prosze o sprawdzenie - komp muli

**Posty:** 8001 · przez **Okocza** 20 Gru 2007, 20:42

witam, system mi strasznie muli, zawiesza sie przy najprostszych czynnosciach...

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 19:40:18, on 2007-12-20 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\ASUS\GamerOSD\GamerOSD.exe C:\WINDOWS\RTHDCPL.EXE C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\A4Tech\Mouse\Amoumain.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterRuntime.exe F:\Progsy\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{F25BF52D-4341-404C-8C0E-316637769526}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

**Posty:** 18165 · przez **wojtas** 20 Gru 2007, 21:25

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

**Posty:** 1 · przez **agaspox** 21 Gru 2007, 01:11

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 23:58:24, on 2007-12-20
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\Mixer.exe
D:\winamp\winampa.exe
D:\Daemon\daemon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe
D:\HakerzyNET AntiVirus\HakerzyNET_MAV.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
D:\nero\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
C:\WINDOWS\System32\svchost.exe
D:\Gadu-Gadu\gg.exe
D:\winamp\winamp.exe
D:\winamp\winamp.exe
D:\Mozilla\firefox.exe
D:\AntySzpieg\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=https=ftp=gopher=socks=
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O2 - BHO: UrlHelper Class - {74322BF9-DF26-493f-B0DA-6D2FC5E6429E} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareIEHelper.dll
O2 - BHO: Ask Search Assistant BHO - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - C:\Program Files\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: Ask Toolbar BHO - {FE063DB1-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare Applications\BearShare MediaBar\BearShareMediaBar.dll
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O4 - HKLM\..\Run: [C-Media Mixer] Mixer.exe /startup
O4 - HKLM\..\Run: [HakerzyNET MAV] D:\HakerzyNET AntiVirus\HakerzyNET_MAV.exe
O4 - HKLM\..\Run: [WinampAgent] D:\winamp\winampa.exe
O4 - HKLM\..\Run: [LogonStudio] "D:\LogonStudio\logonstudio.exe" /RANDOM
O4 - HKLM\..\Run: [BearShare] "D:\BearShareStary\BearShare.exe" /pause
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [RavAV] C:\WINDOWS\RavMonE.exe
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKLM\..\Run: [DAEMON Tools-1033] "D:\Daemon\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [NBKeyScan] "D:\nero\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKCU\..\Run: [Gadu-Gadu] "D:\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [BitComet] "D:\BitComet\BitComet.exe" /tray
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [eMuleAutoStart] D:\eMule\emule.exe -AutoStart
O4 - HKCU\..\Run: [P2kAutostart] D:\P2KCommanderv3.3.0\P2kAutostart.exe
O4 - HKLM\..\Policies\Explorer\Run: [1qaw3edr5] C:\WINDOWS\system32\moje focie.jpg.EXE
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O22 - SharedTaskScheduler: Moduł wstępnego ładowania interfejsu Browseui - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Demon buforu kategorii składników - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Macromedia Licensing Service - Macromedia - C:\Program Files\Common Files\Macromedia Shared\Service\Macromedia Licensing.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - D:\nero\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: WIBU-KEY Server (WkSvW32) - WIBU-SYSTEMS AG - C:\Program Files\WIBUKEY\Server\WkSvW32.exe

--
End of file - 6551 bytes

[ Dodano: Dzisiaj o 0:12 ]
Strasznie muli

[ Dodano: Dzisiaj o 0:13 ]
Tylko proszę o łopatologiczne wytłumaczenie co w czy i jak ?

[ Dodano: Dzisiaj o 0:15 ]
RavMon to wirus juz go pare razy usuwałam

**Posty:** 3854 · przez **Dzi@dek** 21 Gru 2007, 10:18

agaspox
Nie podczepiaj się pod czyjś temat - załóż nowy.

**Posty:** 8001 · przez **Okocza** 23 Gru 2007, 13:55

SDFix

Kod: Zaznacz wszystko: SDFix: Version 1.119 Run by Administrator on 2007-12-23 at 12:43 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting... Normal Mode: Checking Files: No Trojan Files Found Removing Temp Files... ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: catchme 0.3.1333.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-12-23 12:47:28 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden services ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services: ------------------ Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe"="C:\\Program Files\\IVT Corporation\\BlueSoleil\\BlueSoleil.exe:*:Enabled:BlueSoleil" "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule" "H:\\BearShare Pro\\Bearshare.exe"="H:\\BearShare Pro\\Bearshare.exe:*:Enabled:BearShare" "C:\\Program Files\\Intuwave\\Shared\\mRouterRuntime\\mRouterRuntime.exe"="C:\\Program Files\\Intuwave\\Shared\\mRouterRuntime\\mRouterRuntime.exe:*:Enabled:mRouterRuntime Module" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" Remaining Files: --------------- Files with Hidden Attributes: Wed 4 Aug 2004 93,184 A.SH. --- "C:\Program Files\Internet Explorer\iexplore.exe" Finished!

HiJack

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 12:50:16, on 2007-12-23 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\ATKKBService.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\ASUS\GamerOSD\GamerOSD.exe C:\WINDOWS\RTHDCPL.EXE C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\A4Tech\Mouse\Amoumain.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe F:\Progsy\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{F25BF52D-4341-404C-8C0E-316637769526}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

combofix

Kod: Zaznacz wszystko: ComboFix 07-09-21.2 - "RAFAť" 2005-12-23 12:52:04.1 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.48.1045.18.1554 [GMT 1:00] * Created a new restore point . ((((((((((((((((((((((((( Files Created from 2007-08-21 to 2007-09-21 ))))))))))))))))))))))))))))))) . No new files created in this timespan . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-22 12:25 196608 --a------ C:\WINDOWS\system32\drivers\nStandard.bin 2007-12-21 16:41 --------- d-------- C:\Program Files\Xilisoft 2007-12-20 20:55 --------- d-------- C:\Program Files\Mozilla Firefox 3 Beta 2 2007-12-18 19:57 278984 --a------ C:\WINDOWS\system32\drivers\atksgt.sys 2007-12-18 19:57 25416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys 2007-12-17 19:04 --------- d-------- C:\Program Files\Intuwave 2007-12-17 18:17 --------- d-------- C:\Program Files\PC Connectivity Solution 2007-12-17 18:17 --------- d-------- C:\Program Files\Nokia 2007-12-17 18:17 --------- d-------- C:\Program Files\DIFX 2007-12-17 18:17 --------- d-------- C:\Program Files\Common Files\PCSuite 2007-12-17 18:17 --------- d-------- C:\Program Files\Common Files\Nokia 2007-12-17 18:17 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\PC Suite 2007-12-17 18:17 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Installations 2007-12-16 20:34 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\vsosdk 2007-12-16 19:13 --------- d-------- C:\Program Files\AudioEdit Deluxe 2007-12-16 18:20 47360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys 2007-12-16 18:20 --------- d-------- C:\Program Files\VSO 2007-12-14 16:06 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Ahead 2007-12-13 21:56 --------- d-------- C:\Program Files\Monkey's Audio 2007-12-13 18:02 512096 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-12-13 18:02 15424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys 2007-12-13 00:10 --------- d-------- C:\Program Files\Microsoft.NET 2007-12-12 13:51 --------- d-------- C:\Program Files\A4Tech 2007-12-10 19:50 --------- d-------- C:\Program Files\MarBit 2007-12-10 18:48 --------- d-------- C:\Program Files\NAPI-PROJEKT 2007-12-10 16:50 96256 --a------ C:\WINDOWS\system32\drivers\sptddrv1.sys 2007-12-07 16:40 --------- d-------- C:\Program Files\Real 2007-12-07 16:40 --------- d-------- C:\Program Files\Common Files\xing shared 2007-12-07 16:40 --------- d-------- C:\Program Files\Common Files\Real 2007-12-07 15:46 --------- d-------- C:\Program Files\VideoLAN 2007-12-05 21:30 --------- d-------- C:\Program Files\Alt MP3 Bitrate Converter 2007-12-05 20:34 --------- d-------- C:\Program Files\WIBUKEY 2007-12-05 20:34 --------- d-------- C:\Program Files\WIBU-SYSTEMS 2007-12-05 20:34 --------- d-------- C:\Program Files\Motorola 2007-12-05 18:40 --------- d-------- C:\Program Files\Common Files\Ahead 2007-12-05 18:40 --------- d-------- C:\Program Files\Ahead 2007-12-04 22:59 --------- d-------- C:\Program Files\foobar2000 2007-12-04 22:26 --------- d-------- C:\Program Files\eMule 2007-12-04 18:57 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Bluetooth 2007-12-04 18:55 --------- d-------- C:\Program Files\IVT Corporation 2007-12-04 15:45 --------- d-------- C:\Program Files\K-Lite Codec Pack 2007-12-03 18:47 --------- d-------- C:\Program Files\AutoConnect 2007-12-03 18:41 --------- d-------- C:\Program Files\Gadu-Gadu 2007-12-03 18:35 23 --a------ C:\WINDOWS\system32\drivers\adidsl.cfg 2007-12-03 18:35 --------- d-------- C:\Program Files\SAGEM 2007-12-03 18:34 --------- d-------- C:\Program Files\Neostrada TP 2007-12-03 18:34 --------- d-------- C:\Program Files\Java Web Start 2007-12-03 18:14 --------- d-------- C:\Program Files\DAEMON Tools 2007-12-03 18:09 611064 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-12-02 22:02 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\sentinel 2007-12-02 22:00 --------- d-------- C:\Program Files\Common Files\Panda Software 2007-12-02 22:00 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Backup 2007-12-02 21:18 --------- d-------- C:\Program Files\My Company Name 2007-12-02 21:17 --------- d-------- C:\Program Files\ASUS 2007-12-02 21:11 --------- d-------- C:\Program Files\U-ABIT 2007-12-02 21:07 --------- d-------- C:\Program Files\Marvell 2007-12-02 21:03 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-12-02 21:03 --------- d-------- C:\Program Files\Realtek 2007-12-02 21:03 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-12-02 21:02 --------- d-------- C:\Program Files\Intel 2007-12-02 21:00 21277080 --a------ C:\AdbeRdr709_en_US.exe 2007-12-02 20:55 --------- d-------- C:\Program Files\microsoft frontpage 2007-10-25 18:17 7426112 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys 2007-09-21 12:52 6556 --ahs---- C:\WINDOWS\system32\dcbeg.ini2 2007-09-13 16:54 94208 --a------ C:\WINDOWS\EIO.dll 2007-09-13 16:54 643142 --a------ C:\WINDOWS\aticlocklib.dll 2007-09-13 16:54 46592 --a------ C:\WINDOWS\system32\asfrench.dll 2007-09-13 16:54 46080 --a------ C:\WINDOWS\system32\asrussian.dll 2007-09-13 16:54 46080 --a------ C:\WINDOWS\system32\asgerman.dll 2007-09-13 16:54 46080 --a------ C:\WINDOWS\system32\aseng.dll 2007-09-13 16:54 45568 --a------ C:\WINDOWS\system32\askorean.dll 2007-09-13 16:54 45568 --a------ C:\WINDOWS\system32\asjapan.dll 2007-09-13 16:54 45568 --a------ C:\WINDOWS\system32\ASCHT.dll 2007-09-13 16:54 45568 --a------ C:\WINDOWS\system32\aschs.dll 2007-09-13 16:54 348160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-09-13 16:54 258560 --a------ C:\WINDOWS\ATKKBService.exe 2007-09-13 16:54 242816 --a------ C:\WINDOWS\system32\ATKDISP.dll 2007-09-13 16:54 12416 --a------ C:\WINDOWS\system32\drivers\asusgsb.sys 2007-09-13 16:54 122880 --a------ C:\WINDOWS\OneTouchVga.dll 2007-09-13 16:54 12288 --a------ C:\WINDOWS\system32\drivers\EIO.sys 2007-09-13 16:54 12288 --a------ C:\WINDOWS\EIO.sys 2007-09-13 16:54 11264 --a------ C:\WINDOWS\system32\ATKOSDMini.DLL 2007-09-13 16:54 11136 --a------ C:\WINDOWS\system32\drivers\atkkbnt.sys 2007-09-13 16:54 10752 --a------ C:\WINDOWS\system32\drivers\Video3D32.sys 2007-09-13 15:54 90112 --a------ C:\WINDOWS\ASMT_CE.dll 2007-09-13 15:54 8704 --a------ C:\WINDOWS\system32\drivers\Bravo.sys 2007-09-13 15:54 795104 --a------ C:\WINDOWS\system32\DPInst.exe 2007-09-13 15:54 77312 --a------ C:\WINDOWS\system32\devcon.exe 2007-09-13 15:54 7680 --a------ C:\WINDOWS\atillk64.sys 2007-09-13 15:54 73728 --a------ C:\WINDOWS\ASUSRC.dll 2007-09-13 15:54 57344 --a------ C:\WINDOWS\nVGA_i2c.dll 2007-09-13 15:54 57344 --a------ C:\WINDOWS\i2c.dll 2007-09-13 15:54 5376 --a------ C:\WINDOWS\atidgllk.sys 2007-09-13 15:54 53248 --a------ C:\WINDOWS\nvgpio.dll 2007-09-13 15:54 53248 --a------ C:\WINDOWS\i2c_i.dll 2007-09-13 15:54 36864 --a------ C:\WINDOWS\nvapi9x.dll 2007-09-13 15:54 36352 --a------ C:\WINDOWS\system32\ATKOGL32.dll 2007-09-13 15:54 2093056 --a------ C:\WINDOWS\system32\ATKDispCPL.dll 2007-09-13 15:54 20480 --a------ C:\WINDOWS\HyperDrive.exe 2007-09-13 15:54 196653 --a------ C:\WINDOWS\system32\drivers\aVivid.bin . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5C373DE0-DFDB-4ED0-BB56-9B400C8623F5}] 2007-12-19 19:23 326656 --a------ C:\WINDOWS\system32\gebcd.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B9E85D85-F6EE-4655-A639-E33983612A6E}] 2007-12-19 19:18 39936 --------- C:\WINDOWS\system32\urqrqrr.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SkyTel"="SkyTel.EXE" [2006-05-16 12:04 C:\WINDOWS\SkyTel.exe] "ASUSGamerOSD"="C:\Program Files\ASUS\GamerOSD\GamerOSD.exe" [2007-09-13 16:54] "RTHDCPL"="RTHDCPL.EXE" [2007-01-30 12:54 C:\WINDOWS\RTHDCPL.exe] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 20:07] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 20:07] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 20:07] "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-12-07 16:40] "atwtusb"="atwtusb.exe" [] "WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2007-02-10 16:07] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-12-13 18:02] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 16:10] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-25 18:17] "nwiz"="nwiz.exe" [2007-10-25 18:17 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-25 18:17] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44] "ASUS SmartDoctor"="C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe" [2007-10-11 22:36] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-11-14 11:12] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 20:27] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2005-10-24 16:53] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{B9E85D85-F6EE-4655-A639-E33983612A6E}"= C:\WINDOWS\system32\urqrqrr.dll [2007-12-19 19:18 39936] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqrqrr] urqrqrr.dll 2007-12-19 19:18 39936 C:\WINDOWS\system32\urqrqrr.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\gebcd.dll R2 WG1N;SyGate for NT, WG1N;C:\WINDOWS\system32\Drivers\WG1N.sys R2 WG2N;SyGate for NT, WG2N;C:\WINDOWS\system32\Drivers\WG2N.sys R2 WIBUKEY;WIBU-KEY Kernel Driver;C:\WINDOWS\system32\DRIVERS\Wibukey.sys R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys R3 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb.sys R3 ASUSVRC;ASUSTeK Virtual Capture Device;C:\WINDOWS\system32\DRIVERS\AsusVRC.sys R3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys S1 aiptektp;HyperPen;C:\WINDOWS\system32\DRIVERS\aiptektp.sys S3 ABIT-IO;ABIT-IO;\??\C:\Program Files\U-ABIT\abitEQ\ABIT-IO.sys S3 ASPI;Advanced SCSI Programming Interface Driver;\??\C:\WINDOWS\System32\DRIVERS\ASPI32.sys S3 BTNetFilter;Bluetooth Network Filter;\??\C:\WINDOWS\system32\drivers\BTNetFilter.sys S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt S3 Memctl;Memctl;\??\C:\Program Files\U-ABIT\FlashMenu\Memctl.sys . ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-21 12:53:28 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-09-21 12:54:28 . --- E O F ---

poza tym nod32 wywala mi że znalazł wirusa w pliku o nazwie

Kod: Zaznacz wszystko: urqrqrr.dll

**Posty:** 18165 · przez **wojtas** 23 Gru 2007, 16:01

zastosuj:

smitfraudfix z opcji 2

oraz te skanery po kilka razy

VundoFix

VirtumundoBeGone

FixVundo

i wroc z logiem z hj oraz combo

**Posty:** 8001 · przez **Okocza** 23 Gru 2007, 17:05

Kod: Zaznacz wszystko: SmitFraudFix v2.274 Scan done at 16:00:46,01, 2007-09-21 Run from C:\Program Files\Mozilla Firefox\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is FAT32 Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri's WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files »»»»»»»»»»»»»»»»»»»»»»»» IEDFix IEDFix.exe by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: WAN (PPP/SLIP) Interface DNS Server Search Order: 194.204.159.1 DNS Server Search Order: 217.98.63.164 HKLM\SYSTEM\CCS\Services\Tcpip\..\{F25BF52D-4341-404C-8C0E-316637769526}: NameServer=194.204.159.1 217.98.63.164 HKLM\SYSTEM\CS1\Services\Tcpip\..\{F25BF52D-4341-404C-8C0E-316637769526}: NameServer=194.204.159.1 217.98.63.164 HKLM\SYSTEM\CS3\Services\Tcpip\..\{F25BF52D-4341-404C-8C0E-316637769526}: NameServer=194.204.159.1 217.98.63.164 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» End

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 16:04:54, on 2007-09-21 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\ATKKBService.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\Program Files\ASUS\GamerOSD\GamerOSD.exe C:\WINDOWS\RTHDCPL.EXE C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\A4Tech\Mouse\Amoumain.exe C:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterConfig.exe C:\Program Files\Intuwave\Shared\mRouterRuntime\mRouterRuntime.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\WINDOWS\explorer.exe F:\Progsy\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{F25BF52D-4341-404C-8C0E-316637769526}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

dodaje combofixa

Kod: Zaznacz wszystko: ComboFix 07-09-21.2 - "RAFAť" 2005-09-21 16:18:45.2 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1393 [GMT 2:00] . ((((((((((((((((((((((((( Files Created from 2007-08-21 to 2007-09-21 ))))))))))))))))))))))))))))))) . 2007-09-21 16:01 2,820 --a------ C:\WINDOWS\system32\tmp.reg 2007-09-21 16:00 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe 2007-09-21 16:00 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-09-21 16:00 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-09-21 16:00 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-09-21 16:00 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-09-21 16:00 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-22 12:25 196608 --a------ C:\WINDOWS\system32\drivers\nStandard.bin 2007-12-21 16:41 --------- d-------- C:\Program Files\Xilisoft 2007-12-20 20:55 --------- d-------- C:\Program Files\Mozilla Firefox 3 Beta 2 2007-12-18 18:57 278984 --a------ C:\WINDOWS\system32\drivers\atksgt.sys 2007-12-18 18:57 25416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys 2007-12-17 19:04 --------- d-------- C:\Program Files\Intuwave 2007-12-17 18:17 --------- d-------- C:\Program Files\PC Connectivity Solution 2007-12-17 18:17 --------- d-------- C:\Program Files\Nokia 2007-12-17 18:17 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Installations 2007-12-17 17:17 --------- d-------- C:\Program Files\DIFX 2007-12-17 17:17 --------- d-------- C:\Program Files\Common Files\PCSuite 2007-12-17 17:17 --------- d-------- C:\Program Files\Common Files\Nokia 2007-12-17 17:17 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\PC Suite 2007-12-16 19:34 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\vsosdk 2007-12-16 18:13 --------- d-------- C:\Program Files\AudioEdit Deluxe 2007-12-16 17:20 47360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys 2007-12-16 17:20 --------- d-------- C:\Program Files\VSO 2007-12-14 15:06 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Ahead 2007-12-13 20:56 --------- d-------- C:\Program Files\Monkey's Audio 2007-12-13 17:02 512096 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-12-13 17:02 15424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys 2007-12-12 23:10 --------- d-------- C:\Program Files\Microsoft.NET 2007-12-12 13:51 --------- d-------- C:\Program Files\A4Tech 2007-12-10 19:50 --------- d-------- C:\Program Files\MarBit 2007-12-10 17:48 --------- d-------- C:\Program Files\NAPI-PROJEKT 2007-12-10 16:50 96256 --a------ C:\WINDOWS\system32\drivers\sptddrv1.sys 2007-12-07 16:40 --------- d-------- C:\Program Files\Real 2007-12-07 16:40 --------- d-------- C:\Program Files\Common Files\Real 2007-12-07 15:46 --------- d-------- C:\Program Files\VideoLAN 2007-12-07 15:40 --------- d-------- C:\Program Files\Common Files\xing shared 2007-12-05 20:34 --------- d-------- C:\Program Files\WIBU-SYSTEMS 2007-12-05 20:30 --------- d-------- C:\Program Files\Alt MP3 Bitrate Converter 2007-12-05 19:34 --------- d-------- C:\Program Files\WIBUKEY 2007-12-05 19:34 --------- d-------- C:\Program Files\Motorola 2007-12-05 17:40 --------- d-------- C:\Program Files\Common Files\Ahead 2007-12-05 17:40 --------- d-------- C:\Program Files\Ahead 2007-12-04 21:59 --------- d-------- C:\Program Files\foobar2000 2007-12-04 21:26 --------- d-------- C:\Program Files\eMule 2007-12-04 18:55 --------- d-------- C:\Program Files\IVT Corporation 2007-12-04 17:57 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Bluetooth 2007-12-04 15:45 --------- d-------- C:\Program Files\K-Lite Codec Pack 2007-12-03 18:47 --------- d-------- C:\Program Files\AutoConnect 2007-12-03 18:41 --------- d-------- C:\Program Files\Gadu-Gadu 2007-12-03 18:35 --------- d-------- C:\Program Files\SAGEM 2007-12-03 18:34 --------- d-------- C:\Program Files\Neostrada TP 2007-12-03 18:34 --------- d-------- C:\Program Files\Java Web Start 2007-12-03 18:09 611064 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-12-03 17:35 23 --a------ C:\WINDOWS\system32\drivers\adidsl.cfg 2007-12-03 17:14 --------- d-------- C:\Program Files\DAEMON Tools 2007-12-02 21:17 --------- d-------- C:\Program Files\ASUS 2007-12-02 21:11 --------- d-------- C:\Program Files\U-ABIT 2007-12-02 21:03 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-12-02 21:02 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\sentinel 2007-12-02 21:00 21277080 --a------ C:\AdbeRdr709_en_US.exe 2007-12-02 21:00 --------- d-------- C:\Program Files\Common Files\Panda Software 2007-12-02 21:00 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Backup 2007-12-02 20:55 --------- d-------- C:\Program Files\microsoft frontpage 2007-12-02 20:18 --------- d-------- C:\Program Files\My Company Name 2007-12-02 20:07 --------- d-------- C:\Program Files\Marvell 2007-12-02 20:03 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-12-02 20:03 --------- d-------- C:\Program Files\Realtek 2007-12-02 20:02 --------- d-------- C:\Program Files\Intel 2007-10-25 17:17 7426112 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys 2007-09-21 16:18 6798 --ahs---- C:\WINDOWS\system32\dcbeg.ini2 2007-09-13 16:54 348160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-09-13 16:54 258560 --a------ C:\WINDOWS\ATKKBService.exe 2007-09-13 16:54 242816 --a------ C:\WINDOWS\system32\ATKDISP.dll 2007-09-13 15:54 94208 --a------ C:\WINDOWS\EIO.dll 2007-09-13 15:54 90112 --a------ C:\WINDOWS\ASMT_CE.dll 2007-09-13 15:54 8704 --a------ C:\WINDOWS\system32\drivers\Bravo.sys 2007-09-13 15:54 795104 --a------ C:\WINDOWS\system32\DPInst.exe 2007-09-13 15:54 77312 --a------ C:\WINDOWS\system32\devcon.exe 2007-09-13 15:54 7680 --a------ C:\WINDOWS\atillk64.sys 2007-09-13 15:54 73728 --a------ C:\WINDOWS\ASUSRC.dll 2007-09-13 15:54 643142 --a------ C:\WINDOWS\aticlocklib.dll 2007-09-13 15:54 57344 --a------ C:\WINDOWS\nVGA_i2c.dll 2007-09-13 15:54 57344 --a------ C:\WINDOWS\i2c.dll 2007-09-13 15:54 5376 --a------ C:\WINDOWS\atidgllk.sys 2007-09-13 15:54 53248 --a------ C:\WINDOWS\nvgpio.dll 2007-09-13 15:54 53248 --a------ C:\WINDOWS\i2c_i.dll 2007-09-13 15:54 46592 --a------ C:\WINDOWS\system32\asfrench.dll 2007-09-13 15:54 46080 --a------ C:\WINDOWS\system32\asrussian.dll 2007-09-13 15:54 46080 --a------ C:\WINDOWS\system32\asgerman.dll 2007-09-13 15:54 46080 --a------ C:\WINDOWS\system32\aseng.dll 2007-09-13 15:54 45568 --a------ C:\WINDOWS\system32\askorean.dll 2007-09-13 15:54 45568 --a------ C:\WINDOWS\system32\asjapan.dll 2007-09-13 15:54 45568 --a------ C:\WINDOWS\system32\ASCHT.dll 2007-09-13 15:54 45568 --a------ C:\WINDOWS\system32\aschs.dll 2007-09-13 15:54 36864 --a------ C:\WINDOWS\nvapi9x.dll 2007-09-13 15:54 36352 --a------ C:\WINDOWS\system32\ATKOGL32.dll 2007-09-13 15:54 2093056 --a------ C:\WINDOWS\system32\ATKDispCPL.dll 2007-09-13 15:54 20480 --a------ C:\WINDOWS\HyperDrive.exe 2007-09-13 15:54 196653 --a------ C:\WINDOWS\system32\drivers\aVivid.bin 2007-09-13 15:54 196608 --a------ C:\WINDOWS\system32\drivers\nVivid.bin 2007-09-13 15:54 196608 --a------ C:\WINDOWS\system32\drivers\nAsmedia.bin 2007-09-13 15:54 196608 --a------ C:\WINDOWS\system32\drivers\nAdvanced.bin 2007-09-13 15:54 196608 --a------ C:\WINDOWS\system32\drivers\aAdvanced.bin 2007-09-13 15:54 196582 --a------ C:\WINDOWS\system32\drivers\aStandard.bin 2007-09-13 15:54 196582 --a------ C:\WINDOWS\system32\drivers\aAsmedia.bin 2007-09-13 15:54 163840 --a------ C:\WINDOWS\atistclk.dll . ((((((((((((((((((((((((((((( snapshot_2007-09-21_125354,87 ))))))))))))))))))))))))))))))))))))))))) . ----a-w 16,384 2005-09-21 14:18:28 C:\WINDOWS\temp\Perflib_Perfdata_a18.dat ----a-w 163,328 2007-03-13 09:57:12 C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE . . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5C373DE0-DFDB-4ED0-BB56-9B400C8623F5}] 2007-12-19 19:23 326656 --a------ C:\WINDOWS\system32\gebcd.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B9E85D85-F6EE-4655-A639-E33983612A6E}] 2007-12-19 19:18 39936 --------- C:\WINDOWS\system32\urqrqrr.dll [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SkyTel"="SkyTel.EXE" [2006-05-16 11:04 C:\WINDOWS\SkyTel.exe] "ASUSGamerOSD"="C:\Program Files\ASUS\GamerOSD\GamerOSD.exe" [2007-09-13 16:54] "RTHDCPL"="RTHDCPL.EXE" [2007-01-30 12:54 C:\WINDOWS\RTHDCPL.exe] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 19:07] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 20:07] "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-12-07 16:40] "atwtusb"="atwtusb.exe" [] "WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2007-02-10 16:07] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-12-13 18:02] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 16:10] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-25 18:17] "nwiz"="nwiz.exe" [2007-10-25 17:17 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-25 18:17] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:44] "ASUS SmartDoctor"="C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe" [2007-10-11 21:36] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-11-14 10:12] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 20:27] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2005-10-24 15:53] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{B9E85D85-F6EE-4655-A639-E33983612A6E}"= C:\WINDOWS\system32\urqrqrr.dll [2007-12-19 19:18 39936] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqrqrr] urqrqrr.dll 2007-12-19 19:18 39936 C:\WINDOWS\system32\urqrqrr.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\gebcd.dll R2 WG1N;SyGate for NT, WG1N;C:\WINDOWS\system32\Drivers\WG1N.sys R2 WG2N;SyGate for NT, WG2N;C:\WINDOWS\system32\Drivers\WG2N.sys R2 WIBUKEY;WIBU-KEY Kernel Driver;C:\WINDOWS\system32\DRIVERS\Wibukey.sys R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys R3 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb.sys R3 ASUSVRC;ASUSTeK Virtual Capture Device;C:\WINDOWS\system32\DRIVERS\AsusVRC.sys R3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys S1 aiptektp;HyperPen;C:\WINDOWS\system32\DRIVERS\aiptektp.sys S3 ABIT-IO;ABIT-IO;\??\C:\Program Files\U-ABIT\abitEQ\ABIT-IO.sys S3 ASPI;Advanced SCSI Programming Interface Driver;\??\C:\WINDOWS\System32\DRIVERS\ASPI32.sys S3 BTNetFilter;Bluetooth Network Filter;\??\C:\WINDOWS\system32\drivers\BTNetFilter.sys S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt S3 Memctl;Memctl;\??\C:\Program Files\U-ABIT\FlashMenu\Memctl.sys . ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-21 16:20:16 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-09-21 16:21:14 C:\ComboFix2.txt ... 2007-09-21 12:54 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 23 Gru 2007, 17:30

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\dcbeg.ini2
C:\WINDOWS\system32\urqrqrr.dll
C:\WINDOWS\system32\gebcd.dll

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5C373DE0-DFDB-4ED0-BB56-9B400C8623F5}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{B9E85D85-F6EE-4655-A639-E33983612A6E}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\urqrqrr]
[-HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B9E85D85-F6EE-4655-A639-E33983612A6E}"=-

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania

potem ten plik:

C:\WINDOWS\HyperDrive.exe

przeskanuj:
http://virusscan.jotti.org/
http://www.virustotal.com/

Potem nowy log z hijacka oraz combofixa+ raporty ze skanow

**Posty:** 8001 · przez **Okocza** 23 Gru 2007, 17:44

Virustotal:

Kod: Zaznacz wszystko: AhnLab-V3 2007.12.22.10 2007.12.21 - AntiVir 7.6.0.46 2007.12.22 - Authentium 4.93.8 2007.12.23 - Avast 4.7.1098.0 2007.12.22 - AVG 7.5.0.516 2007.12.22 - BitDefender 7.2 2007.12.23 - CAT-QuickHeal 9.00 2007.12.22 - ClamAV 0.91.2 2007.12.23 - DrWeb 4.44.0.09170 2007.12.23 - eSafe 7.0.15.0 2007.12.20 - eTrust-Vet 31.3.5395 2007.12.21 - Ewido 4.0 2007.12.23 - FileAdvisor 1 2007.12.23 - Fortinet 3.14.0.0 2007.12.23 - F-Prot 4.4.2.54 2007.12.23 - F-Secure 6.70.13030.0 2007.12.23 - Ikarus T3.1.1.15 2007.12.23 - Kaspersky 7.0.0.125 2007.12.23 - McAfee 5191 2007.12.21 - Microsoft 1.3109 2007.12.23 - NOD32v2 2744 2007.12.23 - Norman 5.80.02 2007.12.21 - Panda 9.0.0.4 2007.12.22 - Prevx1 V2 2007.12.23 - Rising 20.23.62.00 2007.12.23 - Sophos 4.24.0 2007.12.23 - Sunbelt 2.2.907.0 2007.12.21 - Symantec 10 2007.12.23 - TheHacker 6.2.9.168 2007.12.22 - VBA32 3.12.2.5 2007.12.22 - VirusBuster 4.3.26:9 2007.12.23 - Webwasher-Gateway 6.6.2 2007.12.23 -

virusscan:

Kod: Zaznacz wszystko: A-Squared Found nothing AntiVir Found nothing ArcaVir Found nothing Avast Found nothing AVG Antivirus Found nothing BitDefender Found nothing ClamAV Found nothing CPsecure Found nothing Dr.Web Found nothing F-Prot Antivirus Found nothing F-Secure Anti-Virus Found nothing Fortinet Found nothing Ikarus Found nothing Kaspersky Anti-Virus Found nothing NOD32 Found nothing Norman Virus Control Found nothing Panda Antivirus Found nothing Rising Antivirus Found nothing Sophos Antivirus Found nothing VirusBuster Found nothing VBA32 Found nothing Zoner Antivirus Found nothing

[ Dodano: Dzisiaj o 16:50 ]
combofix

Kod: Zaznacz wszystko: ComboFix 07-09-21.2 - "RAFAť" 2007-09-21 16:45:55.3 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1435 [GMT 2:00] * Created a new restore point FILE:: C:\WINDOWS\system32\dcbeg.ini2 C:\WINDOWS\system32\urqrqrr.dll C:\WINDOWS\system32\gebcd.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\dcbeg.ini2 C:\WINDOWS\system32\gebcd.dll C:\WINDOWS\system32\urqrqrr.dll . ((((((((((((((((((((((((( Files Created from 2007-08-21 to 2007-09-21 ))))))))))))))))))))))))))))))) . 2007-09-21 16:01 2,820 --a------ C:\WINDOWS\system32\tmp.reg 2007-09-21 16:00 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe 2007-09-21 16:00 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-09-21 16:00 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-09-21 16:00 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-09-21 16:00 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-09-21 16:00 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-22 12:25 196608 --a------ C:\WINDOWS\system32\drivers\nStandard.bin 2007-12-21 15:41 --------- d-------- C:\Program Files\Xilisoft 2007-12-20 19:55 --------- d-------- C:\Program Files\Mozilla Firefox 3 Beta 2 2007-12-18 18:57 278984 --a------ C:\WINDOWS\system32\drivers\atksgt.sys 2007-12-18 18:57 25416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys 2007-12-17 18:04 --------- d-------- C:\Program Files\Intuwave 2007-12-17 17:17 --------- d-------- C:\Program Files\PC Connectivity Solution 2007-12-17 17:17 --------- d-------- C:\Program Files\Nokia 2007-12-17 17:17 --------- d-------- C:\Program Files\DIFX 2007-12-17 17:17 --------- d-------- C:\Program Files\Common Files\PCSuite 2007-12-17 17:17 --------- d-------- C:\Program Files\Common Files\Nokia 2007-12-17 17:17 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\PC Suite 2007-12-17 17:17 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Installations 2007-12-16 19:34 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\vsosdk 2007-12-16 18:13 --------- d-------- C:\Program Files\AudioEdit Deluxe 2007-12-16 17:20 47360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys 2007-12-16 17:20 --------- d-------- C:\Program Files\VSO 2007-12-14 15:06 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Ahead 2007-12-13 20:56 --------- d-------- C:\Program Files\Monkey's Audio 2007-12-13 17:02 512096 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-12-13 17:02 15424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys 2007-12-12 23:10 --------- d-------- C:\Program Files\Microsoft.NET 2007-12-12 12:51 --------- d-------- C:\Program Files\A4Tech 2007-12-10 18:50 --------- d-------- C:\Program Files\MarBit 2007-12-10 17:48 --------- d-------- C:\Program Files\NAPI-PROJEKT 2007-12-10 15:50 96256 --a------ C:\WINDOWS\system32\drivers\sptddrv1.sys 2007-12-07 15:40 --------- d-------- C:\Program Files\Real 2007-12-07 15:40 --------- d-------- C:\Program Files\Common Files\xing shared 2007-12-07 15:40 --------- d-------- C:\Program Files\Common Files\Real 2007-12-07 14:46 --------- d-------- C:\Program Files\VideoLAN 2007-12-05 20:30 --------- d-------- C:\Program Files\Alt MP3 Bitrate Converter 2007-12-05 19:34 --------- d-------- C:\Program Files\WIBUKEY 2007-12-05 19:34 --------- d-------- C:\Program Files\WIBU-SYSTEMS 2007-12-05 19:34 --------- d-------- C:\Program Files\Motorola 2007-12-05 17:40 --------- d-------- C:\Program Files\Common Files\Ahead 2007-12-05 17:40 --------- d-------- C:\Program Files\Ahead 2007-12-04 21:59 --------- d-------- C:\Program Files\foobar2000 2007-12-04 21:26 --------- d-------- C:\Program Files\eMule 2007-12-04 17:57 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Bluetooth 2007-12-04 17:55 --------- d-------- C:\Program Files\IVT Corporation 2007-12-04 14:45 --------- d-------- C:\Program Files\K-Lite Codec Pack 2007-12-03 17:47 --------- d-------- C:\Program Files\AutoConnect 2007-12-03 17:41 --------- d-------- C:\Program Files\Gadu-Gadu 2007-12-03 17:35 23 --a------ C:\WINDOWS\system32\drivers\adidsl.cfg 2007-12-03 17:35 --------- d-------- C:\Program Files\SAGEM 2007-12-03 17:34 --------- d-------- C:\Program Files\Neostrada TP 2007-12-03 17:34 --------- d-------- C:\Program Files\Java Web Start 2007-12-03 17:14 --------- d-------- C:\Program Files\DAEMON Tools 2007-12-03 17:09 611064 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-12-02 21:02 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\sentinel 2007-12-02 21:00 21277080 --a------ C:\AdbeRdr709_en_US.exe 2007-12-02 21:00 --------- d-------- C:\Program Files\Common Files\Panda Software 2007-12-02 21:00 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Backup 2007-12-02 20:18 --------- d-------- C:\Program Files\My Company Name 2007-12-02 20:17 --------- d-------- C:\Program Files\ASUS 2007-12-02 20:11 --------- d-------- C:\Program Files\U-ABIT 2007-12-02 20:07 --------- d-------- C:\Program Files\Marvell 2007-12-02 20:03 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-12-02 20:03 --------- d-------- C:\Program Files\Realtek 2007-12-02 20:03 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-12-02 20:02 --------- d-------- C:\Program Files\Intel 2007-12-02 19:55 --------- d-------- C:\Program Files\microsoft frontpage 2007-10-25 17:17 7426112 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys 2007-09-13 15:54 94208 --a------ C:\WINDOWS\EIO.dll 2007-09-13 15:54 90112 --a------ C:\WINDOWS\ASMT_CE.dll 2007-09-13 15:54 8704 --a------ C:\WINDOWS\system32\drivers\Bravo.sys 2007-09-13 15:54 795104 --a------ C:\WINDOWS\system32\DPInst.exe 2007-09-13 15:54 77312 --a------ C:\WINDOWS\system32\devcon.exe 2007-09-13 15:54 7680 --a------ C:\WINDOWS\atillk64.sys 2007-09-13 15:54 73728 --a------ C:\WINDOWS\ASUSRC.dll 2007-09-13 15:54 643142 --a------ C:\WINDOWS\aticlocklib.dll 2007-09-13 15:54 57344 --a------ C:\WINDOWS\nVGA_i2c.dll 2007-09-13 15:54 57344 --a------ C:\WINDOWS\i2c.dll 2007-09-13 15:54 5376 --a------ C:\WINDOWS\atidgllk.sys 2007-09-13 15:54 53248 --a------ C:\WINDOWS\nvgpio.dll 2007-09-13 15:54 53248 --a------ C:\WINDOWS\i2c_i.dll 2007-09-13 15:54 46592 --a------ C:\WINDOWS\system32\asfrench.dll 2007-09-13 15:54 46080 --a------ C:\WINDOWS\system32\asrussian.dll 2007-09-13 15:54 46080 --a------ C:\WINDOWS\system32\asgerman.dll 2007-09-13 15:54 46080 --a------ C:\WINDOWS\system32\aseng.dll 2007-09-13 15:54 45568 --a------ C:\WINDOWS\system32\askorean.dll 2007-09-13 15:54 45568 --a------ C:\WINDOWS\system32\asjapan.dll 2007-09-13 15:54 45568 --a------ C:\WINDOWS\system32\ASCHT.dll 2007-09-13 15:54 45568 --a------ C:\WINDOWS\system32\aschs.dll 2007-09-13 15:54 36864 --a------ C:\WINDOWS\nvapi9x.dll 2007-09-13 15:54 36352 --a------ C:\WINDOWS\system32\ATKOGL32.dll 2007-09-13 15:54 348160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-09-13 15:54 258560 --a------ C:\WINDOWS\ATKKBService.exe 2007-09-13 15:54 242816 --a------ C:\WINDOWS\system32\ATKDISP.dll 2007-09-13 15:54 2093056 --a------ C:\WINDOWS\system32\ATKDispCPL.dll 2007-09-13 15:54 20480 --a------ C:\WINDOWS\HyperDrive.exe 2007-09-13 15:54 196653 --a------ C:\WINDOWS\system32\drivers\aVivid.bin 2007-09-13 15:54 196608 --a------ C:\WINDOWS\system32\drivers\nVivid.bin 2007-09-13 15:54 196608 --a------ C:\WINDOWS\system32\drivers\nAsmedia.bin 2007-09-13 15:54 196608 --a------ C:\WINDOWS\system32\drivers\nAdvanced.bin 2007-09-13 15:54 196608 --a------ C:\WINDOWS\system32\drivers\aAdvanced.bin 2007-09-13 15:54 196582 --a------ C:\WINDOWS\system32\drivers\aStandard.bin 2007-09-13 15:54 196582 --a------ C:\WINDOWS\system32\drivers\aAsmedia.bin 2007-09-13 15:54 163840 --a------ C:\WINDOWS\atistclk.dll 2007-09-13 15:54 15872 --a------ C:\WINDOWS\atikia64.sys . ((((((((((((((((((((((((((((( snapshot_2007-09-21_125354,87 ))))))))))))))))))))))))))))))))))))))))) . ----a-w 33,624 2007-07-30 17:18:40 C:\WINDOWS\system32\wups.dll ----a-w 157,160 2007-09-21 14:48:18 C:\WINDOWS\system32\FNTCACHE.DAT ----a-w 33,624 2007-07-30 17:18:40 C:\WINDOWS\system32\dllcache\wups.dll . ------w 36,864 2004-08-03 22:44:16 C:\WINDOWS\system32\wups.dll ----a-w 157,160 2007-12-20 11:39:14 C:\WINDOWS\system32\FNTCACHE.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SkyTel"="SkyTel.EXE" [2006-05-16 11:04 C:\WINDOWS\SkyTel.exe] "ASUSGamerOSD"="C:\Program Files\ASUS\GamerOSD\GamerOSD.exe" [2007-09-13 15:54] "RTHDCPL"="RTHDCPL.EXE" [2007-01-30 11:54 C:\WINDOWS\RTHDCPL.exe] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 19:07] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07] "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-12-07 15:40] "atwtusb"="atwtusb.exe" [] "WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2007-02-10 15:07] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-12-13 17:02] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-25 17:17] "nwiz"="nwiz.exe" [2007-10-25 17:17 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-25 17:17] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] "ASUS SmartDoctor"="C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe" [2007-10-11 21:36] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-11-14 10:12] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 19:27] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2005-10-24 15:53] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] "Authentication Packages"= msv1_0 C:\WINDOWS\system32\gebcd.dll R2 WG1N;SyGate for NT, WG1N;C:\WINDOWS\system32\Drivers\WG1N.sys R2 WG2N;SyGate for NT, WG2N;C:\WINDOWS\system32\Drivers\WG2N.sys R2 WIBUKEY;WIBU-KEY Kernel Driver;C:\WINDOWS\system32\DRIVERS\Wibukey.sys R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys R3 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb.sys R3 ASUSVRC;ASUSTeK Virtual Capture Device;C:\WINDOWS\system32\DRIVERS\AsusVRC.sys R3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys S1 aiptektp;HyperPen;C:\WINDOWS\system32\DRIVERS\aiptektp.sys S3 ABIT-IO;ABIT-IO;\??\C:\Program Files\U-ABIT\abitEQ\ABIT-IO.sys S3 ASPI;Advanced SCSI Programming Interface Driver;\??\C:\WINDOWS\System32\DRIVERS\ASPI32.sys S3 BTNetFilter;Bluetooth Network Filter;\??\C:\WINDOWS\system32\drivers\BTNetFilter.sys S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt S3 Memctl;Memctl;\??\C:\Program Files\U-ABIT\FlashMenu\Memctl.sys . ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-09-21 16:48:38 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2007-09-21 16:48:56 - machine was rebooted C:\ComboFix3.txt ... 2007-09-21 12:54 C:\ComboFix2.txt ... 2007-09-21 16:21 C:\ComboFix-quarantined-files.txt ... 2007-09-21 16:48 . --- E O F ---

hijack

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 16:50:02, on 2007-09-21 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\ATKKBService.exe C:\Program Files\Eset\nod32krn.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\ASUS\GamerOSD\GamerOSD.exe C:\WINDOWS\RTHDCPL.EXE C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\A4Tech\Mouse\Amoumain.exe C:\Program Files\Eset\nod32kui.exe C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AutoConnect\AutoConnect.exe C:\Program Files\IVT Corporation\BlueSoleil\BlueSoleil.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe F:\Progsy\HijackThis.exe C:\WINDOWS\SoftwareDistribution\Download\c7b4f55875889c9c9ecb3c2a0d57a3fb\update\update.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [ASUSGamerOSD] C:\Program Files\ASUS\GamerOSD\GamerOSD.exe O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [atwtusb] atwtusb.exe beta O4 - HKLM\..\Run: [WheelMouse] C:\Program Files\A4Tech\Mouse\Amoumain.exe O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ASUS SmartDoctor] C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe /start O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [AutoConnect] C:\Program Files\AutoConnect\AutoConnect.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_7 O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{F25BF52D-4341-404C-8C0E-316637769526}: NameServer = 194.204.159.1 217.98.63.164 O23 - Service: ATK Keyboard Service (ATKKeyboardService) - ASUSTeK COMPUTER INC. - C:\WINDOWS\ATKKBService.exe O23 - Service: BlueSoleil Hid Service - Unknown owner - C:\Program Files\IVT Corporation\BlueSoleil\BTNtService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe

**Posty:** 18165 · przez **wojtas** 23 Gru 2007, 17:58

wklej do notatnika

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa]
"Authentication Packages"=-
"Authentication Packages"=hex(7):6d,00,73,00,76,00,31,00,5f,00,30,00,00,00,00,\
00

Z menu Notatnika >>> Plik >>> Zapisz jako >>> Ustaw rozszerzenie na Wszystkie pliki >>> Zapisz jako FIX.REG >>> uruchom ten plik

potem nowy log z combo

**Posty:** 8001 · przez **Okocza** 23 Gru 2007, 18:01

zrobione. cos jescze?

[ Dodano: Dzisiaj o 17:04 ]

Kod: Zaznacz wszystko: ComboFix 07-09-21.2 - "RAFAť" 2005-09-21 17:02:26.4 - [color=red][b]FAT32[/b][/color]x86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.1525 [GMT 2:00] . ((((((((((((((((((((((((( Files Created from 2007-08-21 to 2007-09-21 ))))))))))))))))))))))))))))))) . 2007-09-21 16:50 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2007-09-21 16:50 <DIR> d-------- C:\WINDOWS\LastGood 2007-09-21 16:01 2,820 --a------ C:\WINDOWS\system32\tmp.reg 2007-09-21 16:00 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe 2007-09-21 16:00 53,248 --a------ C:\WINDOWS\system32\Process.exe 2007-09-21 16:00 51,200 --a------ C:\WINDOWS\system32\dumphive.exe 2007-09-21 16:00 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2007-09-21 16:00 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2007-09-21 16:00 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2007-12-22 12:25 196608 --a------ C:\WINDOWS\system32\drivers\nStandard.bin 2007-12-21 15:41 --------- d-------- C:\Program Files\Xilisoft 2007-12-20 19:55 --------- d-------- C:\Program Files\Mozilla Firefox 3 Beta 2 2007-12-18 18:57 278984 --a------ C:\WINDOWS\system32\drivers\atksgt.sys 2007-12-18 18:57 25416 --a------ C:\WINDOWS\system32\drivers\lirsgt.sys 2007-12-17 18:04 --------- d-------- C:\Program Files\Intuwave 2007-12-17 17:17 --------- d-------- C:\Program Files\PC Connectivity Solution 2007-12-17 17:17 --------- d-------- C:\Program Files\Nokia 2007-12-17 17:17 --------- d-------- C:\Program Files\DIFX 2007-12-17 17:17 --------- d-------- C:\Program Files\Common Files\PCSuite 2007-12-17 17:17 --------- d-------- C:\Program Files\Common Files\Nokia 2007-12-17 17:17 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\PC Suite 2007-12-17 17:17 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Installations 2007-12-16 19:34 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\vsosdk 2007-12-16 18:13 --------- d-------- C:\Program Files\AudioEdit Deluxe 2007-12-16 17:20 47360 --a------ C:\WINDOWS\system32\drivers\pcouffin.sys 2007-12-16 17:20 --------- d-------- C:\Program Files\VSO 2007-12-14 15:06 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Ahead 2007-12-13 20:56 --------- d-------- C:\Program Files\Monkey's Audio 2007-12-13 17:02 512096 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-12-13 17:02 15424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys 2007-12-12 23:10 --------- d-------- C:\Program Files\Microsoft.NET 2007-12-12 12:51 --------- d-------- C:\Program Files\A4Tech 2007-12-10 18:50 --------- d-------- C:\Program Files\MarBit 2007-12-10 17:48 --------- d-------- C:\Program Files\NAPI-PROJEKT 2007-12-10 15:50 96256 --a------ C:\WINDOWS\system32\drivers\sptddrv1.sys 2007-12-07 15:40 --------- d-------- C:\Program Files\Real 2007-12-07 15:40 --------- d-------- C:\Program Files\Common Files\xing shared 2007-12-07 15:40 --------- d-------- C:\Program Files\Common Files\Real 2007-12-07 14:46 --------- d-------- C:\Program Files\VideoLAN 2007-12-05 20:30 --------- d-------- C:\Program Files\Alt MP3 Bitrate Converter 2007-12-05 19:34 --------- d-------- C:\Program Files\WIBUKEY 2007-12-05 19:34 --------- d-------- C:\Program Files\WIBU-SYSTEMS 2007-12-05 19:34 --------- d-------- C:\Program Files\Motorola 2007-12-05 17:40 --------- d-------- C:\Program Files\Common Files\Ahead 2007-12-05 17:40 --------- d-------- C:\Program Files\Ahead 2007-12-04 21:59 --------- d-------- C:\Program Files\foobar2000 2007-12-04 21:26 --------- d-------- C:\Program Files\eMule 2007-12-04 17:57 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Bluetooth 2007-12-04 17:55 --------- d-------- C:\Program Files\IVT Corporation 2007-12-04 14:45 --------- d-------- C:\Program Files\K-Lite Codec Pack 2007-12-03 17:47 --------- d-------- C:\Program Files\AutoConnect 2007-12-03 17:41 --------- d-------- C:\Program Files\Gadu-Gadu 2007-12-03 17:35 23 --a------ C:\WINDOWS\system32\drivers\adidsl.cfg 2007-12-03 17:35 --------- d-------- C:\Program Files\SAGEM 2007-12-03 17:34 --------- d-------- C:\Program Files\Neostrada TP 2007-12-03 17:34 --------- d-------- C:\Program Files\Java Web Start 2007-12-03 17:14 --------- d-------- C:\Program Files\DAEMON Tools 2007-12-03 17:09 611064 --a------ C:\WINDOWS\system32\drivers\sptd.sys 2007-12-02 21:02 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\sentinel 2007-12-02 21:00 21277080 --a------ C:\AdbeRdr709_en_US.exe 2007-12-02 21:00 --------- d-------- C:\Program Files\Common Files\Panda Software 2007-12-02 21:00 --------- d-------- C:\DOCUME~1\ALLUSE~1\DANEAP~1\Backup 2007-12-02 20:18 --------- d-------- C:\Program Files\My Company Name 2007-12-02 20:17 --------- d-------- C:\Program Files\ASUS 2007-12-02 20:11 --------- d-------- C:\Program Files\U-ABIT 2007-12-02 20:07 --------- d-------- C:\Program Files\Marvell 2007-12-02 20:03 --------- d--h----- C:\Program Files\InstallShield Installation Information 2007-12-02 20:03 --------- d-------- C:\Program Files\Realtek 2007-12-02 20:03 --------- d-------- C:\Program Files\Common Files\InstallShield 2007-12-02 20:02 --------- d-------- C:\Program Files\Intel 2007-12-02 19:55 --------- d-------- C:\Program Files\microsoft frontpage 2007-10-25 17:17 7426112 --a------ C:\WINDOWS\system32\drivers\nv4_mini.sys 2007-09-13 15:54 8704 --a------ C:\WINDOWS\system32\drivers\Bravo.sys 2007-09-13 15:54 196653 --a------ C:\WINDOWS\system32\drivers\aVivid.bin 2007-09-13 15:54 196608 --a------ C:\WINDOWS\system32\drivers\nVivid.bin 2007-09-13 15:54 196608 --a------ C:\WINDOWS\system32\drivers\nAsmedia.bin 2007-09-13 15:54 196608 --a------ C:\WINDOWS\system32\drivers\nAdvanced.bin 2007-09-13 15:54 196608 --a------ C:\WINDOWS\system32\drivers\aAdvanced.bin 2007-09-13 15:54 196582 --a------ C:\WINDOWS\system32\drivers\aStandard.bin 2007-09-13 15:54 196582 --a------ C:\WINDOWS\system32\drivers\aAsmedia.bin 2007-09-13 15:54 12416 --a------ C:\WINDOWS\system32\drivers\asusgsb.sys 2007-09-13 15:54 12288 --a------ C:\WINDOWS\system32\drivers\EIO.sys 2007-09-13 15:54 11136 --a------ C:\WINDOWS\system32\drivers\atkkbnt.sys 2007-09-13 15:54 10752 --a------ C:\WINDOWS\system32\drivers\Video3D32.sys 2007-07-30 19:19 92504 --a------ C:\WINDOWS\system32\cdm.dll 2007-07-30 19:19 549720 --a------ C:\WINDOWS\system32\wuapi.dll 2007-07-30 19:19 53080 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-07-30 19:19 43352 --a------ C:\WINDOWS\system32\wups2.dll 2007-07-30 19:19 325976 --a------ C:\WINDOWS\system32\wucltui.dll 2007-07-30 19:19 203096 --a------ C:\WINDOWS\system32\wuweb.dll 2007-07-30 19:19 1712984 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\wups.dll 2007-07-30 19:18 33624 --a------ C:\WINDOWS\system32\dllcache\wups.dll 2007-07-20 00:57 267112 --a------ C:\WINDOWS\system32\xactengine2_9.dll 2007-07-20 00:54 18280 --a------ C:\WINDOWS\system32\x3daudio1_2.dll 2007-07-19 18:14 444776 --a------ C:\WINDOWS\system32\d3dx10_35.dll 2007-07-19 18:14 3727720 --a------ C:\WINDOWS\system32\d3dx9_35.dll 2007-07-19 18:14 1358192 --a------ C:\WINDOWS\system32\D3DCompiler_35.dll 2005-09-23 07:28 83456 --a------ C:\WINDOWS\system32\dfshim.dll 2005-09-23 07:28 74240 --a------ C:\WINDOWS\system32\mscories.dll 2005-09-23 07:28 32768 --a------ C:\WINDOWS\system32\netfxperf.dll 2005-09-23 07:28 270848 --a------ C:\WINDOWS\system32\mscoree.dll 2005-09-23 07:28 150016 --a------ C:\WINDOWS\system32\mscorier.dll --------- C:\Program Files\Usługi online . ((((((((((((((((((((((((((((( snapshot_2007-09-21_125354,87 ))))))))))))))))))))))))))))))))))))))))) . ----a-w 157,160 2007-09-21 14:48:18 C:\WINDOWS\system32\FNTCACHE.DAT ----a-w 17,858 2007-09-21 10:52:26 C:\WINDOWS\SoftwareDistribution\EventCache\{2A9FBE06-ED39-429F-95E4-507381D041AB}.bin ----a-w 16,096 2006-12-14 08:54:48 C:\WINDOWS\SoftwareDistribution\Download\10b6b8c0b8095d0a1b3d60a1386bdf12\spmsg.dll ----a-w 216,288 2006-12-14 08:54:48 C:\WINDOWS\SoftwareDistribution\Download\10b6b8c0b8095d0a1b3d60a1386bdf12\spuninst.exe ----a-w 723,680 2006-12-14 08:54:48 C:\WINDOWS\SoftwareDistribution\Download\10b6b8c0b8095d0a1b3d60a1386bdf12\update\update.exe ----a-w 386,784 2006-12-14 08:54:48 C:\WINDOWS\SoftwareDistribution\Download\10b6b8c0b8095d0a1b3d60a1386bdf12\update\updspapi.dll ----a-w 22,752 2006-12-14 08:54:48 C:\WINDOWS\SoftwareDistribution\Download\10b6b8c0b8095d0a1b3d60a1386bdf12\update\spcustom.dll ----a-w 144,896 2007-04-25 14:23:30 C:\WINDOWS\SoftwareDistribution\Download\10b6b8c0b8095d0a1b3d60a1386bdf12\SP2GDR\schannel.dll ----a-w 144,896 2007-04-25 20:33:40 C:\WINDOWS\SoftwareDistribution\Download\10b6b8c0b8095d0a1b3d60a1386bdf12\SP2QFE\schannel.dll ----a-w 16,096 2005-10-12 23:21:28 C:\WINDOWS\SoftwareDistribution\Download\86eff9523196b176b614dac25ad4b690\spmsg.dll ----a-w 216,288 2005-10-12 23:21:30 C:\WINDOWS\SoftwareDistribution\Download\86eff9523196b176b614dac25ad4b690\spuninst.exe ----a-w 723,680 2005-10-12 23:21:34 C:\WINDOWS\SoftwareDistribution\Download\86eff9523196b176b614dac25ad4b690\update\update.exe ----a-w 386,784 2005-10-12 23:21:42 C:\WINDOWS\SoftwareDistribution\Download\86eff9523196b176b614dac25ad4b690\update\updspapi.dll ----a-w 22,752 2005-10-12 23:21:28 C:\WINDOWS\SoftwareDistribution\Download\86eff9523196b176b614dac25ad4b690\update\spcustom.dll ----a-w 262,784 2006-03-17 00:33:10 C:\WINDOWS\SoftwareDistribution\Download\86eff9523196b176b614dac25ad4b690\SP2GDR\http.sys ----a-w 262,656 2006-03-17 01:08:10 C:\WINDOWS\SoftwareDistribution\Download\86eff9523196b176b614dac25ad4b690\SP2QFE\http.sys ----a-w 16,096 2005-10-12 23:21:28 C:\WINDOWS\SoftwareDistribution\Download\c383584119af831a75aa3baf2b5378b8\spmsg.dll ----a-w 216,288 2005-10-12 23:21:30 C:\WINDOWS\SoftwareDistribution\Download\c383584119af831a75aa3baf2b5378b8\spuninst.exe ----a-w 723,680 2005-10-12 23:21:34 C:\WINDOWS\SoftwareDistribution\Download\c383584119af831a75aa3baf2b5378b8\update\update.exe ----a-w 386,784 2005-10-12 23:21:42 C:\WINDOWS\SoftwareDistribution\Download\c383584119af831a75aa3baf2b5378b8\update\updspapi.dll ----a-w 22,752 2005-10-12 23:21:28 C:\WINDOWS\SoftwareDistribution\Download\c383584119af831a75aa3baf2b5378b8\update\spcustom.dll ----a-w 714,240 2006-10-20 01:39:32 C:\WINDOWS\SoftwareDistribution\Download\c383584119af831a75aa3baf2b5378b8\SP2GDR\sxs.dll ----a-w 714,240 2006-10-20 01:41:08 C:\WINDOWS\SoftwareDistribution\Download\c383584119af831a75aa3baf2b5378b8\SP2QFE\sxs.dll ----a-w 16,096 2005-02-24 18:36:08 C:\WINDOWS\SoftwareDistribution\Download\8a431034b6fa3dfdc11ad6aa8f8e8a1c\spmsg.dll ----a-w 212,704 2005-02-24 18:36:08 C:\WINDOWS\SoftwareDistribution\Download\8a431034b6fa3dfdc11ad6aa8f8e8a1c\spuninst.exe ----a-w 725,728 2005-02-24 18:36:08 C:\WINDOWS\SoftwareDistribution\Download\8a431034b6fa3dfdc11ad6aa8f8e8a1c\update\update.exe ----a-w 387,296 2005-02-24 18:36:08 C:\WINDOWS\SoftwareDistribution\Download\8a431034b6fa3dfdc11ad6aa8f8e8a1c\update\updspapi.dll ----a-w 22,240 2005-02-24 18:36:08 C:\WINDOWS\SoftwareDistribution\Download\8a431034b6fa3dfdc11ad6aa8f8e8a1c\update\spcustom.dll ----a-w 254,976 2005-06-29 01:52:58 C:\WINDOWS\SoftwareDistribution\Download\8a431034b6fa3dfdc11ad6aa8f8e8a1c\sp2gdr\icm32.dll ----a-w 74,240 2005-06-29 01:52:58 C:\WINDOWS\SoftwareDistribution\Download\8a431034b6fa3dfdc11ad6aa8f8e8a1c\sp2gdr\mscms.dll ----a-w 254,976 2005-06-29 01:55:00 C:\WINDOWS\SoftwareDistribution\Download\8a431034b6fa3dfdc11ad6aa8f8e8a1c\sp2qfe\icm32.dll ----a-w 73,728 2005-06-29 01:55:00 C:\WINDOWS\SoftwareDistribution\Download\8a431034b6fa3dfdc11ad6aa8f8e8a1c\sp2qfe\mscms.dll ----a-w 212,704 2005-02-25 03:36:06 C:\WINDOWS\SoftwareDistribution\Download\323675b37a82450f450ff6779c471023\spuninst.exe ----a-w 16,096 2005-02-25 03:36:06 C:\WINDOWS\SoftwareDistribution\Download\323675b37a82450f450ff6779c471023\spmsg.dll ----a-w 725,728 2005-02-25 03:36:06 C:\WINDOWS\SoftwareDistribution\Download\323675b37a82450f450ff6779c471023\update\update.exe ----a-w 387,296 2005-02-25 03:36:08 C:\WINDOWS\SoftwareDistribution\Download\323675b37a82450f450ff6779c471023\update\updspapi.dll ----a-w 22,240 2005-02-25 03:36:06 C:\WINDOWS\SoftwareDistribution\Download\323675b37a82450f450ff6779c471023\update\spcustom.dll ----a-w 30,720 2005-08-19 23:50:32 C:\WINDOWS\SoftwareDistribution\Download\323675b37a82450f450ff6779c471023\update\arpidfix.exe ----a-w 197,632 2005-08-22 18:26:28 C:\WINDOWS\SoftwareDistribution\Download\323675b37a82450f450ff6779c471023\sp2qfe\netman.dll ----a-w 197,632 2005-08-22 18:36:16 C:\WINDOWS\SoftwareDistribution\Download\323675b37a82450f450ff6779c471023\sp2gdr\netman.dll ----a-w 154,624 2005-08-22 18:37:36 C:\WINDOWS\SoftwareDistribution\Download\323675b37a82450f450ff6779c471023\sp1qfe\netman.dll ----a-w 16,096 2005-10-12 23:21:28 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\spmsg.dll ----a-w 216,288 2005-10-12 23:21:30 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\spuninst.exe ----a-w 176,128 2006-05-18 23:51:58 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\SP1QFE\obrs0415.dll ----a-w 48,640 2006-05-19 12:07:22 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\SP1QFE\ipv6.exe ----a-w 84,480 2006-05-19 12:42:28 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\SP1QFE\iphlpapi.dll ----a-w 31,232 2006-05-19 12:42:28 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\SP1QFE\inetmib1.dll ----a-w 140,288 2006-05-19 12:42:28 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\SP1QFE\dnsapi.dll ----a-w 95,232 2006-05-19 12:42:26 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\SP1QFE\6to4svc.dll ----a-w 103,424 2006-05-19 12:42:26 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\SP1QFE\dhcpcsvc.dll ----a-w 13,312 2006-05-19 12:42:28 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\SP1QFE\wship6.dll ----a-w 70,656 2006-05-19 12:42:28 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\SP1QFE\ws2_32.dll ----a-w 203,008 2006-05-19 08:46:02 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\SP1QFE\tcpip6.sys ----a-w 11,776 2006-05-19 08:44:16 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\SP1QFE\tunmp.sys ----a-w 84,480 2006-05-19 12:05:56 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\SP1QFE\netsh.exe ----a-w 54,272 2006-05-19 12:42:28 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\SP1QFE\ipv6mon.dll ----a-w 723,680 2005-10-12 23:21:34 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\update\update.exe ----a-w 386,784 2005-10-12 23:21:42 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\update\updspapi.dll ----a-w 22,752 2005-10-12 23:21:28 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\update\spcustom.dll ----a-w 95,744 2006-05-19 14:19:34 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\SP2QFE\iphlpapi.dll ----a-w 147,456 2006-05-19 14:19:34 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\SP2QFE\dnsapi.dll ----a-w 111,616 2006-05-19 14:19:34 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\SP2QFE\dhcpcsvc.dll ----a-w 148,480 2006-05-19 13:26:54 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\SP2GDR\dnsapi.dll ----a-w 111,104 2006-05-19 13:26:54 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\SP2GDR\dhcpcsvc.dll ----a-w 95,744 2006-05-19 13:26:54 C:\WINDOWS\SoftwareDistribution\Download\05ab8c082e41089957695756477f164e\SP2GDR\iphlpapi.dll ----a-w 16,096 2005-10-12 23:21:28 C:\WINDOWS\SoftwareDistribution\Download\d94111772f41011554af35ace1bd70c2\spmsg.dll ----a-w 216,288 2005-10-12 23:21:30 C:\WINDOWS\SoftwareDistribution\Download\d94111772f41011554af35ace1bd70c2\spuninst.exe ----a-w 723,680 2005-10-12 23:21:34 C:\WINDOWS\SoftwareDistribution\Download\d94111772f41011554af35ace1bd70c2\update\update.exe ----a-w 386,784 2005-10-12 23:21:42 C:\WINDOWS\SoftwareDistribution\Download\d94111772f41011554af35ace1bd70c2\update\updspapi.dll ----a-w 22,752 2005-10-12 23:21:28 C:\WINDOWS\SoftwareDistribution\Download\d94111772f41011554af35ace1bd70c2\update\spcustom.dll ----a-w 293,376 2007-03-17 13:47:18 C:\WINDOWS\SoftwareDistribution\Download\d94111772f41011554af35ace1bd70c2\SP2QFE\winsrv.dll ----a-w 293,376 2007-03-17 13:45:36 C:\WINDOWS\SoftwareDistribution\Download\d94111772f41011554af35ace1bd70c2\SP2GDR\winsrv.dll ----a-w 16,096 2005-02-24 18:36:08 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\spmsg.dll ----a-w 212,704 2005-02-24 18:36:08 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\spuninst.exe ----a-w 725,728 2005-02-24 18:36:08 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\update\update.exe ----a-w 387,296 2005-02-24 18:36:08 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\update\updspapi.dll ----a-w 22,240 2005-02-24 18:36:08 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\update\spcustom.dll ----a-w 30,720 2005-07-25 17:21:18 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\update\arpidfix.exe ----a-w 11,776 2005-07-26 04:42:36 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2gdr\xolehlp.dll ----a-w 66,560 2005-07-26 04:42:36 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2gdr\mtxclu.dll ----a-w 101,376 2005-07-26 04:42:36 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2gdr\txflog.dll ----a-w 60,416 2005-07-26 04:42:34 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2gdr\colbact.dll ----a-w 110,080 2005-07-26 04:42:34 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2gdr\clbcatex.dll ----a-w 91,136 2005-07-26 04:42:36 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2gdr\mtxoci.dll ----a-w 37,888 2005-07-26 04:42:36 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2gdr\olecnv32.dll ----a-w 195,072 2005-07-26 04:42:34 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2gdr\comadmin.dll ----a-w 161,280 2005-07-26 04:42:36 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2gdr\msdtcuiu.dll ----a-w 243,200 2005-07-26 04:42:34 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2gdr\es.dll ----a-w 75,264 2005-07-26 04:42:36 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2gdr\olecli32.dll ----a-w 225,792 2005-07-26 04:42:32 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2gdr\catsrv.dll ----a-w 97,792 2005-07-26 04:42:34 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2gdr\comrepl.dll ----a-w 425,472 2005-07-26 04:42:36 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2gdr\msdtcprx.dll ----a-w 397,824 2005-07-26 04:42:36 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2gdr\rpcss.dll ----a-w 498,688 2005-07-26 04:42:34 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2gdr\clbcatq.dll ----a-w 625,152 2005-07-26 04:42:34 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2gdr\catsrvut.dll ----a-w 540,160 2005-07-26 04:42:34 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2gdr\comuid.dll ----a-w 945,152 2005-07-26 04:42:36 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2gdr\msdtctm.dll ----a-w 1,267,200 2005-07-26 04:42:34 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2gdr\comsvcs.dll ----a-w 1,284,608 2005-07-26 04:42:36 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2gdr\ole32.dll ----a-w 11,776 2005-07-26 04:36:50 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\xolehlp.dll ----a-w 66,560 2005-07-26 04:36:48 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\mtxclu.dll ----a-w 8,704 2005-07-25 23:42:36 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\migregdb.exe ----a-w 101,376 2005-07-26 04:36:50 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\txflog.dll ----a-w 60,416 2005-07-26 04:36:44 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\colbact.dll ----a-w 110,080 2005-07-26 04:36:44 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\clbcatex.dll ----a-w 91,136 2005-07-26 04:36:48 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\mtxoci.dll ----a-w 37,376 2005-07-26 04:36:48 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\olecnv32.dll ----a-w 161,280 2005-07-26 04:36:48 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\msdtcuiu.dll ----a-w 243,200 2005-07-26 04:36:46 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\es.dll ----a-w 75,264 2005-07-26 04:36:48 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\olecli32.dll ----a-w 225,792 2005-07-26 04:36:44 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\catsrv.dll ----a-w 97,792 2005-07-26 04:36:44 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\comrepl.dll ----a-w 425,472 2005-07-26 04:36:46 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\msdtcprx.dll ----a-w 398,336 2005-07-26 04:36:50 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\rpcss.dll ----a-w 498,688 2005-07-26 04:36:44 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\clbcatq.dll ----a-w 625,152 2005-07-26 04:36:44 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\catsrvut.dll ----a-w 540,160 2005-07-26 04:36:46 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\comuid.dll ----a-w 195,072 2005-07-26 04:36:44 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\comadmin.dll ----a-w 945,152 2005-07-26 04:36:46 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\msdtctm.dll ----a-w 1,267,200 2005-07-26 04:36:46 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\comsvcs.dll ----a-w 1,285,632 2005-07-26 04:36:48 C:\WINDOWS\SoftwareDistribution\Download\9fc7d8bfae6d0ca56892095376bfd2e3\sp2qfe\ole32.dll ----a-w 16,096 2005-10-12 23:21:28 C:\WINDOWS\SoftwareDistribution\Download\46bd1acd42dba2ef5fa83bdd50f5b5f1\spmsg.dll ----a-w 216,288 2005-10-12 23:21:30 C:\WINDOWS\SoftwareDistribution\Download\46bd1acd42dba2ef5fa83bdd50f5b5f1\spuninst.exe ----a-w 723,680 2005-10-12 23:21:34 C:\WINDOWS\SoftwareDistribution\Download\46bd1acd42dba2ef5fa83bdd50f5b5f1\update\update.exe ----a-w 386,784 2005-10-12 23:21:42 C:\WINDOWS\SoftwareDistribution\Download\46bd1acd42dba2ef5fa83bdd50f5b5f1\update\updspapi.dll ----a-w 22,752 2005-10-12 23:21:28 C:\WINDOWS\SoftwareDistribution\Download\46bd1acd42dba2ef5fa83bdd50f5b5f1\update\spcustom.dll ----a-w 549,888 2007-05-17 11:28:44 C:\WINDOWS\SoftwareDistribution\Download\46bd1acd42dba2ef5fa83bdd50f5b5f1\SP2QFE\oleaut32.dll ----a-w 549,376 2007-05-17 11:30:18 C:\WINDOWS\SoftwareDistribution\Download\46bd1acd42dba2ef5fa83bdd50f5b5f1\SP2GDR\oleaut32.dll ----a-w 16,096 2005-10-12 23:21:28 C:\WINDOWS\SoftwareDistribution\Download\01108c8ae67042f4e24912e4ceb82d52\spmsg.dll ----a-w 216,288 2005-10-12 23:21:30 C:\WINDOWS\SoftwareDistribution\Download\01108c8ae67042f4e24912e4ceb82d52\spuninst.exe ----a-w 723,680 2005-10-12 23:21:34 C:\WINDOWS\SoftwareDistribution\Download\01108c8ae67042f4e24912e4ceb82d52\update\update.exe ----a-w 386,784 2005-10-12 23:21:42 C:\WINDOWS\SoftwareDistribution\Download\01108c8ae67042f4e24912e4ceb82d52\update\updspapi.dll ----a-w 22,752 2005-10-12 23:21:28 C:\WINDOWS\SoftwareDistribution\Download\01108c8ae67042f4e24912e4ceb82d52\update\spcustom.dll ----a-w 728,576 2006-08-17 12:43:18 C:\WINDOWS\SoftwareDistribution\Download\01108c8ae67042f4e24912e4ceb82d52\SP2QFE\lsasrv.dll ----a-w 337,408 2006-08-17 12:43:18 C:\WINDOWS\SoftwareDistribution\Download\01108c8ae67042f4e24912e4ceb82d52\SP2QFE\netapi32.dll ----a-w 132,096 2006-08-17 12:43:18 C:\WINDOWS\SoftwareDistribution\Download\01108c8ae67042f4e24912e4ceb82d52\SP2QFE\wkssvc.dll ----a-w 723,968 2006-08-17 12:30:06 C:\WINDOWS\SoftwareDistribution\Download\01108c8ae67042f4e24912e4ceb82d52\SP2GDR\lsasrv.dll ----a-w 332,288 2006-08-17 12:30:06 C:\WINDOWS\SoftwareDistribution\Download\01108c8ae67042f4e24912e4ceb82d52\SP2GDR\netapi32.dll ----a-w 132,096 2006-08-17 12:30:06 C:\WINDOWS\SoftwareDistribution\Download\01108c8ae67042f4e24912e4ceb82d52\SP2GDR\wkssvc.dll ----a-w 16,096 2005-02-24 18:36:08 C:\WINDOWS\SoftwareDistribution\Download\33b429ed39bc5e95ff7042a3b46c0314\spmsg.dll ----a-w 212,704 2005-02-24 18:36:08 C:\WINDOWS\SoftwareDistribution\Download\33b429ed39bc5e95ff7042a3b46c0314\spuninst.exe ----a-w 725,728 2005-02-24 18:36:08 C:\WINDOWS\SoftwareDistribution\Download\33b429ed39bc5e95ff7042a3b46c0314\update\update.exe ----a-w 387,296 2005-02-24 18:36:08 C:\WINDOWS\SoftwareDistribution\Download\33b429ed39bc5e95ff7042a3b46c0314\update\updspapi.dll ----a-w 22,240 2005-02-24 18:36:08 C:\WINDOWS\SoftwareDistribution\Download\33b429ed39bc5e95ff7042a3b46c0314\update\spcustom.dll ----a-w 30,720 2005-06-29 14:54:32 C:\WINDOWS\SoftwareDistribution\Download\33b429ed39bc5e95ff7042a3b46c0314\update\arpidfix.exe ----a-w 57,856 2005-06-10 23:53:32 C:\WINDOWS\SoftwareDistribution\Download\33b429ed39bc5e95ff7042a3b46c0314\sp2gdr\spoolsv.exe ----a-w 57,856 2005-06-11 00:17:14 C:\WINDOWS\SoftwareDistribution\Download\33b429ed39bc5e95ff7042a3b46c0314\sp2qfe\spoolsv.exe ----a-w 496,880 2005-04-11 23:10:18 C:\WINDOWS\SoftwareDistribution\Download\ef0eb4021a89170edd4d57c53df1dbef\WindowsXP-KB890859-x86-express-PLK.exe ----a-w 16,096 2005-02-24 17:36:08 C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\spmsg.dll ----a-w 212,704 2005-02-24 17:36:08 C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\spuninst.exe ----a-w 725,728 2005-02-24 17:36:08 C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\update\update.exe ----a-w 387,296 2005-02-24 17:36:08 C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\update\updspapi.dll ----a-w 22,240 2005-02-24 17:36:08 C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\update\spcustom.dll ------w 56,832 2004-08-03 22:43:54 C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\backup\sp2gdr\authz.dll ------w 2,149,888 2004-08-03 22:38:52 C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\backup\sp2gdr\ntkrnlmp.exe ------w 2,058,112 2004-08-03 22:38:58 C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\backup\sp2gdr\ntkrnlpa.exe ------w 2,016,768 2004-08-03 22:39:02 C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\backup\sp2gdr\ntkrpamp.exe ------w 2,182,272 2004-08-03 22:39:10 C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\backup\sp2gdr\ntoskrnl.exe ------w 578,560 2004-08-03 22:44:14 C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\backup\sp2gdr\user32.dll ------w 1,836,160 2004-08-03 22:37:28 C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\backup\sp2gdr\win32k.sys ------w 291,328 2004-08-03 22:44:16 C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\backup\sp2gdr\winsrv.dll ------w 56,832 2004-08-03 22:43:54 C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\backup\sp2qfe\authz.dll ------w 2,149,888 2004-08-03 22:38:52 C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\backup\sp2qfe\ntkrnlmp.exe ------w 2,058,112 2004-08-03 22:38:58 C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\backup\sp2qfe\ntkrnlpa.exe ------w 2,016,768 2004-08-03 22:39:02 C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\backup\sp2qfe\ntkrpamp.exe ------w 2,182,272 2004-08-03 22:39:10 C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\backup\sp2qfe\ntoskrnl.exe ------w 578,560 2004-08-03 22:44:14 C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\backup\sp2qfe\user32.dll ------w 1,836,160 2004-08-03 22:37:28 C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\backup\sp2qfe\win32k.sys ------w 291,328 2004-08-03 22:44:16 C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\backup\sp2qfe\winsrv.dll ----a-w 16,096 2005-10-12 23:21:28 C:\WINDOWS\SoftwareDistribution\Download\dab0498c9daad1d46b20213b3bf19ba1\spmsg.dll ----a-w 216,288 2005-10-12 23:21:30 C:\WINDOWS\SoftwareDistribution\Download\dab0498c9daad1d46b20213b3bf19ba1\spuninst.exe ----a-w 723,680 2005-10-12 23:21:34 C:\WINDOWS\SoftwareDistribution\Download\dab0498c9daad1d46b20213b3bf19ba1\update\update.exe ----a-w 386,784 2005-10-12 23:21:42 C:\WINDOWS\SoftwareDistribution\Download\dab0498c9daad1d46b20213b3bf19ba1\update\updspapi.dll ----a-w 22,752 2005-10-12 23:21:28 C:\WINDOWS\SoftwareDistribution\Download\dab0498c9daad1d46b20213b3bf19ba1\update\spcustom.dll ----a-w 1,001,472 2005-10-20 22:34:16 C:\WINDOWS\SoftwareDistribution\Download\dab0498c9daad1d46b20213b3bf19ba1\sp1qfe\esent.dll ----a-w 1,092,608 2005-10-20 22:32:50 C:\WINDOWS\SoftwareDistribution\Download\dab0498c9daad1d46b20213b3bf19ba1\sp2qfe\esent.dll ----a-w 1,092,608 2005-10-20 22:30:54 C:\WINDOWS\SoftwareDistribution\Download\dab0498c9daad1d46b20213b3bf19ba1\sp2gdr\esent.dll ----a-w 497,392 2005-08-05 21:41:00 C:\WINDOWS\SoftwareDistribution\Download\e0c02e66f1fbb5aef252ef298c56437b\WindowsXP-KB899587-x86-express-PLK.exe ----a-w 16,096 2005-02-24 18:36:08 C:\WINDOWS\SoftwareDistribution\Download\f0b88fe1ffe91bd3a9ea0d5ad18f24b7\spmsg.dll ----a-w 212,704 2005-02-24 18:36:08 C:\WINDOWS\SoftwareDistribution\Download\f0b88fe1ffe91bd3a9ea0d5ad18f24b7\spuninst.exe ----a-w 725,728 2005-02-24 18:36:08 C:\WINDOWS\SoftwareDistribution\Download\f0b88fe1ffe91bd3a9ea0d5ad18f24b7\update\update.exe ----a-w 387,296 2005-02-24 18:36:08 C:\WINDOWS\SoftwareDistribution\Download\f0b88fe1ffe91bd3a9ea0d5ad18f24b7\update\updspapi.dll ----a-w 22,240 2005-02-24 18:36:08 C:\WINDOWS\SoftwareDistribution\Download\f0b88fe1ffe91bd3a9ea0d5ad18f24b7\update\spcustom.dll ----a-w 30,720 2005-06-29 14:54:32 C:\WINDOWS\SoftwareDistribution\Download\f0b88fe1ffe91bd3a9ea0d5ad18f24b7\update\arpidfix.exe ------w 294,400 2004-08-03 22:44:02 C:\WINDOWS\SoftwareDistribution\Download\f0b88fe1ffe91bd3a9ea0d5ad18f24b7\backup\sp2gdr\kerberos.dll ------w 294,400 2004-08-03 22:44:02 C:\WINDOWS\SoftwareDistribution\Download\f0b88fe1ffe91bd3a9ea0d5ad18f24b7\backup\sp2qfe\kerberos.dll ----a-w 16,096 2005-10-12 23:21:28 C:\WINDOWS\SoftwareDistribution\Download\6864a7b2406ca1df1ac771ba5d6aed71\spmsg.dll ----a-w 216,288 2005-10-12 23:21:30 C:\WINDOWS\SoftwareDistribution\Download\6864a7b2406ca1df1ac771ba5d6aed71\spuninst.exe ----a-w 723,680 2005-10-12 23:21:34 C:\WINDOWS\SoftwareDistribution\Download\6864a7b2406ca1df1ac771ba5d6aed71\update\update.exe ----a-w 386,784 2005-10-12 23:21:42 C:\WINDOWS\SoftwareDistribution\Download\6864a7b2406ca1df1ac771ba5d6aed71\update\updspapi.dll ----a-w 22,752 2005-10-12 23:21:28 C:\WINDOWS\SoftwareDistribution\Download\6864a7b2406ca1df1ac771ba5d6aed71\update\spcustom.dll ----a-w 454,400 2006-05-05 10:16:40 C:\WINDOWS\SoftwareDistribution\Download\6864a7b2406ca1df1ac771ba5d6aed71\SP2QFE\mrxsmb.sys ----a-w 174,592 2006-05-05 10:22:52 C:\WINDOWS\SoftwareDistribution\Download\6864a7b2406ca1df1ac771ba5d6aed71\SP2QFE\rdbss.sys ----a-w 174,592 2006-05-05 09:47:58 C:\WINDOWS\SoftwareDistribution\Download\6864a7b2406ca1df1ac771ba5d6aed71\SP2GDR\rdbss.sys ----a-w 453,120 2006-05-05 09:41:46 C:\WINDOWS\SoftwareDistribution\Download\6864a7b2406ca1df1ac771ba5d6aed71\SP2GDR\mrxsmb.sys ----a-w 433,152 2006-05-05 09:31:04 C:\WINDOWS\SoftwareDistribution\Download\6864a7b2406ca1df1ac771ba5d6aed71\SP1QFE\mrxsmb.sys ----a-w 166,656 2006-05-05 09:40:32 C:\WINDOWS\SoftwareDistribution\Download\6864a7b2406ca1df1ac771ba5d6aed71\SP1QFE\rdbss.sys ----a-w 92,672 2004-10-28 01:31:20 C:\WINDOWS\SoftwareDistribution\Download\6864a7b2406ca1df1ac771ba5d6aed71\SP1QFE\cscdll.dll ----a-w 216,288 2005-10-12 23:21:30 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\spuninst.exe ----a-w 16,096 2005-10-12 23:21:28 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\spmsg.dll ----a-w 723,680 2005-10-12 23:21:34 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\update\update.exe ----a-w 386,784 2005-10-12 23:21:42 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\update\updspapi.dll ----a-w 22,752 2005-10-12 23:21:28 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\update\spcustom.dll ----a-w 974,336 2006-03-01 19:45:50 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP1QFE\msdtctm.dll ----a-w 11,776 2006-03-01 19:45:50 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP1QFE\xolehlp.dll ----a-w 368,640 2006-03-01 19:45:50 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP1QFE\msdtcprx.dll ----a-w 64,512 2006-03-01 19:45:50 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP1QFE\mtxclu.dll ----a-w 150,528 2006-03-01 19:45:50 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP1QFE\msdtcuiu.dll ----a-w 83,456 2006-03-01 19:45:50 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP1QFE\mtxoci.dll ----a-w 956,416 2006-03-01 19:44:20 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2GDR\msdtctm.dll ----a-w 426,496 2006-03-01 19:44:20 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2GDR\msdtcprx.dll ----a-w 11,776 2006-03-01 19:44:20 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2GDR\xolehlp.dll ----a-w 66,560 2006-03-01 19:44:20 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2GDR\mtxclu.dll ----a-w 161,280 2006-03-01 19:44:20 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2GDR\msdtcuiu.dll ----a-w 91,136 2006-03-01 19:44:20 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2GDR\mtxoci.dll ----a-w 11,776 2006-03-01 19:42:44 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2QFE\xolehlp.dll ----a-w 66,560 2006-03-01 19:42:44 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2QFE\mtxclu.dll ----a-w 426,496 2006-03-01 19:42:44 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2QFE\msdtcprx.dll ----a-w 91,136 2006-03-01 19:42:44 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2QFE\mtxoci.dll ----a-w 161,280 2006-03-01 19:42:44 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2QFE\msdtcuiu.dll ----a-w 956,416 2006-03-01 19:42:44 C:\WINDOWS\SoftwareDistribution\Download\75fbd241c542f5a01412c2129075992e\SP2QFE\msdtctm.dll ----a-w 163,328 2007-03-13 08:57:12 C:\WINDOWS\erdnt\subs\F3M\ERDNT.EXE . ----a-w 157,160 2007-12-20 11:39:14 C:\WINDOWS\system32\FNTCACHE.DAT . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SkyTel"="SkyTel.EXE" [2006-05-16 11:04 C:\WINDOWS\SkyTel.exe] "ASUSGamerOSD"="C:\Program Files\ASUS\GamerOSD\GamerOSD.exe" [2007-09-13 15:54] "RTHDCPL"="RTHDCPL.EXE" [2007-01-30 11:54 C:\WINDOWS\RTHDCPL.exe] "WooCnxMon"="C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [2003-10-16 19:07] "WOOWATCH"="C:\PROGRA~1\NEOSTR~1\Watch.exe" [2003-10-16 19:07] "WOOTASKBARICON"="C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" [2003-10-16 19:07] "NeroCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-12-07 15:40] "atwtusb"="atwtusb.exe" [] "WheelMouse"="C:\Program Files\A4Tech\Mouse\Amoumain.exe" [2007-02-10 15:07] "nod32kui"="C:\Program Files\Eset\nod32kui.exe" [2007-12-13 17:02] "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10] "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-10-25 17:17] "nwiz"="nwiz.exe" [2007-10-25 17:17 C:\WINDOWS\system32\nwiz.exe] "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-25 17:17] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:44] "ASUS SmartDoctor"="C:\Program Files\ASUS\SmartDoctor\SmartDoctor.exe" [2007-10-11 21:36] "Gadu-Gadu"="C:\Program Files\Gadu-Gadu\gg.exe" [2006-11-14 10:12] "AutoConnect"="C:\Program Files\AutoConnect\AutoConnect.exe" [2004-08-28 19:27] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2005-10-24 15:53] [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "Nokia.PCSync"=C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog R2 WG1N;SyGate for NT, WG1N;C:\WINDOWS\system32\Drivers\WG1N.sys R2 WG2N;SyGate for NT, WG2N;C:\WINDOWS\system32\Drivers\WG2N.sys R2 WIBUKEY;WIBU-KEY Kernel Driver;C:\WINDOWS\system32\DRIVERS\Wibukey.sys R3 Amps2prt;A4Tech PS/2 Port Mouse Driver;C:\WINDOWS\system32\DRIVERS\Amps2prt.sys R3 asusgsb;ASUS Virtual Video Capture Device Driver;C:\WINDOWS\system32\drivers\asusgsb.sys R3 ASUSVRC;ASUSTeK Virtual Capture Device;C:\WINDOWS\system32\DRIVERS\AsusVRC.sys R3 Video3D;ASUS Video3D Service;C:\WINDOWS\system32\Drivers\Video3D32.sys S1 aiptektp;HyperPen;C:\WINDOWS\system32\DRIVERS\aiptektp.sys S3 ABIT-IO;ABIT-IO;\??\C:\Program Files\U-ABIT\abitEQ\ABIT-IO.sys S3 ASPI;Advanced SCSI Programming Interface Driver;\??\C:\WINDOWS\System32\DRIVERS\ASPI32.sys S3 BTNetFilter;Bluetooth Network Filter;\??\C:\WINDOWS\system32\drivers\BTNetFilter.sys S3 EverestDriver;Lavalys EVEREST Kernel Driver;\??\C:\Program Files\Lavalys\EVEREST Home Edition\kerneld.wnt S3 Memctl;Memctl;\??\C:\Program Files\U-ABIT\FlashMenu\Memctl.sys . ************************************************************************** catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2005-09-21 17:02:53 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . Completion time: 2005-09-21 17:03:05 C:\ComboFix3.txt ... 2007-09-21 16:21 C:\ComboFix-quarantined-files.txt ... 2005-09-21 17:03 C:\ComboFix2.txt ... 2007-09-21 16:48 . --- E O F ---

**Posty:** 18165 · przez **wojtas** 23 Gru 2007, 18:06

czysto

Autor postu otrzymał pochwałę

**Posty:** 8001 · przez **Okocza** 23 Gru 2007, 18:06

ok, dzieki. mozna zamknac.

prosze o sprawdzenie - komp muli

prosze o sprawdzenie - komp muli

Kto jest na forum