Proszę o sprawdzenie loga (zlosliwy wirus??)

**Posty:** 5 · przez **Deevill700** 31 Gru 2008, 16:50

Zaczne od tego ze nie znam sie wogole na logach, dlatego licze na wasza pomoc, przeczytalem pare tematow podobnych do mojej sprawy, ale nie pomoglo...

zaczelo sie od tego ze siedzialem przed kompem, ogladalem stronki internetowe i ustawialem rrs'y do programu... komp nagle sie wylaczyl... napewno nie bylo to przeciazenie ani nic w tym stylu bo dzialala tylko mozilla i rssowl, w tle kaspersky i gadu...

co sie okazalo... padl kabel zasilajacy... po wymianie kabla komputer sie wlanczal, ale w momencie jak sie mial pokazac panel logowania windowsa znowu sie wylaczal...

zeby go ponownie wlaczyc trzeba bylo odciac zasilanie na pare sekund (np 5) wystarczylo przelacznikiem na zasilaczu i znowu sie wlanczal... po kilku probach, reset biosu, pomoglo to o tyle ze do windowsa mozna sie zalogowac, czasem nawet przez poltorej godziny normalnie chodzi i z nienacka off ;/ czasem chodzi tylko 20 min, czasem 10, tak losowo...

myslalem ze to hardware ale:
- zasilacz sprawdzalem, na innym jest dokladnie to samo
- ram tak samo, inny, w roznych slotach, nic nie pomaga
- karta graficzna, dalej nic nie pomaga
zostal procek i plyta glowna, tego nie jestem w stanie sprawdzic bo nie mam innego ;/

co dalej z obserwacji... komputer sie wylacza za kazdym razem jak w kaspersky daje skanowanie obszarow krytycznych, za kazdym razem jak uruchamiam combofix (nie od razu, ale po jakims czasie, nawet nie zdazy wyskoczyc pierwsza ramka gdzie autor ostrzega ze jest to program "as is" i nie ponosi odpowiedzialnosci ;p

dlatego mysle ze cos zlosliwego w nim siedzi... mam nadzieje ze wyczytacie cos z logow, nawet najmniejsza rada bedzie mile widziana

konfiguracja pc...
Plyta glowna: ASUS a7v880
Procek: Sempron 2200
Ram: 2x256 dual i 1gb
Grafika: Ati Radeon 9600
Zasilacz nie wiem jaki, ale 450W

z ciekawych rzeczy... komp wylacza sie nawet podczas proby instalacji windowsa, przejscia do konsoli odzyskiwania, w czasie memtestu z plyty ubuntu... czyli albo cos siedzi w ramie albo... nie mam pojecia ;/

oto logi:
RSIT

Kod: Zaznacz wszystko: Logfile of random's system information tool 1.05 (written by random/random) Run by Deevill700 at 2008-12-31 15:49:02 Microsoft Windows XP Professional Dodatek Service Pack 3 System drive C: has 56 GB (84%) free of 67 GB Total RAM: 1535 MB (68% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:49, on 2008-12-31 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\Explorer.EXE C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\Mozilla Firefox\firefox.exe D:\!Downloads\Firefox\RSIT.exe C:\Program Files\Trend Micro\HijackThis\Deevill700.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Ustawienia lokalne\Temp" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_02] rundll32 advpack.dll,DelNodeRunDLL32 "%SystemRoot%\System32\dllcache" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] cmd.exe /c md "%SystemRoot%\System32\dllcache" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_04] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_05] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Ustawienia lokalne\Temp" (User 'USŁUGA SIECIOWA') O8 - Extra context menu item: Dodaj do blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Subskrybuj w RssSpeed - file://C:\Program Files\RssSpeed\add_feed.htm O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{A49A50FB-70B9-4CD4-8CEC-B00332EB06F5}: NameServer = 194.204.159.1,192.168.75.1 O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe -- End of file - 5643 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}] Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}] Java(tm) Plug-In SSV Helper - C:\Program Files\Java\jre6\bin\ssv.dll [2008-12-24 320920] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2008-12-24 34816] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-12-24 73728] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "AVP"=C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe [2007-12-18 227856] "SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2008-12-24 136600] "StartCCC"=C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2008-08-29 61440] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "Gadu-Gadu"=C:\Program Files\Gadu-Gadu\gg.exe [2008-03-20 2127296] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RssSpeed] C:\Program Files\RssSpeed\RssSpeed.exe [] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent] C:\WINDOWS\system32\Ati2evxx.dll [2008-12-01 143360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\klogon] C:\WINDOWS\system32\klogon.dll [2007-12-18 219664] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\procexp90.Sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\procexp90.Sys] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\PSEXESVC] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.321\Polish\setup.exe"="C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files\Kaspersky Internet Security 7.0.1.321\Polish\setup.exe:*:Enabled:Kaspersky Internet Security 7.0 Setup" "C:\Program Files\uTorrent\uTorrent.exe"="C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" ======List of files/folders created in the last 1 months====== 2008-12-31 13:07:10 ----D---- C:\ComboFix 2008-12-31 13:07:09 ----A---- C:\WINDOWS\system32\CF2759.exe 2008-12-31 13:03:51 ----A---- C:\WINDOWS\system32\CF2122.exe 2008-12-31 13:00:15 ----A---- C:\WINDOWS\system32\CF1417.exe 2008-12-31 12:57:15 ----A---- C:\WINDOWS\zip.exe 2008-12-31 12:57:15 ----A---- C:\WINDOWS\VFIND.exe 2008-12-31 12:57:15 ----A---- C:\WINDOWS\SWXCACLS.exe 2008-12-31 12:57:15 ----A---- C:\WINDOWS\SWSC.exe 2008-12-31 12:57:15 ----A---- C:\WINDOWS\SWREG.exe 2008-12-31 12:57:15 ----A---- C:\WINDOWS\sed.exe 2008-12-31 12:57:15 ----A---- C:\WINDOWS\NIRCMD.exe 2008-12-31 12:57:15 ----A---- C:\WINDOWS\grep.exe 2008-12-31 12:57:15 ----A---- C:\WINDOWS\fdsv.exe 2008-12-31 12:56:49 ----D---- C:\WINDOWS\ERDNT 2008-12-31 12:56:49 ----D---- C:\Qoobox 2008-12-31 12:56:38 ----A---- C:\WINDOWS\system32\CF698.exe 2008-12-31 12:13:36 ----D---- C:\rsit 2008-12-31 12:13:14 ----D---- C:\Program Files\Trend Micro 2008-12-31 11:48:58 ----A---- C:\WINDOWS\ntbtlog.txt 2008-12-30 12:48:33 ----D---- C:\Program Files\RssSpeed 2008-12-29 21:54:49 ----D---- C:\Program Files\Professional Manager 2008-12-28 14:57:19 ----D---- C:\Program Files\UT 2008-12-28 13:23:55 ----D---- C:\Program Files\Hattrick Coach Professional 2008-12-27 11:25:41 ----D---- C:\Program Files\CH-Soft 2008-12-27 11:15:07 ----D---- C:\Program Files\Common Files\Borland Shared 2008-12-27 11:15:07 ----D---- C:\Program Files\Borland 2008-12-27 11:11:25 ----D---- C:\Program Files\MSXML 4.0 2008-12-27 11:06:04 ----D---- C:\Program Files\Microsoft Visual Studio .NET 2003 2008-12-27 11:06:01 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft Help 2008-12-26 00:50:18 ----D---- C:\Program Files\ReNamer 2008-12-25 23:07:26 ----A---- C:\WINDOWS\system32\wmpns.dll 2008-12-25 15:47:06 ----D---- C:\Program Files\temp 2008-12-25 15:46:54 ----D---- C:\WINDOWS\system32\ocr 2008-12-25 15:46:54 ----D---- C:\WINDOWS\system32\Data 2008-12-25 15:46:53 ----D---- C:\WINDOWS\system32\Plugins 2008-12-25 14:36:22 ----D---- C:\Documents and Settings\Deevill700\Dane aplikacji\VitySoft 2008-12-24 21:08:16 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$ 2008-12-24 21:07:48 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$ 2008-12-24 16:57:31 ----D---- C:\Documents and Settings\Deevill700\Dane aplikacji\ATI 2008-12-24 16:57:31 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\ATI 2008-12-24 16:52:02 ----N---- C:\WINDOWS\system32\ati2sgag.exe 2008-12-24 16:51:30 ----D---- C:\Program Files\ATI Technologies 2008-12-24 16:51:29 ----HD---- C:\Program Files\InstallShield Installation Information 2008-12-24 16:50:41 ----D---- C:\Program Files\Common Files\InstallShield 2008-12-24 16:50:31 ----D---- C:\ATI 2008-12-24 15:58:12 ----D---- C:\Program Files\SystemRequirementsLab 2008-12-24 15:57:31 ----D---- C:\WINDOWS\Sun 2008-12-24 15:24:23 ----A---- C:\WINDOWS\system32\javaws.exe 2008-12-24 15:24:23 ----A---- C:\WINDOWS\system32\javaw.exe 2008-12-24 15:24:23 ----A---- C:\WINDOWS\system32\java.exe 2008-12-24 15:24:23 ----A---- C:\WINDOWS\system32\deploytk.dll 2008-12-24 15:24:08 ----D---- C:\Program Files\Java 2008-12-24 15:23:46 ----D---- C:\Documents and Settings\Deevill700\Dane aplikacji\Sun 2008-12-24 14:04:47 ----D---- C:\Program Files\SkanerOnline 2008-12-24 03:21:59 ----D---- C:\Program Files\xerox 2008-12-24 03:21:58 ----D---- C:\WINDOWS\system32\xircom 2008-12-24 03:21:58 ----D---- C:\Program Files\msn gaming zone 2008-12-24 03:21:57 ----D---- C:\Program Files\microsoft frontpage 2008-12-24 03:21:44 ----D---- C:\WINDOWS\Prefetch 2008-12-24 03:18:43 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$ 2008-12-24 03:18:31 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$ 2008-12-24 03:18:22 ----HDC---- C:\WINDOWS\$NtUninstallKB957095$ 2008-12-24 03:18:12 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$ 2008-12-24 03:18:02 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$ 2008-12-24 03:17:53 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$ 2008-12-24 03:17:39 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$ 2008-12-24 03:16:25 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$ 2008-12-24 03:16:16 ----HDC---- C:\WINDOWS\$NtUninstallKB954211$ 2008-12-24 03:16:08 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$ 2008-12-24 03:15:59 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$ 2008-12-24 03:15:50 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$ 2008-12-24 03:15:41 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$ 2008-12-24 03:15:33 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$ 2008-12-24 03:14:12 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$ 2008-12-24 03:14:04 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$ 2008-12-24 03:13:56 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$ 2008-12-24 03:13:48 ----HDC---- C:\WINDOWS\$NtUninstallKB938464$ 2008-12-24 03:05:24 ----D---- C:\WINDOWS\l2schemas 2008-12-24 03:05:02 ----D---- C:\WINDOWS\system32\pl 2008-12-24 03:04:50 ----D---- C:\WINDOWS\system32\bits 2008-12-24 02:56:12 ----D---- C:\WINDOWS\ServicePackFiles 2008-12-24 02:53:36 ----D---- C:\WINDOWS\system32\ReinstallBackups 2008-12-24 02:52:11 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$ 2008-12-24 02:39:17 ----D---- C:\WINDOWS\ie7updates 2008-12-24 02:37:50 ----D---- C:\WINDOWS\WBEM 2008-12-24 02:30:42 ----HDC---- C:\WINDOWS\ie7 2008-12-24 02:30:04 ----HDC---- C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$ 2008-12-24 02:29:33 ----HDC---- C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$ 2008-12-24 02:29:08 ----HDC---- C:\WINDOWS\$NtUninstallKB915865$ 2008-12-24 02:29:03 ----N---- C:\WINDOWS\system32\xmllite.dll 2008-12-24 02:27:48 ----D---- C:\WINDOWS\network diagnostic 2008-12-24 02:27:47 ----HDC---- C:\WINDOWS\$NtUninstallKB914440$ 2008-12-24 02:24:19 ----A---- C:\WINDOWS\system32\MRT.exe 2008-12-24 02:14:33 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2_0$ 2008-12-24 02:14:27 ----HDC---- C:\WINDOWS\$NtUninstallKB952954_0$ 2008-12-24 02:14:20 ----HDC---- C:\WINDOWS\$NtUninstallKB946648_0$ 2008-12-24 02:14:14 ----HDC---- C:\WINDOWS\$NtUninstallKB956803_0$ 2008-12-24 02:14:07 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$ 2008-12-24 02:14:03 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$ 2008-12-24 02:13:54 ----HDC---- C:\WINDOWS\$NtUninstallKB956391$ 2008-12-24 02:13:47 ----HDC---- C:\WINDOWS\$NtUninstallKB957095_0$ 2008-12-24 02:13:40 ----HDC---- C:\WINDOWS\$NtUninstallKB960714$ 2008-12-24 02:13:29 ----HDC---- C:\WINDOWS\$NtUninstallKB958215$ 2008-12-24 02:13:19 ----HDC---- C:\WINDOWS\$NtUninstallKB950974_0$ 2008-12-24 02:13:12 ----HDC---- C:\WINDOWS\$NtUninstallKB951698_0$ 2008-12-24 02:13:05 ----HDC---- C:\WINDOWS\$NtUninstallKB954211_0$ 2008-12-24 02:12:56 ----HDC---- C:\WINDOWS\$NtUninstallKB956841_0$ 2008-12-24 02:12:47 ----HDC---- C:\WINDOWS\$NtUninstallKB960714_0$ 2008-12-24 02:12:40 ----HDC---- C:\WINDOWS\$NtUninstallKB950762_0$ 2008-12-24 02:12:34 ----HDC---- C:\WINDOWS\$NtUninstallKB957097_0$ 2008-12-24 02:12:27 ----HDC---- C:\WINDOWS\$NtUninstallKB952287_0$ 2008-12-24 02:12:21 ----HDC---- C:\WINDOWS\$NtUninstallKB951066_0$ 2008-12-24 02:12:16 ----HDC---- C:\WINDOWS\$NtUninstallKB938464_0$ 2008-12-24 02:12:10 ----HDC---- C:\WINDOWS\$NtUninstallKB954600_0$ 2008-12-24 02:12:04 ----HDC---- C:\WINDOWS\$NtUninstallKB958644_0$ 2008-12-24 02:11:58 ----HDC---- C:\WINDOWS\$NtUninstallKB955069_0$ 2008-12-24 02:11:52 ----HDC---- C:\WINDOWS\$NtUninstallKB956802_0$ 2008-12-24 02:11:11 ----HDC---- C:\WINDOWS\$NtUninstallKB944338-v2$ 2008-12-24 02:10:35 ----N---- C:\WINDOWS\system32\wlanapi.dll 2008-12-24 02:10:23 ----N---- C:\WINDOWS\system32\tspkg.dll 2008-12-24 02:10:23 ----N---- C:\WINDOWS\system32\tsgqec.dll 2008-12-24 02:10:21 ----N---- C:\WINDOWS\system32\spupdwxp.exe 2008-12-24 02:10:21 ----A---- C:\WINDOWS\system32\spdwnwxp.exe 2008-12-24 02:10:20 ----N---- C:\WINDOWS\system32\slserv.exe 2008-12-24 02:10:20 ----N---- C:\WINDOWS\system32\slrundll.exe 2008-12-24 02:10:20 ----N---- C:\WINDOWS\system32\slgen.dll 2008-12-24 02:10:20 ----N---- C:\WINDOWS\system32\slextspk.dll 2008-12-24 02:10:20 ----N---- C:\WINDOWS\system32\slcoinst.dll 2008-12-24 02:10:20 ----N---- C:\WINDOWS\slrundll.exe 2008-12-24 02:10:19 ----N---- C:\WINDOWS\system32\setupn.exe 2008-12-24 02:10:18 ----N---- C:\WINDOWS\system32\s3gnb.dll 2008-12-24 02:10:18 ----N---- C:\WINDOWS\system32\rhttpaa.dll 2008-12-24 02:10:18 ----N---- C:\WINDOWS\system32\rasqec.dll 2008-12-24 02:10:18 ----N---- C:\WINDOWS\system32\qutil.dll 2008-12-24 02:10:18 ----N---- C:\WINDOWS\system32\qcliprov.dll 2008-12-24 02:10:18 ----N---- C:\WINDOWS\system32\qagentrt.dll 2008-12-24 02:10:18 ----N---- C:\WINDOWS\system32\qagent.dll 2008-12-24 02:10:17 ----N---- C:\WINDOWS\system32\onex.dll 2008-12-24 02:10:16 ----N---- C:\WINDOWS\system32\nv4_disp.dll 2008-12-24 02:10:14 ----N---- C:\WINDOWS\system32\napstat.exe 2008-12-24 02:10:14 ----N---- C:\WINDOWS\system32\napmontr.dll 2008-12-24 02:10:14 ----N---- C:\WINDOWS\system32\napipsec.dll 2008-12-24 02:10:14 ----N---- C:\WINDOWS\system32\mtxparhd.dll 2008-12-24 02:10:14 ----N---- C:\WINDOWS\system32\msshavmsg.dll 2008-12-24 02:10:14 ----N---- C:\WINDOWS\system32\mssha.dll 2008-12-24 02:10:14 ----A---- C:\WINDOWS\system32\msvbvm60.dll 2008-12-24 02:10:11 ----N---- C:\WINDOWS\system32\mmcperf.exe 2008-12-24 02:10:11 ----N---- C:\WINDOWS\system32\mmcfxcommon.dll 2008-12-24 02:10:11 ----N---- C:\WINDOWS\system32\mmcex.dll 2008-12-24 02:10:11 ----N---- C:\WINDOWS\system32\microsoft.managementconsole.dll 2008-12-24 02:10:11 ----N---- C:\WINDOWS\system32\mdmxsdk.dll 2008-12-24 02:10:11 ----A---- C:\WINDOWS\system32\mfc42.dll 2008-12-24 02:10:07 ----N---- C:\WINDOWS\system32\l2gpstore.dll 2008-12-24 02:10:07 ----N---- C:\WINDOWS\system32\kmsvc.dll 2008-12-24 02:10:06 ----N---- C:\WINDOWS\system32\kbdpash.dll 2008-12-24 02:10:06 ----N---- C:\WINDOWS\system32\kbdnepr.dll 2008-12-24 02:10:06 ----N---- C:\WINDOWS\system32\kbdiultn.dll 2008-12-24 02:10:06 ----N---- C:\WINDOWS\system32\kbdbhc.dll 2008-12-24 02:10:05 ----N---- C:\WINDOWS\system32\smtpapi.dll 2008-12-24 02:10:05 ----N---- C:\WINDOWS\system32\rwnh.dll 2008-12-24 02:10:05 ----N---- C:\WINDOWS\system32\comsdupd.exe 2008-12-24 02:10:04 ----N---- C:\WINDOWS\system32\hsfcisp2.dll 2008-12-24 02:10:03 ----N---- C:\WINDOWS\system32\faxpatch.exe 2008-12-24 02:10:03 ----A---- C:\WINDOWS\002803_.tmp 2008-12-24 02:10:02 ----N---- C:\WINDOWS\system32\eapsvc.dll 2008-12-24 02:10:02 ----N---- C:\WINDOWS\system32\eapqec.dll 2008-12-24 02:10:02 ----N---- C:\WINDOWS\system32\eappprxy.dll 2008-12-24 02:10:02 ----N---- C:\WINDOWS\system32\eapphost.dll 2008-12-24 02:10:02 ----N---- C:\WINDOWS\system32\eappgnui.dll 2008-12-24 02:10:02 ----N---- C:\WINDOWS\system32\eappcfg.dll 2008-12-24 02:10:02 ----N---- C:\WINDOWS\system32\eapp3hst.dll 2008-12-24 02:10:02 ----N---- C:\WINDOWS\system32\eapolqec.dll 2008-12-24 02:10:02 ----N---- C:\WINDOWS\system32\dot3ui.dll 2008-12-24 02:10:02 ----N---- C:\WINDOWS\system32\dot3svc.dll 2008-12-24 02:10:02 ----N---- C:\WINDOWS\system32\dot3msm.dll 2008-12-24 02:10:02 ----N---- C:\WINDOWS\system32\dot3gpclnt.dll 2008-12-24 02:10:02 ----N---- C:\WINDOWS\system32\dot3dlg.dll 2008-12-24 02:10:02 ----N---- C:\WINDOWS\system32\dot3cfg.dll 2008-12-24 02:10:02 ----N---- C:\WINDOWS\system32\dot3api.dll 2008-12-24 02:10:02 ----N---- C:\WINDOWS\system32\dimsroam.dll 2008-12-24 02:10:02 ----N---- C:\WINDOWS\system32\dimsntfy.dll 2008-12-24 02:10:01 ----N---- C:\WINDOWS\system32\dhcpqec.dll 2008-12-24 02:10:01 ----N---- C:\WINDOWS\system32\credssp.dll 2008-12-24 02:09:59 ----N---- C:\WINDOWS\system32\bitsprx4.dll 2008-12-24 02:09:59 ----N---- C:\WINDOWS\system32\azroles.dll 2008-12-24 02:09:58 ----N---- C:\WINDOWS\system32\ativtmxx.dll 2008-12-24 02:09:58 ----N---- C:\WINDOWS\system32\ati2dvaa.dll 2008-12-24 02:09:56 ----N---- C:\WINDOWS\system32\aaclient.dll 2008-12-24 01:38:30 ----A---- C:\WINDOWS\ODBC.INI 2008-12-24 01:38:25 ----A---- C:\WINDOWS\system32\mdimon.dll 2008-12-24 01:34:46 ----D---- C:\Program Files\Common Files\DESIGNER 2008-12-24 01:34:12 ----D---- C:\Program Files\Microsoft Works 2008-12-24 01:33:04 ----D---- C:\Program Files\Microsoft Visual Studio 2008-12-24 01:31:51 ----D---- C:\WINDOWS\SHELLNEW 2008-12-24 01:31:37 ----D---- C:\Program Files\Microsoft.NET 2008-12-24 01:31:37 ----D---- C:\Program Files\Microsoft Office 2008-12-24 01:17:00 ----A---- C:\WINDOWS\system32\rmoc3260.dll 2008-12-24 01:17:00 ----A---- C:\WINDOWS\system32\pndx5032.dll 2008-12-24 01:17:00 ----A---- C:\WINDOWS\system32\pndx5016.dll 2008-12-24 01:17:00 ----A---- C:\WINDOWS\system32\pncrt.dll 2008-12-24 01:16:56 ----A---- C:\WINDOWS\avisplitter.ini 2008-12-24 01:16:51 ----A---- C:\WINDOWS\system32\msvcr71.dll 2008-12-24 01:16:51 ----A---- C:\WINDOWS\system32\msvcp71.dll 2008-12-24 01:16:50 ----D---- C:\Program Files\K-Lite Codec Pack 2008-12-24 01:16:50 ----D---- C:\Documents and Settings\Deevill700\Dane aplikacji\Real 2008-12-24 01:16:50 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Real 2008-12-24 01:08:00 ----D---- C:\Program Files\IrfanView 2008-12-24 01:02:53 ----D---- C:\Documents and Settings\Deevill700\Dane aplikacji\foobar2000 2008-12-24 00:44:17 ----HDC---- C:\WINDOWS\$NtUninstallXPSEPSCLP$ 2008-12-24 00:43:59 ----D---- C:\WINDOWS\system32\pl-PL 2008-12-24 00:41:57 ----D---- C:\Program Files\MSBuild 2008-12-24 00:41:53 ----D---- C:\WINDOWS\system32\XPSViewer 2008-12-24 00:41:49 ----D---- C:\WINDOWS\system32\en-us 2008-12-24 00:41:48 ----D---- C:\Program Files\Reference Assemblies 2008-12-24 00:41:28 ----D---- C:\WINDOWS\system32\DllCache 2008-12-24 00:41:27 ----N---- C:\WINDOWS\system32\spmsg2.dll 2008-12-24 00:37:20 ----HDC---- C:\WINDOWS\$NtUninstallWIC$ 2008-12-24 00:37:12 ----D---- C:\Program Files\MSXML 6.0 2008-12-24 00:30:46 ----D---- C:\Documents and Settings\Deevill700\Dane aplikacji\Opera 2008-12-24 00:28:05 ----D---- C:\Documents and Settings\Deevill700\Dane aplikacji\Gadu-Gadu 2008-12-24 00:25:52 ----D---- C:\Program Files\Gadu-Gadu 2008-12-24 00:25:40 ----D---- C:\Program Files\Opera 2008-12-24 00:22:42 ----D---- C:\Program Files\SubEdit-Player 2008-12-24 00:22:17 ----D---- C:\Program Files\TimeOff 2008-12-24 00:19:11 ----D---- C:\Program Files\uTorrent 2008-12-24 00:19:03 ----D---- C:\Documents and Settings\Deevill700\Dane aplikacji\uTorrent 2008-12-24 00:18:49 ----D---- C:\Documents and Settings\Deevill700\Dane aplikacji\Macromedia 2008-12-24 00:18:48 ----D---- C:\Documents and Settings\Deevill700\Dane aplikacji\Adobe 2008-12-24 00:17:53 ----D---- C:\Documents and Settings\Deevill700\Dane aplikacji\Mozilla 2008-12-24 00:15:38 ----RSD---- C:\WINDOWS\assembly 2008-12-24 00:15:38 ----D---- C:\WINDOWS\Microsoft.NET 2008-12-24 00:15:36 ----D---- C:\WINDOWS\system32\URTTemp 2008-12-24 00:14:59 ----D---- C:\Program Files\Nero 2008-12-24 00:14:59 ----D---- C:\Program Files\Common Files\Nero 2008-12-24 00:14:59 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Nero 2008-12-24 00:13:14 ----D---- C:\Program Files\NAPI-PROJEKT 2008-12-24 00:11:47 ----D---- C:\Program Files\foobar2000 2008-12-24 00:11:34 ----D---- C:\Program Files\Mozilla Firefox 2008-12-24 00:10:30 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Adobe 2008-12-24 00:10:10 ----D---- C:\Program Files\Common Files\Adobe 2008-12-24 00:10:10 ----D---- C:\Program Files\Adobe 2008-12-24 00:07:02 ----D---- C:\WINDOWS\pss 2008-12-24 00:06:38 ----HD---- C:\ckis 2008-12-24 00:00:51 ----D---- C:\Program Files\Kaspersky Lab 2008-12-24 00:00:51 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-12-23 23:59:16 ----D---- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab Setup Files 2008-12-23 23:58:41 ----D---- C:\Documents and Settings\Deevill700\Dane aplikacji\WinRAR 2008-12-23 23:57:25 ----D---- C:\Program Files\WinRAR 2008-12-23 23:55:04 ----D---- C:\WINDOWS\system32\SoftwareDistribution 2008-12-23 21:50:51 ----A---- C:\WINDOWS\system32\h323log.txt 2008-12-23 21:48:14 ----A---- C:\WINDOWS\system32\ativvaxx.dll 2008-12-23 21:48:14 ----A---- C:\WINDOWS\system32\ati3duag.dll 2008-12-23 21:48:14 ----A---- C:\WINDOWS\system32\ati3d1ag.dll 2008-12-23 21:48:14 ----A---- C:\WINDOWS\system32\ati2dvag.dll 2008-12-23 21:48:14 ----A---- C:\WINDOWS\system32\ati2cqag.dll 2008-12-23 21:48:02 ----A---- C:\WINDOWS\system32\usbui.dll 2008-12-23 21:47:12 ----A---- C:\WINDOWS\imsins.BAK 2008-12-23 21:47:10 ----SHD---- C:\WINDOWS\Installer 2008-12-23 21:47:10 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2008-12-23 21:47:09 ----D---- C:\Program Files\Common Files\ODBC 2008-12-23 21:47:09 ----A---- C:\WINDOWS\ODBCINST.INI 2008-12-23 21:47:07 ----D---- C:\Program Files\Common Files\SpeechEngines 2008-12-23 21:47:06 ----RD---- C:\Program Files 2008-12-23 21:47:06 ----D---- C:\Program Files\Common Files\Microsoft Shared 2008-12-23 21:47:06 ----D---- C:\Program Files\Common Files 2008-12-23 21:47:00 ----RA---- C:\WINDOWS\system32\kbdtuq.dll 2008-12-23 21:47:00 ----RA---- C:\WINDOWS\system32\kbdtuf.dll 2008-12-23 21:47:00 ----RA---- C:\WINDOWS\system32\kbdazel.dll 2008-12-23 21:46:56 ----RA---- C:\WINDOWS\system32\kbdycc.dll 2008-12-23 21:46:56 ----RA---- C:\WINDOWS\system32\kbduzb.dll 2008-12-23 21:46:56 ----RA---- C:\WINDOWS\system32\kbdur.dll 2008-12-23 21:46:56 ----RA---- C:\WINDOWS\system32\kbdtat.dll 2008-12-23 21:46:56 ----RA---- C:\WINDOWS\system32\kbdru1.dll 2008-12-23 21:46:56 ----RA---- C:\WINDOWS\system32\kbdru.dll 2008-12-23 21:46:56 ----RA---- C:\WINDOWS\system32\kbdmon.dll 2008-12-23 21:46:56 ----RA---- C:\WINDOWS\system32\kbdkyr.dll 2008-12-23 21:46:56 ----RA---- C:\WINDOWS\system32\kbdkaz.dll 2008-12-23 21:46:56 ----RA---- C:\WINDOWS\system32\kbdbu.dll 2008-12-23 21:46:56 ----RA---- C:\WINDOWS\system32\kbdblr.dll 2008-12-23 21:46:56 ----RA---- C:\WINDOWS\system32\kbdaze.dll 2008-12-23 21:46:55 ----RA---- C:\WINDOWS\system32\kbdhept.dll 2008-12-23 21:46:55 ----RA---- C:\WINDOWS\system32\kbdhela3.dll 2008-12-23 21:46:55 ----RA---- C:\WINDOWS\system32\kbdhela2.dll 2008-12-23 21:46:55 ----RA---- C:\WINDOWS\system32\kbdhe319.dll 2008-12-23 21:46:55 ----RA---- C:\WINDOWS\system32\kbdhe220.dll 2008-12-23 21:46:55 ----RA---- C:\WINDOWS\system32\kbdhe.dll 2008-12-23 21:46:55 ----RA---- C:\WINDOWS\system32\kbdgkl.dll 2008-12-23 21:46:54 ----RA---- C:\WINDOWS\system32\kbdlv1.dll 2008-12-23 21:46:54 ----RA---- C:\WINDOWS\system32\kbdlv.dll 2008-12-23 21:46:54 ----RA---- C:\WINDOWS\system32\kbdlt1.dll 2008-12-23 21:46:54 ----RA---- C:\WINDOWS\system32\kbdlt.dll 2008-12-23 21:46:54 ----RA---- C:\WINDOWS\system32\kbdest.dll 2008-12-23 21:46:48 ----RA---- C:\WINDOWS\system32\kbdsl1.dll 2008-12-23 21:46:48 ----RA---- C:\WINDOWS\system32\kbdsl.dll 2008-12-23 21:46:48 ----RA---- C:\WINDOWS\system32\kbdro.dll 2008-12-23 21:46:47 ----RA---- C:\WINDOWS\system32\kbdycl.dll 2008-12-23 21:46:47 ----RA---- C:\WINDOWS\system32\kbdhu1.dll 2008-12-23 21:46:47 ----RA---- C:\WINDOWS\system32\kbdhu.dll 2008-12-23 21:46:47 ----RA---- C:\WINDOWS\system32\kbdcz2.dll 2008-12-23 21:46:47 ----RA---- C:\WINDOWS\system32\kbdcz1.dll 2008-12-23 21:46:47 ----RA---- C:\WINDOWS\system32\kbdcz.dll 2008-12-23 21:46:47 ----RA---- C:\WINDOWS\system32\kbdcr.dll 2008-12-23 21:46:47 ----RA---- C:\WINDOWS\system32\KBDAL.DLL 2008-12-23 21:46:47 ----A---- C:\WINDOWS\system32\irclass.dll 2008-12-23 21:46:47 ----A---- C:\WINDOWS\system32\dgsetup.dll 2008-12-23 21:46:47 ----A---- C:\WINDOWS\system32\dgrpsetu.dll 2008-12-23 21:46:46 ----A---- C:\WINDOWS\system32\spxcoins.dll 2008-12-23 21:46:46 ----A---- C:\WINDOWS\system32\EqnClass.Dll 2008-12-23 21:46:45 ----N---- C:\WINDOWS\system32\CONFIG.TMP 2008-12-23 21:46:45 ----A---- C:\WINDOWS\TASKMAN.EXE 2008-12-23 21:46:44 ----A---- C:\WINDOWS\system32\storprop.dll 2008-12-23 21:46:44 ----A---- C:\WINDOWS\system32\batt.dll 2008-12-23 21:46:44 ----A---- C:\WINDOWS\notepad.exe 2008-12-23 21:46:40 ----ASH---- C:\Documents and Settings\All Users\Dane aplikacji\desktop.ini 2008-12-23 21:46:18 ----RA---- C:\WINDOWS\SET8.tmp 2008-12-23 21:46:16 ----RA---- C:\WINDOWS\SET4.tmp 2008-12-23 21:46:15 ----RA---- C:\WINDOWS\SET3.tmp 2008-12-23 21:46:10 ----D---- C:\WINDOWS\system32\CatRoot2 2008-12-23 21:46:10 ----D---- C:\WINDOWS\system32\CatRoot 2008-12-23 21:46:05 ----SD---- C:\Documents and Settings\All Users\Dane aplikacji\Microsoft 2008-12-23 21:45:53 ----A---- C:\WINDOWS\setuplog.txt 2008-12-23 21:45:51 ----D---- C:\Documents and Settings 2008-12-23 21:45:50 ----SHD---- C:\System Volume Information 2008-12-23 21:44:45 ----SH---- C:\boot.ini 2008-12-23 21:42:06 ----D---- C:\WINDOWS\OemDir 2008-12-23 21:41:57 ----RSD---- C:\WINDOWS\Fonts 2008-12-23 21:41:57 ----RD---- C:\WINDOWS\Web 2008-12-23 21:41:57 ----HD---- C:\WINDOWS\inf 2008-12-23 21:41:57 ----D---- C:\WINDOWS\WinSxS 2008-12-23 21:41:57 ----D---- C:\WINDOWS\twain_32 2008-12-23 21:41:57 ----D---- C:\WINDOWS\Temp 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\wins 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\wbem 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\usmt 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\spool 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\ShellExt 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\Setup 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\ras 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\PreInstall 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\oobe 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\npp 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\mui 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\inetsrv 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\IME 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\icsxml 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\ias 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\export 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\drivers 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\dhcp 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\config 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\3com_dmi 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\3076 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\2052 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\1054 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\1045 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\1042 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\1041 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\1037 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\1033 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\1031 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\1028 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32\1025 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system32 2008-12-23 21:41:57 ----D---- C:\WINDOWS\system 2008-12-23 21:41:57 ----D---- C:\WINDOWS\security 2008-12-23 21:41:57 ----D---- C:\WINDOWS\Resources 2008-12-23 21:41:57 ----D---- C:\WINDOWS\repair 2008-12-23 21:41:57 ----D---- C:\WINDOWS\Provisioning 2008-12-23 21:41:57 ----D---- C:\WINDOWS\PeerNet 2008-12-23 21:41:57 ----D---- C:\WINDOWS\pchealth 2008-12-23 21:41:57 ----D---- C:\WINDOWS\mui 2008-12-23 21:41:57 ----D---- C:\WINDOWS\msapps 2008-12-23 21:41:57 ----D---- C:\WINDOWS\msagent 2008-12-23 21:41:57 ----D---- C:\WINDOWS\Media 2008-12-23 21:41:57 ----D---- C:\WINDOWS\java 2008-12-23 21:41:57 ----D---- C:\WINDOWS\ime 2008-12-23 21:41:57 ----D---- C:\WINDOWS\Help 2008-12-23 21:41:57 ----D---- C:\WINDOWS\ehome 2008-12-23 21:41:57 ----D---- C:\WINDOWS\Driver Cache 2008-12-23 21:41:57 ----D---- C:\WINDOWS\Debug 2008-12-23 21:41:57 ----D---- C:\WINDOWS\Cursors 2008-12-23 21:41:57 ----D---- C:\WINDOWS\Connection Wizard 2008-12-23 21:41:57 ----D---- C:\WINDOWS\Config 2008-12-23 21:41:57 ----D---- C:\WINDOWS\AppPatch 2008-12-23 21:41:57 ----D---- C:\WINDOWS\addins 2008-12-23 21:41:57 ----D---- C:\WINDOWS 2008-12-23 21:22:35 ----SHD---- C:\RECYCLER 2008-12-23 21:22:00 ----D---- C:\WINDOWS\system32\appmgmt 2008-12-23 21:08:16 ----RA---- C:\WINDOWS\system32\a3d.dll 2008-12-23 21:08:15 ----A---- C:\WINDOWS\system32\ksuser.dll 2008-12-23 21:06:45 ----A---- C:\WINDOWS\Ascd_tmp.ini 2008-12-23 20:58:20 ----D---- C:\Documents and Settings\Deevill700\Dane aplikacji\Identities 2008-12-23 20:58:19 ----HD---- C:\Program Files\Uninstall Information 2008-12-23 20:58:13 ----SD---- C:\Documents and Settings\Deevill700\Dane aplikacji\Microsoft 2008-12-23 20:58:13 ----ASH---- C:\Documents and Settings\Deevill700\Dane aplikacji\desktop.ini 2008-12-23 20:57:42 ----D---- C:\WINDOWS\SoftwareDistribution 2008-12-23 20:57:41 ----SD---- C:\WINDOWS\system32\Microsoft 2008-12-23 20:57:41 ----A---- C:\WINDOWS\SchedLgU.Txt 2008-12-23 20:56:02 ----A---- C:\WINDOWS\system32\spupdsvc.exe 2008-12-23 20:55:54 ----N---- C:\WINDOWS\system32\spmsg.dll 2008-12-23 20:55:51 ----HD---- C:\WINDOWS\$hf_mig$ 2008-12-23 20:55:41 ----A---- C:\WINDOWS\control.ini 2008-12-23 20:55:41 ----A---- C:\AUTOEXEC.BAT 2008-12-23 20:55:29 ----A---- C:\WINDOWS\OEWABLog.txt 2008-12-23 20:55:27 ----A---- C:\WINDOWS\system32\mapi32.dll 2008-12-23 20:54:43 ----SD---- C:\WINDOWS\Downloaded Program Files 2008-12-23 20:54:43 ----RD---- C:\WINDOWS\Offline Web Pages 2008-12-23 20:54:43 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest 2008-12-23 20:54:37 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest 2008-12-23 20:54:33 ----HD---- C:\Program Files\WindowsUpdate 2008-12-23 20:54:31 ----D---- C:\Program Files\Usługi online 2008-12-23 20:54:18 ----D---- C:\WINDOWS\system32\DirectX 2008-12-23 20:54:00 ----A---- C:\WINDOWS\system32\atrace.dll 2008-12-23 20:53:54 ----A---- C:\WINDOWS\system32\desktop.ini 2008-12-23 20:53:54 ----A---- C:\WINDOWS\desktop.ini 2008-12-23 20:53:49 ----A---- C:\WINDOWS\system32\nmevtmsg.dll 2008-12-23 20:53:46 ----D---- C:\Program Files\Common Files\Services 2008-12-23 20:53:46 ----A---- C:\WINDOWS\system32\acctres.dll 2008-12-23 20:53:44 ----SD---- C:\WINDOWS\Tasks 2008-12-23 20:53:44 ----A---- C:\WINDOWS\system32\icfgnt5.dll 2008-12-23 20:53:43 ----D---- C:\Program Files\Common Files\MSSoap 2008-12-23 20:53:40 ----D---- C:\WINDOWS\system32\Macromed 2008-12-23 20:53:40 ----D---- C:\WINDOWS\srchasst 2008-12-23 20:53:37 ----A---- C:\WINDOWS\system32\wuweb.dll 2008-12-23 20:53:37 ----A---- C:\WINDOWS\system32\wups.dll 2008-12-23 20:53:37 ----A---- C:\WINDOWS\system32\wucltui.dll 2008-12-23 20:53:37 ----A---- C:\WINDOWS\system32\wuauserv.dll 2008-12-23 20:53:37 ----A---- C:\WINDOWS\system32\wuaueng1.dll 2008-12-23 20:53:37 ----A---- C:\WINDOWS\system32\wuaueng.dll 2008-12-23 20:53:37 ----A---- C:\WINDOWS\system32\wuauclt1.exe 2008-12-23 20:53:37 ----A---- C:\WINDOWS\system32\wuauclt.exe 2008-12-23 20:53:37 ----A---- C:\WINDOWS\system32\wuapi.dll 2008-12-23 20:53:36 ----A---- C:\WINDOWS\system32\qmgrprxy.dll 2008-12-23 20:53:36 ----A---- C:\WINDOWS\system32\qmgr.dll 2008-12-23 20:53:36 ----A---- C:\WINDOWS\system32\bitsprx3.dll 2008-12-23 20:53:36 ----A---- C:\WINDOWS\system32\bitsprx2.dll 2008-12-23 20:53:33 ----D---- C:\Program Files\Movie Maker 2008-12-23 20:53:28 ----A---- C:\WINDOWS\system32\safrslv.dll 2008-12-23 20:53:28 ----A---- C:\WINDOWS\system32\safrdm.dll 2008-12-23 20:53:28 ----A---- C:\WINDOWS\system32\safrcdlg.dll 2008-12-23 20:53:28 ----A---- C:\WINDOWS\system32\racpldlg.dll 2008-12-23 20:53:25 ----D---- C:\WINDOWS\system32\Restore 2008-12-23 20:53:25 ----A---- C:\WINDOWS\system32\srsvc.dll 2008-12-23 20:53:25 ----A---- C:\WINDOWS\system32\srrstr.dll 2008-12-23 20:53:25 ----A---- C:\WINDOWS\system32\srclient.dll 2008-12-23 20:53:25 ----A---- C:\WINDOWS\system32\fltmc.exe 2008-12-23 20:53:25 ----A---- C:\WINDOWS\system32\fltlib.dll 2008-12-23 20:53:24 ----A---- C:\WINDOWS\system32\nmmkcert.dll 2008-12-23 20:53:24 ----A---- C:\WINDOWS\system32\msconf.dll 2008-12-23 20:53:24 ----A---- C:\WINDOWS\system32\mnmsrvc.exe 2008-12-23 20:53:24 ----A---- C:\WINDOWS\system32\mnmdd.dll 2008-12-23 20:53:24 ----A---- C:\WINDOWS\system32\isrdbg32.dll 2008-12-23 20:53:24 ----A---- C:\WINDOWS\system32\ils.dll 2008-12-23 20:53:22 ----D---- C:\Program Files\NetMeeting 2008-12-23 20:53:22 ----A---- C:\WINDOWS\system32\msoert2.dll 2008-12-23 20:53:22 ----A---- C:\WINDOWS\system32\msoeacct.dll 2008-12-23 20:53:21 ----A---- C:\WINDOWS\system32\inetres.dll 2008-12-23 20:53:21 ----A---- C:\WINDOWS\system32\inetcomm.dll 2008-12-23 20:53:20 ----D---- C:\Program Files\Outlook Express 2008-12-23 20:53:20 ----A---- C:\WINDOWS\system32\schedsvc.dll 2008-12-23 20:53:20 ----A---- C:\WINDOWS\system32\mstinit.exe 2008-12-23 20:53:19 ----A---- C:\WINDOWS\system32\mstask.dll 2008-12-23 20:53:19 ----A---- C:\WINDOWS\system32\isign32.dll 2008-12-23 20:53:19 ----A---- C:\WINDOWS\system32\inetcfg.dll 2008-12-23 20:53:19 ----A---- C:\WINDOWS\system32\icwphbk.dll 2008-12-23 20:53:19 ----A---- C:\WINDOWS\system32\icwdial.dll 2008-12-23 20:53:14 ----D---- C:\Program Files\Internet Explorer 2008-12-23 20:53:14 ----D---- C:\Program Files\Common Files\System 2008-12-23 20:52:47 ----D---- C:\Program Files\ComPlus Applications 2008-12-23 20:52:46 ----A---- C:\WINDOWS\vbaddin.ini 2008-12-23 20:52:46 ----A---- C:\WINDOWS\vb.ini 2008-12-23 20:52:44 ----D---- C:\WINDOWS\Registration 2008-12-23 20:52:40 ----D---- C:\Program Files\Windows Media Player 2008-12-23 20:52:37 ----D---- C:\Program Files\Messenger 2008-12-23 20:52:34 ----A---- C:\WINDOWS\system32\write.exe 2008-12-23 20:52:26 ----A---- C:\WINDOWS\system32\sndvol32.exe 2008-12-23 20:52:26 ----A---- C:\WINDOWS\system32\hticons.dll 2008-12-23 20:52:26 ----A---- C:\WINDOWS\system32\avwav.dll 2008-12-23 20:52:26 ----A---- C:\WINDOWS\system32\avtapi.dll 2008-12-23 20:52:26 ----A---- C:\WINDOWS\system32\avmeter.dll 2008-12-23 20:52:25 ----A---- C:\WINDOWS\system32\winchat.exe 2008-12-23 20:52:20 ----A---- C:\WINDOWS\system32\sol.exe 2008-12-23 20:52:20 ----A---- C:\WINDOWS\system32\getuname.dll 2008-12-23 20:52:20 ----A---- C:\WINDOWS\system32\charmap.exe 2008-12-23 20:52:20 ----A---- C:\WINDOWS\system32\calc.exe 2008-12-23 20:52:19 ----A---- C:\WINDOWS\system32\winmine.exe 2008-12-23 20:52:19 ----A---- C:\WINDOWS\system32\usrlogon.cmd 2008-12-23 20:52:19 ----A---- C:\WINDOWS\system32\tsshutdn.exe 2008-12-23 20:52:19 ----A---- C:\WINDOWS\system32\tslabels.ini 2008-12-23 20:52:19 ----A---- C:\WINDOWS\system32\tskill.exe 2008-12-23 20:52:19 ----A---- C:\WINDOWS\system32\tsdiscon.exe 2008-12-23 20:52:19 ----A---- C:\WINDOWS\system32\tscon.exe 2008-12-23 20:52:19 ----A---- C:\WINDOWS\system32\reset.exe 2008-12-23 20:52:19 ----A---- C:\WINDOWS\system32\mshearts.exe 2008-12-23 20:52:19 ----A---- C:\WINDOWS\system32\freecell.exe 2008-12-23 20:52:18 ----A---- C:\WINDOWS\system32\shadow.exe 2008-12-23 20:52:18 ----A---- C:\WINDOWS\system32\rwinsta.exe 2008-12-23 20:52:18 ----A---- C:\WINDOWS\system32\regini.exe 2008-12-23 20:52:18 ----A---- C:\WINDOWS\system32\rdpcfgex.dll 2008-12-23 20:52:18 ----A---- C:\WINDOWS\system32\qwinsta.exe 2008-12-23 20:52:18 ----A---- C:\WINDOWS\system32\qappsrv.exe 2008-12-23 20:52:18 ----A---- C:\WINDOWS\system32\msg.exe 2008-12-23 20:52:18 ----A---- C:\WINDOWS\system32\msdtcprf.ini 2008-12-23 20:52:18 ----A---- C:\WINDOWS\system32\logoff.exe 2008-12-23 20:52:18 ----A---- C:\WINDOWS\system32\cdmodem.dll 2008-12-23 20:52:17 ----A---- C:\WINDOWS\system32\stclient.dll 2008-12-23 20:52:17 ----A---- C:\WINDOWS\system32\mtxlegih.dll 2008-12-23 20:52:17 ----A---- C:\WINDOWS\system32\mtxex.dll 2008-12-23 20:52:17 ----A---- C:\WINDOWS\system32\mtxdm.dll 2008-12-23 20:52:17 ----A---- C:\WINDOWS\system32\dcomcnfg.exe 2008-12-23 20:52:17 ----A---- C:\WINDOWS\system32\comsnap.dll 2008-12-23 20:52:17 ----A---- C:\WINDOWS\system32\comrepl.dll 2008-12-23 20:52:17 ----A---- C:\WINDOWS\system32\comaddin.dll 2008-12-23 20:52:12 ----A---- C:\WINDOWS\system32\wmimgmt.msc 2008-12-23 20:52:12 ----A---- C:\WINDOWS\system32\accwiz.exe 2008-12-23 20:52:11 ----D---- C:\Program Files\Windows NT 2008-12-23 20:52:11 ----A---- C:\WINDOWS\system32\sndrec32.exe 2008-12-23 20:52:11 ----A---- C:\WINDOWS\system32\mspaint.exe 2008-12-23 20:52:11 ----A---- C:\WINDOWS\system32\mplay32.exe 2008-12-23 20:52:11 ----A---- C:\WINDOWS\system32\hypertrm.dll 2008-12-23 20:52:10 ----A---- C:\WINDOWS\system32\tscfgwmi.dll 2008-12-23 20:52:10 ----A---- C:\WINDOWS\system32\spider.exe 2008-12-23 20:52:10 ----A---- C:\WINDOWS\system32\clipbrd.exe 2008-12-23 20:52:09 ----A---- C:\WINDOWS\system32\tscupgrd.exe 2008-12-23 20:52:09 ----A---- C:\WINDOWS\system32\termsrv.dll 2008-12-23 20:52:09 ----A---- C:\WINDOWS\system32\sessmgr.exe 2008-12-23 20:52:09 ----A---- C:\WINDOWS\system32\remotepg.dll 2008-12-23 20:52:09 ----A---- C:\WINDOWS\system32\rdshost.exe 2008-12-23 20:52:09 ----A---- C:\WINDOWS\system32\rdsaddin.exe 2008-12-23 20:52:09 ----A---- C:\WINDOWS\system32\rdpwsx.dll 2008-12-23 20:52:09 ----A---- C:\WINDOWS\system32\rdpsnd.dll 2008-12-23 20:52:09 ----A---- C:\WINDOWS\system32\rdpclip.exe 2008-12-23 20:52:09 ----A---- C:\WINDOWS\system32\rdchost.dll 2008-12-23 20:52:09 ----A---- C:\WINDOWS\system32\mstscax.dll 2008-12-23 20:52:09 ----A---- C:\WINDOWS\system32\mstsc.exe 2008-12-23 20:52:08 ----D---- C:\WINDOWS\system32\MsDtc 2008-12-23 20:52:08 ----A---- C:\WINDOWS\system32\qprocess.exe 2008-12-23 20:52:08 ----A---- C:\WINDOWS\system32\mtxoci.dll 2008-12-23 20:52:08 ----A---- C:\WINDOWS\system32\msdtcuiu.dll 2008-12-23 20:52:08 ----A---- C:\WINDOWS\system32\msdtctm.dll 2008-12-23 20:52:08 ----A---- C:\WINDOWS\system32\msdtcprx.dll 2008-12-23 20:52:08 ----A---- C:\WINDOWS\system32\icaapi.dll 2008-12-23 20:52:08 ----A---- C:\WINDOWS\system32\cfgbkend.dll 2008-12-23 20:52:07 ----D---- C:\WINDOWS\system32\Com 2008-12-23 20:52:07 ----A---- C:\WINDOWS\system32\xolehlp.dll 2008-12-23 20:52:07 ----A---- C:\WINDOWS\system32\msdtclog.dll 2008-12-23 20:52:07 ----A---- C:\WINDOWS\system32\msdtc.exe 2008-12-23 20:52:07 ----A---- C:\WINDOWS\system32\colbact.dll 2008-12-23 20:52:06 ----A---- C:\WINDOWS\system32\clbcatex.dll 2008-12-23 20:52:06 ----A---- C:\WINDOWS\system32\catsrvut.dll 2008-12-23 20:52:06 ----A---- C:\WINDOWS\system32\catsrvps.dll 2008-12-23 20:52:06 ----A---- C:\WINDOWS\system32\catsrv.dll 2008-12-23 20:52:05 ----A---- C:\WINDOWS\system32\comuid.dll 2008-12-23 20:52:05 ----A---- C:\WINDOWS\system32\comsvcs.dll 2008-12-23 20:52:05 ----A---- C:\WINDOWS\system32\clbcatq.dll 2008-12-23 20:52:00 ----A---- C:\WINDOWS\system32\servdeps.dll 2008-12-23 20:52:00 ----A---- C:\WINDOWS\system32\mmfutil.dll 2008-12-23 20:52:00 ----A---- C:\WINDOWS\system32\licwmi.dll 2008-12-23 20:52:00 ----A---- C:\WINDOWS\system32\cmprops.dll 2008-12-01 21:52:52 ----A---- C:\WINDOWS\system32\ATIDEMGX.dll 2008-12-01 21:46:17 ----A---- C:\WINDOWS\system32\atioglxx.dll 2008-12-01 21:41:02 ----A---- C:\WINDOWS\system32\atipdlxx.dll 2008-12-01 21:40:49 ----A---- C:\WINDOWS\system32\Oemdspif.dll 2008-12-01 21:40:41 ----A---- C:\WINDOWS\system32\Ati2mdxx.exe 2008-12-01 21:40:32 ----A---- C:\WINDOWS\system32\ati2edxx.dll 2008-12-01 21:40:14 ----A---- C:\WINDOWS\system32\ati2evxx.dll 2008-12-01 21:38:42 ----A---- C:\WINDOWS\system32\ati2evxx.exe 2008-12-01 21:37:21 ----A---- C:\WINDOWS\system32\ATIDDC.DLL 2008-12-01 21:19:53 ----A---- C:\WINDOWS\system32\atiiiexx.dll 2008-12-01 20:57:33 ----A---- C:\WINDOWS\system32\amdpcom32.dll 2008-12-01 20:53:36 ----A---- C:\WINDOWS\system32\atikvmag.dll 2008-12-01 20:53:16 ----A---- C:\WINDOWS\system32\amdcalrt.dll 2008-12-01 20:53:07 ----A---- C:\WINDOWS\system32\amdcalcl.dll 2008-12-01 20:52:12 ----A---- C:\WINDOWS\system32\atiadlxx.dll 2008-12-01 20:52:02 ----A---- C:\WINDOWS\system32\atitvo32.dll 2008-12-01 20:50:52 ----A---- C:\WINDOWS\system32\atiok3x2.dll 2008-12-01 20:50:36 ----A---- C:\WINDOWS\system32\Amdcaldd.dll ======List of files/folders modified in the last 1 months====== 2008-12-13 07:39:17 ----A---- C:\WINDOWS\system32\mshtml.dll ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 AmdK7;Sterownik procesora AMD K7; C:\WINDOWS\system32\DRIVERS\amdk7.sys [2008-04-14 41856] R1 klif;Klif; \??\C:\WINDOWS\system32\drivers\klif.sys [] R3 aeaudio;aeaudio; C:\WINDOWS\system32\drivers\aeaudio.sys [2002-04-01 4816] R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-12-01 3452928] R3 klim5;Kaspersky Anti-Virus NDIS Filter; C:\WINDOWS\system32\DRIVERS\klim5.sys [2007-12-13 24592] R3 smwdm;smwdm; C:\WINDOWS\system32\drivers\smwdm.sys [2003-07-15 578368] R3 usbehci;Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208] R3 usbhub;Koncentrator z obsługą USB2; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520] R3 usbuhci;Sterownik Miniport uniwersalnego kontrolera hosta USB Microsoft; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608] R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2004-08-19 189568] S3 USBSTOR;Sterownik magazynu masowego USB; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-12-01 598016] R2 AVP;Kaspersky Internet Security 7.0; C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe [2007-12-18 227856] R2 JavaQuickStarterService;Java Quick Starter; C:\Program Files\Java\jre6\bin\jqs.exe [2008-12-24 152984] R2 MDM;Machine Debug Manager; C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-03-19 335872] S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2008-12-01 593920] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144] S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864] S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256] S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2003-07-28 89136] S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880] -----------------EOF-----------------

HJT

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 15:49, on 2008-12-31 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16762) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\Explorer.EXE C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\Gadu-Gadu\gg.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [StartCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Ustawienia lokalne\Temp" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_02] rundll32 advpack.dll,DelNodeRunDLL32 "%SystemRoot%\System32\dllcache" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] cmd.exe /c md "%SystemRoot%\System32\dllcache" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_04] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_05] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Ustawienia lokalne\Temp" (User 'USŁUGA SIECIOWA') O8 - Extra context menu item: Dodaj do blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\ie_banner_deny.htm O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~1\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Subskrybuj w RssSpeed - file://C:\Program Files\RssSpeed\add_feed.htm O9 - Extra button: Statystyki dla ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{A49A50FB-70B9-4CD4-8CEC-B00332EB06F5}: NameServer = 194.204.159.1,192.168.75.1 O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe -- End of file - 5611 bytes

**Posty:** 8001 · przez **Okocza** 01 Sty 2009, 14:50

Deevill700, a ja bym się skłaniał do skoku napięcia które spaliło coś na płycie głównej, sprawdź czy nie masz napuchniętych kondensatorków, czy nie ma śladów spalenizny nigdzie.

**Posty:** 5 · przez **Deevill700** 01 Sty 2009, 15:12

jak tak ogladalismy plyte z tata (elektrykiem) to na pierwszy rzut oka nic nie widac, w tej sprawie jutro rano jade do goscia ktory sie na tym lepiej zna i sprawdzimy jeszcze ewentualnie procek

rozumiem ze w logach nic nie ma??;>

**Posty:** 8001 · przez **Okocza** 01 Sty 2009, 15:25

Kod: Zaznacz wszystko: O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Ustawienia lokalne\Temp" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_02] rundll32 advpack.dll,DelNodeRunDLL32 "%SystemRoot%\System32\dllcache" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_03] cmd.exe /c md "%SystemRoot%\System32\dllcache" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_04] cmd.exe /C move /Y "%SystemRoot%\System32\syssetub.dll" "%SystemRoot%\System32\syssetup.dll" (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_05] rundll32 advpack.dll,LaunchINFSection nlite.inf,nLiteReg (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-19\..\RunOnce: [nlpo_06] rundll32 advpack.dll,LaunchINFSection nlite.inf,S (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\RunOnce: [nlpo_01] cmd.exe /c md "%USERPROFILE%\Ustawienia lokalne\Temp" (User 'USŁUGA SIECIOWA')

fix w hj

---------------------

Wklej w notatnik:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\zip.exe C:\WINDOWS\VFIND.exe C:\WINDOWS\SWXCACLS.exe C:\WINDOWS\SWSC.exe C:\WINDOWS\SWREG.exe C:\WINDOWS\sed.exe C:\WINDOWS\NIRCMD.exe C:\WINDOWS\grep.exe C:\WINDOWS\fdsv.exe C:\WINDOWS\system32\CF698.exe C:\WINDOWS\system32\CF2759.exe C:\WINDOWS\system32\CF2122.exe C:\WINDOWS\system32\CF1417.exe C:\WINDOWS\002803_.tmp

zapisz jako CFScript.txt i przeciągnij na combofix.exe

**Posty:** 5 · przez **Deevill700** 01 Sty 2009, 16:29

O ile w HJT wszystko przebieglo pomyslnie, combofix wylacza kompa, pokazuje sie:

"Prosze czekac.
Combofix rozpoczyna dzialanie."

stoi na tym ok 20 sek i sie wylacza...

jeszcze jakies pomysly??

Combofix'a robilem po hjt...

Wszystkie pomysly mile widziane bo komp na studia jest mi niezbedny i musze go jakos zrobic ;/

**Posty:** 8001 · przez **Okocza** 01 Sty 2009, 16:57

Pobierz i uruchom narzędzie
The Avenger
Zaznacz opcję Input script manually i kliknij na Lupkę z prawej strony. W okienku, które się otworzy wklejasz:

Kod: Zaznacz wszystko: Files to delete: C:\WINDOWS\zip.exe C:\WINDOWS\VFIND.exe C:\WINDOWS\SWXCACLS.exe C:\WINDOWS\SWSC.exe C:\WINDOWS\SWREG.exe C:\WINDOWS\sed.exe C:\WINDOWS\NIRCMD.exe C:\WINDOWS\grep.exe C:\WINDOWS\fdsv.exe C:\WINDOWS\system32\CF698.exe C:\WINDOWS\system32\CF2759.exe C:\WINDOWS\system32\CF2122.exe C:\WINDOWS\system32\CF1417.exe C:\WINDOWS\002803_.tmp

Klikasz Done, a następnie zielone światełko i zgadzasz się na restart klikając OK.

Kasujesz ręcznie z dysku plik: C:\Avenger\backup.zip i wklejasz na forum raport: C:\avenger.txt + log z combofixa

**Posty:** 5 · przez **Deevill700** 01 Sty 2009, 17:45

Kod: Zaznacz wszystko: Logfile of The Avenger Version 2.0, (c) by Swandog46 http://swandog46.geekstogo.com Platform: Windows XP ******************* Script file opened successfully. Script file read successfully. Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: Rootkit scan active. No rootkits found! File "C:\WINDOWS\zip.exe" deleted successfully. File "C:\WINDOWS\VFIND.exe" deleted successfully. File "C:\WINDOWS\SWXCACLS.exe" deleted successfully. File "C:\WINDOWS\SWSC.exe" deleted successfully. File "C:\WINDOWS\SWREG.exe" deleted successfully. File "C:\WINDOWS\sed.exe" deleted successfully. File "C:\WINDOWS\NIRCMD.exe" deleted successfully. File "C:\WINDOWS\grep.exe" deleted successfully. File "C:\WINDOWS\fdsv.exe" deleted successfully. File "C:\WINDOWS\system32\CF698.exe" deleted successfully. File "C:\WINDOWS\system32\CF2759.exe" deleted successfully. File "C:\WINDOWS\system32\CF2122.exe" deleted successfully. File "C:\WINDOWS\system32\CF1417.exe" deleted successfully. File "C:\WINDOWS\002803_.tmp" deleted successfully. Completed script processing. ******************* Finished! Terminate.

raport z avengera, zaraz uruchamiam combofix'a i edytuje tego posta

EDIT: po wlaczeniu combofix'a komputer sie wylaczyl, ale tym razem po paru ok 7 a nie 20 sek ;/

**Posty:** 8001 · przez **Okocza** 01 Sty 2009, 18:03

Wykonaj to co jest podane w tym temacie

1. tym programem przejdź komputer
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5. Przeskanuj komputer pod względem Trojanów tym programem
6. Wstaw na forum screen z zakładki uruchamianie (start – uruchom – msconfig – uruchamianie) może uda się cos wyrzucic stamtąd

**Posty:** 5 · przez **Deevill700** 01 Sty 2009, 19:49

All done, czekamy czy sie wylaczy

I screen:

**Posty:** 8001 · przez **Okocza** 01 Sty 2009, 19:54

wszystko, powinno być ok

Kto jest na forum