\inf
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\WinSxS
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\twain_32
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\wins
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\wbem
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\usmt
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\spool
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\ShellExt
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\Setup
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\ras
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\oobe
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\npp
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\mui
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\inetsrv
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\IME
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\icsxml
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\ias
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\export
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\drivers\etc
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\drivers\disdn
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\drivers
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\dhcp
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\config
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\3com_dmi
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\3076
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\2052
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1054
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1045
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1042
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1041
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1037
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1033
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1031
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1028
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1025
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\security
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Resources
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\repair
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\mui
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\msapps
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\msagent
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Media
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\ime
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Help
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Driver Cache
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Debug
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Cursors
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Connection Wizard
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Config
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\AppPatch
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\addins
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS
2007-04-12 16:33 <DIR> d--hs---- C:\RECYCLER
2007-04-12 16:32 <DIR> d-------- C:\Program Files\ToniArts
2007-04-12 16:31 1,168 --a------ C:\WINDOWS\mozver.dat
2007-04-12 16:23 <DIR> d-------- C:\DOCUME~1\USER\DANEAP~1\Lavasoft
2007-04-12 16:10 57,856 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2007-04-12 16:10 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2007-04-12 16:09 9,856 --a------ C:\WINDOWS\system32\drivers\gameenum.sys
2007-04-12 16:09 70,144 --a------ C:\WINDOWS\system32\usbui.dll
2007-04-12 16:09 27,165 --a------ C:\WINDOWS\system32\drivers\fetnd5.sys
2007-04-12 16:08 9,936 --a------ C:\WINDOWS\system\LZEXPAND.DLL
2007-04-12 16:08 9,168 --a------ C:\WINDOWS\system\VER.DLL
2007-04-12 16:08 85,532 --a------ C:\WINDOWS\system32\dgsetup.dll
2007-04-12 16:08 83,456 --a------ C:\WINDOWS\system\OLECLI.DLL
2007-04-12 16:08 8,192 -ra------ C:\WINDOWS\system32\kbdhept.dll
2007-04-12 16:08 72,192 --a------ C:\WINDOWS\system32\storprop.dll
2007-04-12 16:08 70,096 --a------ C:\WINDOWS\system\AVICAP.DLL
2007-04-12 16:08 7,168 --a------ C:\WINDOWS\system32\kbdcz.dll
2007-04-12 16:08 69,712 --a------ C:\WINDOWS\system\MMSYSTEM.DLL
2007-04-12 16:08 67,072 --a------ C:\WINDOWS\NOTEPAD.EXE
2007-04-12 16:08 6,656 -ra------ C:\WINDOWS\system32\kbdhela3.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\kbdycl.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\kbdsl1.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\kbdsl.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\kbdhu.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\kbdcz2.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\kbdcz1.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\kbdcr.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\KBDAL.DLL
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\batt.dll
2007-04-12 16:08 6,144 -ra------ C:\WINDOWS\system32\kbdtuq.dll
2007-04-12 16:08 6,144 -ra------ C:\WINDOWS\system32\kbdtuf.dll
2007-04-12 16:08 6,144 -ra------ C:\WINDOWS\system32\kbdlv1.dll
2007-04-12 16:08 6,144 -ra------ C:\WINDOWS\system32\kbdlv.dll
2007-04-12 16:08 6,144 -ra------ C:\WINDOWS\system32\kbdhela2.dll
2007-04-12 16:08 6,144 -ra------ C:\WINDOWS\system32\kbdgkl.dll
2007-04-12 16:08 6,144 -ra------ C:\WINDOWS\system32\kbdest.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdmon.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdlt1.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdlt.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdkyr.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdhe319.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdhe220.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdhe.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdazel.dll
2007-04-12 16:08 5,632 --a------ C:\WINDOWS\system32\kbdro.dll
2007-04-12 16:08 5,632 --a------ C:\WINDOWS\system32\kbdhu1.dll
2007-04-12 16:08 5,120 --a------ C:\WINDOWS\system\SHELL.DLL
2007-04-12 16:08 33,376 --a------ C:\WINDOWS\system\COMMDLG.DLL
2007-04-12 16:08 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2007-04-12 16:08 24,064 --a------ C:\WINDOWS\system\OLESVR.DLL
2007-04-12 16:08 19,200 --a------ C:\WINDOWS\system\TAPI.DLL
2007-04-12 16:08 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll
2007-04-12 16:08 15,360 --a------ C:\WINDOWS\TASKMAN.EXE
2007-04-12 16:08 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2007-04-12 16:08 127,008 --a------ C:\WINDOWS\system\MSVIDEO.DLL
2007-04-12 16:08 109,488 --a------ C:\WINDOWS\system\AVIFILE.DLL
2007-04-12 16:08 103,424 --a------ C:\WINDOWS\system32\EqnClass.Dll
2007-04-12 16:08 10,496 --a------ C:\WINDOWS\system32\drivers\irenum.sys
2007-04-12 16:08 <DIR> dr-h----- C:\DOCUME~1\DEFAUL~1\Ustawienia lokalne
2007-04-12 16:08 <DIR> dr------- C:\Program Files
2007-04-12 16:08 <DIR> dr------- C:\DOCUME~1\DEFAUL~1\Menu Start
2007-04-12 16:08 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Menu Start
2007-04-12 16:08 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Dokumenty
2007-04-12 16:08 <DIR> d--h----- C:\DOCUME~1\DEFAUL~1\Szablony
2007-04-12 16:08 <DIR> d--h----- C:\DOCUME~1\ALLUSE~1\Szablony
2007-04-12 16:08 <DIR> d-------- C:\Program Files\Common Files\SpeechEngines
2007-04-12 16:08 <DIR> d-------- C:\Program Files\Common Files\ODBC
2007-04-12 16:08 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Ulubione
2007-04-12 16:08 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Pulpit
2007-04-12 16:08 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Moje dokumenty
2007-04-12 16:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Ulubione
2007-04-12 16:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Pulpit
2007-04-12 16:07 <DIR> dr-h----- C:\DOCUME~1\DEFAUL~1\Dane aplikacji
2007-04-12 16:07 <DIR> dr-h----- C:\DOCUME~1\ALLUSE~1\Dane aplikacji
2007-04-12 16:07 <DIR> d-------- C:\WINDOWS\system32\CatRoot2
2007-04-12 16:07 <DIR> d-------- C:\WINDOWS\system32\CatRoot
2007-04-12 16:07 <DIR> d-------- C:\Documents and Settings
2007-04-12 15:55 270,336 --a------ C:\WINDOWS\system32\imon.dll
2007-04-12 15:54 0 --a------ C:\WINDOWS\nsreg.dat
2007-04-12 15:54 <DIR> d-------- C:\Program Files\Lavasoft
2007-04-12 15:51 516,096 --------- C:\WINDOWS\system32\ati2sgag.exe
2007-04-12 15:51 <DIR> d-------- C:\Program Files\ATI Technologies
2007-04-12 15:50 <DIR> d-------- C:\ATI
2007-04-12 15:48 77,440 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2007-04-12 15:48 7,040 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys
2007-04-12 15:48 577,536 --a------ C:\WINDOWS\soundman.exe
2007-04-12 15:48 57,856 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2007-04-12 15:48 56,832 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2007-04-12 15:48 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2007-04-12 15:48 50,048 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2007-04-12 15:48 5,888 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2007-04-12 15:48 5,120 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2007-04-12 15:48 44,416 --a------ C:\WINDOWS\system32\drivers\stream.sys
2007-04-12 15:48 40,960 --a------ C:\WINDOWS\system32\ChCfg.exe
2007-04-12 15:48 4,608 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys
2007-04-12 15:48 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2007-04-12 15:48 315,392 --a------ C:\WINDOWS\alcupd.exe
2007-04-12 15:48 3,972,672 --a------ C:\WINDOWS\system32\drivers\alcxwdm.sys
2007-04-12 15:48 217,088 --a------ C:\WINDOWS\Alcrmv.exe
2007-04-12 15:48 2,816 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys
2007-04-12 15:48 159,360 --a------ C:\WINDOWS\system32\drivers\kmixer.sys
2007-04-12 15:48 143,360 --a------ C:\WINDOWS\system32\RtlCPAPI.dll
2007-04-12 15:48 142,208 --a------ C:\WINDOWS\system32\drivers\aec.sys
2007-04-12 15:48 134,272 --a------ C:\WINDOWS\system32\drivers\portcls.sys
2007-04-12 15:48 131,712 --a------ C:\WINDOWS\system32\drivers\ks.sys
2007-04-12 15:48 10,527,744 --a------ C:\WINDOWS\system32\RTLCPL.exe
2007-04-12 15:48 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-04-12 15:48 <DIR> d-------- C:\Program Files\Realtek AC97
2007-04-12 15:47 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2007-04-12 15:43 545 --a------ C:\WINDOWS\UC.PIF
2007-04-12 15:43 545 --a------ C:\WINDOWS\RAR.PIF
2007-04-12 15:43 545 --a------ C:\WINDOWS\PKZIP.PIF
2007-04-12 15:43 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2007-04-12 15:43 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2007-04-12 15:43 545 --a------ C:\WINDOWS\LHA.PIF
2007-04-12 15:43 545 --a------ C:\WINDOWS\ARJ.PIF
2007-04-12 15:43 <DIR> d-------- C:\totalcmd
2007-04-12 15:28 2,359,296 --ah----- C:\DOCUME~1\USER\NTUSER.DAT
2007-04-12 15:28 <DIR> dr-h----- C:\DOCUME~1\USER\Dane aplikacji
2007-04-12 15:28 <DIR> dr------- C:\DOCUME~1\USER\Ulubione
2007-04-12 15:28 <DIR> dr------- C:\DOCUME~1\USER\Moje dokumenty
2007-04-12 15:28 <DIR> dr------- C:\DOCUME~1\USER\Menu Start
2007-04-12 15:28 <DIR> d--hs---- C:\WINDOWS\Installer
2007-04-12 15:28 <DIR> d--h----- C:\DOCUME~1\USER\Ustawienia lokalne
2007-04-12 15:28 <DIR> d--h----- C:\DOCUME~1\USER\Szablony
2007-04-12 15:28 <DIR> d-------- C:\DOCUME~1\USER\Pulpit
2007-04-12 15:27 262,144 --ah----- C:\DOCUME~1\NETWOR~1\NTUSER.DAT
2007-04-12 15:27 229,376 --ah----- C:\DOCUME~1\LOCALS~1\NTUSER.DAT
2007-04-12 15:27 <DIR> d--hs---- C:\System Volume Information
2007-04-12 15:27 <DIR> d--h----- C:\DOCUME~1\NETWOR~1\Ustawienia lokalne
2007-04-12 15:27 <DIR> d--h----- C:\DOCUME~1\LOCALS~1\Ustawienia lokalne
2007-04-12 15:27 <DIR> d-------- C:\WINDOWS\Prefetch
2007-04-12 15:27 <DIR> d-------- C:\DOCUME~1\NETWOR~1\Dane aplikacji
2007-04-12 15:27 <DIR> d-------- C:\DOCUME~1\LOCALS~1\Dane aplikacji
2007-04-12 15:18 <DIR> d-------- C:\WINDOWS\system32\xircom
2007-04-12 15:18 <DIR> d-------- C:\Program Files\microsoft frontpage
2007-04-12 15:17 229,376 ---h----- C:\DOCUME~1\DEFAUL~1\NTUSER.DAT
2007-04-12 15:17 112,128 --a------ C:\WINDOWS\system32\mapi32.dll
2007-04-12 15:17 0 -rahs---- C:\MSDOS.SYS
2007-04-12 15:17 0 -rahs---- C:\IO.SYS
2007-04-12 15:17 0 --a------ C:\CONFIG.SYS
2007-04-12 15:17 0 --------- C:\AUTOEXEC.BAT
2007-04-12 15:16 <DIR> dr------- C:\WINDOWS\Offline Web Pages
2007-04-12 15:16 <DIR> d--hs---- C:\DOCUME~1\ALLUSE~1\DRM
2007-04-12 15:16 <DIR> d---s---- C:\WINDOWS\Downloaded Program Files
2007-04-12 15:16 <DIR> d-------- C:\WINDOWS\system32\DirectX
2007-04-12 15:15 9,728 --a------ C:\WINDOWS\system32\mstinit.exe
2007-04-12 15:15 81,920 --a------ C:\WINDOWS\system32\isign32.dll
2007-04-12 15:15 81,408 --a------ C:\WINDOWS\system32\msoert2.dll
2007-04-12 15:15 73,728 --a------ C:\WINDOWS\system32\ils.dll
2007-04-12 15:15 69,632 --a------ C:\WINDOWS\system32\icwdial.dll
2007-04-12 15:15 69,248 --a------ C:\WINDOWS\system32\drivers\sr.sys
2007-04-12 15:15 67,584 --a------ C:\WINDOWS\system32\acctres.dll
2007-04-12 15:15 65,536 --a------ C:\WINDOWS\system32\msconf.dll
2007-04-12 15:15 63,488 --a------ C:\WINDOWS\system32\srclient.dll
2007-04-12 15:15 61,440 --a------ C:\WINDOWS\system32\icwphbk.dll
2007-04-12 15:15 587,776 --a------ C:\WINDOWS\system32\inetcomm.dll
2007-04-12 15:15 49,152 --a------ C:\WINDOWS\system32\inetres.dll
2007-04-12 15:15 40,960 --a------ C:\WINDOWS\system32\safrslv.dll
2007-04-12 15:15 39,424 --a------ C:\WINDOWS\system32\safrcdlg.dll
2007-04-12 15:15 33,792 --a------ C:\WINDOWS\system32\racpldlg.dll
2007-04-12 15:15 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2007-04-12 15:15 32,256 --a------ C:\WINDOWS\system32\mnmdd.dll
2007-04-12 15:15 28,672 --a------ C:\WINDOWS\system32\isrdbg32.dll
2007-04-12 15:15 270,336 --a------ C:\WINDOWS\system32\inetcfg.dll
2007-04-12 15:15 26,624 --a------ C:\WINDOWS\system32\safrdm.dll
2007-04-12 15:15 253,952 --a------ C:\WINDOWS\system32\mstask.dll
2007-04-12 15:15 24,576 --a------ C:\WINDOWS\system32\nmmkcert.dll
2007-04-12 15:15 228,864 --a------ C:\WINDOWS\system32\msoeacct.dll
2007-04-12 15:15 227,328 --a------ C:\WINDOWS\system32\srrstr.dll
2007-04-12 15:15 221,696 --a------ C:\WINDOWS\system32\qmgr.dll
2007-04-12 15:15 17,408 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2007-04-12 15:15 160,256 --a------ C:\WINDOWS\system32\schedsvc.dll
2007-04-12 15:15 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2007-04-12 15:15 159,232 --a------ C:\WINDOWS\system32\srsvc.dll
2007-04-12 15:15 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2007-04-12 15:15 11,264 --a------ C:\WINDOWS\system32\atrace.dll
2007-04-12 15:15 <DIR> d---s---- C:\WINDOWS\Tasks
2007-04-12 15:15 <DIR> d-------- C:\WINDOWS\system32\Restore
2007-04-12 15:15 <DIR> d-------- C:\WINDOWS\system32\Macromed
2007-04-12 15:15 <DIR> d-------- C:\WINDOWS\srchasst
2007-04-12 15:15 <DIR> d-------- C:\WINDOWS\PCHealth
2007-04-12 15:15 <DIR> d-------- C:\Program Files\Movie Maker
2007-04-12 15:15 <DIR> d-------- C:\Program Files\Common Files\MSSoap
2007-04-12 15:14 73,216 --a------ C:\WINDOWS\system32\avwav.dll
2007-04-12 15:14 5,632 --a------ C:\WINDOWS\system32\write.exe
2007-04-12 15:14 494,592 --a------ C:\WINDOWS\system32\hypertrm.dll
2007-04-12 15:14 44,544 --a------ C:\WINDOWS\system32\hticons.dll
2007-04-12 15:14 35,328 --a------ C:\WINDOWS\system32\winchat.exe
2007-04-12 15:14 231,424 --a------ C:\WINDOWS\system32\avtapi.dll
2007-04-12 15:14 21,856 --a------ C:\WINDOWS\system32\emptyregdb.dat
2007-04-12 15:14 183,296 --a------ C:\WINDOWS\system32\accwiz.exe
2007-04-12 15:14 16,384 --a------ C:\WINDOWS\system32\avmeter.dll
2007-04-12 15:14 139,264 --a------ C:\WINDOWS\system32\sndvol32.exe
2007-04-12 15:14 125,440 --a------ C:\WINDOWS\system32\sndrec32.exe
2007-04-12 15:14 <DIR> d--h----- C:\Program Files\WindowsUpdate
2007-04-12 15:14 <DIR> d-------- C:\WINDOWS\Registration
2007-04-12 15:14 <DIR> d-------- C:\Program Files\Usˆugi online
2007-04-12 15:14 <DIR> d-------- C:\Program Files\MSN Gaming Zone
2007-04-12 15:14 <DIR> d-------- C:\Program Files\Messenger
2007-04-12 15:13 99,328 --a------ C:\WINDOWS\system32\clipbrd.exe
2007-04-12 15:13 9,728 --a------ C:\WINDOWS\system32\xolehlp.dll
2007-04-12 15:13 9,728 --a------ C:\WINDOWS\system32\reset.exe
2007-04-12 15:13 9,216 --a------ C:\WINDOWS\system32\wuauserv.dll
2007-04-12 15:13 9,216 --a------ C:\WINDOWS\system32\icaapi.dll
2007-04-12 15:13 89,088 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2007-04-12 15:13 869,376 --a------ C:\WINDOWS\system32\msdtctm.dll
2007-04-12 15:13 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll
2007-04-12 15:13 83,968 --a------ C:\WINDOWS\system32\mtxoci.dll
2007-04-12 15:13 82,432 --a------ C:\WINDOWS\system32\comrepl.dll
2007-04-12 15:13 80,896 --a------ C:\WINDOWS\system32\charmap.exe
2007-04-12 15:13 75,912 --a------ C:\WINDOWS\system32\rdpwsx.dll
2007-04-12 15:13 61,952 --a------ C:\WINDOWS\system32\rdshost.exe
2007-04-12 15:13 605,696 --a------ C:\WINDOWS\system32\getuname.dll
2007-04-12 15:13 6,144 --a------ C:\WINDOWS\system32\msdtc.exe
2007-04-12 15:13 598,016 --a------ C:\WINDOWS\system32\mstscax.dll
2007-04-12 15:13 582,656 --a------ C:\WINDOWS\system32\catsrvut.dll
2007-04-12 15:13 57,856 --a------ C:\WINDOWS\system32\licwmi.dll
2007-04-12 15:13 57,344 --a------ C:\WINDOWS\system32\sol.exe
2007-04-12 15:13 56,832 --a------ C:\WINDOWS\system32\remotepg.dll
2007-04-12 15:13 56,832 --a------ C:\WINDOWS\system32\colbact.dll
2007-04-12 15:13 55,808 --a------ C:\WINDOWS\system32\freecell.exe
2007-04-12 15:13 54,784 --a------ C:\WINDOWS\system32\msdtclog.dll
2007-04-12 15:13 54,272 --a------ C:\WINDOWS\system32\stclient.dll
2007-04-12 15:13 534,016 --a------ C:\WINDOWS\system32\spider.exe
2007-04-12 15:13 53,248 --a------ C:\WINDOWS\system32\servdeps.dll
2007-04-12 15:13 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2007-04-12 15:13 495,616 --a------ C:\WINDOWS\system32\comuid.dll
2007-04-12 15:13 468,480 --a------ C:\WINDOWS\system32\clbcatq.dll
2007-04-12 15:13 44,032 --a------ C:\WINDOWS\system32\rdpclip.exe
2007-04-12 15:13 40,960 --a------ C:\WINDOWS\system32\tscupgrd.exe
2007-04-12 15:13 4,608 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2007-04-12 15:13 4,096 --a------ C:\WINDOWS\system32\mtxex.dll
2007-04-12 15:13 390,144 --a------ C:\WINDOWS\system32\mstsc.exe
2007-04-12 15:13 38,024 --a------ C:\WINDOWS\system32\drivers\termdd.sys
2007-04-12 15:13 359,936 --a------ C:\WINDOWS\system32\msdtcprx.dll
2007-04-12 15:13 342,016 --a------ C:\WINDOWS\system32\mspaint.exe
2007-04-12 15:13 33,792 --a------ C:\WINDOWS\system32\regini.exe
2007-04-12 15:13 32,768 --a------ C:\WINDOWS\system32\cfgbkend.dll
2007-04-12 15:13 25,600 --a------ C:\WINDOWS\system32\comaddin.dll
2007-04-12 15:13 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2007-04-12 15:13 22,528 --a------ C:\WINDOWS\system32\qwinsta.exe
2007-04-12 15:13 22,528 --a------ C:\WINDOWS\system32\msg.exe
2007-04-12 15:13 215,040 --a------ C:\WINDOWS\system32\catsrv.dll
2007-04-12 15:13 201,216 --a------ C:\WINDOWS\system32\termsrv.dll
2007-04-12 15:13 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll
2007-04-12 15:13 20,232 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys
2007-04-12 15:13 19,456 --a------ C:\WINDOWS\system32\qprocess.exe
2007-04-12 15:13 189,440 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-04-12 15:13 182,400 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys
2007-04-12 15:13 177,152 --a------ C:\WINDOWS\system32\cmprops.dll
2007-04-12 15:13 17,920 --a------ C:\WINDOWS\system32\tsshutdn.exe
2007-04-12 15:13 17,408 --a------ C:\WINDOWS\system32\qappsrv.exe
2007-04-12 15:13 16,896 --a------ C:\WINDOWS\system32\mmfutil.dll
2007-04-12 15:13 16,384 --a------ C:\WINDOWS\system32\tskill.exe
2007-04-12 15:13 16,384 --a------ C:\WINDOWS\system32\rwinsta.exe
2007-04-12 15:13 151,040 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2007-04-12 15:13 15,872 --a------ C:\WINDOWS\system32\logoff.exe
2007-04-12 15:13 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll
2007-04-12 15:13 15,360 --a------ C:\WINDOWS\system32\tsdiscon.exe
2007-04-12 15:13 15,360 --a------ C:\WINDOWS\system32\tscon.exe
2007-04-12 15:13 15,360 --a------ C:\WINDOWS\system32\shadow.exe
2007-04-12 15:13 147,456 --a------ C:\WINDOWS\system32\comsnap.dll
2007-04-12 15:13 142,336 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-04-12 15:13 14,848 --a------ C:\WINDOWS\system32\rdpsnd.dll
2007-04-12 15:13 135,680 --a------ C:\WINDOWS\system32\rdchost.dll
2007-04-12 15:13 130,048 --a------ C:\WINDOWS\system32\sessmgr.exe
2007-04-12 15:13 128,000 --a------ C:\WINDOWS\system32\mshearts.exe
2007-04-12 15:13 12,288 --a------ C:\WINDOWS\system32\rdsaddin.exe
2007-04-12 15:13 119,808 --a------ C:\WINDOWS\system32\winmine.exe
2007-04-12 15:13 118,272 --a------ C:\WINDOWS\system32\mplay32.exe
2007-04-12 15:13 115,976 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys
2007-04-12 15:13 115,200 --a------ C:\WINDOWS\system32\calc.exe
2007-04-12 15:13 11,144 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys
2007-04-12 15:13 100,864 --a------ C:\WINDOWS\system32\clbcatex.dll
2007-04-12 15:13 1,225 --a------ C:\WINDOWS\system32\usrlogon.cmd
2007-04-12 15:13 1,172,992 --a------ C:\WINDOWS\system32\comsvcs.dll
2007-04-12 15:13 <DIR> d-------- C:\WINDOWS\system32\MsDtc
2007-04-12 15:13 <DIR> d-------- C:\WINDOWS\system32\Com
2007-04-12 15:13 <DIR> d-------- C:\Program Files\Windows NT
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-04-17 11:59 49492 --a------ C:\WINDOWS\system32\perfc015.dat
2007-04-17 11:59 355486 --a------ C:\WINDOWS\system32\perfh015.dat
2007-04-12 16:08 62 --ahs---- C:\DOCUME~1\USER\DANEAP~1\desktop.ini
2007-04-12 15:16 -------- d-------- C:\Program Files\usˆugi online
2007-03-09 20:52 200768 --a------ C:\WINDOWS\system32\klogon.dll
2007-03-03 21:39 110360 --a------ C:\WINDOWS\system32\drivers\kl1.sys
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SpeedTouch USB Diagnostics"="\"C:\\Program Files\\Thomson\\SpeedTouch USB\\Dragdiag.exe\" /icon"
"AVP"="\"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe\""
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Gadu-Gadu"="\"C:\\Program Files\\Gadu-fGadu\\gg.exe\" /tray"
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
********************************************************************
catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-04-24 17:52:17
Windows 5.1.2600 Dodatek Service Pack. 1 NTFS
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
********************************************************************
Completion time: 07-04-24 17:52:18
C:\ComboFix-quarantined-files.txt ... 07-04-24 17:52
przez wojtas 24 Kwi 2007, 18:13
sciagnij gmera:
http://gmer.net/gmer.zip
Uruchomić Gmer, w zakładce Procesy wybrać Gmer awaryjny co objawi się samoczynnym resetem kompa i startem Gmera. Wtedy:
>>> zakładka Procesy i przez opcję Pliki ręcznie skasować:
potem nowy log z combofixa
http://gmer.net/gmer.zip
Uruchomić Gmer, w zakładce Procesy wybrać Gmer awaryjny co objawi się samoczynnym resetem kompa i startem Gmera. Wtedy:
>>> zakładka Procesy i przez opcję Pliki ręcznie skasować:
C:\WINDOWS\zts2.exe
C:\WINDOWS\system32\vcmgcd32.dll
C:\WINDOWS\system32\iifgfgf.dll
C:\WINDOWS\rundll16.exe
C:\WINDOWS\rundl132.dll
C:\WINDOWS\logo1_.exe
C:\WINDOWS\system32\ehkmp.bak2
potem nowy log z combofixa
-
wojtas - *mod
- Posty: 18165
- Dołączenie: 13 Sty 2006, 16:00
- Miejscowość: Krzeszyce
- Pochwały: 1656
-
przez Gerwazy 24 Kwi 2007, 18:47
"
USER" - 07-04-24 18:32:49 Dodatek Service Pack. 1
ComboFix 07-04-24.2V - Running from: "C:\Documents and Settings\USER\Pulpit\"
((((((((((((((((((((((((((((((( Files Created from 2007-03-24 to 2007-04-24 ))))))))))))))))))))))))))))))))))
2007-04-24 17:16 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-04-24 14:42 <DIR> d-------- C:\Program Files\BearShare
2007-04-24 14:42 <DIR> d-------- C:\My Downloads
2007-04-23 15:32 <DIR> d-------- C:\WINDOWS\speech
2007-04-23 15:32 <DIR> d-------- C:\Program Files\ivo
2007-04-19 20:54 75,932 --a------ C:\WINDOWS\system32\drivers\klick.dat
2007-04-19 20:54 74,396 --a------ C:\WINDOWS\system32\drivers\klin.dat
2007-04-19 20:53 72,224 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2007-04-19 20:53 1,881,632 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2007-04-19 20:53 <DIR> d-------- C:\Program Files\Kaspersky Lab
2007-04-19 20:53 <DIR> d-------- C:\KAV
2007-04-18 21:22 <DIR> d-------- C:\Program Files\Tibia Auto
2007-04-18 21:21 <DIR> d-------- C:\Python24
2007-04-17 16:50 36,528 --------- C:\WINDOWS\system32\drivers\PxHelp20.sys
2007-04-17 16:50 2,560 --------- C:\WINDOWS\system32\drivers\cdralw2k.sys
2007-04-17 16:50 2,432 --------- C:\WINDOWS\system32\drivers\cdr4_xp.sys
2007-04-17 16:50 129,784 --------- C:\WINDOWS\system32\pxafs.dll
2007-04-17 16:50 115,880 --------- C:\WINDOWS\system32\pxinsi64.exe
2007-04-17 16:50 <DIR> d-------- C:\Program Files\Winamp
2007-04-16 21:35 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Kaspersky Lab
2007-04-16 12:00 <DIR> d-------- C:\DOCUME~1\USER\DANEAP~1\PC Tools
2007-04-15 20:17 524,288 --ah----- C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-04-15 20:17 <DIR> dr-h----- C:\DOCUME~1\ADMINI~1\Dane aplikacji
2007-04-15 20:17 <DIR> dr------- C:\DOCUME~1\ADMINI~1\Menu Start
2007-04-15 20:17 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Ustawienia lokalne
2007-04-15 20:17 <DIR> d--h----- C:\DOCUME~1\ADMINI~1\Szablony
2007-04-15 20:17 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Ulubione
2007-04-15 20:17 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Pulpit
2007-04-15 20:17 <DIR> d-------- C:\DOCUME~1\ADMINI~1\Moje dokumenty
2007-04-15 16:53 70,688 --a------ C:\WINDOWS\system32\drivers\alcaudsl.sys
2007-04-15 16:53 5,606 --a------ C:\WINDOWS\system32\stci.dll
2007-04-15 16:53 5,280 --a------ C:\WINDOWS\system32\drivers\alcawh.sys
2007-04-15 16:53 3,968 --a------ C:\WINDOWS\system32\drivers\alcacr.sys
2007-04-15 16:53 <DIR> d-------- C:\Program Files\Thomson
2007-04-15 13:34 <DIR> d--h----- C:\WINDOWS\PIF
2007-04-13 22:38 499,712 --a------ C:\WINDOWS\system32\MSVCP71.dll
2007-04-13 22:38 348,160 --a------ C:\WINDOWS\system32\MSVCR71.dll
2007-04-13 22:38 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2007-04-13 21:06 41,474 --ahs---- C:\WINDOWS\system32\smsc.exe
2007-04-13 13:13 <DIR> d-------- C:\DOCUME~1\USER\DANEAP~1\Help
2007-04-12 19:24 <DIR> d-------- C:\Program Files\Tibia
2007-04-12 17:38 <DIR> d-------- C:\WINDOWS\pss
2007-04-12 17:28 <DIR> d-------- C:\Program Files\Gadu-fGadu
2007-04-12 17:28 <DIR> d-------- C:\DOCUME~1\USER\Gadu-Gadu
2007-04-12 17:11 53,600 --a------ C:\WINDOWS\system32\drivers\alcan5wn.sys
2007-04-12 17:03 <DIR> dr-hsc--- C:\WINDOWS\system32\dllcache
2007-04-12 17:03 <DIR> dr--s---- C:\WINDOWS\Fonts
2007-04-12 17:03 <DIR> dr------- C:\WINDOWS\Web
2007-04-12 17:03 <DIR> d--h----- C:\WINDOWS\inf
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\WinSxS
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\twain_32
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\wins
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\wbem
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\usmt
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\spool
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\ShellExt
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\Setup
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\ras
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\oobe
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\npp
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\mui
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\inetsrv
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\IME
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\icsxml
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\ias
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\export
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\drivers\etc
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\drivers\disdn
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\drivers
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\dhcp
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\config
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\3com_dmi
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\3076
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\2052
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1054
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1045
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1042
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1041
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1037
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1033
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1031
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1028
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32\1025
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system32
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\system
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\security
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Resources
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\repair
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\mui
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\msapps
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\msagent
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Media
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\ime
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Help
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Driver Cache
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Debug
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Cursors
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Connection Wizard
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\Config
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\AppPatch
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS\addins
2007-04-12 17:03 <DIR> d-------- C:\WINDOWS
2007-04-12 16:33 <DIR> d--hs---- C:\RECYCLER
2007-04-12 16:32 <DIR> d-------- C:\Program Files\ToniArts
2007-04-12 16:31 1,168 --a------ C:\WINDOWS\mozver.dat
2007-04-12 16:23 <DIR> d-------- C:\DOCUME~1\USER\DANEAP~1\Lavasoft
2007-04-12 16:10 57,856 --a------ C:\WINDOWS\system32\drivers\redbook.sys
2007-04-12 16:10 3,072 --a------ C:\WINDOWS\system32\drivers\audstub.sys
2007-04-12 16:09 9,856 --a------ C:\WINDOWS\system32\drivers\gameenum.sys
2007-04-12 16:09 70,144 --a------ C:\WINDOWS\system32\usbui.dll
2007-04-12 16:09 27,165 --a------ C:\WINDOWS\system32\drivers\fetnd5.sys
2007-04-12 16:08 9,936 --a------ C:\WINDOWS\system\LZEXPAND.DLL
2007-04-12 16:08 9,168 --a------ C:\WINDOWS\system\VER.DLL
2007-04-12 16:08 85,532 --a------ C:\WINDOWS\system32\dgsetup.dll
2007-04-12 16:08 83,456 --a------ C:\WINDOWS\system\OLECLI.DLL
2007-04-12 16:08 8,192 -ra------ C:\WINDOWS\system32\kbdhept.dll
2007-04-12 16:08 72,192 --a------ C:\WINDOWS\system32\storprop.dll
2007-04-12 16:08 70,096 --a------ C:\WINDOWS\system\AVICAP.DLL
2007-04-12 16:08 7,168 --a------ C:\WINDOWS\system32\kbdcz.dll
2007-04-12 16:08 69,712 --a------ C:\WINDOWS\system\MMSYSTEM.DLL
2007-04-12 16:08 67,072 --a------ C:\WINDOWS\NOTEPAD.EXE
2007-04-12 16:08 6,656 -ra------ C:\WINDOWS\system32\kbdhela3.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\kbdycl.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\kbdsl1.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\kbdsl.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\kbdhu.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\kbdcz2.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\kbdcz1.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\kbdcr.dll
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\KBDAL.DLL
2007-04-12 16:08 6,656 --a------ C:\WINDOWS\system32\batt.dll
2007-04-12 16:08 6,144 -ra------ C:\WINDOWS\system32\kbdtuq.dll
2007-04-12 16:08 6,144 -ra------ C:\WINDOWS\system32\kbdtuf.dll
2007-04-12 16:08 6,144 -ra------ C:\WINDOWS\system32\kbdlv1.dll
2007-04-12 16:08 6,144 -ra------ C:\WINDOWS\system32\kbdlv.dll
2007-04-12 16:08 6,144 -ra------ C:\WINDOWS\system32\kbdhela2.dll
2007-04-12 16:08 6,144 -ra------ C:\WINDOWS\system32\kbdgkl.dll
2007-04-12 16:08 6,144 -ra------ C:\WINDOWS\system32\kbdest.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdmon.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdlt1.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdlt.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdkyr.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdhe319.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdhe220.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdhe.dll
2007-04-12 16:08 5,632 -ra------ C:\WINDOWS\system32\kbdazel.dll
2007-04-12 16:08 5,632 --a------ C:\WINDOWS\system32\kbdro.dll
2007-04-12 16:08 5,632 --a------ C:\WINDOWS\system32\kbdhu1.dll
2007-04-12 16:08 5,120 --a------ C:\WINDOWS\system\SHELL.DLL
2007-04-12 16:08 33,376 --a------ C:\WINDOWS\system\COMMDLG.DLL
2007-04-12 16:08 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2007-04-12 16:08 24,064 --a------ C:\WINDOWS\system\OLESVR.DLL
2007-04-12 16:08 19,200 --a------ C:\WINDOWS\system\TAPI.DLL
2007-04-12 16:08 176,157 --a------ C:\WINDOWS\system32\dgrpsetu.dll
2007-04-12 16:08 15,360 --a------ C:\WINDOWS\TASKMAN.EXE
2007-04-12 16:08 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2007-04-12 16:08 127,008 --a------ C:\WINDOWS\system\MSVIDEO.DLL
2007-04-12 16:08 109,488 --a------ C:\WINDOWS\system\AVIFILE.DLL
2007-04-12 16:08 103,424 --a------ C:\WINDOWS\system32\EqnClass.Dll
2007-04-12 16:08 10,496 --a------ C:\WINDOWS\system32\drivers\irenum.sys
2007-04-12 16:08 <DIR> dr-h----- C:\DOCUME~1\DEFAUL~1\Ustawienia lokalne
2007-04-12 16:08 <DIR> dr------- C:\Program Files
2007-04-12 16:08 <DIR> dr------- C:\DOCUME~1\DEFAUL~1\Menu Start
2007-04-12 16:08 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Menu Start
2007-04-12 16:08 <DIR> dr------- C:\DOCUME~1\ALLUSE~1\Dokumenty
2007-04-12 16:08 <DIR> d--h----- C:\DOCUME~1\DEFAUL~1\Szablony
2007-04-12 16:08 <DIR> d--h----- C:\DOCUME~1\ALLUSE~1\Szablony
2007-04-12 16:08 <DIR> d-------- C:\Program Files\Common Files\SpeechEngines
2007-04-12 16:08 <DIR> d-------- C:\Program Files\Common Files\ODBC
2007-04-12 16:08 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Ulubione
2007-04-12 16:08 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Pulpit
2007-04-12 16:08 <DIR> d-------- C:\DOCUME~1\DEFAUL~1\Moje dokumenty
2007-04-12 16:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Ulubione
2007-04-12 16:08 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Pulpit
2007-04-12 16:07 <DIR> dr-h----- C:\DOCUME~1\DEFAUL~1\Dane aplikacji
2007-04-12 16:07 <DIR> dr-h----- C:\DOCUME~1\ALLUSE~1\Dane aplikacji
2007-04-12 16:07 <DIR> d-------- C:\WINDOWS\system32\CatRoot2
2007-04-12 16:07 <DIR> d-------- C:\WINDOWS\system32\CatRoot
2007-04-12 16:07 <DIR> d-------- C:\Documents and Settings
2007-04-12 15:55 270,336 --a------ C:\WINDOWS\system32\imon.dll
2007-04-12 15:54 0 --a------ C:\WINDOWS\nsreg.dat
2007-04-12 15:54 <DIR> d-------- C:\Program Files\Lavasoft
2007-04-12 15:51 516,096 --------- C:\WINDOWS\system32\ati2sgag.exe
2007-04-12 15:51 <DIR> d-------- C:\Program Files\ATI Technologies
2007-04-12 15:50 <DIR> d-------- C:\ATI
2007-04-12 15:48 77,440 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys
2007-04-12 15:48 7,040 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys
2007-04-12 15:48 577,536 --a------ C:\WINDOWS\soundman.exe
2007-04-12 15:48 57,856 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2007-04-12 15:48 56,832 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys
2007-04-12 15:48 54,272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys
2007-04-12 15:48 50,048 --a------ C:\WINDOWS\system32\drivers\DMusic.sys
2007-04-12 15:48 5,888 --a------ C:\WINDOWS\system32\drivers\splitter.sys
2007-04-12 15:48 5,120 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys
2007-04-12 15:48 44,416 --a------ C:\WINDOWS\system32\drivers\stream.sys
2007-04-12 15:48 40,960 --a------ C:\WINDOWS\system32\ChCfg.exe
2007-04-12 15:48 4,608 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys
2007-04-12 15:48 4,096 --a------ C:\WINDOWS\system32\ksuser.dll
2007-04-12 15:48 315,392 --a------ C:\WINDOWS\alcupd.exe
2007-04-12 15:48 3,972,672 --a------ C:\WINDOWS\system32\drivers\alcxwdm.sys
2007-04-12 15:48 217,088 --a------ C:\WINDOWS\Alcrmv.exe
2007-04-12 15:48 2,816 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys
2007-04-12 15:48 159,360 --a------ C:\WINDOWS\system32\drivers\kmixer.sys
2007-04-12 15:48 143,360 --a------ C:\WINDOWS\system32\RtlCPAPI.dll
2007-04-12 15:48 142,208 --a------ C:\WINDOWS\system32\drivers\aec.sys
2007-04-12 15:48 134,272 --a------ C:\WINDOWS\system32\drivers\portcls.sys
2007-04-12 15:48 131,712 --a------ C:\WINDOWS\system32\drivers\ks.sys
2007-04-12 15:48 10,527,744 --a------ C:\WINDOWS\system32\RTLCPL.exe
2007-04-12 15:48 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2007-04-12 15:48 <DIR> d-------- C:\Program Files\Realtek AC97
2007-04-12 15:47 <DIR> d-------- C:\Program Files\Common Files\InstallShield
2007-04-12 15:43 545 --a------ C:\WINDOWS\UC.PIF
2007-04-12 15:43 545 --a------ C:\WINDOWS\RAR.PIF
2007-04-12 15:43 545 --a------ C:\WINDOWS\PKZIP.PIF
2007-04-12 15:43 545 --a------ C:\WINDOWS\PKUNZIP.PIF
2007-04-12 15:43 545 --a------ C:\WINDOWS\NOCLOSE.PIF
2007-04-12 15:43 545 --a------ C:\WINDOWS\LHA.PIF
2007-04-12 15:43 545 --a------ C:\WINDOWS\ARJ.PIF
2007-04-12 15:43 <DIR> d-------- C:\totalcmd
2007-04-12 15:28 2,359,296 --ah----- C:\DOCUME~1\USER\NTUSER.DAT
2007-04-12 15:28 <DIR> dr-h----- C:\DOCUME~1\USER\Dane aplikacji
2007-04-12 15:28 <DIR> dr------- C:\DOCUME~1\USER\Ulubione
2007-04-12 15:28 <DIR> dr------- C:\DOCUME~1\USER\Moje dokumenty
2007-04-12 15:28 <DIR> dr------- C:\DOCUME~1\USER\Menu Start
2007-04-12 15:28 <DIR> d--hs---- C:\WINDOWS\Installer
2007-04-12 15:28 <DIR> d--h----- C:\DOCUME~1\USER\Ustawienia lokalne
2007-04-12 15:28 <DIR> d--h----- C:\DOCUME~1\USER\Szablony
2007-04-12 15:28 <DIR> d-------- C:\DOCUME~1\USER\Pulpit
2007-04-12 15:27 262,144 --ah----- C:\DOCUME~1\NETWOR~1\NTUSER.DAT
2007-04-12 15:27 229,376 --ah----- C:\DOCUME~1\LOCALS~1\NTUSER.DAT
2007-04-12 15:27 <DIR> d--hs---- C:\System Volume Information
2007-04-12 15:27 <DIR> d--h----- C:\DOCUME~1\NETWOR~1\Ustawienia lokalne
2007-04-12 15:27 <DIR> d--h----- C:\DOCUME~1\LOCALS~1\Ustawienia lokalne
2007-04-12 15:27 <DIR> d-------- C:\WINDOWS\Prefetch
2007-04-12 15:27 <DIR> d-------- C:\DOCUME~1\NETWOR~1\Dane aplikacji
2007-04-12 15:27 <DIR> d-------- C:\DOCUME~1\LOCALS~1\Dane aplikacji
2007-04-12 15:18 <DIR> d-------- C:\WINDOWS\system32\xircom
2007-04-12 15:18 <DIR> d-------- C:\Program Files\microsoft frontpage
2007-04-12 15:17 229,376 ---h----- C:\DOCUME~1\DEFAUL~1\NTUSER.DAT
2007-04-12 15:17 112,128 --a------ C:\WINDOWS\system32\mapi32.dll
2007-04-12 15:17 0 -rahs---- C:\MSDOS.SYS
2007-04-12 15:17 0 -rahs---- C:\IO.SYS
2007-04-12 15:17 0 --a------ C:\CONFIG.SYS
2007-04-12 15:17 0 --------- C:\AUTOEXEC.BAT
2007-04-12 15:16 <DIR> dr------- C:\WINDOWS\Offline Web Pages
2007-04-12 15:16 <DIR> d--hs---- C:\DOCUME~1\ALLUSE~1\DRM
2007-04-12 15:16 <DIR> d---s---- C:\WINDOWS\Downloaded Program Files
2007-04-12 15:16 <DIR> d-------- C:\WINDOWS\system32\DirectX
2007-04-12 15:15 9,728 --a------ C:\WINDOWS\system32\mstinit.exe
2007-04-12 15:15 81,920 --a------ C:\WINDOWS\system32\isign32.dll
2007-04-12 15:15 81,408 --a------ C:\WINDOWS\system32\msoert2.dll
2007-04-12 15:15 73,728 --a------ C:\WINDOWS\system32\ils.dll
2007-04-12 15:15 69,632 --a------ C:\WINDOWS\system32\icwdial.dll
2007-04-12 15:15 69,248 --a------ C:\WINDOWS\system32\drivers\sr.sys
2007-04-12 15:15 67,584 --a------ C:\WINDOWS\system32\acctres.dll
2007-04-12 15:15 65,536 --a------ C:\WINDOWS\system32\msconf.dll
2007-04-12 15:15 63,488 --a------ C:\WINDOWS\system32\srclient.dll
2007-04-12 15:15 61,440 --a------ C:\WINDOWS\system32\icwphbk.dll
2007-04-12 15:15 587,776 --a------ C:\WINDOWS\system32\inetcomm.dll
2007-04-12 15:15 49,152 --a------ C:\WINDOWS\system32\inetres.dll
2007-04-12 15:15 40,960 --a------ C:\WINDOWS\system32\safrslv.dll
2007-04-12 15:15 39,424 --a------ C:\WINDOWS\system32\safrcdlg.dll
2007-04-12 15:15 33,792 --a------ C:\WINDOWS\system32\racpldlg.dll
2007-04-12 15:15 32,768 --a------ C:\WINDOWS\system32\mnmsrvc.exe
2007-04-12 15:15 32,256 --a------ C:\WINDOWS\system32\mnmdd.dll
2007-04-12 15:15 28,672 --a------ C:\WINDOWS\system32\isrdbg32.dll
2007-04-12 15:15 270,336 --a------ C:\WINDOWS\system32\inetcfg.dll
2007-04-12 15:15 26,624 --a------ C:\WINDOWS\system32\safrdm.dll
2007-04-12 15:15 253,952 --a------ C:\WINDOWS\system32\mstask.dll
2007-04-12 15:15 24,576 --a------ C:\WINDOWS\system32\nmmkcert.dll
2007-04-12 15:15 228,864 --a------ C:\WINDOWS\system32\msoeacct.dll
2007-04-12 15:15 227,328 --a------ C:\WINDOWS\system32\srrstr.dll
2007-04-12 15:15 221,696 --a------ C:\WINDOWS\system32\qmgr.dll
2007-04-12 15:15 17,408 --a------ C:\WINDOWS\system32\qmgrprxy.dll
2007-04-12 15:15 160,256 --a------ C:\WINDOWS\system32\schedsvc.dll
2007-04-12 15:15 16,384 --a------ C:\WINDOWS\system32\icfgnt5.dll
2007-04-12 15:15 159,232 --a------ C:\WINDOWS\system32\srsvc.dll
2007-04-12 15:15 12,288 --a------ C:\WINDOWS\system32\nmevtmsg.dll
2007-04-12 15:15 11,264 --a------ C:\WINDOWS\system32\atrace.dll
2007-04-12 15:15 <DIR> d---s---- C:\WINDOWS\Tasks
2007-04-12 15:15 <DIR> d-------- C:\WINDOWS\system32\Restore
2007-04-12 15:15 <DIR> d-------- C:\WINDOWS\system32\Macromed
2007-04-12 15:15 <DIR> d-------- C:\WINDOWS\srchasst
2007-04-12 15:15 <DIR> d-------- C:\WINDOWS\PCHealth
2007-04-12 15:15 <DIR> d-------- C:\Program Files\Movie Maker
2007-04-12 15:15 <DIR> d-------- C:\Program Files\Common Files\MSSoap
2007-04-12 15:14 73,216 --a------ C:\WINDOWS\system32\avwav.dll
2007-04-12 15:14 5,632 --a------ C:\WINDOWS\system32\write.exe
2007-04-12 15:14 494,592 --a------ C:\WINDOWS\system32\hypertrm.dll
2007-04-12 15:14 44,544 --a------ C:\WINDOWS\system32\hticons.dll
2007-04-12 15:14 35,328 --a------ C:\WINDOWS\system32\winchat.exe
2007-04-12 15:14 231,424 --a------ C:\WINDOWS\system32\avtapi.dll
2007-04-12 15:14 21,856 --a------ C:\WINDOWS\system32\emptyregdb.dat
2007-04-12 15:14 183,296 --a------ C:\WINDOWS\system32\accwiz.exe
2007-04-12 15:14 16,384 --a------ C:\WINDOWS\system32\avmeter.dll
2007-04-12 15:14 139,264 --a------ C:\WINDOWS\system32\sndvol32.exe
2007-04-12 15:14 125,440 --a------ C:\WINDOWS\system32\sndrec32.exe
2007-04-12 15:14 <DIR> d--h----- C:\Program Files\WindowsUpdate
2007-04-12 15:14 <DIR> d-------- C:\WINDOWS\Registration
2007-04-12 15:14 <DIR> d-------- C:\Program Files\Usˆugi online
2007-04-12 15:14 <DIR> d-------- C:\Program Files\MSN Gaming Zone
2007-04-12 15:14 <DIR> d-------- C:\Program Files\Messenger
2007-04-12 15:13 99,328 --a------ C:\WINDOWS\system32\clipbrd.exe
2007-04-12 15:13 9,728 --a------ C:\WINDOWS\system32\xolehlp.dll
2007-04-12 15:13 9,728 --a------ C:\WINDOWS\system32\reset.exe
2007-04-12 15:13 9,216 --a------ C:\WINDOWS\system32\wuauserv.dll
2007-04-12 15:13 9,216 --a------ C:\WINDOWS\system32\icaapi.dll
2007-04-12 15:13 89,088 --a------ C:\WINDOWS\system32\tscfgwmi.dll
2007-04-12 15:13 869,376 --a------ C:\WINDOWS\system32\msdtctm.dll
2007-04-12 15:13 85,504 --a------ C:\WINDOWS\system32\catsrvps.dll
2007-04-12 15:13 83,968 --a------ C:\WINDOWS\system32\mtxoci.dll
2007-04-12 15:13 82,432 --a------ C:\WINDOWS\system32\comrepl.dll
2007-04-12 15:13 80,896 --a------ C:\WINDOWS\system32\charmap.exe
2007-04-12 15:13 75,912 --a------ C:\WINDOWS\system32\rdpwsx.dll
2007-04-12 15:13 61,952 --a------ C:\WINDOWS\system32\rdshost.exe
2007-04-12 15:13 605,696 --a------ C:\WINDOWS\system32\getuname.dll
2007-04-12 15:13 6,144 --a------ C:\WINDOWS\system32\msdtc.exe
2007-04-12 15:13 598,016 --a------ C:\WINDOWS\system32\mstscax.dll
2007-04-12 15:13 582,656 --a------ C:\WINDOWS\system32\catsrvut.dll
2007-04-12 15:13 57,856 --a------ C:\WINDOWS\system32\licwmi.dll
2007-04-12 15:13 57,344 --a------ C:\WINDOWS\system32\sol.exe
2007-04-12 15:13 56,832 --a------ C:\WINDOWS\system32\remotepg.dll
2007-04-12 15:13 56,832 --a------ C:\WINDOWS\system32\colbact.dll
2007-04-12 15:13 55,808 --a------ C:\WINDOWS\system32\freecell.exe
2007-04-12 15:13 54,784 --a------ C:\WINDOWS\system32\msdtclog.dll
2007-04-12 15:13 54,272 --a------ C:\WINDOWS\system32\stclient.dll
2007-04-12 15:13 534,016 --a------ C:\WINDOWS\system32\spider.exe
2007-04-12 15:13 53,248 --a------ C:\WINDOWS\system32\servdeps.dll
2007-04-12 15:13 5,120 --a------ C:\WINDOWS\system32\dcomcnfg.exe
2007-04-12 15:13 495,616 --a------ C:\WINDOWS\system32\comuid.dll
2007-04-12 15:13 468,480 --a------ C:\WINDOWS\system32\clbcatq.dll
2007-04-12 15:13 44,032 --a------ C:\WINDOWS\system32\rdpclip.exe
2007-04-12 15:13 40,960 --a------ C:\WINDOWS\system32\tscupgrd.exe
2007-04-12 15:13 4,608 --a------ C:\WINDOWS\system32\rdpcfgex.dll
2007-04-12 15:13 4,096 --a------ C:\WINDOWS\system32\mtxex.dll
2007-04-12 15:13 390,144 --a------ C:\WINDOWS\system32\mstsc.exe
2007-04-12 15:13 38,024 --a------ C:\WINDOWS\system32\drivers\termdd.sys
2007-04-12 15:13 359,936 --a------ C:\WINDOWS\system32\msdtcprx.dll
2007-04-12 15:13 342,016 --a------ C:\WINDOWS\system32\mspaint.exe
2007-04-12 15:13 33,792 --a------ C:\WINDOWS\system32\regini.exe
2007-04-12 15:13 32,768 --a------ C:\WINDOWS\system32\cfgbkend.dll
2007-04-12 15:13 25,600 --a------ C:\WINDOWS\system32\comaddin.dll
2007-04-12 15:13 25,088 --a------ C:\WINDOWS\system32\mtxlegih.dll
2007-04-12 15:13 22,528 --a------ C:\WINDOWS\system32\qwinsta.exe
2007-04-12 15:13 22,528 --a------ C:\WINDOWS\system32\msg.exe
2007-04-12 15:13 215,040 --a------ C:\WINDOWS\system32\catsrv.dll
2007-04-12 15:13 201,216 --a------ C:\WINDOWS\system32\termsrv.dll
2007-04-12 15:13 20,480 --a------ C:\WINDOWS\system32\mtxdm.dll
2007-04-12 15:13 20,232 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys
2007-04-12 15:13 19,456 --a------ C:\WINDOWS\system32\qprocess.exe
2007-04-12 15:13 189,440 --a------ C:\WINDOWS\system32\wuaueng.dll
2007-04-12 15:13 182,400 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys
2007-04-12 15:13 177,152 --a------ C:\WINDOWS\system32\cmprops.dll
2007-04-12 15:13 17,920 --a------ C:\WINDOWS\system32\tsshutdn.exe
2007-04-12 15:13 17,408 --a------ C:\WINDOWS\system32\qappsrv.exe
2007-04-12 15:13 16,896 --a------ C:\WINDOWS\system32\mmfutil.dll
2007-04-12 15:13 16,384 --a------ C:\WINDOWS\system32\tskill.exe
2007-04-12 15:13 16,384 --a------ C:\WINDOWS\system32\rwinsta.exe
2007-04-12 15:13 151,040 --a------ C:\WINDOWS\system32\msdtcuiu.dll
2007-04-12 15:13 15,872 --a------ C:\WINDOWS\system32\logoff.exe
2007-04-12 15:13 15,872 --a------ C:\WINDOWS\system32\cdmodem.dll
2007-04-12 15:13 15,360 --a------ C:\WINDOWS\system32\tsdiscon.exe
2007-04-12 15:13 15,360 --a------ C:\WINDOWS\system32\tscon.exe
2007-04-12 15:13 15,360 --a------ C:\WINDOWS\system32\shadow.exe
2007-04-12 15:13 147,456 --a------ C:\WINDOWS\system32\comsnap.dll
2007-04-12 15:13 142,336 --a------ C:\WINDOWS\system32\wuauclt.exe
2007-04-12 15:13 14,848 --a------ C:\WINDOWS\system32\rdpsnd.dll
2007-04-12 15:13 135,680 --a------ C:\WINDOWS\system32\rdchost.dll
2007-04-12 15:13 130,048 --a------ C:\WINDOWS\system32\sessmgr.exe
2007-04-12 15:13 128,000 --a------ C:\WINDOWS\system32\mshearts.exe
2007-04-12 15:13 12,288 --a------ C:\WINDOWS\system32\rdsaddin.exe
2007-04-12 15:13 119,808 --a------ C:\WINDOWS\system32\winmine.exe
2007-04-12 15:13 118,272 --a------ C:\WINDOWS\system32\mplay32.exe
2007-04-12 15:13 115,976 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys
2007-04-12 15:13 115,200 --a------ C:\WINDOWS\system32\calc.exe
2007-04-12 15:13 11,144 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys
2007-04-12 15:13 100,864 --a------ C:\WINDOWS\system32\clbcatex.dll
2007-04-12 15:13 1,225 --a------ C:\WINDOWS\system32\usrlogon.cmd
2007-04-12 15:13 1,172,992 --a------ C:\WINDOWS\system32\comsvcs.dll
2007-04-12 15:13 <DIR> d-------- C:\WINDOWS\system32\MsDtc
2007-04-12 15:13 <DIR> d-------- C:\WINDOWS\system32\Com
2007-04-12 15:13 <DIR> d-------- C:\Program Files\Windows NT
(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-04-17 11:59 49492 --a------ C:\WINDOWS\system32\perfc015.dat
2007-04-17 11:59 355486 --a------ C:\WINDOWS\system32\perfh015.dat
2007-04-12 16:08 62 --ahs---- C:\DOCUME~1\USER\DANEAP~1\desktop.ini
2007-04-12 15:16 -------- d-------- C:\Program Files\usˆugi online
2007-03-09 20:52 200768 --a------ C:\WINDOWS\system32\klogon.dll
2007-03-03 21:39 110360 --a------ C:\WINDOWS\system32\drivers\kl1.sys
(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SpeedTouch USB Diagnostics"="\"C:\\Program Files\\Thomson\\SpeedTouch USB\\Dragdiag.exe\" /icon"
"AVP"="\"C:\\Program Files\\Kaspersky Lab\\Kaspersky Anti-Virus 6.0\\avp.exe\""
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Gadu-Gadu"="\"C:\\Program Files\\Gadu-fGadu\\gg.exe\" /tray"
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
Authentication Packages REG_MULTI_SZ msv1_0\0\0
Security Packages REG_MULTI_SZ kerberos\0msv1_0\0schannel\0wdigest\0\0
Notification Packages REG_MULTI_SZ scecli\0\0
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ DnsCache\0\0
rpcss REG_MULTI_SZ RpcSs\0\0
imgsvc REG_MULTI_SZ StiSvc\0\0
termsvcs REG_MULTI_SZ TermService\0\0
********************************************************************
catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-04-24 18:33:46
Windows 5.1.2600 Dodatek Service Pack. 1 NTFS
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0
********************************************************************
Completion time: 07-04-24 18:33:48
C:\ComboFix-quarantined-files.txt ... 07-04-24 18:33
przez prog 24 Kwi 2007, 19:08
Wygląda, że okej.
Objawy ustępiły
Objawy ustępiły
C2D E8400 3GHZ + Pentagram Freezone HP-120 ALCu, Asus P5Q SE /intel P45/, A-Data 2x2GB CL4 Extreme Edition, Sapphire Radeon HD4870 512mb/256bit DDR5, WD 640GB SATA, Lite-ON Super AllWrite DVD SATA, Chieftec 500W, Samsung 2032BW Black 20', Vista Ultimate x64
Exoriare aliquis nostris ex ossibus ultor...
Exoriare aliquis nostris ex ossibus ultor...
-
prog - ~user
- Posty: 4043
- Dołączenie: 23 Mar 2005, 22:02
- Miejscowość: /home/prog/
- Pochwały: 232
-
32 posty(ów) • Strona 2 z 2 • 1, 2
Kto jest na forum
Użytkownicy przeglądający to forum: Brak zarejestrowanych użytkowników oraz 9 gości