spyware attack

[maciek_s]

Oto logi:

"Silent Runners.vbs", revision 46, http://www.silentrunners.org/
Operating System: Windows XP SP2
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS]
"Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."]
"Komunikator" = "C:\Program Files\Tlen.pl\tlen.exe" ["o2.pl Sp. z o.o."]

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++}
"cFosSpeed" = "D:\Programs\Cfoss\cFosSpeed.exe" ["cFos Software GmbH"]
"NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"]
"OrderReminder" = "C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe" ["Hewlett-Packard"]
"HydraVisionDesktopManager" = "C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe" ["ATI Technologies Inc."]
"SoundMan" = "SOUNDMAN.EXE" ["Realtek Semiconductor Corp."]
"WinampAgent" = "D:\Programs\Winamp\winampa.exe" [file not found]
"Adobe Photo Downloader" = ""D:\Programs\Adobe\Lightroom\apdproxy.exe"" ["Adobe Systems Incorporated"]
"!AVG Anti-Spyware" = ""D:\Programs\AVG Anti-Spyware 7.5\avgas.exe" /minimized" ["GRISOFT s.r.o."]
"b0b6f076" = "rundll32.exe "C:\WINDOWS\system32\postrdtr.dll",b" [MS]
"SmcService" = "D:\Programs\Sygate\SPF\smc.exe -startgui" ["Sygate Technologies, Inc."]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided)
-> {HKLM...CLSID} = "AcroIEHlprObj Class"
\InProcServer32\(Default) = "D:\Programs\Adobe\ActiveX\AcroIEHelper.dll" ["Adobe Systems Incorporated"]
{3AEACBF5-C6BC-4C5D-A0E2-4218F71C86D9}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\ddabc.dll" [null data]
{5ca7b125-755c-46a6-8d75-1fe6169f0441}\(Default) = "{1440f961-6ef1-57d8-6a64-c557521b7ac5}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\wcfpqjid.dll" [null data]
{7953954F-2C10-4D44-B3C2-38A289830253}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\mljjg.dll" [null data]
{837B45D6-BF85-457D-AABF-6D2E7815F791}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\xxyaxvw.dll" [null data]
{A95B2816-1D7E-4561-A202-68C0DE02353A}\(Default) = (no title provided)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\rwwendug.dll" [null data]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINDOWS\System32\hticons.dll" ["Hilgraeve, Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "D:\Programs\WinRAR\rarext.dll" [null data]
"{5858A72C-C2B4-4dd7-B2BF-B76DB1BD9F6C}" = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"
-> {HKLM...CLSID} = "Microsoft Office OneNote Namespace Extension for Windows Desktop Search"
\InProcServer32\(Default) = "D:\Programs\MICROS~1\Office12\ONFILTER.DLL" [MS]
"{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "D:\Programs\Microsoft Office\Office12\msohevi.dll" [MS]
"{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler"
-> {HKLM...CLSID} = "Microsoft Office Metadata Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]
"{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler"
-> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS]

HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\
INFECTION WARNING! "{837B45D6-BF85-457D-AABF-6D2E7815F791}" = "*n" (unwritable string)
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\WINDOWS\system32\xxyaxvw.dll" [null data]
INFECTION WARNING! "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5"
-> {HKLM...CLSID} = "CShellExecuteHookImpl Object"
\InProcServer32\(Default) = "D:\Programs\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["GRISOFT s.r.o."]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
INFECTION WARNING! AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."]
INFECTION WARNING! rwwendug\DLLName = "rwwendug.dll" [null data]
INFECTION WARNING! winrkq32\DLLName = "winrkq32.dll" [null data]
INFECTION WARNING! xxyaxvw\DLLName = "xxyaxvw.dll" [null data]

HKLM\Software\Classes\PROTOCOLS\Filter\
INFECTION WARNING! text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}"
-> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter"
\InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS]

HKLM\Software\Classes\Folder\shellex\ColumnHandlers\
{F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info"
-> {HKLM...CLSID} = "PDF Shell Extension"
\InProcServer32\(Default) = "D:\Programs\Adobe\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "D:\Programs\AVG Anti-Spyware 7.5\context.dll" ["GRISOFT s.r.o."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "D:\Programs\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}"
-> {HKLM...CLSID} = "CContextScan Object"
\InProcServer32\(Default) = "D:\Programs\AVG Anti-Spyware 7.5\context.dll" ["GRISOFT s.r.o."]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "D:\Programs\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "D:\Programs\WinRAR\rarext.dll" [null data]


Active Desktop and Wallpaper:
-----------------------------

Active Desktop is disabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\WINDOWS\web\wallpaper\Idylla.bmp"


Enabled Screen Saver:
---------------------

HKCU\Control Panel\Desktop\
"SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS]


Startup items in "Kasia" & "All Users" startup folders:
-------------------------------------------------------

C:\Documents and Settings\All Users.WINDOWS\Menu Start\Programy\Autostart
"Adobe Reader Speed Launch" -> shortcut to: "D:\Programs\Adobe\Reader\reader_sl.exe" ["Adobe Systems Incorporated"]


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]
000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Toolbars

HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\
"{11A69AE4-FBED-4832-A2BF-45AF82825583}"
-> {HKLM...CLSID} = "Security Toolbar"
\InProcServer32\(Default) = "C:\WINDOWS\system32\rwwendug.dll" [null data]

HKLM\Software\Microsoft\Internet Explorer\Toolbar\
"{11A69AE4-FBED-4832-A2BF-45AF82825583}" = (no title provided)
-> {HKLM...CLSID} = "Security Toolbar"
\InProcServer32\(Default) = "C:\WINDOWS\system32\rwwendug.dll" [null data]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{08B0E5C0-4FCB-11CF-AAA5-00401C608501}\
"MenuText" = "Sun Java Console"
"CLSIDExtension" = "{08B0E5C0-4FCB-11CF-AAA5-00401C608501}"

{2670000A-7350-4F3C-8081-5663EE0C6C49}\
"ButtonText" = "Wyślij do programu OneNote"
"MenuText" = "Wyślij &do programu OneNote"
"CLSIDExtension" = "{48E73304-E1D6-4330-914C-F5F514E3486C}"
-> {HKLM...CLSID} = "Send to OneNote from Internet Explorer button"
\InProcServer32\(Default) = "D:\Programs\MICROS~1\Office12\ONBttnIE.dll" [MS]

{92780B25-18CC-41C8-B9BE-3C9C571A8263}\
"ButtonText" = "Research"

{FB5F1910-F110-11D2-BB9E-00C04F795683}\
"ButtonText" = "Messenger"
"MenuText" = "Windows Messenger"
"Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS]


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\System32\Ati2evxx.exe" ["ATI Technologies Inc."]
AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, "D:\Programs\AVG Anti-Spyware 7.5\guard.exe" ["GRISOFT s.r.o."]
cFosSpeed System Service, cFosSpeedS, ""D:\Programs\Cfoss\spd.exe" -service" ["cFos Software GmbH"]


Print Monitors:
---------------

HKLM\System\CurrentControlSet\Control\Print\Monitors\
HPLJ1020LM\Driver = "ZLhp1020.DLL" ["Zenographics, Inc."]
Send To Microsoft OneNote Monitor\Driver = "msonpmon.dll" [MS]


----------
+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points and all Registry CLSIDs for dormant Explorer Bars,
use the -supp parameter or answer "No" at the first message box.
---------- (total run time: 65 seconds, including 18 seconds for message boxes)

Logfile of HijackThis v1.99.1
Scan saved at 09:17:58, on 2007-11-12
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Programs\AVG Anti-Spyware 7.5\guard.exe
D:\Programs\Cfoss\spd.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
D:\Programs\Cfoss\cFosSpeed.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\Programs\Adobe\Lightroom\apdproxy.exe
C:\WINDOWS\System32\svchost.exe
D:\Programs\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Gadu-Gadu\gg.exe
C:\Program Files\Tlen.pl\tlen.exe
D:\Programs\TC UP\TOTALCMD.EXE
C:\WINDOWS\System32\msiexec.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Internet Explorer\iexplore.exe
D:\Installs\Security\HijackThis.exe
C:\Program Files\Mozilla Firefox\firefox.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\rwwendug.dll
O4 - HKLM\..\Run: [cFosSpeed] D:\Programs\Cfoss\cFosSpeed.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [WinampAgent] D:\Programs\Winamp\winampa.exe
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Programs\Adobe\Lightroom\apdproxy.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Programs\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [b0b6f076] rundll32.exe "C:\WINDOWS\system32\postrdtr.dll",b
O4 - HKLM\..\Run: [SmcService] D:\Programs\Sygate\SPF\smc.exe -startgui
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [Komunikator] C:\Program Files\Tlen.pl\tlen.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Programs\Adobe\Reader\reader_sl.exe
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://D:\Programs\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_03\bin\npjpi141_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_03\bin\npjpi141_03.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Programs\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Programs\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programs\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Programs\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: cFosSpeed System Service (cFosSpeedS) - Unknown owner - D:\Programs\Cfoss\spd.exe" -service (file missing)
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - D:\Programs\Sygate\SPF\smc.exe

z góry dzięki

[Precel]

napisz co dzieje sie z kompem niedostosowanie sie do mojej prośby skończy sie zamknięciem tematu i przeniesieniem go do kosza

[maciek_s]

Sorki.

Wyskakują mi komunikaty o zainfekowaniu trojanami.. zainstalował mi się jakiś pseudo programik do zwalczania wirusów "on line security" czy coś podobnego... plus spowolnienie pracy komputera i obniżenie prędkości netu

[wojtas]

Wykonaj to co jest podane w tym temacie

zastosuj:

smitfraudfix z opcji 2

oraz te skanery po kilka razy

VundoFix

VirtumundoBeGone

FixVundo

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz z hijacka

[maciek_s]

Oto żądane logi:

SDFix: Version 1.114

Run by Administrator on 2007-11-12 at 20:35

Microsoft Windows XP [Wersja 5.1.2600]

Running From: C:\SDFix

Safe Mode:
Checking Services:


Restoring Windows Registry Values
Restoring Windows Default Hosts File

Rebooting...


Normal Mode:
Checking Files:

Trojan Files Found:

C:\WINDOWS\TEMP\WIN1.TMP - Deleted
C:\WINDOWS\TEMP\WIN10.TMP - Deleted
C:\WINDOWS\TEMP\WIN11.TMP - Deleted
C:\WINDOWS\TEMP\WIN12.TMP - Deleted
C:\WINDOWS\TEMP\WIN13.TMP - Deleted
C:\WINDOWS\TEMP\WIN14.TMP - Deleted
C:\WINDOWS\TEMP\WIN15.TMP - Deleted
C:\WINDOWS\TEMP\WIN16.TMP - Deleted
C:\WINDOWS\TEMP\WIN17.TMP - Deleted
C:\WINDOWS\TEMP\WIN18.TMP - Deleted
C:\WINDOWS\TEMP\WIN19.TMP - Deleted
C:\WINDOWS\TEMP\WIN1A.TMP - Deleted
C:\WINDOWS\TEMP\WIN1B.TMP - Deleted
C:\WINDOWS\TEMP\WIN1D.TMP - Deleted
C:\WINDOWS\TEMP\WIN1E.TMP - Deleted
C:\WINDOWS\TEMP\WIN1F.TMP - Deleted
C:\WINDOWS\TEMP\WIN2.TMP - Deleted
C:\WINDOWS\TEMP\WIN20.TMP - Deleted
C:\WINDOWS\TEMP\WIN21.TMP - Deleted
C:\WINDOWS\TEMP\WIN22.TMP - Deleted
C:\WINDOWS\TEMP\WIN23.TMP - Deleted
C:\WINDOWS\TEMP\WIN24.TMP - Deleted
C:\WINDOWS\TEMP\WIN25.TMP - Deleted
C:\WINDOWS\TEMP\WIN26.TMP - Deleted
C:\WINDOWS\TEMP\WIN2C.TMP - Deleted
C:\WINDOWS\TEMP\WIN2D.TMP - Deleted
C:\WINDOWS\TEMP\WIN2E.TMP - Deleted
C:\WINDOWS\TEMP\WIN3.TMP - Deleted
C:\WINDOWS\TEMP\WIN31.TMP - Deleted
C:\WINDOWS\TEMP\WIN32.TMP - Deleted
C:\WINDOWS\TEMP\WIN34.TMP - Deleted
C:\WINDOWS\TEMP\WIN35.TMP - Deleted
C:\WINDOWS\TEMP\WIN36.TMP - Deleted
C:\WINDOWS\TEMP\WIN37.TMP - Deleted
C:\WINDOWS\TEMP\WIN3D.TMP - Deleted
C:\WINDOWS\TEMP\WIN3E.TMP - Deleted
C:\WINDOWS\TEMP\WIN3F.TMP - Deleted
C:\WINDOWS\TEMP\WIN4.TMP - Deleted
C:\WINDOWS\TEMP\WIN40.TMP - Deleted
C:\WINDOWS\TEMP\WIN41.TMP - Deleted
C:\WINDOWS\TEMP\WIN42.TMP - Deleted
C:\WINDOWS\TEMP\WIN43.TMP - Deleted
C:\WINDOWS\TEMP\WIN44.TMP - Deleted
C:\WINDOWS\TEMP\WIN45.TMP - Deleted
C:\WINDOWS\TEMP\WIN46.TMP - Deleted
C:\WINDOWS\TEMP\WIN48.TMP - Deleted
C:\WINDOWS\TEMP\WIN49.TMP - Deleted
C:\WINDOWS\TEMP\WIN4A.TMP - Deleted
C:\WINDOWS\TEMP\WIN4B.TMP - Deleted
C:\WINDOWS\TEMP\WIN4C.TMP - Deleted
C:\WINDOWS\TEMP\WIN4D.TMP - Deleted
C:\WINDOWS\TEMP\WIN4E.TMP - Deleted
C:\WINDOWS\TEMP\WIN4F.TMP - Deleted
C:\WINDOWS\TEMP\WIN5.TMP - Deleted
C:\WINDOWS\TEMP\WIN50.TMP - Deleted
C:\WINDOWS\TEMP\WIN51.TMP - Deleted
C:\WINDOWS\TEMP\WIN52.TMP - Deleted
C:\WINDOWS\TEMP\WIN53.TMP - Deleted
C:\WINDOWS\TEMP\WIN54.TMP - Deleted
C:\WINDOWS\TEMP\WIN55.TMP - Deleted
C:\WINDOWS\TEMP\WIN57.TMP - Deleted
C:\WINDOWS\TEMP\WIN58.TMP - Deleted
C:\WINDOWS\TEMP\WIN59.TMP - Deleted
C:\WINDOWS\TEMP\WIN5A.TMP - Deleted
C:\WINDOWS\TEMP\WIN5B.TMP - Deleted
C:\WINDOWS\TEMP\WIN5C.TMP - Deleted
C:\WINDOWS\TEMP\WIN5D.TMP - Deleted
C:\WINDOWS\TEMP\WIN5E.TMP - Deleted
C:\WINDOWS\TEMP\WIN5F.TMP - Deleted
C:\WINDOWS\TEMP\WIN6.TMP - Deleted
C:\WINDOWS\TEMP\WIN60.TMP - Deleted
C:\WINDOWS\TEMP\WIN61.TMP - Deleted
C:\WINDOWS\TEMP\WIN62.TMP - Deleted
C:\WINDOWS\TEMP\WIN63.TMP - Deleted
C:\WINDOWS\TEMP\WIN64.TMP - Deleted
C:\WINDOWS\TEMP\WIN65.TMP - Deleted
C:\WINDOWS\TEMP\WIN66.TMP - Deleted
C:\WINDOWS\TEMP\WIN67.TMP - Deleted
C:\WINDOWS\TEMP\WIN68.TMP - Deleted
C:\WINDOWS\TEMP\WIN69.TMP - Deleted
C:\WINDOWS\TEMP\WIN6A.TMP - Deleted
C:\WINDOWS\TEMP\WIN6C.TMP - Deleted
C:\WINDOWS\TEMP\WIN6D.TMP - Deleted
C:\WINDOWS\TEMP\WIN6E.TMP - Deleted
C:\WINDOWS\TEMP\WIN6F.TMP - Deleted
C:\WINDOWS\TEMP\WIN7.TMP - Deleted
C:\WINDOWS\TEMP\WIN70.TMP - Deleted
C:\WINDOWS\TEMP\WIN71.TMP - Deleted
C:\WINDOWS\TEMP\WIN72.TMP - Deleted
C:\WINDOWS\TEMP\WIN73.TMP - Deleted
C:\WINDOWS\TEMP\WIN74.TMP - Deleted
C:\WINDOWS\TEMP\WIN75.TMP - Deleted
C:\WINDOWS\TEMP\WIN76.TMP - Deleted
C:\WINDOWS\TEMP\WIN77.TMP - Deleted
C:\WINDOWS\TEMP\WIN78.TMP - Deleted
C:\WINDOWS\TEMP\WIN79.TMP - Deleted
C:\WINDOWS\TEMP\WIN7A.TMP - Deleted
C:\WINDOWS\TEMP\WIN7B.TMP - Deleted
C:\WINDOWS\TEMP\WIN7C.TMP - Deleted
C:\WINDOWS\TEMP\WIN7D.TMP - Deleted
C:\WINDOWS\TEMP\WIN7E.TMP - Deleted
C:\WINDOWS\TEMP\WIN7F.TMP - Deleted
C:\WINDOWS\TEMP\WIN8.TMP - Deleted
C:\WINDOWS\TEMP\WIN80.TMP - Deleted
C:\WINDOWS\TEMP\WIN81.TMP - Deleted
C:\WINDOWS\TEMP\WIN82.TMP - Deleted
C:\WINDOWS\TEMP\WIN83.TMP - Deleted
C:\WINDOWS\TEMP\WIN84.TMP - Deleted
C:\WINDOWS\TEMP\WIN85.TMP - Deleted
C:\WINDOWS\TEMP\WIN86.TMP - Deleted
C:\WINDOWS\TEMP\WIN87.TMP - Deleted
C:\WINDOWS\TEMP\WIN88.TMP - Deleted
C:\WINDOWS\TEMP\WIN89.TMP - Deleted
C:\WINDOWS\TEMP\WIN8A.TMP - Deleted
C:\WINDOWS\TEMP\WIN8C.TMP - Deleted
C:\WINDOWS\TEMP\WIN8D.TMP - Deleted
C:\WINDOWS\TEMP\WIN8E.TMP - Deleted
C:\WINDOWS\TEMP\WIN8F.TMP - Deleted
C:\WINDOWS\TEMP\WIN90.TMP - Deleted
C:\WINDOWS\TEMP\WIN91.TMP - Deleted
C:\WINDOWS\TEMP\WIN92.TMP - Deleted
C:\WINDOWS\TEMP\WIN93.TMP - Deleted
C:\WINDOWS\TEMP\WIN94.TMP - Deleted
C:\WINDOWS\TEMP\WIN95.TMP - Deleted
C:\WINDOWS\TEMP\WIN96.TMP - Deleted
C:\WINDOWS\TEMP\WIN97.TMP - Deleted
C:\WINDOWS\TEMP\WIN98.TMP - Deleted
C:\WINDOWS\TEMP\WIN99.TMP - Deleted
C:\WINDOWS\TEMP\WIN9A.TMP - Deleted
C:\WINDOWS\TEMP\WIN9B.TMP - Deleted
C:\WINDOWS\TEMP\WIN9C.TMP - Deleted
C:\WINDOWS\TEMP\WIN9D.TMP - Deleted
C:\WINDOWS\TEMP\WIN9E.TMP - Deleted
C:\WINDOWS\TEMP\WIN9F.TMP - Deleted
C:\WINDOWS\TEMP\WINA.TMP - Deleted
C:\WINDOWS\TEMP\WINA0.TMP - Deleted
C:\WINDOWS\TEMP\WINA1.TMP - Deleted
C:\WINDOWS\TEMP\WINA2.TMP - Deleted
C:\WINDOWS\TEMP\WINA3.TMP - Deleted
C:\WINDOWS\TEMP\WINA4.TMP - Deleted
C:\WINDOWS\TEMP\WINA5.TMP - Deleted
C:\WINDOWS\TEMP\WINA6.TMP - Deleted
C:\WINDOWS\TEMP\WINA7.TMP - Deleted
C:\WINDOWS\TEMP\WINA8.TMP - Deleted
C:\WINDOWS\TEMP\WINA9.TMP - Deleted
C:\WINDOWS\TEMP\WINAA.TMP - Deleted
C:\WINDOWS\TEMP\WINAB.TMP - Deleted
C:\WINDOWS\TEMP\WINAC.TMP - Deleted
C:\WINDOWS\TEMP\WINAD.TMP - Deleted
C:\WINDOWS\TEMP\WINAE.TMP - Deleted
C:\WINDOWS\TEMP\WINAF.TMP - Deleted
C:\WINDOWS\TEMP\WINB.TMP - Deleted
C:\WINDOWS\TEMP\WINB0.TMP - Deleted
C:\WINDOWS\TEMP\WINB1.TMP - Deleted
C:\WINDOWS\TEMP\WINB2.TMP - Deleted
C:\WINDOWS\TEMP\WINB3.TMP - Deleted
C:\WINDOWS\TEMP\WINB4.TMP - Deleted
C:\WINDOWS\TEMP\WINB5.TMP - Deleted
C:\WINDOWS\TEMP\WINB6.TMP - Deleted
C:\WINDOWS\TEMP\WINB7.TMP - Deleted
C:\WINDOWS\TEMP\WINB8.TMP - Deleted
C:\WINDOWS\TEMP\WINBA.TMP - Deleted
C:\WINDOWS\TEMP\WINBB.TMP - Deleted
C:\WINDOWS\TEMP\WINBC.TMP - Deleted
C:\WINDOWS\TEMP\WINBD.TMP - Deleted
C:\WINDOWS\TEMP\WINBE.TMP - Deleted
C:\WINDOWS\TEMP\WINBF.TMP - Deleted
C:\WINDOWS\TEMP\WINC.TMP - Deleted
C:\WINDOWS\TEMP\WINC0.TMP - Deleted
C:\WINDOWS\TEMP\WINC1.TMP - Deleted
C:\WINDOWS\TEMP\WINC2.TMP - Deleted
C:\WINDOWS\TEMP\WINC4.TMP - Deleted
C:\WINDOWS\TEMP\WINC7.TMP - Deleted
C:\WINDOWS\TEMP\WINC8.TMP - Deleted
C:\WINDOWS\TEMP\WINC9.TMP - Deleted
C:\WINDOWS\TEMP\WINCA.TMP - Deleted
C:\WINDOWS\TEMP\WINCB.TMP - Deleted
C:\WINDOWS\TEMP\WINCC.TMP - Deleted
C:\WINDOWS\TEMP\WINCD.TMP - Deleted
C:\WINDOWS\TEMP\WINCE.TMP - Deleted
C:\WINDOWS\TEMP\WINCF.TMP - Deleted
C:\WINDOWS\TEMP\WIND.TMP - Deleted
C:\WINDOWS\TEMP\WIND0.TMP - Deleted
C:\WINDOWS\TEMP\WIND1.TMP - Deleted
C:\WINDOWS\TEMP\WIND2.TMP - Deleted
C:\WINDOWS\TEMP\WIND3.TMP - Deleted
C:\WINDOWS\TEMP\WINE.TMP - Deleted
C:\WINDOWS\TEMP\WINF.TMP - Deleted



Removing Temp Files...

ADS Check:

C:\WINDOWS
No streams found.

C:\WINDOWS\system32
No streams found.

C:\WINDOWS\system32\svchost.exe
No streams found.

C:\WINDOWS\system32\ntoskrnl.exe
No streams found.



Final Check:

catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-12 20:43:26
Windows 5.1.2600 Dodatek Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

scanning hidden registry entries ...

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Favorites\A\1\5\1c]
"Order"=hex:08,00,00,00,02,00,00,00,b8,01,00,00,01,00,00,00,04,00,00,00,8c,..

scanning hidden files ...

scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0


Remaining Services:
------------------



Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"D:\\Programs\\Microsoft Office\\Office12\\ONENOTE.EXE"="D:\\Programs\\Microsoft Office\\Office12\\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote"
"C:\\Program Files\\Gadu-Gadu\\gg.exe"="C:\\Program Files\\Gadu-Gadu\\gg.exe:*:Enabled:Gadu-Gadu - program gˆ˘wny"
"C:\\Program Files\\Tlen.pl\\tlen.exe"="C:\\Program Files\\Tlen.pl\\tlen.exe:*:Enabled:Komunikator Tlen.pl"
"D:\\Programs\\Azureus\\Azureus.exe"="D:\\Programs\\Azureus\\Azureus.exe:*:Enabled:Azureus"
"D:\\Programs\\eMule\\emule.exe"="D:\\Programs\\eMule\\emule.exe:*:Enabled:eMule"
"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:uTorrent"
"C:\\DOCUME~1\\MACIEK~1.HOM\\USTAWI~1\\Temp\\win29.exe"="C:\\DOCUME~1\\MACIEK~1.HOM\\USTAWI~1\\Temp\\win29.exe:*:Enabled:win29"
"C:\\WINDOWS\\system32\\wyoibytm.exe"="C:\\WINDOWS\\system32\\wyo"
"C:\\WINDOWS\\TEMP\\winC6.exe"="C:\\WINDOWS\\TEMP\\winC6.exe:*:Enabled:winC6"
"C:\\WINDOWS\\system32\\ndvrxgug.exe"="C:\\WINDOWS\\system32\\ndv"
"C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

Remaining Files:
---------------
C:\WINDOWS\TEMP\WIN3.TMP Found
C:\WINDOWS\TEMP\WIN4.TMP Found
C:\WINDOWS\TEMP\WIN5.TMP Found

File Backups: - C:\SDFix\backups\backups.zip

Files with Hidden Attributes:

Wed 4 Aug 2004 3,555,328 A..H. --- "C:\Program Files\Movie Maker\moviemk.exe"
Fri 26 Oct 2001 110,657 A..H. --- "C:\Program Files\Movie Maker\wmmfilt.dll"
Fri 26 Oct 2001 327,743 A..H. --- "C:\Program Files\Movie Maker\wmmres.dll"
Fri 26 Oct 2001 163,906 A..H. --- "C:\Program Files\Movie Maker\wmmutil.dll"
Wed 4 Aug 2004 385,024 A..H. --- "C:\Program Files\NetMeeting\callcont.dll"
Fri 26 Oct 2001 12,288 A..H. --- "C:\Program Files\NetMeeting\cb32.exe"
Wed 4 Aug 2004 1,036,288 A..H. --- "C:\Program Files\NetMeeting\conf.exe"
Wed 4 Aug 2004 45,056 A..H. --- "C:\Program Files\NetMeeting\confmrsl.dll"
Wed 4 Aug 2004 40,960 A..H. --- "C:\Program Files\NetMeeting\dcap32.dll"
Wed 4 Aug 2004 57,344 A..H. --- "C:\Program Files\NetMeeting\h323cc.dll"
Wed 4 Aug 2004 274,432 A..H. --- "C:\Program Files\NetMeeting\mst120.dll"
Wed 4 Aug 2004 57,344 A..H. --- "C:\Program Files\NetMeeting\mst123.dll"
Wed 4 Aug 2004 221,184 A..H. --- "C:\Program Files\NetMeeting\nac.dll"
Wed 4 Aug 2004 229,376 A..H. --- "C:\Program Files\NetMeeting\nmas.dll"
Wed 4 Aug 2004 28,672 A..H. --- "C:\Program Files\NetMeeting\nmasnt.dll"
Wed 4 Aug 2004 81,920 A..H. --- "C:\Program Files\NetMeeting\nmchat.dll"
Wed 4 Aug 2004 77,824 A..H. --- "C:\Program Files\NetMeeting\nmcom.dll"
Wed 4 Aug 2004 151,552 A..H. --- "C:\Program Files\NetMeeting\nmft.dll"
Wed 4 Aug 2004 172,032 A..H. --- "C:\Program Files\NetMeeting\nmoldwb.dll"
Wed 4 Aug 2004 188,416 A..H. --- "C:\Program Files\NetMeeting\nmwb.dll"
Wed 4 Aug 2004 61,440 A..H. --- "C:\Program Files\NetMeeting\rrcm.dll"
Fri 26 Oct 2001 12,288 A..H. --- "C:\Program Files\NetMeeting\wb32.exe"
Mon 12 Nov 2007 20,640 ..SH. --- "C:\WINDOWS\system32\rwwendug.dllbox"
Sat 24 Mar 2007 13 ...H. --- "C:\Documents and Settings\All Users\Dane aplikacji\íŢĆŽ3113>.sys"
Tue 5 Dec 2006 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak"
Fri 26 Oct 2001 77,824 A..H. --- "C:\Program Files\MSN\MSNCoreFiles\copymar.exe"
Fri 26 Oct 2001 72,104 A..H. --- "C:\Program Files\MSN\MSNCoreFiles\csapi3t1.dll"
Fri 26 Oct 2001 24,576 A..H. --- "C:\Program Files\MSN\MSNCoreFiles\custdial.dll"
Fri 26 Oct 2001 161,184 A..H. --- "C:\Program Files\MSN\MSNCoreFiles\dw.exe"
Fri 26 Oct 2001 245,760 A..H. --- "C:\Program Files\MSN\MSNCoreFiles\logonmgr.dll"
Fri 26 Oct 2001 53,248 A..H. --- "C:\Program Files\MSN\MSNCoreFiles\migrate.dll"
Fri 26 Oct 2001 65,536 A..H. --- "C:\Program Files\MSN\MSNCoreFiles\msdbx.dll"
Fri 26 Oct 2001 372,736 A..H. --- "C:\Program Files\MSN\MSNCoreFiles\msmom.dll"
Fri 26 Oct 2001 90,112 A..H. --- "C:\Program Files\MSN\MSNCoreFiles\msn6.exe"
Fri 26 Oct 2001 1,032,192 A..H. --- "C:\Program Files\MSN\MSNCoreFiles\msnmetal.dll"
Fri 26 Oct 2001 90,112 A..H. --- "C:\Program Files\MSN\MSNCoreFiles\msnmtllc.dll"
Fri 26 Oct 2001 94,208 A..H. --- "C:\Program Files\MSN\MSNCoreFiles\msnspell.dll"
Fri 26 Oct 2001 90,112 A..H. --- "C:\Program Files\MSN\MSNCoreFiles\popc.dll"
Fri 26 Oct 2001 141,736 A..H. --- "C:\Program Files\MSN\MSNCoreFiles\sqdll.dll"
Fri 26 Oct 2001 77,824 A..H. --- "C:\Program Files\MSN\MSNCoreFiles\update.exe"
Fri 26 Oct 2001 82,501 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\bckg.dll"
Fri 26 Oct 2001 1,817,687 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\bckgres.dll"
Fri 26 Oct 2001 42,577 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\bckgzm.exe"
Fri 26 Oct 2001 40,515 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\chkr.dll"
Fri 26 Oct 2001 781,397 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\chkrres.dll"
Fri 26 Oct 2001 42,575 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\chkrzm.exe"
Fri 26 Oct 2001 217,160 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\Cmnclim.dll"
Fri 26 Oct 2001 1,041,491 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\Cmnresm.dll"
Fri 26 Oct 2001 57,409 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\hrtz.dll"
Fri 26 Oct 2001 1,175,635 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\Hrtzres.dll"
Fri 26 Oct 2001 42,573 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\hrtzzm.exe"
Fri 26 Oct 2001 48,706 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\rvse.dll"
Fri 26 Oct 2001 753,236 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\Rvseres.dll"
Fri 26 Oct 2001 42,574 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\Rvsezm.exe"
Fri 26 Oct 2001 66,113 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\shvl.dll"
Fri 26 Oct 2001 2,178,131 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\Shvlres.dll"
Fri 26 Oct 2001 42,573 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\shvlzm.exe"
Fri 26 Oct 2001 32,339 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\UniAnsi.dll"
Fri 26 Oct 2001 36,937 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\zClientm.exe"
Fri 26 Oct 2001 41,029 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\ZCorem.dll"
Fri 26 Oct 2001 4,677 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\zeeverm.dll"
Fri 26 Oct 2001 29,760 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\ZNetM.dll"
Fri 26 Oct 2001 113,222 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\zoneclim.dll"
Fri 26 Oct 2001 13,894 A..H. --- "C:\Program Files\MSN Gaming Zone\Windows\zonelibM.dll"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico1.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico10.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico11.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico12.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico13.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico14.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico15.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico16.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico17.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico18.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico19.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico1A.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico1B.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico1C.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico1D.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico1E.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico1F.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico2.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico20.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico21.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico22.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico23.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico24.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico25.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico26.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico27.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico28.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico29.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico2A.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico2B.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico2C.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico2D.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico2E.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico2F.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico3.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico30.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico31.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico32.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico3C.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico3D.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico3E.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico3F.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico4.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico40.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico41.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico42.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico43.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico44.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico45.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico4B.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico4C.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico4D.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico4E.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico4F.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico5.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico50.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico51.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico52.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico53.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico54.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico56.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico57.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico58.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico59.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico5A.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico5B.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico5C.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico5D.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico5E.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico5F.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico6.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico62.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico63.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico64.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico65.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico66.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico67.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico68.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico69.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico6A.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico6B.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico6C.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico6D.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico6E.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico6F.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico7.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico70.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico73.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico74.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico75.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico76.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico77.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico78.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico79.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico7A.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico7B.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico7C.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico8.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico82.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico83.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico84.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico85.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico86.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico87.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico88.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico89.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico8A.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico8B.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico9.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico98.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico99.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico9A.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico9B.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico9C.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoA.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoB.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoC.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoD.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoE.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoF.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico1.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico10.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico2.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico27.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico28.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico29.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico2A.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico2B.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico3.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico38.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico39.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico3A.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico3B.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico3C.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico4.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico5.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico7.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico8.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\ico9.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoA.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoB.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoBA.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoBB.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoBC.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoBD.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoBE.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoC.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoD.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoD6.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoD7.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoD8.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoD9.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoDA.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoDB.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoDC.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoDD.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoDE.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoDF.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoE.tmp"
Mon 12 Nov 2007 4,286 A..H. --- "C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ustawienia lokalne\Temp\icoF.tmp"
Fri 26 Oct 2001 55,440 A..H. --- "C:\Program Files\MSN\MSNCoreFiles\1045\dwintl.dll"
Fri 26 Oct 2001 28,672 A..H. --- "C:\Program Files\MSN\MSNCoreFiles\Setup\migrate.dll"
Fri 26 Oct 2001 6,656 A..H. --- "C:\Program Files\MSN\MSNCoreFiles\Setup\msn9xmig.dll"
Fri 26 Oct 2001 32,768 A..H. --- "C:\Program Files\MSN\MSNCoreFiles\Setup\msnunin.exe"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\066f4c6032ec52b2d0460047fd5c67aa\BIT44.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\076f1aa5a201db5b428fbe164817aab2\BIT4B.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0d5de1cd7fc62d3668ea0afcc642fb24\BIT42.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\1679cd06c3d72c42ad169baedad676c9\BIT51.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\20a4a6e3d70f3001229eaa8cf46f9b6e\BIT41.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\22d177b61fde58f114e05dfd9b70c96d\BIT37.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\24823ed08383f02a4a29c3ae029f9c14\BIT45.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\286ced246fa8efd37a907f9f08846ce8\BIT57.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2c7c094c07d8ab1c6d2c7df6e96d2df0\BIT50.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\42a9e16ebc4d2a5515c111ecad82af2f\BIT3F.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\5c9fd830c61df8040995447f1d8e61b0\BIT29.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\6d3e4a8f99a381f392de0d99b22fc9a6\BIT4D.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\762fc57e7d7138faef1f37e9eec268dc\BIT4F.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\7bfd24c44368c1f4c08da0b18d20b54e\BIT4C.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8024f4e99b89fb365c808f79d373434f\BIT4A.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8b0720d229b505788fc5c09af3f8c479\BIT3E.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\8fc9362cdeea2d9e312dca7d0ae818ee\BIT40.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\929cd614a46aa170511c3292b3848eb2\BIT3C.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9fde447cfd86a360844378b784e73f37\BIT33.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a23edd26fc03189a66774c8772cf784c\BIT54.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a700888399b59cee38c0ae52e87f0a91\BIT56.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a973a4b0bff52375def6ea55f54d9f60\BIT53.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\abf37927fe96bc682b342849c5743771\BIT34.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\be1ffa8cce945fce80b8bcf08e4890c5\BIT32.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c636f36b2a084e07ecb5cf11b488b148\BIT48.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c7ca82c6527101a1221a39f48bd67bac\BIT38.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\cceb21cd2a7a35a4e5b1d264978f4dfd\BIT4E.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d24445e8cd369b6927c4ffb132d21fca\BIT3B.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\df4c8391579dd99f8d7ffa70e2eb37c3\BIT52.tmp"
Mon 12 Nov 2007 804,768 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\e6a7525a4b32c7adb3b1c81ba8f28cb5\BIT2D.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f0b88fe1ffe91bd3a9ea0d5ad18f24b7\BIT58.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f57c255e25adcef74d2dff8c5940b09c\BIT46.tmp"
Wed 19 Sep 2007 444 ...HR --- "C:\Documents and Settings\Maciek\Dane aplikacji\SecuROM\UserData\securom_v7_01.bak"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0300c0210ca0c3725210067af2e4882c\download\BIT55.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\0fffd07eaf930cc2973bc1444b13a2dd\download\BIT5F.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\12653710f178a9422c9846070c687e8e\download\BIT49.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\1b87084fdbfcd6d6273c66bb33faa288\download\BIT14.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\2f591c6de1d57e751071795880d0c1d2\download\BIT5D.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\31383aab90693af2687520e301606b09\download\BITE.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\3685dbdd2272739b2f3609d9dc699b5f\download\BIT11.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4594f50665d34bef5af87c38b6953ce2\download\BITB.tmp"
Mon 12 Nov 2007 765,039 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4c41adde360d8087c4b4dd4e2d835dec\download\BIT65.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\4d39b1b575a5584d11abd56a8de2f045\download\BIT10.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\607c3e95df650a193f50ba0792fb4a68\download\BIT5E.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\67363d1e42ce421cde25a6a620fabf78\download\BIT60.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\6d09d0f1482adb9cdbb79b3d45a002d6\download\BIT5B.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\94ccbe980556f2828ed2d3768c02f4dd\download\BIT8.tmp"
Mon 12 Nov 2007 171,842 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\99c63b8154c86bb80bd4d4ef1f97d4ee\download\BIT6B.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\9ec74fb7ec17ab7a6f098ff95504d6d2\download\BITF.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a8e852df97910fef5d18e30ff3fc6517\download\BIT5C.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\aa5843f35b888e23da16633e2a1ea0ba\download\BITA.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\b96f4018a5a1e8840e523891e4664d45\download\BITC.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\baf5873d097c20aedd3e06e2ff27a933\download\BIT13.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\c16cb0a8736e71c6b91afa7e786ebaca\download\BIT59.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d36bccab140cfdcbeab0c880e5a7c294\download\BIT4.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d4630b482e634466a28ee1e624558dd5\download\BIT9.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\d73b5fdacb6f744050beee3d7f715ec6\download\BIT26.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ec799b70d90cb0bf29b4da57cffabd91\download\BIT3.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\f34ea1aa600dc2889509baa1a15ec8f8\download\BITD.tmp"
Mon 12 Nov 2007 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fd43c53f6dd72556f6c8c981a93ce522\download\BIT12.tmp"

Finished!

Logfile of HijackThis v1.99.1
Scan saved at 20:49:51, on 2007-11-12
Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\Programs\Sygate\SPF\smc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
D:\Programs\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
C:\WINDOWS\SOUNDMAN.EXE
D:\Programs\Adobe\Lightroom\apdproxy.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
D:\Programs\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Gadu-Gadu\gg.exe
D:\Programs\Adobe\Reader\reader_sl.exe
D:\Programs\Microsoft Office\Office12\ONENOTEM.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
D:\Programs\TC UP\TOTALCMD.EXE
D:\Installs\Security\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Adobe Photo Downloader] "D:\Programs\Adobe\Lightroom\apdproxy.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Programs\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SmcService] D:\Programs\Sygate\SPF\smc.exe -startgui
O4 - HKLM\..\Run: [b0b6f076] rundll32.exe "C:\WINDOWS\system32\enqjhvkh.dll",b
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Tworzenie wycinków ekranu i uruchamianie programu OneNote 2007.lnk = D:\Programs\Microsoft Office\Office12\ONENOTEM.EXE
O4 - Global Startup: Adobe Reader Speed Launch.lnk = D:\Programs\Adobe\Reader\reader_sl.exe
O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://D:\Programs\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_03\bin\npjpi141_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.1_03\bin\npjpi141_03.dll
O9 - Extra button: Wyślij do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Programs\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Wyślij &do programu OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - D:\Programs\MICROS~1\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programs\MICROS~1\Office12\REFIEBAR.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Programs\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Sygate Personal Firewall (SmcService) - Sygate Technologies, Inc. - D:\Programs\Sygate\SPF\smc.exe

ComboFix 07-11-08.1 - Maciek 2007-11-12 20:53:15.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.175 [GMT 1:00]
Running from: D:\Installs\Security\ComboFix.exe
* Created a new restore point
.

Unable to gain System Privileges

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\All Users.WINDOWS\Menu Start\Live Safety Center.lnk
C:\Documents and Settings\All Users.WINDOWS\Menu Start\Online Security Guide.lnk
C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ulubione\Online Security Guide.lnk
C:\Documents and Settings\Kasia\Pulpit\internet.lnk
C:\Documents and Settings\LocalService\Dane aplikacji\NetMon
C:\Documents and Settings\LocalService\Dane aplikacji\NetMon\domains.txt
C:\Documents and Settings\LocalService\Dane aplikacji\NetMon\log.txt
C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Ulubione\Online Security Guide.lnk
C:\Documents and Settings\Maciek\Dane aplikacji\Install.dat
C:\WINDOWS\system32\ayadd.ini
C:\WINDOWS\system32\ayadd.ini2
C:\WINDOWS\system32\ddabc.dll
C:\WINDOWS\system32\ddaya.dll
C:\WINDOWS\system32\rwwendug.dllbox
C:\WINDOWS\system32\winrkq32.dll
C:\windows\xpupdate.exe

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService


((((((((((((((((((((((((( Files Created from 2007-10-12 to 2007-11-12 )))))))))))))))))))))))))))))))
.

2007-11-12 20:50 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-12 20:34 <DIR> d-------- C:\WINDOWS\ERUNT
2007-11-12 20:33 <DIR> d--h----- C:\Documents and Settings\Administrator.HOME-MSJ0FOWGZT\Ustawienia lokalne
2007-11-12 20:33 <DIR> d-------- C:\Documents and Settings\Administrator.HOME-MSJ0FOWGZT\Ulubione
2007-11-12 20:33 <DIR> d--h----- C:\Documents and Settings\Administrator.HOME-MSJ0FOWGZT\Szablony
2007-11-12 20:33 <DIR> d-------- C:\Documents and Settings\Administrator.HOME-MSJ0FOWGZT\Pulpit
2007-11-12 20:33 <DIR> d-------- C:\Documents and Settings\Administrator.HOME-MSJ0FOWGZT\Moje dokumenty
2007-11-12 20:33 <DIR> dr------- C:\Documents and Settings\Administrator.HOME-MSJ0FOWGZT\Menu Start
2007-11-12 20:33 <DIR> dr-h----- C:\Documents and Settings\Administrator.HOME-MSJ0FOWGZT\Dane aplikacji
2007-11-12 19:51 81,472 --a------ C:\WINDOWS\system32\qxxlymws.dll
2007-11-12 19:43 145,984 --a------ C:\WINDOWS\system32\eqavocfd.dll
2007-11-12 19:43 89,664 --a------ C:\WINDOWS\system32\enqjhvkh.dll
2007-11-12 18:51 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2007-11-12 18:14 145,984 --a------ C:\WINDOWS\system32\vyfvefsg.dll
2007-11-12 14:56 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Spybot - Search & Destroy
2007-11-12 14:47 1,448 --a------ C:\WINDOWS\system32\tmp.reg
2007-11-12 14:46 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2007-11-12 14:46 53,248 --a------ C:\WINDOWS\system32\Process.exe
2007-11-12 14:46 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2007-11-12 14:34 <DIR> d-------- C:\WINDOWS\pss
2007-11-12 14:30 81,472 --a------ C:\WINDOWS\system32\rwkmjsgf.dll
2007-11-12 14:25 89,664 --a------ C:\WINDOWS\system32\dmmllmca.dll
2007-11-12 14:25 71,232 --a------ C:\WINDOWS\system32\fdeihcdg.exe
2007-11-12 12:47 <DIR> d-------- C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Dane aplikacji\vlc
2007-11-12 09:15 11,914 --a------ C:\WINDOWS\system32\drivers\wg3n.sys
2007-11-12 09:14 83,096 --a------ C:\WINDOWS\system32\SSSensor.dll
2007-11-12 09:14 55,891 --a------ C:\WINDOWS\system32\drivers\Teefer.sys
2007-11-12 09:14 18,518 --a------ C:\WINDOWS\system32\drivers\wpsdrvnt.sys
2007-11-12 09:03 89,664 --------- C:\WINDOWS\system32\postrdtr.dll
2007-11-12 08:57 81,472 --a------ C:\WINDOWS\system32\wcfpqjid.dll
2007-11-12 08:57 71,232 --a------ C:\WINDOWS\system32\fsitypin.exe
2007-11-12 08:49 81,472 --a------ C:\WINDOWS\system32\kcopwnwq.dll
2007-11-12 08:43 89,664 --a------ C:\WINDOWS\system32\giutllwo.dll
2007-11-12 08:40 145,984 --a------ C:\WINDOWS\system32\qwocqfpr.dll
2007-11-11 22:54 <DIR> d-------- C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Dane aplikacji\Grisoft
2007-11-11 20:58 <DIR> d-------- C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Dane aplikacji\AdobeUM
2007-11-11 17:09 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Adobe Systems
2007-11-11 15:32 <DIR> d-------- C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Dane aplikacji\Grisoft
2007-11-11 15:32 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Grisoft
2007-11-11 15:32 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-11-11 15:15 44,054 --a------ C:\WINDOWS\system32\xxyaxvw.dll.vir
2007-11-11 15:14 <DIR> d-------- C:\Program Files\MalwareAlarm
2007-11-11 12:10 <DIR> d-------- C:\Program Files\uTorrent
2007-11-11 12:10 <DIR> d-------- C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Dane aplikacji\uTorrent
2007-11-08 23:21 <DIR> d-------- C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Dane aplikacji\Gadu-Gadu
2007-11-08 23:17 <DIR> d-------- C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Gadu-Gadu
2007-11-08 20:49 <DIR> d-------- C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\.jpi_cache
2007-11-08 20:49 <DIR> d-------- C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\.java
2007-11-08 13:34 <DIR> d-------- C:\Program Files\Tlen.pl
2007-11-08 13:34 <DIR> d-------- C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Dane aplikacji\Tlen.pl
2007-11-08 13:31 <DIR> d-------- C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\.jpi_cache
2007-11-08 13:31 <DIR> d-------- C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\.java
2007-11-08 00:09 32,592 --a------ C:\WINDOWS\system32\msonpmon.dll
2007-11-08 00:08 <DIR> d-------- C:\Program Files\Microsoft Works
2007-11-08 00:07 <DIR> d-------- C:\Program Files\Microsoft.NET
2007-11-08 00:05 <DIR> d-------- C:\WINDOWS\SHELLNEW
2007-11-08 00:05 <DIR> d-------- C:\Documents and Settings\All Users.WINDOWS\Dane aplikacji\Microsoft Help
2007-11-08 00:01 <DIR> C:\Documents and Settings\LocalService.ZARZąDZANIE NT\Menu Start
2007-11-08 00:01 <DIR> C:\Documents and Settings\LocalService.ZARZąDZANIE NT\Menu Start
2007-11-08 00:00 <DIR> d---s---- C:\WINDOWS\system32\Microsoft
2007-11-07 23:52 <DIR> d-------- C:\WINDOWS\ServicePackFiles
2007-11-07 23:48 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
2007-11-07 23:46 <DIR> d-------- C:\WINDOWS\EHome
2007-11-07 22:14 <DIR> d-------- C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Dane aplikacji\Azureus
2007-11-07 19:10 <DIR> d-------- C:\Program Files\Gadu-Gadu
2007-11-07 19:10 <DIR> d-------- C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Gadu-Gadu
2007-11-07 15:51 20,992 --a------ C:\WINDOWS\system32\drivers\rtl8139.sys
2007-11-07 09:04 <DIR> d-------- C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Dane aplikacji\Talkback
2007-11-07 09:03 <DIR> d-------- C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Dane aplikacji\Talkback
2007-11-07 08:58 <DIR> d-------- C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Dane aplikacji\Skype
2007-11-07 08:57 <DIR> d-------- C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Dane aplikacji\Thunderbird
2007-11-07 08:54 <DIR> d--h----- C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ustawienia lokalne
2007-11-07 08:54 <DIR> dr------- C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Ulubione
2007-11-07 08:54 <DIR> d--h----- C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Szablony
2007-11-07 08:54 <DIR> d-------- C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Pulpit
2007-11-07 08:54 <DIR> dr------- C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Moje dokumenty
2007-11-07 08:54 <DIR> dr------- C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Menu Start
2007-11-07 08:54 <DIR> dr-h----- C:\Documents and Settings\Kasia.HOME-MSJ0FOWGZT\Dane aplikacji
2007-11-07 08:53 <DIR> d-------- C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Dane aplikacji\Tlen.pl
2007-11-07 08:45 <DIR> d-------- C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\Dane aplikacji\Thunderbird
2007-11-06 21:21 <DIR> d-------- C:\WINDOWS\system32\Lang
2007-11-06 21:21 60,416 --a------ C:\WINDOWS\ALCFDRTM.EXE
2007-11-06 21:16 0 --a------ C:\WINDOWS\nsreg.dat
2007-11-06 21:10 9,409,536 -ra------ C:\WINDOWS\system32\RTLCPL.EXE
2007-11-06 21:10 2,324,160 -ra------ C:\WINDOWS\system32\drivers\ALCXWDM.SYS
2007-11-06 21:10 294,912 -r------- C:\WINDOWS\alcupd.exe
2007-11-06 21:10 200,704 -r------- C:\WINDOWS\alcrmv.exe
2007-11-06 21:10 156,672 -ra------ C:\WINDOWS\system32\RTLCPAPI.dll
2007-11-06 21:10 145,792 --a------ C:\WINDOWS\system32\drivers\portcls.sys
2007-11-06 21:10 77,824 -ra------ C:\WINDOWS\SOUNDMAN.EXE
2007-11-06 21:10 60,288 --a------ C:\WINDOWS\system32\drivers\drmk.sys
2007-11-06 21:10 40,960 -r------- C:\WINDOWS\system32\ChCfg.exe
2007-11-06 21:09 5,824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS
2007-11-06 21:04 <DIR> d-------- C:\Program Files\Java Web Start
2007-11-06 21:04 <DIR> d-------- C:\Program Files\Java
2007-11-06 21:04 <DIR> d-------- C:\Documents and Settings\Maciek.HOME-MSJ0FOWGZT\.javaws
2007-11-06 21:02 <DIR> d-------- C:\Documents and Settings\MACIEK~1~HOM\USTAWI~1
2007-11-06 20:47 <DIR> d--h----- C:\Program Files\Zenographics
2007-11-06 20:47 <DIR> d-------- C:\Program Files\Hewlett-Packard
2007-11-06 20:47 397,312 -ra------ C:\WINDOWS\system32\zshp1020.exe

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-12 20:01 237,568 ---ha-w C:\Documents and Settings\NetworkService.ZARZąDZANIE NT\NTUSER.DAT
2007-11-12 20:01 237,568 ---ha-w C:\Documents and Settings\NetworkService.ZARZąDZANIE NT\NTUSER.DAT
2007-11-12 20:01 237,568 ---ha-w C:\Documents and Settings\LocalService.ZARZąDZANIE NT\NTUSER.DAT
2007-11-12 20:01 237,568 ---ha-w C:\Documents and Settings\LocalService.ZARZąDZANIE NT\NTUSER.DAT
2007-11-07 08:01 --------- d-----w C:\Documents and Settings\Kasia\Dane aplikacji\Thunderbird
2007-11-07 07:54 --------- d-----w C:\Documents and Settings\Maciek\Dane aplikacji\Tlen.pl
2007-11-07 07:52 --------- d-----w C:\Documents and Settings\Maciek\Dane aplikacji\Thunderbird
2007-11-07 07:52 --------- d-----w C:\Documents and Settings\Maciek\Dane aplikacji\Skype
2007-11-06 13:45 --------- d-s---w C:\Documents and Settings\NetworkService.ZARZąDZANIE NT\Dane aplikacji\Microsoft
2007-11-06 13:45 --------- d-s---w C:\Documents and Settings\NetworkService.ZARZąDZANIE NT\Dane aplikacji\Microsoft
2007-11-06 13:45 --------- d-s---w C:\Documents and Settings\NetworkService.ZARZąDZANIE NT\Dane aplikacji\Microsoft
2007-11-06 13:45 --------- d-s---w C:\Documents and Settings\LocalService.ZARZąDZANIE NT\Dane aplikacji\Microsoft
2007-11-06 13:44 --------- d-----w C:\Program Files\Usługi online
2007-11-01 21:59 --------- d-----w C:\Documents and Settings\Kasia\Dane aplikacji\Tlen.pl
2007-10-30 10:48 --------- d-----w C:\Program Files\Common Files\Ahead
2007-10-30 10:16 --------- d-----w C:\Program Files\Common Files\Adobe
2007-10-22 19:07 --------- d-----w C:\Documents and Settings\Maciek\Dane aplikacji\Ahead
2007-10-17 18:45 --------- d-----w C:\Documents and Settings\Maciek\Dane aplikacji\Winamp
2007-10-09 13:14 --------- d-----w C:\Documents and Settings\Kasia\Dane aplikacji\Ahead
2007-10-08 14:15 --------- d-----w C:\Documents and Settings\Maciek\Dane aplikacji\GameHouse
2007-09-25 20:35 --------- d-----w C:\Documents and Settings\Maciek\Dane aplikacji\Azureus
2007-09-24 05:15 48,632 ----a-w C:\Documents and Settings\Kasia\Dane aplikacji\GDIPFONTCACHEV1.DAT
2007-09-15 19:19 --------- d-----w C:\Documents and Settings\Maciek\Dane aplikacji\Nero
2007-09-13 17:49 --------- d-----w C:\Documents and Settings\Kasia\Dane aplikacji\Skype
2007-09-11 15:59 48,632 ----a-w C:\Documents and Settings\Maciek\Dane aplikacji\GDIPFONTCACHEV1.DAT
2007-01-12 11:07 23,022 ----a-w C:\Documents and Settings\Maciek\Menu Start.zip
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3138fdf3-89d8-4279-99f2-af91741ec15c}]
2007-11-12 19:51 81472 --a------ C:\WINDOWS\system32\qxxlymws.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50]
"OrderReminder"="C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2005-03-18 12:18]
"HydraVisionDesktopManager"="C:\Program Files\ATI Technologies\ATI HYDRAVISION\HydraDM.exe" [2003-09-15 21:00]
"SoundMan"="SOUNDMAN.EXE" [2005-06-14 11:36 C:\WINDOWS\SOUNDMAN.EXE]
"Adobe Photo Downloader"="D:\Programs\Adobe\Lightroom\apdproxy.exe" [2007-08-30 06:32]
"!AVG Anti-Spyware"="D:\Programs\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25]
"SmcService"="D:\Programs\Sygate\SPF\smc.exe" [2004-02-24 16:35]
"b0b6f076"="C:\WINDOWS\system32\enqjhvkh.dll" [2007-11-12 19:43]

[wojtas]

sciagnij ATF_Cleaner
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED


skasuj ten wpis:

O4 - HKLM\..\Run: [b0b6f076] rundll32.exe "C:\WINDOWS\system32\enqjhvkh.dll",b

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\rwkmjsgf.dll
C:\WINDOWS\system32\qxxlymws.dll
C:\WINDOWS\system32\eqavocfd.dll
C:\WINDOWS\system32\enqjhvkh.dll
C:\WINDOWS\system32\vyfvefsg.dll
C:\WINDOWS\system32\dmmllmca.dll
C:\WINDOWS\system32\fdeihcdg.exe
C:\WINDOWS\system32\postrdtr.dll
C:\WINDOWS\system32\wcfpqjid.dll
C:\WINDOWS\system32\fsitypin.exe
C:\WINDOWS\system32\kcopwnwq.dll
C:\WINDOWS\system32\giutllwo.dll
C:\WINDOWS\system32\qwocqfpr.dll
C:\WINDOWS\system32\xxyaxvw.dll.vir

Folder::
C:\Program Files\MalwareAlarm

Plik >>> zapisz jako CFScript.txt .Plik przeciągnij i upuść na ikonę ComboFixa (tak jak tu ) . Potwierdz >>> zresetuje sie komputer

(jeśli pojawi się pytanie "1 or 2" - to wpisz 1 i naciśnij ENTER). Rozpocznie się proces usuwania
Potem nowy log z hijacka oraz combofixa