trojan-gen {other} - jak sie tego pozbyc?

**Posty:** 9 · przez **sandrak91** 20 Mar 2007, 18:56

Witam! Mam taki problem. Od wczoraj przy uruchamianiu gry wyskakuje mi caly czas wirus TRojan-gen... ;/ i gra sie nie uruchamia. Probowalam przeinstalowac gre, ale to nic nie dalo... Pojawia sie caly czas to samo : "C:\DOCUME~1\user\USTAWI~1\Temp" Nazwa pliku: ddxgb.sys Jak mozna tego sie pozbyc? Prosze o pomoc !!

Kod: Zaznacz wszystko: Logfile of HijackThis v1.99.1 Scan saved at 17:49:22, on 2007-03-20 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Watch.exe C:\Program Files\Mozilla Firefox\firefox.exe G:\GG\Gadu-Gadu\gg.exe C:\Program Files\Winamp\winamp.exe C:\Program Files\Alwil Software\Avast4\ashSimpl.exe G:\hijack\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - G:\Bit COmet\BitComet\tools\BitCometBHO.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BitTorrent] "G:\Bittorrent\bittorrent.exe" --force_start_minimized O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Download all links using BitComet - res://G:\Bit COmet\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://G:\Bit COmet\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://G:\Bit COmet\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: Pobierz z &BitSpirit - G:\BitSpirit\BitSpirit\bsurl.htm O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{5371A56B-2543-4970-8480-CC5840585F86}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

**Posty:** 8694 · przez **Red** 20 Mar 2007, 19:31

TAKIEGO LOGA NIKT NIE SPRAWDZI.MA BYć W TAGACH.

**Posty:** 18165 · przez **wojtas** 20 Mar 2007, 21:15

start>urchom> wpisz msconfig> zakladka uruchamianie> wylacz progsy ktore nie chcesz zeby startowaly z systemem

sciagnij:

ATF_Cleaner

http://www.atribune.org/ccount/click.php?id=1
zaznacz
Windows Temp
Temporary internet files
i wcisnij EMPTY SELECTED

dodatkowo log z silent runners przyda sie:

otwierasz link>> http://www.silentrunners.org/Silent%20Runners.vbs >>zapisujesz jako na pulpicie>>klikasz dwa razy >>masz wybor i wybierasz no>>i czekasz troszke az wygeneruje sie cały log do konca
wrzucasz na forum

**Posty:** 9 · przez **sandrak91** 20 Mar 2007, 21:37

Zrobilam tak, jak powiedziales. Log z silent runners:

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision R50, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "BitTorrent" = ""G:\Bittorrent\bittorrent.exe" --force_start_minimized" [file not found] HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "SoundMAXPnP" = "C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe" ["Analog Devices, Inc."] "SoundMAX" = ""C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray" ["Analog Devices, Inc."] "ATIPTA" = "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" ["ATI Technologies, Inc."] "Ptipbmf" = "rundll32.exe ptipbmf.dll,SetWriteCacheMode" [MS] "RemoteControl" = ""C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"" ["Cyberlink Corp."] "NeroFilterCheck" = "C:\WINDOWS\system32\NeroCheck.exe" ["Ahead Software Gmbh"] "WooCnxMon" = "C:\PROGRA~1\NEOSTR~1\CnxMon.exe" [empty string] "SpeedTouch USB Diagnostics" = ""C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon" ["THOMSON Telecom Belgium"] "WOOWATCH" = "C:\PROGRA~1\NEOSTR~1\Watch.exe" ["France Télécom R&D"] "WOOTASKBARICON" = "C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe" ["France Télécom R&D"] "avast!" = "C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [null data] "Logitech Utility" = "Logi_MwX.Exe" ["Logitech Inc."] "(Default)" = "(empty string)" [file not found] "Sony Ericsson PC Suite" = ""C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions" ["Sony Ericsson Mobile Communications AB"] HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}\(Default) = (no title provided) -> {HKLM...CLSID} = "AcroIEHlprObj Class" \InProcServer32\(Default) = "C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx" [empty string] {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60}\(Default) = "BitComet ClickCapture" -> {HKLM...CLSID} = "BitComet Helper" \InProcServer32\(Default) = "G:\Bit COmet\BitComet\tools\BitCometBHO.dll" ["BitComet"] HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{472083B0-C522-11CF-8763-00608CC02F24}" = "avast" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\Office\OLKFSTUB.DLL" [MS] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{A5110426-177D-4e08-AB3F-785F10B4439C}" = "Sony Ericsson File Manager" -> {HKLM...CLSID} = "Sony Ericsson File Manager" \InProcServer32\(Default) = "C:\Program Files\Sony Ericsson\Mobile2\File Manager\fmgrgui.dll" ["Sony Ericsson Mobile Communications AB"] HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> AtiExtEvent\DLLName = "Ati2evxx.dll" ["ATI Technologies Inc."] HKLM\Software\Classes\*\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\ avast\(Default) = "{472083B0-C522-11CF-8763-00608CC02F24}" -> {HKLM...CLSID} = "avast" \InProcServer32\(Default) = "C:\Program Files\Alwil Software\Avast4\ashShell.dll" ["ALWIL Software"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) hex:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\user\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Startup items in "user" & "All Users" startup folders: ------------------------------------------------------ C:\Documents and Settings\All Users\Menu Start\Programy\Autostart "Microsoft Office" -> shortcut to: "C:\Program Files\Microsoft Office\Office\OSA9.EXE -b -l" [MS] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 17 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Toolbars HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\ "{37B85A29-692B-4205-9CAD-2626E4993404}" -> {HKLM...CLSID} = "My Global Search Bar" \InProcServer32\(Default) = "C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL" [file not found] Explorer Bars HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\ HKLM\Software\Classes\CLSID\{01002DB2-8170-4D9B-A8B1-DDC9DD114E03}\(Default) = "Volet Wanadoo" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] HKLM\Software\Classes\CLSID\{3BAF4A27-C764-4E1A-A6F4-62F7A7E5E51C}\(Default) = "ToolBand Class" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] HKLM\Software\Classes\CLSID\{5BF498C0-931E-4A4F-B33F-456D07137EAA}\(Default) = "Volet Wanadoo" Implemented Categories\{00021494-0000-0000-C000-000000000046}\ [horizontal bar] InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\audience\audience.dll" [empty string] Miscellaneous IE Hijack Points ------------------------------ HKCU\Software\Microsoft\Internet Explorer\URLSearchHooks\ <<H>> "{08C06D61-F1F3-4799-86F8-BE1A89362C85}" = (no title provided) -> {HKLM...CLSID} = "Search Class" \InProcServer32\(Default) = "C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL" [empty string] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Ati HotKey Poller, Ati HotKey Poller, "C:\WINDOWS\system32\Ati2evxx.exe" ["ATI Technologies Inc."] avast! Antivirus, avast! Antivirus, ""C:\Program Files\Alwil Software\Avast4\ashServ.exe"" [null data] avast! iAVS4 Control Service, aswUpdSv, ""C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe"" [null data] avast! Mail Scanner, avast! Mail Scanner, ""C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service" ["ALWIL Software"] avast! Web Scanner, avast! Web Scanner, ""C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service" ["ALWIL Software"] LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"] SoundMAX Agent Service, SoundMAX Agent Service (default), "C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe" ["Analog Devices, Inc."] ---------- <<!>>: Suspicious data at a malware launch point. <<H>>: Suspicious data at a browser hijack point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 52 seconds, including 25 seconds for message boxes)

**Posty:** 18165 · przez **wojtas** 20 Mar 2007, 21:40

Użyj WWDC :
http://www.firewallleaktester.com/wwdc.htm
Zmień opcje z disable na enable. Uruchom ponownie komputer.
Tak powinny wyglądać porty (NetBIOS może być żółty) :
http://www.firewallleaktester.com/images_site/wwdc.jpg

wklej do notatnika:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{37B85A29-692B-4205-9CAD-2626E4993404}"=-

w notatniku u góry>>>plik zapisz jako>>>Zmien rozszerzenie z TXT na Wszystkie pliki *.* >>> Zapisz pod nazwą FIX.REG

Klikasz dwa razy na powstały plik fix i dodajesz go do rejestru....

daj loga z comboscana:

http://www.techsupportforum.com/sectools/Deckard/comboscan.exe

**Posty:** 9 · przez **sandrak91** 20 Mar 2007, 22:12

Wszystko zrobilam tak, jak napisales i teraz log:

Kod: Zaznacz wszystko: ComboScan v20070306.20 run by user on 2007-03-20 at 21:03:23 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- System Restore -------------------------------------------------------------- Successfully created ComboScan Restore Point. -- Last 5 Restore Point(s) -- 29: 2007-03-20 20:03:26 UTC - RP29 - ComboScan Restore Point 28: 2007-03-19 20:38:00 UTC - RP28 - Zainstalowane Tactical Ops - Wojna z Terrorem 27: 2007-03-19 20:29:31 UTC - RP27 - Usunięte Tactical Ops - Wojna z Terrorem 26: 2007-03-19 19:15:19 UTC - RP26 - Zainstalowane Tactical Ops - Wojna z Terrorem 25: 2007-03-19 19:10:39 UTC - RP25 - Usunięte Tactical Ops - Wojna z Terrorem -- First Restore Point -- 1: 2007-03-01 10:20:15 UTC - RP1 - Punkt kontrolny systemu Performed disk cleanup. -- HijackThis (run as user.exe) ------------------------------------------------ Logfile of HijackThis v1.99.1 Scan saved at 21:03:33, on 2007-03-20 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe C:\Program Files\Analog Devices\SoundMAX\Smax4.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe C:\PROGRA~1\NEOSTR~1\CnxMon.exe C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Logitech\MouseWare\system\em_exec.exe C:\Program Files\Common Files\Teleca Shared\CapabilityManager.exe C:\Program Files\Common Files\Teleca Shared\Generic.exe C:\Program Files\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe C:\Program Files\Alwil Software\Avast4\ashServ.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe C:\WINDOWS\system32\wscntfy.exe C:\Program Files\Alwil Software\Avast4\ashWebSv.exe C:\PROGRA~1\NEOSTR~1\NeostradaTP.exe C:\PROGRA~1\NEOSTR~1\ComComp.exe C:\PROGRA~1\NEOSTR~1\Watch.exe C:\Program Files\Mozilla Firefox\firefox.exe G:\hijack\comboscana\comboscan.exe G:\hijack\user.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.neostrada.pl R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - C:\PROGRA~1\NEOSTR~1\SEARCH~1.DLL O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0 CE\Reader\ActiveX\AcroIEHelper.ocx O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - G:\Bit COmet\BitComet\tools\BitCometBHO.dll O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe O4 - HKLM\..\Run: [Ptipbmf] rundll32.exe ptipbmf.dll,SetWriteCacheMode O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [WooCnxMon] C:\PROGRA~1\NEOSTR~1\CnxMon.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [WOOWATCH] C:\PROGRA~1\NEOSTR~1\Watch.exe O4 - HKLM\..\Run: [WOOTASKBARICON] C:\PROGRA~1\NEOSTR~1\TaskbarIcon.exe O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [BitTorrent] "G:\Bittorrent\bittorrent.exe" --force_start_minimized O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE O8 - Extra context menu item: Download all links using BitComet - res://G:\Bit COmet\BitComet\BitComet.exe/AddAllLink.htm O8 - Extra context menu item: Download all videos using BitComet - res://G:\Bit COmet\BitComet\BitComet.exe/AddVideo.htm O8 - Extra context menu item: Download link using &BitComet - res://G:\Bit COmet\BitComet\BitComet.exe/AddLink.htm O8 - Extra context menu item: Pobierz z &BitSpirit - G:\BitSpirit\BitSpirit\bsurl.htm O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{5371A56B-2543-4970-8480-CC5840585F86}: NameServer = 194.204.159.1 217.98.63.164 O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing) O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing) O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- HijackThis Fixed Entries (G:\hijack\backups\) ------------------------------- backup-20070319-220500-258 O2 - BHO: My Global Search Bar BHO - {37B85A21-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing) backup-20070319-220500-582 O3 - Toolbar: My Global Search Bar - {37B85A29-692B-4205-9CAD-2626E4993404} - C:\Program Files\MyGlobalSearch\bar\1.bin\MGSBAR.DLL (file missing) -- File Associations ----------------------------------------------------------- .bat - batfile - "%1" %* .chm - chm.file - "C:\WINDOWS\hh.exe" %1 .cmd - cmdfile - "%1" %* .com - comfile - "%1" %* .exe - exefile - "%1" %* .hlp - hlpfile - %SystemRoot%\System32\winhlp32.exe %1 .inf - inffile - %SystemRoot%\System32\NOTEPAD.EXE %1 .ini - inifile - %SystemRoot%\System32\NOTEPAD.EXE %1 .js - JSFile - %SystemRoot%\System32\WScript.exe "%1" %* .lnk - lnkfile - {00021401-0000-0000-C000-000000000046} .pif - piffile - "%1" %* .reg - regfile - regedit.exe "%1" .scr - scrfile - "%1" /S .txt - txtfile - %SystemRoot%\system32\NOTEPAD.EXE %1 .vbs - VBSFile - %SystemRoot%\System32\WScript.exe "%1" %* -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------- 1R Aavmker4 (avast! Asynchronous Virus Monitor) - C:\WINDOWS\system32\drivers\aavmker4.sys 3R aeaudio - C:\WINDOWS\system32\drivers\aeaudio.sys 3R alcan5wn (SpeedTouch USB ADSL PPP Networking Driver (NDISWAN)) - C:\WINDOWS\system32\drivers\alcan5wn.sys 3R alcaudsl (SpeedTouch ADSL Modem ATM Transport) - C:\WINDOWS\system32\drivers\alcaudsl.sys 3R Arp1394 (Protokół klienta 1394 ARP) - C:\WINDOWS\system32\drivers\arp1394.sys 2R aswMon2 (avast! Standard Shield Support) - C:\WINDOWS\system32\drivers\aswmon2.sys 3R aswRdr - C:\WINDOWS\system32\drivers\aswRdr.sys 1R aswTdi (avast! Network Shield Support) - C:\WINDOWS\system32\drivers\aswTdi.sys 3R ati2mtag - C:\WINDOWS\system32\drivers\ati2mtag.sys 3R E1000 (Intel(R) PRO/1000 Adapter Driver) - C:\WINDOWS\system32\drivers\e1000325.sys 0R fasttx2k - C:\WINDOWS\system32\drivers\Fasttx2k.sys 1R intelppm (Sterownik procesora Intel) - C:\WINDOWS\system32\drivers\intelppm.sys 3S k750bus (Sony Ericsson 750 driver (WDM)) - C:\WINDOWS\system32\drivers\k750bus.sys 3S k750mdfl (Sony Ericsson 750 USB WMC Modem Filter) - C:\WINDOWS\system32\drivers\k750mdfl.sys 3S k750mdm (Sony Ericsson 750 USB WMC Modem Drivers) - C:\WINDOWS\system32\drivers\k750mdm.sys 3S k750mgmt (Sony Ericsson 750 USB WMC Device Management Drivers) - C:\WINDOWS\system32\drivers\k750mgmt.sys 3S k750obex (Sony Ericsson 750 USB WMC OBEX Interface Drivers) - C:\WINDOWS\system32\drivers\k750obex.sys 3R L8042pr2 (Logitech PS/2 Mouse Filter Driver) - C:\WINDOWS\system32\drivers\L8042pr2.Sys 3R LMouFlt2 (Logitech Mouse Class Filter Driver) - C:\WINDOWS\system32\drivers\LMouFlt2.Sys 3S MidiSyn - C:\WINDOWS\system32\drivers\MidiSyn.sys 3R NIC1394 (Sterownik sieci 1394) - C:\WINDOWS\system32\drivers\nic1394.sys 0R ohci1394 (Kontroler hosta IEEE 1394 VIA zgodny z OHCI) - C:\WINDOWS\system32\drivers\ohci1394.sys 0R PxHelp20 - C:\WINDOWS\system32\drivers\PxHelp20.sys 3R smwdm - C:\WINDOWS\system32\drivers\smwdm.sys 3R usbehci (Sterownik Miniport rozszerzonego kontrolera hosta USB 2.0 Microsoft) - C:\WINDOWS\system32\drivers\usbehci.sys 3S USBSTOR (Sterownik magazynu masowego USB) - C:\WINDOWS\system32\drivers\USBSTOR.SYS -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled -------------------- 3S aspnet_state (ASP.NET State Service) - C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe 2R aswUpdSv (avast! iAVS4 Control Service) - "C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe" 2R Ati HotKey Poller - C:\WINDOWS\system32\Ati2evxx.exe 2S ATI Smart - C:\WINDOWS\system32\ati2sgag.exe 2R avast! Antivirus - "C:\Program Files\Alwil Software\Avast4\ashServ.exe" 3R avast! Mail Scanner - "C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service 3R avast! Web Scanner - "C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service 2R LightScribeService (LightScribeService Direct Disc Labeling Service) - "C:\Program Files\Common Files\LightScribe\LSSrvc.exe" 2R SoundMAX Agent Service (default) (SoundMAX Agent Service) - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe -- Files created between 2007-02-20 and 2007-03-20 ----------------------------- 2007-03-17 14:51:49 217088 --a------ C:\WINDOWS\system32\yv12vfw.dll 2007-03-17 14:51:48 180224 --a------ C:\WINDOWS\system32\xvidvfw.dll 2007-03-17 14:51:48 765952 --a------ C:\WINDOWS\system32\xvidcore.dll 2007-03-17 14:51:48 1565480 --a------ C:\WINDOWS\system32\wmv9vcm.dll 2007-03-17 14:51:48 200704 --a------ C:\WINDOWS\system32\ssldivx.dll 2007-03-17 14:51:48 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll 2007-03-17 14:51:47 1044480 --a------ C:\WINDOWS\system32\libdivx.dll 2007-03-17 14:51:47 196608 --a------ C:\WINDOWS\system32\dtu100.dll 2007-03-17 14:51:47 73728 --a------ C:\WINDOWS\system32\dpl100.dll 2007-03-17 14:51:47 639066 --a------ C:\WINDOWS\system32\divx.dll 2007-03-17 14:51:46 10752 --a------ C:\WINDOWS\system32\ff_vfw.dll 2007-03-17 14:51:45 0 d-------- C:\Program Files\K-Lite Codec Pack<K-LITE~1> 2007-03-14 16:50:33 0 d-------- C:\Temp 2007-03-14 16:49:00 0 d-------- C:\Program Files\QuickTime<QUICKT~1> 2007-03-09 12:39:28 0 d-------- C:\Downloads<DOWNLO~1> 2007-03-08 19:59:19 12800 --a------ C:\WINDOWS\system32\WING32.DLL 2007-03-03 22:21:59 0 d-------- C:\Program Files\Common Files\Teleca Shared<TELECA~1> 2007-03-03 22:21:53 0 d-------- C:\Program Files\Sony Ericsson<SONYER~1> 2007-03-03 22:20:16 0 d------c- C:\WINDOWS\system32\DRVSTORE 2007-03-03 22:19:38 5744 --a------ C:\WINDOWS\system32\drivers\k750whnt.sys 2007-03-03 22:19:38 5744 --a------ C:\WINDOWS\system32\drivers\k750wh.sys 2007-03-03 22:19:38 79488 --a------ C:\WINDOWS\system32\drivers\k750obex.sys 2007-03-03 22:19:38 81728 --a------ C:\WINDOWS\system32\drivers\k750mgmt.sys 2007-03-03 22:19:38 89872 --a------ C:\WINDOWS\system32\drivers\k750mdm.sys 2007-03-03 22:19:37 6576 --a------ C:\WINDOWS\system32\drivers\k750mdfl.sys 2007-03-03 22:19:36 6144 --a------ C:\WINDOWS\system32\drivers\k750cmnt.sys 2007-03-03 22:19:36 6144 --a------ C:\WINDOWS\system32\drivers\k750cm.sys 2007-03-03 22:19:35 55216 --a------ C:\WINDOWS\system32\drivers\k750bus.sys 2007-03-03 22:19:28 0 d-------- C:\WINDOWS\Downloaded Installations<DOWNLO~2> 2007-03-03 21:26:14 0 d-------- C:\WINDOWS\Microsoft.NET<MICROS~1.NET> 2007-03-03 21:26:14 0 dr--s---- C:\WINDOWS\assembly 2007-03-03 21:26:13 0 d-------- C:\WINDOWS\system32\URTTemp 2007-03-02 22:23:31 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard<WISEIN~1> 2007-03-01 23:22:47 0 d-------- C:\WINDOWS\system32\LogFiles 2007-03-01 21:09:31 97792 --a------ C:\WINDOWS\system32\LGUICOM.DLL 2007-03-01 21:09:31 0 d-------- C:\Program Files\Common Files\Logitech 2007-03-01 21:09:30 16896 --a------ C:\WINDOWS\system32\LMOUSE32.DLL 2007-03-01 21:09:30 3568 --a------ C:\WINDOWS\system32\LMOUSE16.DLL 2007-03-01 21:09:30 152064 -----n--- C:\WINDOWS\system32\lmoufrc.dll 2007-03-01 21:09:30 23375 --a------ C:\WINDOWS\system32\LCoInst.Dll 2007-03-01 21:09:30 70801 --a------ C:\WINDOWS\system32\drivers\LMouFlt2.Sys 2007-03-01 21:09:30 37887 -----n--- C:\WINDOWS\system32\drivers\LHIDUSB.SYS 2007-03-01 21:09:30 25505 -----n--- C:\WINDOWS\system32\drivers\LHIDFLT2.SYS 2007-03-01 21:09:30 14095 -----n--- C:\WINDOWS\system32\drivers\LCCFLTR.SYS 2007-03-01 21:09:30 51729 --a------ C:\WINDOWS\system32\drivers\L8042pr2.Sys 2007-03-01 21:09:30 104960 --a------ C:\WINDOWS\system32\COMNCTR.DLL 2007-03-01 21:09:30 19968 -----n--- C:\WINDOWS\LOGI_MWX.EXE 2007-03-01 21:09:30 0 d-------- C:\Program Files\Logitech 2007-03-01 20:56:24 43520 --a------ C:\WINDOWS\system32\CmdLineExt03.dll<CMDLIN~1.DLL> 2007-03-01 19:57:54 0 d-------- C:\WINDOWS\Profiles 2007-03-01 19:57:51 0 d-------- C:\WINDOWS\system32\Adobe 2007-03-01 19:57:51 0 d-------- C:\Program Files\Common Files\Adobe 2007-03-01 19:57:44 327168 --a------ C:\WINDOWS\IsUn0415.exe 2007-03-01 19:15:30 1168 --a------ C:\WINDOWS\mozver.dat 2007-03-01 17:22:05 0 d-------- C:\Program Files\Common Files\Skype 2007-03-01 17:21:55 0 d-------- C:\Program Files\Skype 2007-03-01 16:07:27 0 d-------- C:\WINDOWS\ShellNew 2007-03-01 15:50:41 0 --a------ C:\WINDOWS\nsreg.dat 2007-03-01 15:50:34 0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1> 2007-03-01 15:35:47 43176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys 2007-03-01 15:35:47 23352 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys 2007-03-01 15:35:46 31560 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys 2007-03-01 15:35:45 94424 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys 2007-03-01 15:35:45 85952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys 2007-03-01 15:35:41 499712 --a------ C:\WINDOWS\system32\MSVCP71.dll 2007-03-01 15:35:41 1060864 --a------ C:\WINDOWS\system32\MFC71.dll 2007-03-01 15:35:41 90112 --a------ C:\WINDOWS\system32\AVASTSS.scr 2007-03-01 15:35:41 689280 --a------ C:\WINDOWS\system32\aswBoot.exe 2007-03-01 15:35:38 0 d-------- C:\Program Files\Alwil Software<ALWILS~1> 2007-03-01 15:17:57 32768 --a------ C:\WINDOWS\system32\WooDial2000.dll<WOODIA~1.DLL> 2007-03-01 15:16:56 5606 --a------ C:\WINDOWS\system32\stci.dll 2007-03-01 15:16:56 5280 --a------ C:\WINDOWS\system32\drivers\alcawh.sys 2007-03-01 15:16:56 70688 --a------ C:\WINDOWS\system32\drivers\alcaudsl.sys 2007-03-01 15:16:56 3968 --a------ C:\WINDOWS\system32\drivers\alcacr.sys 2007-03-01 15:16:55 53600 --a------ C:\WINDOWS\system32\drivers\alcan5wn.sys 2007-03-01 15:16:54 0 d-------- C:\Program Files\Thomson 2007-03-01 15:15:20 0 d-------- C:\Program Files\Neostrada TP<NEOSTR~1> 2007-03-01 11:59:08 0 d-------- C:\Program Files\Common Files\Nero 2007-03-01 11:57:38 3072 --a------ C:\WINDOWS\system32\drivers\audstub.sys 2007-03-01 11:57:13 0 d-------- C:\Program Files\Common Files\LightScribe<LIGHTS~1> 2007-03-01 11:57:02 58624 --a------ C:\WINDOWS\system32\drivers\redbook.sys 2007-03-01 11:56:28 768512 --a------ C:\WINDOWS\system32\drivers\ati2mtag.sys 2007-03-01 11:56:28 484128 --a------ C:\WINDOWS\system32\ativvaxx.dll 2007-03-01 11:56:28 2177184 --a------ C:\WINDOWS\system32\ati3duag.dll 2007-03-01 11:56:28 870784 --a------ C:\WINDOWS\system32\ati3d1ag.dll 2007-03-01 11:56:28 208896 --a------ C:\WINDOWS\system32\ati2dvag.dll 2007-03-01 11:56:27 233472 --a------ C:\WINDOWS\system32\ati2cqag.dll 2007-03-01 11:56:26 6400 --a------ C:\WINDOWS\system32\drivers\enum1394.sys 2007-03-01 11:56:13 5504 --a------ C:\WINDOWS\system32\drivers\intelide.sys 2007-03-01 11:56:11 106496 --a------ C:\WINDOWS\system32\TwnLib20.dll 2007-03-01 11:56:09 77312 --a------ C:\WINDOWS\system32\usbui.dll 2007-03-01 11:56:07 471040 -----n--- C:\WINDOWS\system32\ImagXRA7.dll 2007-03-01 11:56:07 42368 --a------ C:\WINDOWS\system32\drivers\AGP440.SYS 2007-03-01 11:56:06 262144 -----n--- C:\WINDOWS\system32\ImagXR7.dll 2007-03-01 11:56:06 476320 -----n--- C:\WINDOWS\system32\ImagXpr7.dll 2007-03-01 11:56:06 1568768 -----n--- C:\WINDOWS\system32\ImagX7.dll 2007-03-01 11:56:05 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe<NEROCH~1.EXE> 2007-03-01 11:56:03 0 d-------- C:\Program Files\Common Files\Ahead 2007-03-01 11:56:01 0 d-------- C:\Program Files\Ahead 2007-03-01 11:55:05 0 d--hs---- C:\WINDOWS\Installer<INSTAL~1> 2007-03-01 11:55:05 0 d-------- C:\Program Files\Common Files\ODBC 2007-03-01 11:55:02 0 dr------- C:\Program Files<PROGRA~1> 2007-03-01 11:55:02 0 d-------- C:\Program Files\Common Files\SpeechEngines<SPEECH~1> 2007-03-01 11:54:58 6144 -ra------ C:\WINDOWS\system32\kbdtuq.dll 2007-03-01 11:54:58 6144 -ra------ C:\WINDOWS\system32\kbdtuf.dll 2007-03-01 11:54:58 5632 -ra------ C:\WINDOWS\system32\kbdazel.dll 2007-03-01 11:54:55 5632 -ra------ C:\WINDOWS\system32\kbdmon.dll 2007-03-01 11:54:55 5632 -ra------ C:\WINDOWS\system32\kbdkyr.dll 2007-03-01 11:54:52 8192 -ra------ C:\WINDOWS\system32\kbdhept.dll 2007-03-01 11:54:52 6656 -ra------ C:\WINDOWS\system32\kbdhela3.dll 2007-03-01 11:54:52 6144 -ra------ C:\WINDOWS\system32\kbdhela2.dll 2007-03-01 11:54:52 5632 -ra------ C:\WINDOWS\system32\kbdhe319.dll 2007-03-01 11:54:52 5632 -ra------ C:\WINDOWS\system32\kbdhe220.dll 2007-03-01 11:54:52 5632 -ra------ C:\WINDOWS\system32\kbdhe.dll 2007-03-01 11:54:52 6144 -ra------ C:\WINDOWS\system32\kbdgkl.dll 2007-03-01 11:54:50 6144 -ra------ C:\WINDOWS\system32\kbdlv1.dll 2007-03-01 11:54:50 6144 -ra------ C:\WINDOWS\system32\kbdlv.dll 2007-03-01 11:54:50 5632 -ra------ C:\WINDOWS\system32\kbdlt1.dll 2007-03-01 11:54:50 5632 -ra------ C:\WINDOWS\system32\kbdlt.dll 2007-03-01 11:54:50 6144 -ra------ C:\WINDOWS\system32\kbdest.dll 2007-03-01 11:54:44 6656 --a------ C:\WINDOWS\system32\kbdycl.dll 2007-03-01 11:54:44 6656 --a------ C:\WINDOWS\system32\kbdsl1.dll 2007-03-01 11:54:44 6656 --a------ C:\WINDOWS\system32\kbdsl.dll 2007-03-01 11:54:44 5632 --a------ C:\WINDOWS\system32\kbdro.dll 2007-03-01 11:54:44 5632 --a------ C:\WINDOWS\system32\kbdhu1.dll 2007-03-01 11:54:44 6656 --a------ C:\WINDOWS\system32\kbdhu.dll 2007-03-01 11:54:44 6656 --a------ C:\WINDOWS\system32\kbdcz2.dll 2007-03-01 11:54:44 6656 --a------ C:\WINDOWS\system32\kbdcz1.dll 2007-03-01 11:54:44 7168 --a------ C:\WINDOWS\system32\kbdcz.dll 2007-03-01 11:54:44 6656 --a------ C:\WINDOWS\system32\kbdcr.dll 2007-03-01 11:54:44 6656 --a------ C:\WINDOWS\system32\KBDAL.DLL 2007-03-01 11:54:43 13312 --a------ C:\WINDOWS\system32\irclass.dll 2007-03-01 11:54:43 85532 --a------ C:\WINDOWS\system32\dgsetup.dll 2007-03-01 11:54:43 176157 --a------ C:\WINDOWS\system32\dgrpsetu.dll 2007-03-01 11:54:42 24661 --a------ C:\WINDOWS\system32\spxcoins.dll 2007-03-01 11:54:42 103424 --a------ C:\WINDOWS\system32\EqnClass.Dll 2007-03-01 11:54:42 9168 --a------ C:\WINDOWS\system\VER.DLL 2007-03-01 11:54:42 19200 --a------ C:\WINDOWS\system\TAPI.DLL 2007-03-01 11:54:41 5120 --a------ C:\WINDOWS\system\SHELL.DLL 2007-03-01 11:54:41 24064 --a------ C:\WINDOWS\system\OLESVR.DLL 2007-03-01 11:54:41 83456 --a------ C:\WINDOWS\system\OLECLI.DLL 2007-03-01 11:54:41 127008 --a------ C:\WINDOWS\system\MSVIDEO.DLL 2007-03-01 11:54:41 9936 --a------ C:\WINDOWS\system\LZEXPAND.DLL 2007-03-01 11:54:40 15360 --a------ C:\WINDOWS\TASKMAN.EXE 2007-03-01 11:54:40 33376 --a------ C:\WINDOWS\system\COMMDLG.DLL 2007-03-01 11:54:40 109488 --a------ C:\WINDOWS\system\AVIFILE.DLL 2007-03-01 11:54:40 70096 --a------ C:\WINDOWS\system\AVICAP.DLL 2007-03-01 11:54:39 11264 --a------ C:\WINDOWS\system32\drivers\irenum.sys 2007-03-01 11:54:39 8704 --a------ C:\WINDOWS\system32\batt.dll 2007-03-01 11:54:39 69552 --a------ C:\WINDOWS\system\MMSYSTEM.DLL 2007-03-01 11:54:39 70144 --a------ C:\WINDOWS\NOTEPAD.EXE 2007-03-01 11:54:38 75776 --a------ C:\WINDOWS\system32\storprop.dll 2007-03-01 11:54:18 0 d-------- C:\WINDOWS\system32\CatRoot2 2007-03-01 11:54:18 0 d-------- C:\WINDOWS\system32\CatRoot 2007-03-01 11:53:56 0 d-------- C:\Program Files\CyberLink<CYBERL~1> 2007-03-01 11:53:55 0 d--hs---- C:\System Volume Information<SYSTEM~1> 2007-03-01 11:53:55 0 d-------- C:\Documents and Settings<DOCUME~1> 2007-03-01 11:51:50 0 d-------- C:\Program Files\MarBit 2007-03-01 11:51:33 348160 --a------ C:\WINDOWS\system32\msvcr71.dll 2007-03-01 11:50:47 115880 -----n--- C:\WINDOWS\system32\pxinsi64.exe 2007-03-01 11:50:47 129784 -----n--- C:\WINDOWS\system32\pxafs.dll 2007-03-01 11:50:47 36528 -----n--- C:\WINDOWS\system32\drivers\PxHelp20.sys 2007-03-01 11:50:47 2560 -----n--- C:\WINDOWS\system32\drivers\cdralw2k.sys 2007-03-01 11:50:47 2432 -----n--- C:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-03-01 11:50:44 0 d-------- C:\Program Files\Winamp 2007-03-01 11:50:33 0 d-------- C:\Program Files\XnView 2007-03-01 11:49:13 0 d-------- C:\WINDOWS 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\WinSxS 2007-03-01 11:49:13 0 dr------- C:\WINDOWS\Web 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\twain_32 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\wins 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\wbem 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\usmt 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\spool 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\ShellExt 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\Setup 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\ras 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\oobe 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\npp 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\mui 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\inetsrv 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\IME 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\icsxml 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\ias 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\export 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\drivers 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\drivers\etc 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\drivers\disdn 2007-03-01 11:49:13 0 dr-hs--c- C:\WINDOWS\system32\dllcache 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\dhcp 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\config 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\3com_dmi 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\3076 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\2052 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\1054 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\1045 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\1042 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\1041 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\1037 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\1033 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\1031 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\1028 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system32\1025 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\system 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\security 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\Resources<RESOUR~1> 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\repair 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\Provisioning<PROVIS~1> 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\PeerNet 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\pchealth 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\mui 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\msapps 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\msagent 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\Media 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\java 2007-03-01 11:49:13 0 d--h----- C:\WINDOWS\inf 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\ime 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\Help 2007-03-01 11:49:13 0 dr--s---- C:\WINDOWS\Fonts 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\ehome 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\Driver Cache<DRIVER~1> 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\Debug 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\Cursors 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\Connection Wizard<CONNEC~1> 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\Config 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\AppPatch 2007-03-01 11:49:13 0 d-------- C:\WINDOWS\addins 2007-03-01 11:40:37 118784 -ra------ C:\WINDOWS\system32\ptipbmf.dll 2007-03-01 11:40:37 159744 -ra------ C:\WINDOWS\system32\drivers\Fasttx2k.sys 2007-03-01 11:26:31 516096 -----n--- C:\WINDOWS\system32\ati2sgag.exe 2007-03-01 11:26:27 294912 -ra------ C:\WINDOWS\system32\atiiiexx.dll 2007-03-01 11:26:25 135168 -ra------ C:\WINDOWS\system32\ATIDEMGR.dll 2007-03-01 11:26:08 0 d-------- C:\Program Files\ATI Technologies<ATITEC~1> 2007-03-01 11:24:02 118784 -ra------ C:\WINDOWS\system32\Prounstl.exe 2007-03-01 11:24:02 24064 -ra------ C:\WINDOWS\system32\IntelNic.dll 2007-03-01 11:24:02 126976 -ra------ C:\WINDOWS\system32\e1000msg.dll 2007-03-01 11:24:01 121856 -ra------ C:\WINDOWS\system32\drivers\e1000325.sys 2007-03-01 11:23:23 235100 --a------ C:\WINDOWS\system32\drivers\MidiSyn.sys 2007-03-01 11:23:16 6400 --a------ C:\WINDOWS\system32\drivers\splitter.sys 2007-03-01 11:23:15 82944 --a------ C:\WINDOWS\system32\drivers\wdmaud.sys 2007-03-01 11:23:14 52864 --a------ C:\WINDOWS\system32\drivers\DMusic.sys 2007-03-01 11:23:13 54272 --a------ C:\WINDOWS\system32\drivers\swmidi.sys 2007-03-01 11:23:12 142464 --a------ C:\WINDOWS\system32\drivers\aec.sys 2007-03-01 11:23:11 171776 --a------ C:\WINDOWS\system32\drivers\kmixer.sys 2007-03-01 11:23:10 2944 --a------ C:\WINDOWS\system32\drivers\drmkaud.sys 2007-03-01 11:23:09 60800 --a------ C:\WINDOWS\system32\drivers\sysaudio.sys 2007-03-01 11:23:08 7552 --a------ C:\WINDOWS\system32\drivers\MSKSSRV.sys 2007-03-01 11:23:07 4992 --a------ C:\WINDOWS\system32\drivers\MSPQM.sys 2007-03-01 11:23:05 5376 --a------ C:\WINDOWS\system32\drivers\MSPCLOCK.sys 2007-03-01 11:23:02 4096 --a------ C:\WINDOWS\system32\ksuser.dll 2007-03-01 11:23:02 145792 --a------ C:\WINDOWS\system32\drivers\portcls.sys 2007-03-01 11:23:02 60288 --a------ C:\WINDOWS\system32\drivers\drmk.sys 2007-03-01 11:23:00 3744 --a------ C:\WINDOWS\system32\drivers\smsens.sys 2007-03-01 11:23:00 100224 --a------ C:\WINDOWS\system32\drivers\aeaudio.sys 2007-03-01 11:22:57 30208 --a------ C:\WINDOWS\system32\wdmioctl.dll 2007-03-01 11:22:56 1285632 --a------ C:\WINDOWS\system32\SMMedia.dll 2007-03-01 11:22:53 0 d-------- C:\WINDOWS\VirtualEar<VIRTUA~1> 2007-03-01 11:22:53 720896 --a------ C:\WINDOWS\system32\Audio3d.dll 2007-03-01 11:22:53 765952 --a------ C:\WINDOWS\system\crlds3d.dll 2007-03-01 11:22:52 991232 --a------ C:\WINDOWS\system32\virtear.dll 2007-03-01 11:22:52 578304 --a------ C:\WINDOWS\system32\drivers\smwdm.sys 2007-03-01 11:22:51 49152 --a------ C:\WINDOWS\system32\DSndUp.exe 2007-03-01 11:22:51 45056 --a------ C:\WINDOWS\system32\CleanUp.exe 2007-03-01 11:22:51 720896 --a------ C:\WINDOWS\system32\a3d.dll 2007-03-01 11:22:51 0 d-------- C:\Program Files\Analog Devices<ANALOG~1> 2007-03-01 11:21:55 0 d-------- C:\Program Files\Intel 2007-03-01 11:21:18 0 d-------- C:\WINDOWS\system32\ReinstallBackups<REINST~1> 2007-03-01 11:21:11 0 d--h----- C:\Program Files\InstallShield Installation Information<INSTAL~1> 2007-03-01 11:21:00 0 d-------- C:\Program Files\Common Files\InstallShield<INSTAL~1> 2007-03-01 11:20:36 5824 --a------ C:\WINDOWS\system32\drivers\ASUSHWIO.SYS 2007-03-01 11:09:15 0 d-------- C:\WINDOWS\SoftwareDistribution<SOFTWA~1> 2007-03-01 11:09:14 0 d-------- C:\WINDOWS\Prefetch 2007-03-01 11:06:16 0 d-------- C:\WINDOWS\system32\xircom 2007-03-01 11:06:16 0 d-------- C:\Program Files\microsoft frontpage<MICROS~1> 2007-03-01 11:06:00 0 -rahs---- C:\MSDOS.SYS 2007-03-01 11:06:00 0 -rahs---- C:\IO.SYS 2007-03-01 11:06:00 0 --a------ C:\CONFIG.SYS 2007-03-01 11:06:00 0 --a------ C:\AUTOEXEC.BAT 2007-03-01 11:05:49 112128 --a------ C:\WINDOWS\system32\mapi32.dll 2007-03-01 11:05:05 0 dr------- C:\WINDOWS\Offline Web Pages<OFFLIN~1> 2007-03-01 11:05:05 0 d---s---- C:\WINDOWS\Downloaded Program Files<DOWNLO~1> 2007-03-01 11:04:56 0 d--h----- C:\Program Files\WindowsUpdate<WINDOW~3> 2007-03-01 11:04:53 0 d-------- C:\Program Files\Usługi online<USUGIO~1> 2007-03-01 11:04:36 0 d-------- C:\WINDOWS\system32\DirectX 2007-03-01 11:04:14 11264 --a------ C:\WINDOWS\system32\atrace.dll 2007-03-01 11:04:04 12288 --a------ C:\WINDOWS\system32\nmevtmsg.dll 2007-03-01 11:04:02 67584 --a------ C:\WINDOWS\system32\acctres.dll 2007-03-01 11:03:58 0 d---s---- C:\WINDOWS\Tasks 2007-03-01 11:03:58 16384 --a------ C:\WINDOWS\system32\icfgnt5.dll 2007-03-01 11:03:57 0 d-------- C:\Program Files\Common Files\MSSoap 2007-03-01 11:03:54 0 d-------- C:\WINDOWS\srchasst 2007-03-01 11:03:53 0 d-------- C:\WINDOWS\system32\Macromed 2007-03-01 11:03:50 120320 --a------ C:\WINDOWS\system32\wuweb.dll 2007-03-01 11:03:50 36864 --a------ C:\WINDOWS\system32\wups.dll 2007-03-01 11:03:50 113664 --a------ C:\WINDOWS\system32\wucltui.dll 2007-03-01 11:03:50 6656 --a------ C:\WINDOWS\system32\wuauserv.dll 2007-03-01 11:03:50 184320 --a------ C:\WINDOWS\system32\wuaueng1.dll 2007-03-01 11:03:50 1134592 --a------ C:\WINDOWS\system32\wuaueng.dll 2007-03-01 11:03:50 168960 --a------ C:\WINDOWS\system32\wuauclt1.exe 2007-03-01 11:03:49 112128 --a------ C:\WINDOWS\system32\wuauclt.exe 2007-03-01 11:03:49 431616 --a------ C:\WINDOWS\system32\wuapi.dll 2007-03-01 11:03:49 18944 --a------ C:\WINDOWS\system32\qmgrprxy.dll 2007-03-01 11:03:49 382464 --a------ C:\WINDOWS\system32\qmgr.dll 2007-03-01 11:03:49 7168 --a------ C:\WINDOWS\system32\bitsprx3.dll 2007-03-01 11:03:49 8192 --a------ C:\WINDOWS\system32\bitsprx2.dll 2007-03-01 11:03:46 0 d-------- C:\Program Files\Movie Maker<MOVIEM~1> 2007-03-01 11:03:42 45568 --a------ C:\WINDOWS\system32\safrslv.dll 2007-03-01 11:03:41 29696 --a------ C:\WINDOWS\system32\safrdm.dll 2007-03-01 11:03:41 43520 --a------ C:\WINDOWS\system32\safrcdlg.dll 2007-03-01 11:03:41 43520 --a------ C:\WINDOWS\system32\racpldlg.dll 2007-03-01 11:03:39 22528 --a------ C:\WINDOWS\system32\fltMc.exe 2007-03-01 11:03:39 16896 --a------ C:\WINDOWS\system32\fltlib.dll 2007-03-01 11:03:39 124800 --a------ C:\WINDOWS\system32\drivers\fltMgr.sys 2007-03-01 11:03:38 171008 --a------ C:\WINDOWS\system32\srsvc.dll 2007-03-01 11:03:38 240128 --a------ C:\WINDOWS\system32\srrstr.dll 2007-03-01 11:03:38 67584 --a------ C:\WINDOWS\system32\srclient.dll 2007-03-01 11:03:38 0 d-------- C:\WINDOWS\system32\Restore 2007-03-01 11:03:38 73472 --a------ C:\WINDOWS\system32\drivers\sr.sys 2007-03-01 11:03:37 28672 --a------ C:\WINDOWS\system32\nmmkcert.dll 2007-03-01 11:03:37 32768 --a------ C:\WINDOWS\system32\mnmsrvc.exe 2007-03-01 11:03:37 34560 --a------ C:\WINDOWS\system32\mnmdd.dll 2007-03-01 11:03:37 32768 --a------ C:\WINDOWS\system32\isrdbg32.dll 2007-03-01 11:03:37 81920 --a------ C:\WINDOWS\system32\ils.dll 2007-03-01 11:03:36 69632 --a------ C:\WINDOWS\system32\msconf.dll 2007-03-01 11:03:34 105984 --a------ C:\WINDOWS\system32\msoert2.dll 2007-03-01 11:03:33 252928 --a------ C:\WINDOWS\system32\msoeacct.dll 2007-03-01 11:03:32 49664 --a------ C:\WINDOWS\system32\inetres.dll 2007-03-01 11:03:32 678400 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-03-01 11:03:31 192000 --a------ C:\WINDOWS\system32\schedsvc.dll 2007-03-01 11:03:31 12288 --a------ C:\WINDOWS\system32\mstinit.exe 2007-03-01 11:03:31 278528 --a------ C:\WINDOWS\system32\mstask.dll 2007-03-01 11:03:30 86016 --a------ C:\WINDOWS\system32\isign32.dll 2007-03-01 11:03:30 278528 --a------ C:\WINDOWS\system32\inetcfg.dll 2007-03-01 11:03:30 65536 --a------ C:\WINDOWS\system32\icwphbk.dll 2007-03-01 11:03:30 73728 --a------ C:\WINDOWS\system32\icwdial.dll 2007-03-01 11:03:01 21856 --a------ C:\WINDOWS\system32\emptyregdb.dat<EMPTYR~1.DAT> 2007-03-01 11:02:48 0 d-------- C:\WINDOWS\Registration<REGIST~1> 2007-03-01 11:02:38 0 d-------- C:\Program Files\Messenger<MESSEN~1> 2007-03-01 11:02:33 5632 --a------ C:\WINDOWS\system32\write.exe 2007-03-01 11:02:33 0 d-------- C:\Program Files\MSN Gaming Zone<MSNGAM~1> 2007-03-01 11:02:23 139264 --a------ C:\WINDOWS\system32\sndvol32.exe 2007-03-01 11:02:22 44544 --a------ C:\WINDOWS\system32\hticons.dll 2007-03-01 11:02:22 73216 --a------ C:\WINDOWS\system32\avwav.dll 2007-03-01 11:02:22 231424 --a------ C:\WINDOWS\system32\avtapi.dll 2007-03-01 11:02:22 16384 --a------ C:\WINDOWS\system32\avmeter.dll 2007-03-01 11:02:21 35328 --a------ C:\WINDOWS\system32\winchat.exe 2007-03-01 11:02:14 605696 --a------ C:\WINDOWS\system32\getuname.dll 2007-03-01 11:02:13 57344 --a------ C:\WINDOWS\system32\sol.exe 2007-03-01 11:02:13 80896 --a------ C:\WINDOWS\system32\charmap.exe 2007-03-01 11:02:13 115200 --a------ C:\WINDOWS\system32\calc.exe 2007-03-01 11:02:12 119808 --a------ C:\WINDOWS\system32\winmine.exe 2007-03-01 11:02:12 1225 --a------ C:\WINDOWS\system32\usrlogon.cmd 2007-03-01 11:02:12 16384 --a------ C:\WINDOWS\system32\tskill.exe 2007-03-01 11:02:12 9728 --a------ C:\WINDOWS\system32\reset.exe 2007-03-01 11:02:12 128000 --a------ C:\WINDOWS\system32\mshearts.exe 2007-03-01 11:02:12 55808 --a------ C:\WINDOWS\system32\freecell.exe 2007-03-01 11:02:11 17920 --a------ C:\WINDOWS\system32\tsshutdn.exe 2007-03-01 11:02:11 15360 --a------ C:\WINDOWS\system32\tsdiscon.exe 2007-03-01 11:02:11 15360 --a------ C:\WINDOWS\system32\tscon.exe 2007-03-01 11:02:11 15360 --a------ C:\WINDOWS\system32\shadow.exe 2007-03-01 11:02:11 16384 --a------ C:\WINDOWS\system32\rwinsta.exe 2007-03-01 11:02:11 33792 --a------ C:\WINDOWS\system32\regini.exe 2007-03-01 11:02:11 4608 --a------ C:\WINDOWS\system32\rdpcfgex.dll 2007-03-01 11:02:11 22528 --a------ C:\WINDOWS\system32\qwinsta.exe 2007-03-01 11:02:11 17408 --a------ C:\WINDOWS\system32\qappsrv.exe 2007-03-01 11:02:11 22528 --a------ C:\WINDOWS\system32\msg.exe 2007-03-01 11:02:11 15872 --a------ C:\WINDOWS\system32\logoff.exe 2007-03-01 11:02:10 15872 --a------ C:\WINDOWS\system32\cdmodem.dll 2007-03-01 11:02:09 25088 --a------ C:\WINDOWS\system32\mtxlegih.dll 2007-03-01 11:02:09 4096 --a------ C:\WINDOWS\system32\mtxex.dll 2007-03-01 11:02:09 20480 --a------ C:\WINDOWS\system32\mtxdm.dll 2007-03-01 11:02:09 5120 --a------ C:\WINDOWS\system32\dcomcnfg.exe 2007-03-01 11:02:09 82432 --a------ C:\WINDOWS\system32\comrepl.dll 2007-03-01 11:02:09 25600 --a------ C:\WINDOWS\system32\comaddin.dll 2007-03-01 11:02:08 54272 --a------ C:\WINDOWS\system32\stclient.dll 2007-03-01 11:02:08 147456 --a------ C:\WINDOWS\system32\comsnap.dll 2007-03-01 11:02:01 132608 --a------ C:\WINDOWS\system32\sndrec32.exe 2007-03-01 11:02:01 124928 --a------ C:\WINDOWS\system32\mplay32.exe 2007-03-01 11:02:01 349696 --a------ C:\WINDOWS\system32\hypertrm.dll 2007-03-01 11:02:01 187904 --a------ C:\WINDOWS\system32\accwiz.exe 2007-03-01 11:02:00 539136 --a------ C:\WINDOWS\system32\spider.exe 2007-03-01 11:02:00 345088 --a------ C:\WINDOWS\system32\mspaint.exe 2007-03-01 11:02:00 21896 --a------ C:\WINDOWS\system32\drivers\tdtcp.sys 2007-03-01 11:02:00 12040 --a------ C:\WINDOWS\system32\drivers\tdpipe.sys 2007-03-01 11:02:00 103424 --a------ C:\WINDOWS\system32\clipbrd.exe 2007-03-01 11:02:00 0 d-------- C:\Program Files\Windows NT<WINDOW~1> 2007-03-01 11:01:59 94720 --a------ C:\WINDOWS\system32\tscfgwmi.dll 2007-03-01 11:01:59 141824 --a------ C:\WINDOWS\system32\sessmgr.exe 2007-03-01 11:01:59 60928 --a------ C:\WINDOWS\system32\remotepg.dll 2007-03-01 11:01:59 67072 --a------ C:\WINDOWS\system32\rdshost.exe 2007-03-01 11:01:59 13824 --a------ C:\WINDOWS\system32\rdsaddin.exe 2007-03-01 11:01:59 147968 --a------ C:\WINDOWS\system32\rdchost.dll 2007-03-01 11:01:59 655360 --a------ C:\WINDOWS\system32\mstscax.dll 2007-03-01 11:01:59 408576 --a------ C:\WINDOWS\system32\mstsc.exe 2007-03-01 11:01:59 139400 --a------ C:\WINDOWS\system32\drivers\rdpwd.sys 2007-03-01 11:01:58 44544 --a------ C:\WINDOWS\system32\tscupgrd.exe 2007-03-01 11:01:58 296448 --a------ C:\WINDOWS\system32\termsrv.dll 2007-03-01 11:01:58 87176 --a------ C:\WINDOWS\system32\rdpwsx.dll 2007-03-01 11:01:58 19968 --a------ C:\WINDOWS\system32\rdpsnd.dll 2007-03-01 11:01:58 62464 --a------ C:\WINDOWS\system32\rdpclip.exe 2007-03-01 11:01:58 20992 --a------ C:\WINDOWS\system32\qprocess.exe 2007-03-01 11:01:58 11264 --a------ C:\WINDOWS\system32\icaapi.dll 2007-03-01 11:01:58 38912 --a------ C:\WINDOWS\system32\cfgbkend.dll 2007-03-01 11:01:57 11776 --a------ C:\WINDOWS\system32\xolehlp.dll 2007-03-01 11:01:57 90112 --a------ C:\WINDOWS\system32\mtxoci.dll 2007-03-01 11:01:57 161280 --a------ C:\WINDOWS\system32\msdtcuiu.dll 2007-03-01 11:01:57 949248 --a------ C:\WINDOWS\system32\msdtctm.dll 2007-03-01 11:01:57 425472 --a------ C:\WINDOWS\system32\msdtcprx.dll 2007-03-01 11:01:57 58880 --a------ C:\WINDOWS\system32\msdtclog.dll 2007-03-01 11:01:57 0 d-------- C:\WINDOWS\system32\MsDtc 2007-03-01 11:01:57 6144 --a------ C:\WINDOWS\system32\msdtc.exe 2007-03-01 11:01:56 0 d-------- C:\WINDOWS\system32\Com 2007-03-01 11:01:56 62464 --a------ C:\WINDOWS\system32\colbact.dll 2007-03-01 11:01:56 110080 --a------ C:\WINDOWS\system32\clbcatex.dll 2007-03-01 11:01:56 85504 --a------ C:\WINDOWS\system32\catsrvps.dll 2007-03-01 11:01:55 540160 --a------ C:\WINDOWS\system32\comuid.dll 2007-03-01 11:01:55 1251840 --a------ C:\WINDOWS\system32\comsvcs.dll 2007-03-01 11:01:55 501248 --a------ C:\WINDOWS\system32\clbcatq.dll 2007-03-01 11:01:55 628224 --a------ C:\WINDOWS\system32\catsrvut.dll 2007-03-01 11:01:55 229888 --a------ C:\WINDOWS\system32\catsrv.dll 2007-03-01 11:01:49 56320 --a------ C:\WINDOWS\system32\servdeps.dll 2007-03-01 11:01:49 17920 --a------ C:\WINDOWS\system32\mmfutil.dll 2007-03-01 11:01:49 58880 --a------ C:\WINDOWS\system32\licwmi.dll 2007-03-01 11:01:49 187904 --a------ C:\WINDOWS\system32\cmprops.dll 2007-03-01 11:01:46 40840 --a------ C:\WINDOWS\system32\drivers\termdd.sys 2007-03-01 11:01:46 196864 --a------ C:\WINDOWS\system32\drivers\rdpdr.sys -- Find3M Report --------------------------------------------------------------- 2007-03-20 21:03:30 435978 --a------ C:\WINDOWS\system32\perfh015.dat 2007-03-20 21:03:29 67078 --a------ C:\WINDOWS\system32\perfc015.dat 2007-03-17 14:54:48 0 d-------- C:\Documents and Settings\user\Dane aplikacji\Media Player Classic<MEDIAP~1> 2007-03-16 14:47:37 0 d-------- C:\Documents and Settings\user\Dane aplikacji\XnView 2007-03-14 20:15:25 0 d-------- C:\Documents and Settings\user\Dane aplikacji\Skype 2007-03-09 12:39:28 2560 --a------ C:\WINDOWS\system32\BitCometRes.dll<BITCOM~1.DLL> 2007-03-09 12:34:50 0 d-------- C:\Documents and Settings\user\Dane aplikacji\uTorrent 2007-03-08 18:18:48 0 d---s---- C:\Documents and Settings\user\Dane aplikacji\Microsoft<MICROS~1> 2007-03-07 22:20:10 0 d-------- C:\Documents and Settings\user\Dane aplikacji\.BitTornado<BITTOR~2> 2007-03-07 19:36:54 0 d-------- C:\Documents and Settings\user\Dane aplikacji\BitTorrent<BITTOR~1> 2007-03-04 12:50:07 0 d-------- C:\Documents and Settings\user\Dane aplikacji\Teleca 2007-03-02 22:23:52 0 d-------- C:\Documents and Settings\user\Dane aplikacji\Lavasoft 2007-03-02 22:21:59 0 d-------- C:\Documents and Settings\user\Dane aplikacji\teamspeak2<TEAMSP~1> 2007-03-01 19:57:51 0 d-------- C:\Documents and Settings\user\Dane aplikacji\InterTrust<INTERT~1> 2007-03-01 19:57:51 0 d-------- C:\Documents and Settings\user\Dane aplikacji\Adobe 2007-03-01 19:15:47 0 d-------- C:\Documents and Settings\user\Dane aplikacji\Macromedia<MACROM~1> 2007-03-01 16:06:20 0 d-------- C:\Documents and Settings\user\Dane aplikacji\Microsoft Web Folders<MICROS~2> 2007-03-01 15:50:39 0 d-------- C:\Documents and Settings\user\Dane aplikacji\Mozilla 2007-03-01 11:55:05 0 d-------- C:\Documents and Settings\user\Dane aplikacji\CyberLink<CYBERL~1> 2007-03-01 11:54:31 62 --ahs---- C:\Documents and Settings\user\Dane aplikacji\desktop.ini 2007-03-01 11:31:27 0 d-------- C:\Documents and Settings\user\Dane aplikacji\Help 2007-03-01 11:20:04 0 d-------- C:\Documents and Settings\user\Dane aplikacji\Identities<IDENTI~1> -- Registry Dump --------------------------------------------------------------- [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe" "BitTorrent"="\"G:\\Bittorrent\\bittorrent.exe\" --force_start_minimized" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run] "SoundMAXPnP"="C:\\Program Files\\Analog Devices\\SoundMAX\\SMax4PNP.exe" "SoundMAX"="\"C:\\Program Files\\Analog Devices\\SoundMAX\\Smax4.exe\" /tray" "ATIPTA"="C:\\Program Files\\ATI Technologies\\ATI Control Panel\\atiptaxx.exe" "Ptipbmf"="rundll32.exe ptipbmf.dll,SetWriteCacheMode" "RemoteControl"="\"C:\\Program Files\\CyberLink\\PowerDVD\\PDVDServ.exe\"" "NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe" "WooCnxMon"="C:\\PROGRA~1\\NEOSTR~1\\CnxMon.exe" "SpeedTouch USB Diagnostics"="\"C:\\Program Files\\Thomson\\SpeedTouch USB\\Dragdiag.exe\" /icon" "WOOWATCH"="C:\\PROGRA~1\\NEOSTR~1\\Watch.exe" "WOOTASKBARICON"="C:\\PROGRA~1\\NEOSTR~1\\TaskbarIcon.exe" "avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe" "Logitech Utility"="Logi_MwX.Exe" @="" "Sony Ericsson PC Suite"="\"C:\\Program Files\\Sony Ericsson\\Mobile2\\Application Launcher\\Application Launcher.exe\" /startoptions" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL] "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI] "NoChange"="1" "Installed"="1" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS] "Installed"="1" [HKEY_USERS\.default\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run] "CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE" [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders] "SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll" [HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost] HTTPFilter REG_MULTI_SZ HTTPFilter\0\0 LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0 NetworkService REG_MULTI_SZ DnsCache\0\0 DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0 rpcss REG_MULTI_SZ RpcSs\0\0 imgsvc REG_MULTI_SZ StiSvc\0\0 termsvcs REG_MULTI_SZ TermService\0\0 [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D] Shell\AutoRun\command D:\autorun.exe [HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{643a1129-c7e2-11db-9fcb-806d6172696f}] Shell\AutoRun\command D:\autorun.exe -- End of ComboScan: finished at 2007-03-20 at 21:03:54 ------------------------

**Posty:** 18165 · przez **wojtas** 20 Mar 2007, 22:17

w logach jest ok nic nie widac czy dalej masz problem?

**Posty:** 9 · przez **sandrak91** 20 Mar 2007, 22:40

Dalej jest to samo

Tylko jak plytka z gra ruszy w napedzie od razu, wyskakuje komunikat z avasta, ze znaleziono wirusa ;/ Co mozna jeszcze w takiej sytuacji zrobic?

**Posty:** 18165 · przez **wojtas** 20 Mar 2007, 22:48

pokaz screena z alertem

**Posty:** 9 · przez **sandrak91** 20 Mar 2007, 23:24

Kod: Zaznacz wszystko: http://img398.imageshack.us/my.php?image=wirusmy0.jpg

**Posty:** 18165 · przez **wojtas** 20 Mar 2007, 23:42

moim zdaniem to jest falszywy alarm

uzyj: jeszcze raz
ATF_Cleaner

przeskanuj www.ewido.com >> wywal wszystko co znajdzie

**Posty:** 9 · przez **sandrak91** 21 Mar 2007, 00:28

Uzylam jeszcze raz tego programu i przeskanowalam tym drugim ;/ dalej to samo...

**Posty:** 8694 · przez **Red** 21 Mar 2007, 09:48

Podeslij jeszcze logi z programu gmer:

http://www.gmer.net/

- Rootkit >>> zaznaczone Pokaż wszystko >>> wskazane tylko Usługi >>> Szukaj >>> Kopiuj >>> CTRL+V do posta
- Rootkit >>> odznaczone Pokaż wszystko >>> wskazane wszystkie obiekty do skanu >>> Szukaj >>> Kopiuj >>> CTRL+V do posta

**Posty:** 9 · przez **sandrak91** 21 Mar 2007, 10:28

Nie wiem czy to o to chodzilo

http://traxa.pl/file.php?file=bae474136ffba430a290845357cc5d0c

**Posty:** 8694 · przez **Red** 21 Mar 2007, 11:57

log sie nie miesci,wrzuc je jako załaczniki,ok

Autor postu otrzymał pochwałę

**Posty:** 9 · przez **sandrak91** 23 Mar 2007, 22:15

Ma ktos moze jeszcze jakis pomysl jak sie pozbyc tego trojana

?

**Posty:** 18165 · przez **wojtas** 24 Mar 2007, 09:02

przeinstaluj avasta i zobacz czy dalej bedzie krzyczal oraz wejsc do sciezki podanej przez Ciebie na screenie i zobacz czy tam jest jakis plik

Autor postu otrzymał pochwałę

**Posty:** 9 · przez **sandrak91** 25 Mar 2007, 19:56

Oki, dzieki juz sie naprawilo

Dzieki za pomoc :]

trojan-gen {other} - jak sie tego pozbyc?

trojan-gen {other} - jak sie tego pozbyc?

Kto jest na forum