Rootkit i gasnący komputer proszę o pomoc

**Posty:** 8 · przez **bartosz121** 19 Lis 2008, 02:48

Mam dwa problemy pierwszy to taki że komputer co jakiś czas sam mi się wyłącza po prostu w różnych odstępach czasu restartuje co 1 godzinę 2 różnie bywa a drugi problem to taki że program antywirusowy AVG wykrył ukryty sterownik i klasyfikuje go jako rootkit wygląda to u mnie tak F:\WINDOWS\System32\Drivers\ak83Ioii.SYS i pisze obiekt jest ukryty a ja jak chcę go usunąć to AVG prosi o restart komputera po czym jak skanuję znów go wykrywa nie potrafi usunąć nie wiem czy oba problemy są powiązane ale mam dość wyłączającego się kompa ostatnio w czasie nagrywania płyty wiem że umiecie pomóc z góry dziękuję
i umieszczam loga z hj
bartosz121

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 01:31:36, on 2008-11-19 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: F:\WINDOWS\System32\smss.exe F:\WINDOWS\system32\winlogon.exe F:\WINDOWS\system32\services.exe F:\WINDOWS\system32\lsass.exe F:\WINDOWS\system32\svchost.exe F:\WINDOWS\System32\svchost.exe F:\Program Files\Ahead\InCD\InCDsrv.exe F:\WINDOWS\system32\spoolsv.exe F:\WINDOWS\Explorer.EXE F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe E:\avg\ANTYWI~1\avgwdsvc.exe E:\avg\ANTYWI~1\avgfws8.exe F:\WINDOWS\system32\svchost.exe F:\Program Files\Common Files\LightScribe\LSSrvc.exe F:\WINDOWS\System32\svchost.exe F:\WINDOWS\system32\nvsvc32.exe F:\WINDOWS\System32\svchost.exe E:\avg\ANTYWI~1\avgam.exe F:\WINDOWS\RTHDCPL.EXE F:\WINDOWS\system32\PSIService.exe F:\WINDOWS\system32\RUNDLL32.EXE F:\Program Files\WinFast\WFTVFM\WFWIZ.exe E:\avg\ANTYWI~1\avgrsx.exe F:\Program Files\lg_fwupdate\fwupdate.exe F:\WINDOWS\system32\svchost.exe F:\Program Files\HP\HP Software Update\HPWuSchd2.exe F:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe E:\avg\ANTYWI~1\avgnsx.exe F:\Program Files\Java\jre1.6.0_07\bin\jusched.exe F:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe E:\avg\ANTYWI~1\avgtray.exe F:\WINDOWS\system32\ctfmon.exe F:\Program Files\Gigabyte\ET5\GUI.exe F:\programy Bartek\damon tools\DAEMON Tools Lite\daemon.exe F:\Program Files\Mozilla Firefox\firefox.exe F:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - F:\Program Files\HP\Smart Web Printing\hpswp_printenhancer.dll O2 - BHO: HP Print Clips - {053F9267-DC04-4294-A72C-58F732D338C0} - F:\Program Files\HP\Smart Web Printing\hpswp_framework.dll O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - F:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - F:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - E:\avg\antywirusowe\avgssie.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - F:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - E:\avg\antywirusowe\avgtoolbar.dll O3 - Toolbar: AVG Security Toolbar - {A057A204-BACC-4D26-9990-79A187E2698E} - E:\avg\antywirusowe\avgtoolbar.dll O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [JMB36X IDE Setup] F:\WINDOWS\JM\JMInsIDE.exe O4 - HKLM\..\Run: [36X Raid Configurer] F:\WINDOWS\system32\JMRaidSetup.exe boot O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE F:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [WinFast Schedule] F:\Program Files\WinFast\WFTVFM\WFWIZ.exe O4 - HKLM\..\Run: [NeroFilterCheck] F:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [LGODDFU] "F:\Program Files\lg_fwupdate\fwupdate.exe" O4 - HKLM\..\Run: [HP Software Update] F:\Program Files\HP\HP Software Update\HPWuSchd2.exe O4 - HKLM\..\Run: [EasyTuneV] F:\Program Files\Gigabyte\ET5\ETcall.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [GrooveMonitor] "F:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" O4 - HKLM\..\Run: [AVG8_TRAY] E:\avg\ANTYWI~1\avgtray.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKCU\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [DAEMON Tools Lite] "F:\programy Bartek\damon tools\DAEMON Tools Lite\daemon.exe" -autorun O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] F:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://F:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O8 - Extra context menu item: Pobierz wszystkie VIdeo za pomocą BitComet - res://F:\Program Files\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Pobierz wszystko za pomocą BitComet - res://F:\Program Files\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Pobierz za pomocą BitComet - res://F:\Program Files\BitComet\BitComet.exe/AddLink.htm O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - F:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Run WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - F:\programy Bartek\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra 'Tools' menuitem: Launch WinHTTrack - {36ECAF82-3300-8F84-092E-AFF36D6C7040} - F:\programy Bartek\WinHTTrack\WinHTTrackIEBar.dll O9 - Extra button: Kolekcja wycinków HP - {58ECB495-38F0-49cb-A538-10282ABF65E7} - F:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll O9 - Extra button: Zaznaczanie HP Smart - {700259D7-1666-479a-93B1-3250410481E8} - F:\Program Files\HP\Smart Web Printing\hpswp_extensions.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://F:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing) O12 - Plugin for .spop: F:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - F:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - E:\avg\antywirusowe\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: Apple Mobile Device - Apple Inc. - F:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - E:\avg\ANTYWI~1\avgwdsvc.exe O23 - Service: AVG8 Firewall (avgfws8) - AVG Technologies CZ, s.r.o. - E:\avg\ANTYWI~1\avgfws8.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: InCD Helper (InCDsrv) - Nero AG - F:\Program Files\Ahead\InCD\InCDsrv.exe O23 - Service: Usługa iPod (iPod Service) - Apple Inc. - F:\Program Files\iPod\bin\iPodService.exe O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - F:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINDOWS\system32\nvsvc32.exe O23 - Service: ProtexisLicensing - Unknown owner - F:\WINDOWS\system32\PSIService.exe O23 - Service: stllssvr - MicroVision Development, Inc. - F:\Program Files\Common Files\SureThing Shared\stllssvr.exe O23 - Service: Ulead Burning Helper (UleadBurningHelper) - Ulead Systems, Inc. - F:\Program Files\Common Files\Ulead Systems\DVD\ULCDRSvr.exe -- End of file - 9118 bytes

[color=#BF0000][color=#BF0000][color=#800000][color=#800000][color=#000000][color=#000000][/color][/color][/color][/color][/color][/color]

**Posty:** 8001 · przez **Okocza** 19 Lis 2008, 08:21

bartosz121 napisał(a):w różnych odstępach czasu restartuje co 1 godzinę 2 różnie bywa

podaj CAŁY konfig kompa, razem z marką i mocą zasilacza.

Kod: Zaznacz wszystko: O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

fixujesz w hj - daj log z combofixa

**Posty:** 684 · przez **djarta** 19 Lis 2008, 10:18

To też Fixujesz:

O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://F:\Program Files\BitComet\tools\BitCometBHO_1.2.8.7.dll/206 (file missing)

>>Hijack>>scan(Do a system scan only)>>zaznacz>>Fix checked.

Tak jak Pan @Okocza powiedział wyżej, daj log z ComboFixa.

================================
K.

**Posty:** 8 · przez **bartosz121** 20 Lis 2008, 01:21

Przepraszam że nie zamieściłem loga z combofixa oto ono i konfiguracja komputera ---zasilacz może nie z pierwszej pułki ale nie najgorszy....

Intel core2duo E6320 1,86 GHz
2 razy 1024 MB DDR-2 PC800 Kingston i 2 razy 512 MB Kingston dual chanell
WD Caviar 250 GB Sata-2 16MB Cache
Gigabyte GA-965P-DS3
Galaxy 7900GS Super 256 DDR3
ATX TRACER XENO 400W 12CM+PFC

Kod: Zaznacz wszystko: ComboFix 08-11-18.A2 - Bartek 2008-11-20 0:11:01.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.3.1250.1.1045.18.2579 [GMT 1:00] Uruchomiony z: f:\documents and settings\Bartek\Pulpit\ComboFix.exe * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((( Pliki utworzone od 2008-10-19 do 2008-11-19 ))))))))))))))))))))))))))))))) . 2008-11-19 03:42 . 2008-11-19 03:44 <DIR> d-------- f:\program files\WinUAE 2008-11-19 03:21 . 2008-11-19 03:21 <DIR> d-------- f:\program files\Commander 2008-11-19 03:03 . 2008-11-19 03:04 <DIR> d-------- F:\DOS 2008-11-19 01:31 . 2008-11-19 01:31 <DIR> d-------- f:\program files\Trend Micro 2008-11-18 18:58 . 2008-11-18 19:01 <DIR> d-------- f:\program files\BitComet 2008-11-18 18:16 . 2008-11-19 03:30 <DIR> d-------- f:\program files\DOSBox-0.63 2008-11-13 03:00 . 2008-11-13 03:01 1,393 --a------ f:\windows\imsins.BAK 2008-11-12 14:43 . 2008-10-24 12:21 455,296 -----c--- f:\windows\system32\dllcache\mrxsmb.sys 2008-11-12 14:42 . 2008-09-04 18:17 1,106,944 -----c--- f:\windows\system32\dllcache\msxml3.dll 2008-11-08 01:45 . 2008-11-08 01:46 <DIR> d---s---- f:\program files\Xfire 2008-11-08 01:45 . 2008-11-08 01:45 <DIR> d-------- f:\documents and settings\Bartek\Dane aplikacji\Xfire 2008-11-08 01:45 . 2008-11-08 01:45 271,360 --a------ f:\windows\system32\drivers\atksgt.sys 2008-11-08 01:45 . 2008-11-08 01:45 18,048 --a------ f:\windows\system32\drivers\lirsgt.sys 2008-11-07 13:34 . 2008-11-07 13:34 <DIR> d-------- f:\program files\Ashampoo 2008-11-05 00:02 . 2008-11-09 23:01 <DIR> d--h----- F:\$AVG8.VAULT$ 2008-11-04 23:26 . 2008-11-19 23:40 <DIR> d-------- f:\windows\system32\drivers\Avg 2008-11-04 23:26 . 2008-11-04 23:26 <DIR> d-------- f:\documents and settings\Bartek\Dane aplikacji\AVGTOOLBAR 2008-11-04 23:26 . 2008-11-05 12:09 98,440 --a------ f:\windows\system32\drivers\avgldx86.sys 2008-11-04 23:26 . 2008-11-05 23:05 90,632 --a------ f:\windows\system32\drivers\avgtdix.sys 2008-11-04 23:26 . 2008-11-04 23:26 12,936 --a------ f:\windows\system32\drivers\avgrkx86.sys 2008-11-04 23:26 . 2008-11-04 23:26 10,520 --a------ f:\windows\system32\avgrsstx.dll 2008-11-04 23:25 . 2008-11-04 23:25 <DIR> d-------- f:\program files\AVG 2008-11-04 23:25 . 2008-11-04 23:25 <DIR> d-------- f:\documents and settings\All Users\Dane aplikacji\avg8 2008-11-04 22:56 . 2008-11-05 23:05 50,968 --a------ f:\windows\system32\avgfwdx.dll 2008-11-04 22:56 . 2008-11-05 23:05 29,208 --a------ f:\windows\system32\drivers\avgfwdx.sys 2008-10-23 21:34 . 2008-10-15 17:36 337,408 -----c--- f:\windows\system32\dllcache\netapi32.dll . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-19 23:08 --------- d-----w f:\program files\lg_fwupdate 2008-11-18 14:28 --------- d-----w f:\documents and settings\Bartek\Dane aplikacji\uTorrent 2008-11-13 02:03 --------- d-----w f:\documents and settings\All Users\Dane aplikacji\Microsoft Help 2008-11-08 00:39 --------- d--h--w f:\program files\InstallShield Installation Information 2008-11-07 21:54 --------- d-----w f:\program files\Spybot - Search & Destroy 2008-11-07 21:54 --------- d-----w f:\program files\Guitar FX BOX 2.6 2008-11-07 21:54 --------- d-----w f:\documents and settings\Bartek\Dane aplikacji\LimeWire 2008-11-07 12:27 --------- d-----w f:\program files\OpenOffice.org 2.4 2008-11-07 12:27 --------- d-----w f:\documents and settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-11-07 12:24 --------- d-----w f:\program files\Techland 2008-11-07 12:21 --------- d-----w f:\program files\SlySoft 2008-11-06 23:26 2,516 --sha-w f:\windows\system32\KGyGaAvL.sys 2008-11-05 11:07 --------- d-----w f:\documents and settings\Bartek\Dane aplikacji\OpenOffice.org2 2008-11-04 21:52 --------- d-----w f:\documents and settings\All Users\Dane aplikacji\FRISK Software 2008-10-24 11:21 455,296 ----a-w f:\windows\system32\drivers\mrxsmb.sys 2008-10-16 13:13 202,776 ----a-w f:\windows\system32\wuweb.dll 2008-10-16 13:13 1,809,944 ----a-w f:\windows\system32\wuaueng.dll 2008-10-16 13:12 561,688 ----a-w f:\windows\system32\wuapi.dll 2008-10-16 13:12 323,608 ----a-w f:\windows\system32\wucltui.dll 2008-10-16 13:09 92,696 ----a-w f:\windows\system32\cdm.dll 2008-10-16 13:09 51,224 ----a-w f:\windows\system32\wuauclt.exe 2008-10-16 13:09 43,544 ----a-w f:\windows\system32\wups2.dll 2008-10-16 13:08 34,328 ----a-w f:\windows\system32\wups.dll 2008-10-16 13:06 268,648 ----a-w f:\windows\system32\mucltui.dll 2008-10-16 13:06 208,744 ----a-w f:\windows\system32\muweb.dll 2008-10-06 08:12 --------- d-----w f:\documents and settings\Bartek\Dane aplikacji\Corel 2008-10-06 08:09 --------- d-----w f:\documents and settings\All Users\Dane aplikacji\Corel 2008-10-05 10:48 --------- d-----w f:\program files\Sony 2008-09-30 15:43 1,286,152 ----a-w f:\windows\system32\msxml4.dll 2008-09-22 07:44 --------- d-----w f:\documents and settings\All Users\Dane aplikacji\NOS 2008-09-21 22:13 --------- d-----w f:\program files\Common Files\Adobe AIR 2008-09-21 22:12 --------- d-----w f:\program files\Common Files\Adobe 2008-09-15 15:27 1,846,656 ----a-w f:\windows\system32\win32k.sys 2008-09-10 01:15 1,307,648 ------w f:\windows\system32\msxml6.dll 2008-09-04 17:17 1,106,944 ----a-w f:\windows\system32\msxml3.dll 2008-08-28 15:51 47,360 ----a-w f:\documents and settings\Bartek\Dane aplikacji\pcouffin.sys 2008-08-26 08:27 826,368 ----a-w f:\windows\system32\wininet.dll 2008-08-23 18:01 98,304 ----a-w f:\windows\system32\qttask.exe 2008-08-23 09:44 14,656 ----a-w f:\windows\gdrv.sys 2008-08-22 22:17 70,969 ----a-w f:\windows\BricoPackUninst.cmd 2008-08-22 22:17 5,466 ----a-w f:\windows\BricoPackFoldersDelete.cmd 2008-08-22 22:17 219,648 ----a-w f:\windows\system32\uxtheme.dll 2004-10-01 13:00 40,960 ----a-w f:\program files\Uninstall_CDS.exe . ((((((((((((((((((((((((((((( snapshot@2008-11-05_12.52.53,68 ))))))))))))))))))))))))))))))))))))))))) . + 2008-09-10 01:12:48 1,379,840 ----a-w f:\windows\$hf_mig$\KB954459\SP3QFE\msxml6.dll + 2007-11-30 12:40:46 19,320 ----a-w f:\windows\$hf_mig$\KB954459\spmsg.dll + 2007-11-30 12:40:46 234,360 ----a-w f:\windows\$hf_mig$\KB954459\spuninst.exe + 2007-11-30 12:40:46 26,488 ----a-w f:\windows\$hf_mig$\KB954459\update\spcustom.dll + 2007-11-30 12:40:47 763,256 ----a-w f:\windows\$hf_mig$\KB954459\update\update.exe + 2007-11-30 12:40:47 398,200 ----a-w f:\windows\$hf_mig$\KB954459\update\updspapi.dll - 2008-10-05 10:28:16 53,248 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll + 2008-11-08 00:44:34 53,248 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.AudioVideoPlayback\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.AudioVideoPlayback.dll - 2008-10-05 10:28:16 12,800 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll + 2008-11-08 00:44:34 12,800 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Diagnostics\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Diagnostics.dll - 2008-10-05 10:28:16 473,600 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll + 2008-11-08 00:44:35 473,600 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3D\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3D.dll - 2008-10-05 10:28:14 2,676,224 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-11-08 00:44:31 2,676,224 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-10-05 10:28:15 2,846,720 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-11-08 00:44:32 2,846,720 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2903.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-10-05 10:28:15 563,712 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-11-08 00:44:32 563,712 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2904.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-10-05 10:28:15 567,296 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-11-08 00:44:32 567,296 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2905.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-10-05 10:28:15 576,000 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-11-08 00:44:32 576,000 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2906.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-10-05 10:28:15 577,024 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-11-08 00:44:33 577,024 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2907.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-10-05 10:28:16 577,536 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-11-08 00:44:33 577,536 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2908.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-10-05 10:28:16 577,536 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-11-08 00:44:33 577,536 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2909.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-10-05 10:28:16 578,560 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-11-08 00:44:34 578,560 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2910.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-10-05 10:28:16 578,560 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll + 2008-11-08 00:44:35 578,560 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.Direct3DX\1.0.2911.0__31bf3856ad364e35\Microsoft.DirectX.Direct3DX.dll - 2008-10-05 10:28:17 145,920 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll + 2008-11-08 00:44:35 145,920 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.DirectDraw\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectDraw.dll - 2008-10-05 10:28:17 159,232 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll + 2008-11-08 00:44:35 159,232 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.DirectInput\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectInput.dll - 2008-10-05 10:28:17 364,544 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll + 2008-11-08 00:44:36 364,544 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.DirectPlay\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectPlay.dll - 2008-10-05 10:28:17 178,176 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll + 2008-11-08 00:44:36 178,176 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX.DirectSound\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.DirectSound.dll - 2008-10-05 10:28:16 223,232 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll + 2008-11-08 00:44:34 223,232 ----a-w f:\windows\assembly\GAC\Microsoft.DirectX\1.0.2902.0__31bf3856ad364e35\Microsoft.DirectX.dll + 2008-10-24 11:21:09 455,296 ------w f:\windows\Driver Cache\i386\mrxsmb.sys + 2008-11-13 02:00:45 32,768 ----a-r f:\windows\Installer\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}\icon.exe - 2008-10-16 12:47:23 1,165,584 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe + 2008-11-13 02:03:00 1,165,584 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe - 2008-10-16 12:47:23 20,240 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe + 2008-11-13 02:03:00 20,240 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe - 2008-10-16 12:47:23 159,504 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe + 2008-11-13 02:03:00 159,504 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe - 2008-10-16 12:47:23 184,080 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe + 2008-11-13 02:03:00 184,080 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe - 2008-10-16 12:47:23 217,864 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe + 2008-11-13 02:03:00 217,864 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe - 2008-10-16 12:47:23 18,704 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe + 2008-11-13 02:03:00 18,704 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe - 2008-10-16 12:47:23 35,088 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe + 2008-11-13 02:03:00 35,088 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe - 2008-10-16 12:47:23 845,584 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe + 2008-11-13 02:03:00 845,584 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe - 2008-10-16 12:47:23 922,384 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe + 2008-11-13 02:03:00 922,384 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe - 2008-10-16 12:47:23 272,648 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe + 2008-11-13 02:03:00 272,648 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe - 2008-10-16 12:47:23 888,080 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe + 2008-11-13 02:03:00 888,080 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe - 2008-10-16 12:47:23 1,172,240 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe + 2008-11-13 02:03:00 1,172,240 ----a-r f:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe - 2005-03-18 14:23:10 53,248 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.AudioVideoPlayback.dll + 2005-03-18 15:23:10 53,248 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.AudioVideoPlayback.dll - 2005-03-18 14:23:10 12,800 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Diagnostics.dll + 2005-03-18 15:23:10 12,800 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Diagnostics.dll - 2005-03-18 14:23:14 473,600 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3D.dll + 2005-03-18 15:23:14 473,600 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3D.dll - 2004-09-29 10:38:58 2,676,224 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3DX.dll + 2004-09-29 11:38:58 2,676,224 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.Direct3DX.dll - 2005-03-18 14:23:10 145,920 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectDraw.dll + 2005-03-18 15:23:10 145,920 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectDraw.dll - 2005-03-18 14:23:10 159,232 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectInput.dll + 2005-03-18 15:23:10 159,232 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectInput.dll - 2005-03-18 14:23:14 364,544 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectPlay.dll + 2005-03-18 15:23:14 364,544 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectPlay.dll - 2005-03-18 14:23:12 178,176 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectSound.dll + 2005-03-18 15:23:12 178,176 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.DirectSound.dll - 2005-03-18 14:23:14 223,232 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.dll + 2005-03-18 15:23:14 223,232 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2902.0\Microsoft.DirectX.dll - 2004-12-01 13:53:06 2,846,720 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2903.0\Microsoft.DirectX.Direct3DX.dll + 2004-12-01 14:53:06 2,846,720 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2903.0\Microsoft.DirectX.Direct3DX.dll - 2005-02-05 17:32:54 563,712 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2904.0\Microsoft.DirectX.Direct3DX.dll + 2005-02-05 18:32:54 563,712 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2904.0\Microsoft.DirectX.Direct3DX.dll - 2005-03-18 15:23:14 567,296 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2905.0\Microsoft.DirectX.Direct3DX.dll + 2005-03-18 16:23:14 567,296 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2905.0\Microsoft.DirectX.Direct3DX.dll - 2005-05-26 13:15:56 576,000 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2906.0\Microsoft.DirectX.Direct3DX.dll + 2005-05-26 14:15:56 576,000 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2906.0\Microsoft.DirectX.Direct3DX.dll - 2005-07-22 15:21:34 577,024 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\Microsoft.DirectX.Direct3DX.dll + 2005-07-22 16:21:34 577,024 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2907.0\Microsoft.DirectX.Direct3DX.dll - 2005-09-28 12:11:52 577,536 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2908.0\Microsoft.DirectX.Direct3DX.dll + 2005-09-28 13:11:52 577,536 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2908.0\Microsoft.DirectX.Direct3DX.dll - 2005-12-05 15:20:50 577,536 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2909.0\Microsoft.DirectX.Direct3DX.dll + 2005-12-05 16:20:50 577,536 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2909.0\Microsoft.DirectX.Direct3DX.dll - 2006-02-03 05:40:48 578,560 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2910.0\Microsoft.DirectX.Direct3DX.dll + 2006-02-03 06:40:48 578,560 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2910.0\Microsoft.DirectX.Direct3DX.dll - 2006-03-31 09:27:50 578,560 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2911.0\Microsoft.DirectX.Direct3DX.dll + 2006-03-31 10:27:50 578,560 ----a-w f:\windows\Microsoft.NET\DirectX for Managed Code\1.0.2911.0\Microsoft.DirectX.Direct3DX.dll - 2005-02-05 17:45:26 2,222,800 ----a-w f:\windows\system32\d3dx9_24.dll + 2005-02-05 18:45:26 2,222,800 ----a-w f:\windows\system32\d3dx9_24.dll - 2005-03-18 15:19:58 2,337,488 ----a-w f:\windows\system32\d3dx9_25.dll + 2005-03-18 16:19:58 2,337,488 ----a-w f:\windows\system32\d3dx9_25.dll - 2005-05-26 13:34:52 2,297,552 ----a-w f:\windows\system32\d3dx9_26.dll + 2005-05-26 14:34:52 2,297,552 ----a-w f:\windows\system32\d3dx9_26.dll - 2005-07-22 17:59:04 2,319,568 ----a-w f:\windows\system32\d3dx9_27.dll + 2005-07-22 18:59:04 2,319,568 ----a-w f:\windows\system32\d3dx9_27.dll - 2005-12-05 16:09:18 2,323,664 ----a-w f:\windows\system32\d3dx9_28.dll + 2005-12-05 17:09:18 2,323,664 ----a-w f:\windows\system32\d3dx9_28.dll - 2006-02-03 06:43:16 2,332,368 ----a-w f:\windows\system32\d3dx9_29.dll + 2006-02-03 07:43:16 2,332,368 ----a-w f:\windows\system32\d3dx9_29.dll - 2006-03-31 10:40:58 2,388,176 ----a-w f:\windows\system32\d3dx9_30.dll + 2006-03-31 11:40:58 2,388,176 ----a-w f:\windows\system32\d3dx9_30.dll - 2008-07-18 20:10:48 94,920 -c--a-w f:\windows\system32\dllcache\cdm.dll + 2008-10-16 13:09:44 92,696 -c--a-w f:\windows\system32\dllcache\cdm.dll - 2008-04-14 17:20:39 1,306,624 -c----w f:\windows\system32\dllcache\msxml6.dll + 2008-09-10 01:15:56 1,307,648 -c----w f:\windows\system32\dllcache\msxml6.dll - 2008-07-18 20:09:44 563,912 -c--a-w f:\windows\system32\dllcache\wuapi.dll + 2008-10-16 13:12:20 561,688 -c--a-w f:\windows\system32\dllcache\wuapi.dll - 2008-07-18 20:10:42 68,808 -c--a-w f:\windows\system32\dllcache\wuauclt.exe + 2008-10-16 13:09:44 51,224 -c--a-w f:\windows\system32\dllcache\wuauclt.exe - 2008-07-18 20:09:42 1,811,656 -c--a-w f:\windows\system32\dllcache\wuaueng.dll + 2008-10-16 13:13:40 1,809,944 -c--a-w f:\windows\system32\dllcache\wuaueng.dll - 2008-07-18 20:09:46 325,832 -c--a-w f:\windows\system32\dllcache\wucltui.dll + 2008-10-16 13:12:22 323,608 -c--a-w f:\windows\system32\dllcache\wucltui.dll - 2008-07-18 20:10:20 36,552 -c--a-w f:\windows\system32\dllcache\wups.dll + 2008-10-16 13:08:58 34,328 -c--a-w f:\windows\system32\dllcache\wups.dll - 2008-07-18 20:09:44 205,000 -c--a-w f:\windows\system32\dllcache\wuweb.dll + 2008-10-16 13:13:40 202,776 -c--a-w f:\windows\system32\dllcache\wuweb.dll - 2008-10-07 19:19:40 16,721,856 ----a-w f:\windows\system32\MRT.exe + 2008-11-04 00:10:25 17,318,336 ----a-w f:\windows\system32\MRT.exe + 2008-10-16 13:08:58 34,328 ----a-w f:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups.dll\7.2.6001.788\wups.dll + 2008-10-16 13:09:44 43,544 ----a-w f:\windows\system32\SoftwareDistribution\Setup\ServiceStartup\wups2.dll\7.2.6001.788\wups2.dll - 2007-11-30 11:21:28 19,320 ------w f:\windows\system32\spmsg.dll + 2008-07-08 13:20:04 19,320 ------w f:\windows\system32\spmsg.dll - 2006-02-03 06:41:26 14,032 ----a-w f:\windows\system32\x3daudio1_0.dll + 2006-02-03 07:41:26 14,032 ----a-w f:\windows\system32\x3daudio1_0.dll - 2006-02-03 06:42:06 230,096 ----a-w f:\windows\system32\xactengine2_0.dll + 2006-02-03 07:42:06 230,096 ----a-w f:\windows\system32\xactengine2_0.dll - 2006-03-31 10:39:48 229,584 ----a-w f:\windows\system32\xactengine2_1.dll + 2006-03-31 11:39:48 229,584 ----a-w f:\windows\system32\xactengine2_1.dll - 2006-05-31 05:24:16 230,168 ----a-w f:\windows\system32\xactengine2_2.dll + 2006-05-31 06:24:16 230,168 ----a-w f:\windows\system32\xactengine2_2.dll - 2006-07-28 07:30:32 236,824 ----a-w f:\windows\system32\xactengine2_3.dll + 2006-07-28 08:30:32 236,824 ----a-w f:\windows\system32\xactengine2_3.dll - 2006-03-31 10:39:24 62,672 ----a-w f:\windows\system32\xinput1_1.dll + 2006-03-31 11:39:24 62,672 ----a-w f:\windows\system32\xinput1_1.dll - 2006-07-28 07:30:14 62,744 ----a-w f:\windows\system32\xinput1_2.dll + 2006-07-28 08:30:14 62,744 ----a-w f:\windows\system32\xinput1_2.dll - 2005-12-05 16:07:30 61,136 ----a-w f:\windows\system32\xinput9_1_0.dll + 2005-12-05 17:07:30 61,136 ----a-w f:\windows\system32\xinput9_1_0.dll + 2008-09-30 15:42:08 1,286,152 ----a-w f:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9870.0_x-ww_a32d74cf\msxml4.dll + 2008-09-30 15:45:12 91,656 ----a-w f:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.1.0_x-ww_2a41bceb\msxml4r.dll + 2005-09-23 00:35:10 65,536 ----a-w f:\windows\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0ee63867\vcomp.dll . -- Migawka wyzerowana -- . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="f:\windows\system32\ctfmon.exe" [2008-04-14 15360] "DAEMON Tools Lite"="f:\programy bartek\damon tools\DAEMON Tools Lite\daemon.exe" [2008-08-08 490952] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "JMB36X IDE Setup"="f:\windows\JM\JMInsIDE.exe" [2006-10-31 36864] "36X Raid Configurer"="f:\windows\system32\JMRaidSetup.exe" [2006-11-17 1953792] "NvCplDaemon"="f:\windows\system32\NvCpl.dll" [2006-08-11 7630848] "NvMediaCenter"="f:\windows\system32\NvMcTray.dll" [2006-08-11 86016] "WinFast Schedule"="f:\program files\WinFast\WFTVFM\WFWIZ.exe" [2006-07-07 348160] "NeroFilterCheck"="f:\windows\system32\NeroCheck.exe" [2001-07-09 155648] "LGODDFU"="f:\program files\lg_fwupdate\fwupdate.exe" [2005-04-12 229376] "HP Software Update"="f:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-03-11 49152] "EasyTuneV"="f:\program files\Gigabyte\ET5\ETcall.exe" [2007-01-04 24576] "SunJavaUpdateSched"="f:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "GrooveMonitor"="f:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2007-08-24 33648] "AVG8_TRAY"="e:\avg\ANTYWI~1\avgtray.exe" [2008-11-05 1235736] "SkyTel"="SkyTel.EXE" [2006-12-12 f:\windows\SkyTel.exe] "RTHDCPL"="RTHDCPL.EXE" [2006-12-12 f:\windows\RTHDCPL.EXE] "nwiz"="nwiz.exe" [2006-08-11 f:\windows\system32\nwiz.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="f:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) "NoFileAssociate"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.iac2"= f:\progra~2\ACEMEG~1\SystemS\Intel\iac25_32.ax "vidc.avrn"= f:\progra~2\ACEMEG~1\SystemS\AVIDAV~1.DLL "vidc.advj"= f:\progra~2\ACEMEG~1\SystemS\AVIDAV~1.DLL "vidc.mszh"= f:\progra~2\ACEMEG~1\SystemS\avimszh.dll "vidc.zlib"= f:\progra~2\ACEMEG~1\SystemS\avizlib.dll "vidc.cscd"= f:\progra~2\ACEMEG~1\SystemS\camcodec.dll "vidc.cvid"= f:\progra~2\ACEMEG~1\SystemS\iccvid.dll "msacm.trspch"= f:\progra~2\ACEMEG~1\SystemS\tssoft32.acm "vidc.em2v"= f:\progra~2\ACEMEG~1\SystemS\etxcodec.dll "vidc.mkvc"= f:\progra~2\ACEMEG~1\SystemS\kmvidc32.dll "vidc.hfyu"= f:\progra~2\ACEMEG~1\SystemS\huffyuv.dll "msacm.lameacm"= f:\progra~2\ACEMEG~1\SystemS\lameacm.acm "msacm.lhacm"= f:\progra~2\ACEMEG~1\SystemS\lhacm.acm "msacm.l3acm"= f:\progra~2\ACEMEG~1\SystemS\l3codecp.acm "vidc.sjpg"= f:\progra~2\ACEMEG~1\SystemS\pmjpeg32.dll "vidc.dmb2"= f:\progra~2\ACEMEG~1\SystemS\pmjpeg32.dll "vidc.gepj"= f:\progra~2\ACEMEG~1\SystemS\pmjpeg32.dll "vidc.qpeg"= f:\progra~2\ACEMEG~1\SystemS\Qpeg32.dll "vidc.q1.0"= f:\progra~2\ACEMEG~1\SystemS\Qpeg32.dll "msacm.sl_anet"= f:\progra~2\ACEMEG~1\SystemS\sl_anet.acm "vidc.tscc"= f:\progra~2\ACEMEG~1\SystemS\tsccvid.dll "vidc.vifp"= f:\progra~2\ACEMEG~1\SystemS\vfcodec.dll "vidc.wrpr"= f:\progra~2\ACEMEG~1\SystemS\aviwrap.dll "vidc.wnv1"= f:\progra~2\ACEMEG~1\SystemS\wnvplay1.dll "vidc.3ivx"= f:\progra~2\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL "vidc.3iv0"= f:\progra~2\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL "vidc.3iv1"= f:\progra~2\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL "vidc.3iv2"= f:\progra~2\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL "vidc.3ivd"= f:\progra~2\ACEMEG~1\SystemS\3ivx\3IVXVF~1.DLL "vidc.advs"= f:\progra~2\ACEMEG~1\SystemS\Adaptec\Dvc.dll "vidc.aflc"= f:\progra~2\ACEMEG~1\SystemS\Autodesk\FLCCOD~1.DLL "vidc.afli"= f:\progra~2\ACEMEG~1\SystemS\Autodesk\FLCCOD~1.DLL "vidc.aasc"= f:\progra~2\ACEMEG~1\SystemS\Autodesk\Aasc32.dll "vidc.aas4"= f:\progra~2\ACEMEG~1\SystemS\Autodesk\Aasc32.dll "vidc.asv1"= f:\progra~2\ACEMEG~1\SystemS\ASUS\asusasv1.dll "vidc.asv2"= f:\progra~2\ACEMEG~1\SystemS\ASUS\asusasv2.dll "vidc.asvx"= f:\progra~2\ACEMEG~1\SystemS\ASUS\asusasv2.dll "vidc.vcr1"= f:\progra~2\ACEMEG~1\SystemS\ATI\ativcr1.dll "vidc.vcr2"= f:\progra~2\ACEMEG~1\SystemS\ATI\ativcr2.dll "vidc.yv12"= f:\progra~2\ACEMEG~1\SystemS\ATI\atiyuv12.DLL "vidc.mwv1"= f:\progra~2\ACEMEG~1\SystemS\Aware\icmw_32.dll "vidc.bt20"= f:\progra~2\ACEMEG~1\SystemS\BROOKT~1\btvvc32.drv "vidc.y41p"= f:\progra~2\ACEMEG~1\SystemS\BROOKT~1\btvvc32.drv "msacm.pcdv"= f:\progra~2\ACEMEG~1\SystemS\Canopus\pcdv.acm "vidc.cdvc"= f:\progra~2\ACEMEG~1\SystemS\Canopus\CSCCDVC.DLL "vidc.ddvc"= f:\progra~2\ACEMEG~1\SystemS\Canopus\CSCdvsd.DLL "vidc.png1"= f:\progra~2\ACEMEG~1\SystemS\Core\COREPN~1.DLL "msacm.CoreFLAC_ACM"= f:\progra~2\ACEMEG~1\SystemS\Core\COREFL~1.ACM "vidc.davc"= f:\progra~2\ACEMEG~1\SystemS\dicas\davcvfw.dll "vidc.div3"= f:\progra~2\ACEMEG~1\SystemS\DivX\DivXc32.dll "vidc.div5"= f:\progra~2\ACEMEG~1\SystemS\DivX\DivXc32.dll "vidc.mpg3"= f:\progra~2\ACEMEG~1\SystemS\DivX\DivXc32.dll "vidc.div4"= f:\progra~2\ACEMEG~1\SystemS\DivX\DivXc32f.dll "vidc.div6"= f:\progra~2\ACEMEG~1\SystemS\DivX\DivXc32f.dll "vidc.ap41"= f:\progra~2\ACEMEG~1\SystemS\DivX\DivXc32f.dll "vidc.dvx4"= f:\progra~2\ACEMEG~1\SystemS\DivX\divx4.dll "vidc.divx"= f:\progra~2\ACEMEG~1\SystemS\DivX\DivX520.dll "msacm.divxa32"= msaud32_divx.acm "vidc.frwd"= f:\progra~2\ACEMEG~1\SystemS\Forward\frwd.dll "vidc.frwt"= f:\progra~2\ACEMEG~1\SystemS\Forward\frwd.dll "vidc.frwa"= f:\progra~2\ACEMEG~1\SystemS\Forward\frwt.dll "vidc.frwu"= f:\progra~2\ACEMEG~1\SystemS\Forward\frwu.dll "vidc.glzw"= f:\progra~2\ACEMEG~1\SystemS\Gabest\GLZW.dll "vidc.gpeg"= f:\progra~2\ACEMEG~1\SystemS\Gabest\GPEG.dll "vidc.i263"= f:\progra~2\ACEMEG~1\SystemS\Intel\i263_32.drv "vidc.iv30"= f:\progra~2\ACEMEG~1\SystemS\Intel\ir32_32.dll "vidc.iv31"= f:\progra~2\ACEMEG~1\SystemS\Intel\ir32_32.dll "vidc.iv32"= f:\progra~2\ACEMEG~1\SystemS\Intel\ir32_32.dll "vidc.iv33"= f:\progra~2\ACEMEG~1\SystemS\Intel\ir32_32.dll "vidc.iv34"= f:\progra~2\ACEMEG~1\SystemS\Intel\ir32_32.dll "vidc.iv35"= f:\progra~2\ACEMEG~1\SystemS\Intel\ir32_32.dll "vidc.iv36"= f:\progra~2\ACEMEG~1\SystemS\Intel\ir32_32.dll "vidc.iv37"= f:\progra~2\ACEMEG~1\SystemS\Intel\ir32_32.dll "vidc.iv38"= f:\progra~2\ACEMEG~1\SystemS\Intel\ir32_32.dll "vidc.iv39"= f:\progra~2\ACEMEG~1\SystemS\Intel\ir32_32.dll "vidc.iv40"= f:\progra~2\ACEMEG~1\SystemS\Intel\ir41_32.dll "vidc.iv41"= f:\progra~2\ACEMEG~1\SystemS\Intel\ir41_32.dll "vidc.iv42"= f:\progra~2\ACEMEG~1\SystemS\Intel\ir41_32.dll "vidc.iv43"= f:\progra~2\ACEMEG~1\SystemS\Intel\ir41_32.dll "vidc.iv44"= f:\progra~2\ACEMEG~1\SystemS\Intel\ir41_32.dll "vidc.iv45"= f:\progra~2\ACEMEG~1\SystemS\Intel\ir41_32.dll "vidc.iv46"= f:\progra~2\ACEMEG~1\SystemS\Intel\ir41_32.dll "vidc.iv47"= f:\progra~2\ACEMEG~1\SystemS\Intel\ir41_32.dll "vidc.iv48"= f:\progra~2\ACEMEG~1\SystemS\Intel\ir41_32.dll "vidc.iv49"= f:\progra~2\ACEMEG~1\SystemS\Intel\ir41_32.dll "vidc.iv50"= f:\progra~2\ACEMEG~1\SystemS\Intel\ir50_32.dll "vidc.iyuv"= f:\progra~2\ACEMEG~1\SystemS\Intel\iyuv_32.dll "vidc.yvu9"= f:\progra~2\ACEMEG~1\SystemS\Intel\Iyvu9_32.dll "vidc.ir21"= f:\progra~2\ACEMEG~1\SystemS\Intel\IR21_R.DLL "vidc.rt21"= f:\progra~2\ACEMEG~1\SystemS\Intel\IR21_R.DLL "msacm.imc"= f:\progra~2\ACEMEG~1\SystemS\Intel\IMC32.ACM "vidc.lead"= f:\progra~2\ACEMEG~1\SystemS\LEAD\LCODCCMP.DLL "vidc.dvsd"= f:\progra~2\ACEMEG~1\SystemS\MAINCO~1\MCDVD_32.DLL "vidc.dvc"= f:\progra~2\ACEMEG~1\SystemS\MAINCO~1\MCDVD_32.DLL "vidc.dvcs"= f:\progra~2\ACEMEG~1\SystemS\MAINCO~1\MCDVD_32.DLL "vidc.dcmj"= f:\progra~2\ACEMEG~1\SystemS\MAINCO~1\MCMJPG32.DLL "vidc.avi1"= f:\progra~2\ACEMEG~1\SystemS\MAINCO~1\MCMJPG32.DLL "vidc.avi2"= f:\progra~2\ACEMEG~1\SystemS\MAINCO~1\MCMJPG32.DLL "vidc.dv25"= f:\progra~2\ACEMEG~1\SystemS\Matrox\DigiVCap.dll "vidc.dv50"= f:\progra~2\ACEMEG~1\SystemS\Matrox\DigiVCap.dll "vidc.msmc"= f:\progra~2\ACEMEG~1\SystemS\Matrox\DigiVCap.dll "vidc.mmjp"= f:\progra~2\ACEMEG~1\SystemS\Matrox\DigiVCap.dll "vidc.mtx1"= f:\progra~2\ACEMEG~1\SystemS\Matrox\DigiVCap.dll "vidc.mtx2"= f:\progra~2\ACEMEG~1\SystemS\Matrox\DigiVCap.dll "vidc.mtx3"= f:\progra~2\ACEMEG~1\SystemS\Matrox\DigiVCap.dll "vidc.mtx4"= f:\progra~2\ACEMEG~1\SystemS\Matrox\DigiVCap.dll "vidc.mtx5"= f:\progra~2\ACEMEG~1\SystemS\Matrox\DigiVCap.dll "vidc.mtx6"= f:\progra~2\ACEMEG~1\SystemS\Matrox\DigiVCap.dll "vidc.mtx7"= f:\progra~2\ACEMEG~1\SystemS\Matrox\DigiVCap.dll "vidc.mtx8"= f:\progra~2\ACEMEG~1\SystemS\Matrox\DigiVCap.dll "vidc.mtx9"= f:\progra~2\ACEMEG~1\SystemS\Matrox\DigiVCap.dll "vidc.mmes"= f:\progra~2\ACEMEG~1\SystemS\Matrox\DigiVCap.dll "msacm.msadpcm"= f:\progra~2\ACEMEG~1\SystemS\MICROS~1\msadp32.acm "msacm.imaadpcm"= f:\progra~2\ACEMEG~1\SystemS\MICROS~1\imaadp32.acm "msacm.msg711"= f:\progra~2\ACEMEG~1\SystemS\MICROS~1\msg711.acm "msacm.msg723"= f:\progra~2\ACEMEG~1\SystemS\MICROS~1\msg723.acm "msacm.msgsm610"= f:\progra~2\ACEMEG~1\SystemS\MICROS~1\msgsm32.acm "vidc.m261"= f:\progra~2\ACEMEG~1\SystemS\MICROS~1\msh261.drv "vidc.m263"= f:\progra~2\ACEMEG~1\SystemS\MICROS~1\msh263.drv "vidc.i420"= f:\progra~2\ACEMEG~1\SystemS\MICROS~1\msh263.drv "vidc.mrle"= f:\progra~2\ACEMEG~1\SystemS\MICROS~1\msrle32.dll "vidc.uyvy"= f:\progra~2\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "vidc.yvyu"= f:\progra~2\ACEMEG~1\SystemS\MICROS~1\msyuv.dll "vidc.msvc"= f:\progra~2\ACEMEG~1\SystemS\MICROS~1\msvidc32.dll "vidc.cram"= f:\progra~2\ACEMEG~1\SystemS\MICROS~1\msvidc32.dll "vidc.mpg4"= f:\progra~2\ACEMEG~1\SystemS\MICROS~1\mpg4c32.dll "vidc.mp41"= f:\progra~2\ACEMEG~1\SystemS\MICROS~1\mpg4c32.dll "vidc.mp42"= f:\progra~2\ACEMEG~1\SystemS\MICROS~1\mpg4c32.dll "vidc.mp43"= f:\progra~2\ACEMEG~1\SystemS\MICROS~1\mpg4c32.dll "vidc.mp4s"= f:\progra~2\ACEMEG~1\SystemS\MICROS~1\mpg4c32.dll "vidc.mp4v"= f:\progra~2\ACEMEG~1\SystemS\MICROS~1\mpg4c32.dll "vidc.wmv3"= f:\progra~2\ACEMEG~1\SystemS\MICROS~1\WMV9VCM.dll "msacm.msaudio1"= f:\progra~2\ACEMEG~1\SystemS\MICROS~1\msaud32.acm "vidc.vixl"= f:\progra~2\ACEMEG~1\SystemS\Miro\miroxl32.dll "vidc.nt00"= f:\progra~2\ACEMEG~1\SystemS\Newtek\ntcodec.dll "msacm.vorbis"= f:\progra~2\ACEMEG~1\SystemS\OGG\vorbis.acm "vidc.vp30"= f:\progra~2\ACEMEG~1\SystemS\ON2TEC~1\vp31vfw.dll "vidc.vp31"= f:\progra~2\ACEMEG~1\SystemS\ON2TEC~1\vp31vfw.dll "vidc.vp60"= f:\progra~2\ACEMEG~1\SystemS\ON2TEC~1\vp6vfw.dll "vidc.vp61"= f:\progra~2\ACEMEG~1\SystemS\ON2TEC~1\vp6vfw.dll "vidc.pdvc"= f:\progra~2\ACEMEG~1\SystemS\PANASO~1\idvcodec.dll "vidc.ipdv"= f:\progra~2\ACEMEG~1\SystemS\PANASO~1\idvcodec.dll "vidc.pvw2"= f:\progra~2\ACEMEG~1\SystemS\Pegasus\pvwv220.dll "vidc.pimj"= f:\progra~2\ACEMEG~1\SystemS\Pegasus\pvljpg20.dll "vidc.mjpx"= f:\progra~2\ACEMEG~1\SystemS\Pegasus\pvmjpg21.dll "vidc.miro"= f:\progra~2\ACEMEG~1\SystemS\Pinnacle\MIRODV~1.DLL "vidc.dcap"= f:\progra~2\ACEMEG~1\SystemS\Pinnacle\MIRODV~1.DLL "vidc.mjpa"= f:\progra~2\ACEMEG~1\SystemS\Pinnacle\RTMJPG~1.DLL "vidc.gpjm"= f:\progra~2\ACEMEG~1\SystemS\Pinnacle\RTMJPG~1.DLL "vidc.pim1"= f:\progra~2\ACEMEG~1\SystemS\Pinnacle\pclepim1.dll "msacm.qmpeg"= f:\progra~2\ACEMEG~1\SystemS\QDesign\qmpeg.acm "vidc.rmp4"= f:\progra~2\ACEMEG~1\SystemS\REALMA~1\rmp4.dll "vidc.rud0"= f:\progra~2\ACEMEG~1\SystemS\Rududu\rududu.dll "msacm.at3"= f:\progra~2\ACEMEG~1\SystemS\SONY\atrac3.acm "vidc.sony"= f:\progra~2\ACEMEG~1\SystemS\SONY\sonydv.dll "vidc.dvcp"= f:\progra~2\ACEMEG~1\SystemS\SONY\sonydv.dll "vidc.s422"= f:\progra~2\ACEMEG~1\SystemS\Tekram\tekyuv.dll "vidc.t420"= f:\progra~2\ACEMEG~1\SystemS\Toshiba\tsbyuv.dll "vidc.y411"= f:\progra~2\ACEMEG~1\SystemS\Toshiba\tsbyuv.dll "vidc.vssv"= f:\progra~2\ACEMEG~1\SystemS\VANGUA~1\vsscodec.dll "msacm.voxacm160"= f:\progra~2\ACEMEG~1\SystemS\VoxWare\vct3216.acm "vidc.xvid"= f:\progra~2\ACEMEG~1\SystemS\XviD\xvidvfw.dll [HKLM\~\startupfolder\F:^Documents and Settings^All Users^Menu Start^Programy^Autostart^HP Digital Imaging Monitor.lnk] path=f:\documents and settings\All Users\Menu Start\Programy\Autostart\HP Digital Imaging Monitor.lnk backup=f:\windows\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKLM\~\startupfolder\F:^Documents and Settings^Bartek^Menu Start^Programy^Autostart^OpenOffice.org 2.4.lnk] path=f:\documents and settings\Bartek\Menu Start\Programy\Autostart\OpenOffice.org 2.4.lnk backup=f:\windows\pss\OpenOffice.org 2.4.lnkStartup [HKLM\~\startupfolder\F:^Documents and Settings^Bartek^Menu Start^Programy^Autostart^Picture Motion Browser Media Check Tool.lnk] path=f:\documents and settings\Bartek\Menu Start\Programy\Autostart\Picture Motion Browser Media Check Tool.lnk backup=f:\windows\pss\Picture Motion Browser Media Check Tool.lnkStartup [HKLM\~\startupfolder\F:^Documents and Settings^Bartek^Menu Start^Programy^Autostart^RocketDock.lnk] path=f:\documents and settings\Bartek\Menu Start\Programy\Autostart\RocketDock.lnk backup=f:\windows\pss\RocketDock.lnkStartup [HKLM\~\startupfolder\F:^Documents and Settings^Bartek^Menu Start^Programy^Autostart^Xfire.lnk] path=f:\documents and settings\Bartek\Menu Start\Programy\Autostart\Xfire.lnk backup=f:\windows\pss\Xfire.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-06-12 01:38 34672 f:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AppleSyncNotifier] --a------ 2008-07-22 19:42 116040 f:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] --------- 2006-11-02 07:55 1397760 f:\program files\Ahead\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2008-07-30 09:47 289064 f:\program files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2008-05-27 09:50 413696 f:\program files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl] --a------ 2004-11-02 19:24 32768 f:\programy bartek\PowerDVD\PDVDServ.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "f:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"= "f:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"= "f:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"= "f:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"= "f:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"= "f:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"= "f:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"= "f:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"= "f:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"= "f:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"= "c:\\emule\\emule.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "f:\\Program Files\\iTunes\\iTunes.exe"= "f:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"= "f:\\Program Files\\Microsoft Office\\Office12\\GROOVE.EXE"= "f:\\Program Files\\Microsoft Office\\Office12\\ONENOTE.EXE"= "e:\\avg\\antywirusowe\\avgupd.exe"= "e:\\avg\\antywirusowe\\avgnsx.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "25541:TCP"= 25541:TCP:BitComet 25541 TCP "25541:UDP"= 25541:UDP:BitComet 25541 UDP R0 AvgRkx86;avgrkx86.sys;f:\windows\system32\Drivers\avgrkx86.sys [2008-11-04 12936] R1 AvgLdx86;AVG AVI Loader Driver x86;f:\windows\system32\Drivers\avgldx86.sys [2008-11-04 98440] R1 AvgTdiX;AVG8 Network Redirector;f:\windows\system32\Drivers\avgtdix.sys [2008-11-04 90632] R2 avg8wd;AVG8 WatchDog;e:\avg\ANTYWI~1\avgwdsvc.exe [2008-11-04 231704] R2 avgfws8;AVG8 Firewall;e:\avg\ANTYWI~1\avgfws8.exe [2008-11-05 1212184] R3 Avgfwdx;Avgfwdx;f:\windows\system32\DRIVERS\avgfwdx.sys [2008-11-04 29208] R3 WFIOCTL;WFIOCTL;\??\f:\program files\WinFast\WFTVFM\WFIOCTL.SYS [2008-08-21 9446] S3 Avgfwfd;AVG network filter service;f:\windows\system32\DRIVERS\avgfwdx.sys [2008-11-04 29208] S3 PSI;PSI;f:\windows\system32\DRIVERS\psi_mf.sys [2008-06-16 7808] S3 SunkFilt6;Alcor Micro Corp - 6360;\??\f:\windows\System32\Drivers\sunkfilt6.sys [] S3 SunkFilt62;Alcor Micro Corp - 6362;\??\f:\windows\System32\Drivers\sunkfilt62.sys [] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost] HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12 hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{88e51e8b-6ef0-11dd-8970-806d6172696f}] \Shell\AutoRun\command - K:\Run.exe . Zawartość folderu 'Zaplanowane zadania' 2008-08-31 f:\windows\Tasks\AppleSoftwareUpdate.job - f:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57] . - - - - USUNIĘTO PUSTE WPISY - - - - MSConfigStartUp-AnyDVD - f:\program files\SlySoft\AnyDVD\AnyDVDtray.exe MSConfigStartUp-Corel File Shell Monitor - f:\program files\Corel\Corel Paint Shop Pro Photo X2\CorelIOMonitor.exe MSConfigStartUp-Corel Photo Downloader - f:\program files\Common Files\Corel\Corel PhotoDownloader\Corel Photo Downloader.exe MSConfigStartUp-SpybotSD TeaTimer - f:\program files\Spybot - Search & Destroy\TeaTimer.exe . ------- Skan uzupełniający ------- . FireFox -: Profile - f:\documents and settings\Bartek\Dane aplikacji\Mozilla\Firefox\Profiles\5kllfmfa.default\ FF -: plugin - f:\program files\iTunes\Mozilla Plugins\npitunes.dll FF -: plugin - f:\program files\Mozilla Firefox\plugins\npqtplugin8.dll FF -: plugin - f:\program files\QuickTime\Plugins\npqtplugin8.dll FF -: plugin - f:\programy bartek\ACE Mega CoDecS Pack\SystemS\RealMedia\Browser\plugins\nppl3260.dll FF -: plugin - f:\programy bartek\ACE Mega CoDecS Pack\SystemS\RealMedia\Browser\plugins\nprpjplug.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-20 00:11:50 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-11-20 0:12:14 ComboFix-quarantined-files.txt 2008-11-19 23:12:08 ComboFix2.txt 2008-11-05 11:53:09 Przed: 33 429 913 600 bajtów wolnych Po: 33,426,092,032 bajtów wolnych 542 --- E O F --- 2008-11-13 02:03:01

z góry dziękuję za fatygę ...

**Posty:** 684 · przez **djarta** 21 Lis 2008, 15:39

W logu nic nie ma.

ATX TRACER XENO 400W 12CM+PFC

To ma być żart? Taką zasiłkę (lub nie) <lol>

możesz wsadźić do mikrofali...

Weś od kogoś jakąś porządną zasiłkę i podłącz. Zobacz czy są te same problemy.
Ale narazie upewnimy się czy nie ma żadnego trojana.

Wykonaj to co jest podane w tym temacie (jeśli wykonałeś/łaś to wcześniej to nie rób tego).

Usuń ręcznie folder C:\Qoobox,

Usuń instalkę ComboFix z dysku.

Wykonaj optymalizację autostartu

Przeczyść komputer ATF-Cleaner

Wyłącz i włącz przywracanie systemu na wszystkich dyskach.Instrukcja

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

=============================
K.

**Posty:** 8 · przez **bartosz121** 22 Lis 2008, 13:45

Dziękuję za cenne porady zrobiłem wszystko po kolei jak kazałeś problem wynikł tylko przy scanie kasperskim online trwało to bardzo długo a jak chciałem zapisać raport to akurat problem się powtórzył i komputer się wyłączył ale nic skaner nie wykrył mam za to loga z FixIEDef oto on

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.20.6811 * * * ******************************************************************************** Created at 12:27:39 on Saturday, November 22, 2008 Time Zone : Logged On User : Bartek Operating System : Microsoft Windows XP Home Edition Dodatek Service Pack 3 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 Intel(R) Core(TM)2 CPU 6320 @ 1.86GHz System Drive : F:\ Windows Directory : F:\WINDOWS System Directory : F:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : system i programy System Drive Size : 80 GB System Drive Free : 53.33 GB Total Physical Memory: 3070 MB Free Physical Memory : 2573 MB Total Page File : 3070 MB Free Page File : 4596 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1956 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

No jest taki problem że komputer się nadal wyłącza <rotfl>

ostatnio siedziałem ze 3 godziny i dopiero się zrestartował zostawiłem na całą noc z bitcomet i się nie wyłączył ale zauważyłem ciekawą regułę jeśli wyłączę bitcomet to jego proces w menadżerze zadań windows nadal się znajduje to samo miałem wcześniej z utorrentem i jeśli chcę go wyłączyć to nie mogę ,jak wejdę w internet to dużo wolniej pracuje po czym po jakiejś nie określonej chwili -różnie to bywa wyłącza się komputer.Nie bardzo rozumiem dlaczego nie mogę do końca zakończyć pracy Bitcometa i dlaczego spowolnienie restartuje kompa...może to Ci coś podpowie wiem że mogę pisać dość niejasno dzięki jeszcze raz za fatygę :wink:

Dodano Dzisiaj, 23:33:

F:\WINDOWS\System32\Drivers\ak83Ioii.SYS i pisze obiekt jest ukryty

Aha jeszcze jedno pytanko które zadałem na początku nie wiecie co to jest ten rootkit proszę o odpowiedz jak ktoś wie :?:

zgóry dziękuję