Wirus (ljjbqoll.dll)

**Posty:** 30 · przez **svieru** 17 Paź 2008, 17:35

witam, mam nastepujacy problem. sciagnalem niby plik z serialem do gry Zuma, ktory uruchomilem i sie okazalo ze to syf straszny. mam win xp sp2. system sie uruchamia lecz w prawym dolnym rogu caly czas wyskakuje komunikat

Kod: Zaznacz wszystko: Your computer is infected! Windows has detected spyware infection It is recommended to use special ... ... Click to protect your computer from spyware

Po kliknieciu sciaga sie automatycznie XP AntiSpyware 2009 - Installer, ale nigdy nie dociąga do konca.
Menedzer zadan jak chce uruchomic pojawia sie komunikat Menedzer zadan zostal wylaczony przez administratora (a zawsze dzialal normalnie, nic nie wylaczalem).
Nie da sie uruchomic prawie zadnego programu (w tym ComboFixa, hijackthis, Avg antispywarenawet w trybie awaryjnym). Dziala Ashampoo win optimizer, odkurzacz. pliki i foldery z gra natychmiast usunalem. po procesach w ashampoo doszedlem ze jeden ma zrodlo w c:\documents and settings\all users\dane aplikacji\folder_jakis, usunalem ten folder.
Ponadto, w katalogu Windows sa dwa pliki ktore za kazdym razem daja sie usunac ale po uruchumieniu ponownym sa znow: karna.dat i aplikacja brastk, a w katalogu system32 udalo mi sie pare plikow o dacie i godzinie w ktorej instalowalem to usunac, ale zostaly jeszcze 3 ktorych sie usunac nie da (nawet filewiperem), sa to te same 2 co w kat. windows i ljJBqolL.dll, jest tez wini10451631 ale tu sie domyslam ze to ten xp antispyware bo ta sama ikone maja.
przywracania systemu nie dam rady zrobic bo wczesniej nie byla ta opcja uruchomiona.
W Ashampoo w startup tunerze mam plik brastk.exe, ktory za kazdym razem jak wylacze, to potem jest znow zaznaczony, a w zakladce IE Plugins mam C:\windows\system32\ljJBqolL.dll, ktory jak dam remove to mi pisze, ze przy ponownym uruchomieniu go usunie, tak sie oczywiscie nei dzieje.
Czasem po uruchomieniu pokazuje sie okno ze system sie zamknie za 60sek (powiedzmy raz na 5 uruchomien komputera, oczywiscie po zlapaniu tego wirusa)
Nie wiem co jeszcze moge dodac. Sorry za brak polskich liter ale pisze z cudzego laptopa. Nie bardzo juz mam pomysl co zrobic, mecze sie z tym juz 3h. z gory dzieki za wszelka pomoc.

**Posty:** 1340 · przez **eSpEY** 17 Paź 2008, 18:01

hijackthis-silent-runners-obsluga-i-umieszczanie-vt9452.html

Autor postu otrzymał pochwałę

**Posty:** 30 · przez **svieru** 17 Paź 2008, 20:01

tak jak pisałem: HJ nie uruchamia mi się, nawet po przeinstalowaniu. ten xp antispyware sie w koncu sciagnal i skanuje juz dlugo ale na niego nie licze. ogolnie internet strasznie muli zapewne przez to wszystko.

log z silentrunners:

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 58, http://www.silentrunners.org/ Operating System: Windows XP SP2 Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "gadu-gadu" = ""C:\Program Files\GaduGadu\gg.exe" /tray" ["sms-express.com"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ {++} "0xictJ10Fp" = "C:\Documents and Settings\All Users\Dane aplikacji\verqxyxq\hqbudwdk.exe" [file not found] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "XP Antispyware 2009" = ""C:\Program Files\XP_AntiSpyware\XP_AntiSpyware.exe" /hide" [empty string] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {d8cadfe4-81e7-4424-887f-dc661b79eaff}\(Default) = (no title provided) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\ljJBqolL.dll" [null data] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{00020D75-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Desktop Icon Handler" -> {HKLM...CLSID} = "Microsoft Office Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\MLSHEXT.DLL" [MS] "{0006F045-0000-0000-C000-000000000046}" = "Microsoft Office Outlook Custom Icon Handler" -> {HKLM...CLSID} = "Rozszerzenie ikon plików programu Outlook" \InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\OLKFSTUB.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Microsoft Office\OFFICE11\msohev.dll" [MS] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] "{416651E4-9C3C-11D9-8BDE-F66BAD1E3F3A}" = "Nokia Phone Browser" -> {HKLM...CLSID} = "Nokia Phone Browser" \InProcServer32\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 7\phonebrowser.dll" ["Nokia"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{57B86673-276A-48B2-BAE7-C6DBB3020EB8}" = "AVG Anti-Spyware 7.5" -> {HKLM...CLSID} = "CShellExecuteHookImpl Object" \InProcServer32\(Default) = "C:\Program Files\AVG Anti-Spyware 7.5\shellexecutehook.dll" ["GRISOFT s.r.o."] <<!>> "{D8CADFE4-81E7-4424-887F-DC661B79EAFF}" = "*n" (unwritable string) -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\ljJBqolL.dll" [null data] HKLM\SYSTEM\CurrentControlSet\Control\Lsa\ <<!>> "Authentication Packages" = "msv1_0"|"C:\WINDOWS\system32\yayvSjhF" HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\ <<!>> "BootExecute" = "autocheck autochk *"|"lsdelete" [null data] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> ljJBqolL\DLLName = "ljJBqolL.dll" [null data] <<!>> wintoi32\DLLName = "wintoi32.dll" [file not found] HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807553E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSOXMLMF.DLL" [MS] HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\ {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\AVG Anti-Spyware 7.5\context.dll" ["GRISOFT s.r.o."] dap_menu\(Default) = "{BED4C38B-F765-45AC-8C56-613F76BBF43E}" -> {HKLM...CLSID} = "DAPMenuShellExt Class" \InProcServer32\(Default) = "C:\PROGRA~1\DAP\Privacy Package\DAPCtxMenuShell.dll" ["Speedbit Ltd."] DAP_ShredMenu\(Default) = "{BED4C38B-F765-45AC-8C56-613F76BBF43E}" -> {HKLM...CLSID} = "DAPMenuShellExt Class" \InProcServer32\(Default) = "C:\PROGRA~1\DAP\Privacy Package\DAPCtxMenuShell.dll" ["Speedbit Ltd."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ AVG Anti-Spyware\(Default) = "{8934FCEF-F5B8-468f-951F-78A921CD3920}" -> {HKLM...CLSID} = "CContextScan Object" \InProcServer32\(Default) = "C:\Program Files\AVG Anti-Spyware 7.5\context.dll" ["GRISOFT s.r.o."] DAP_ShredMenu\(Default) = "{BED4C38B-F765-45AC-8C56-613F76BBF43E}" -> {HKLM...CLSID} = "DAPMenuShellExt Class" \InProcServer32\(Default) = "C:\PROGRA~1\DAP\Privacy Package\DAPCtxMenuShell.dll" ["Speedbit Ltd."] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data] Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoCDBurning" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "NoRecentDocsHistory" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "ClearRecentDocsOnExit" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideClock" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "NoTrayItemsDisplay" = (REG_DWORD) dword:0x00000000 {User Configuration|Administrative Templates|Start Menu and Taskbar| Hide the notification area} "ForceClassicControlPanel" = (REG_DWORD) dword:0x00000001 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoResolveTrack" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "NoPropertiesMyComputer" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "NoViewContextMenu" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "NoFileAssociate" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "NoFind" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "NoClose" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "StartMenuLogoff" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "NoSMHelp" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "DisableTaskMgr" = (REG_DWORD) dword:0x00000001 {User Configuration|Administrative Templates|System|Ctrl+Alt+Del Options| Remove Task Manager} HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel\ "SecurityTab" = (REG_DWORD) dword:0x00000000 {Computer Configuration|Administrative Templates|Windows Components|Internet Explorer|Internet Control Panel| Disable the Security page} "ConnectionsTab" = (REG_DWORD) dword:0x00000000 {Computer Configuration|Administrative Templates|Windows Components|Internet Explorer|Internet Control Panel| Disable the Connections page} "SecChangeSettings" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions\ "NoBrowserOptions" = (REG_DWORD) dword:0x00000000 {Computer Configuration|Administrative Templates|Windows Components|Internet Explorer|Browser Menus| Tools menu: Disable Internet Options... menu option} "NoBrowserSaveAs" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "NoFavorites" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "NoFileNew" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "NoFileOpen" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "NoTheaterMode" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ "undockwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} "ShutdownWithoutLogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "NoDispCPL" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "NoDispBackgroundPage" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "NoDispSettingsPage" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "NoDispScrSavPage" = (REG_DWORD) dword:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\Adam\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Enabled Screen Saver: --------------------- HKCU\Control Panel\Desktop\ "SCRNSAVE.EXE" = "C:\WINDOWS\System32\logon.scr" [MS] Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ ACDSeeAcquirePicturesOnArrival\ "Provider" = "ACDSee" "InvokeProgID" = "ACDSee.AutoPlayHandlerAcquire" "InvokeVerb" = "Acquire" HKLM\SOFTWARE\Classes\ACDSee.AutoPlayHandlerAcquire\shell\Acquire\command\(Default) = ""C:\Program Files\ACD Systems\ACDSee\8.0\ACDSee8.exe" /detect:%1" ["ACD Systems Ltd."] ACDSeeShowPicturesOnArrival\ "Provider" = "ACDSee" "InvokeProgID" = "ACDSee.AutoPlayHandler" "InvokeVerb" = "Open" HKLM\SOFTWARE\Classes\ACDSee.AutoPlayHandler\shell\Open\command\(Default) = ""C:\Program Files\ACD Systems\ACDSee\8.0\ACDSee8.exe" "%1"" ["ACD Systems Ltd."] NMMPlayCDAudioOnArrival\ "Provider" = "Nokia Music Manager" "InvokeProgID" = "NokiaMusicManager" "InvokeVerb" = "NMMPlayCD" HKLM\SOFTWARE\Classes\NokiaMusicManager\shell\NMMPlayCD\command\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 7\MusicManager.exe /playCD "%L"" ["Nokia"] NMMRipCDAudioOnArrival\ "Provider" = "Nokia Music Manager" "InvokeProgID" = "NokiaMusicManager" "InvokeVerb" = "NMMRipCD" HKLM\SOFTWARE\Classes\NokiaMusicManager\shell\NMMRipCD\command\(Default) = "C:\Program Files\Nokia\Nokia PC Suite 7\MusicManager.exe /ripCD "%L"" ["Nokia"] WinampMTPHandler\ "Provider" = "Winamp" "ProgID" = "Shell.HWEventHandlerShellExecute" "InitCmdLine" = "C:\Program Files\Winamp\winamp.exe" HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" -> {HKLM...CLSID} = "ShellExecute HW Event Handler" \LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS] WinampPlayMediaOnArrival\ "Provider" = "Winamp" "InvokeProgID" = "Winamp.File" "InvokeVerb" = "Play" HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\command\(Default) = ""C:\Program Files\Winamp\winamp.exe" "%1"" ["Nullsoft"] HKLM\SOFTWARE\Classes\Winamp.File\shell\Play\DropTarget\CLSID = "{46986115-84D6-459c-8F95-52DD653E532E}" -> {HKLM...CLSID} = (no title provided) \LocalServer32\(Default) = ""C:\Program Files\Winamp\winamp.exe"" ["Nullsoft"] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 11 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ HKLM\SOFTWARE\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Badanie" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\ {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Badanie" Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ AVG Anti-Spyware Guard, AVG Anti-Spyware Guard, "C:\Program Files\AVG Anti-Spyware 7.5\guard.exe" ["GRISOFT s.r.o."] Lavasoft Ad-Aware Service, aawservice, ""C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe"" ["Lavasoft"] Windows User Mode Driver Framework, UMWdf, "C:\WINDOWS\system32\wdfmgr.exe" [MS] ---------- (launch time: 2008-10-17 19:23:43) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 2107 seconds, including 18 seconds for message boxes)

udało mi się zainstalować smitfraudfixa i przeskanować, oto log

Kod: Zaznacz wszystko: SmitFraudFix v2.362 Scan done at 19:08:07,17, 2008-10-17 Run from C:\Documents and Settings\Adam\Pulpit\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» Process C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\Explorer.EXE C:\Program Files\GaduGadu\gg.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE C:\WINDOWS\system32\svchost.exe C:\Documents and Settings\Adam\Pulpit\SmitfraudFix\SmiUpdate.exe C:\WINDOWS\system32\cmd.exe »»»»»»»»»»»»»»»»»»»»»»»» hosts »»»»»»»»»»»»»»»»»»»»»»»» C:\ »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS C:\WINDOWS\karna.dat FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32 C:\WINDOWS\system32\brastk.exe FOUND ! C:\WINDOWS\system32\karna.dat FOUND ! »»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Adam »»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Adam\Application Data »»»»»»»»»»»»»»»»»»»»»»»» Start Menu »»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Adam\Ulubione »»»»»»»»»»»»»»»»»»»»»»»» Desktop »»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files »»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys »»»»»»»»»»»»»»»»»»»»»»»» Desktop Components [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0] "Source"="About:Home" "SubscribedURL"="About:Home" "FriendlyName"="Moja bieľĄca strona g˘wna" »»»»»»»»»»»»»»»»»»»»»»»» o4Patch !!!Attention, following keys are not inevitably infected!!! o4Patch Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» IEDFix !!!Attention, following keys are not inevitably infected!!! IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» VACFix !!!Attention, following keys are not inevitably infected!!! VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix !!!Attention, following keys are not inevitably infected!!! 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix !!!Attention, following keys are not inevitably infected!!! AntiXPVSTFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="karna.dat" »»»»»»»»»»»»»»»»»»»»»»»» Winlogon !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "Userinit"="C:\\WINDOWS\\system32\\userinit.exe," "System"="" »»»»»»»»»»»»»»»»»»»»»»»» RK C:\WINDOWS\system32\drivers\beep.sys infected ! »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: Karta Realtek RTL8029(AS) PCI Ethernet Adapter - Sterownik miniport Harmonogramu pakietów DNS Server Search Order: 192.0.2.2 DNS Server Search Order: 87.239.216.6 HKLM\SYSTEM\CCS\Services\Tcpip\..\{2F618E1A-80CC-468A-931B-79899F4B881B}: DhcpNameServer=192.0.2.2 87.239.216.6 HKLM\SYSTEM\CS2\Services\Tcpip\..\{2F618E1A-80CC-468A-931B-79899F4B881B}: DhcpNameServer=192.0.2.2 87.239.216.6 HKLM\SYSTEM\CS3\Services\Tcpip\..\{2F618E1A-80CC-468A-931B-79899F4B881B}: DhcpNameServer=192.0.2.2 87.239.216.6 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.0.2.2 87.239.216.6 HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.0.2.2 87.239.216.6 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.0.2.2 87.239.216.6 »»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection »»»»»»»»»»»»»»»»»»»»»»»» End

**Posty:** 8001 · przez **Okocza** 17 Paź 2008, 20:09

svieru, wstaw log z combofixa

**Posty:** 30 · przez **svieru** 17 Paź 2008, 20:13

tak jak pisałem w 1. poście, nie uruchamia mi się combofix, ani normalnie, ani w trybie awaryjnym, tak samo HJ i niektore inne programy, po prostu klikam dwukrotnie i nic się nie dzieje, tak jakby coś blokowało niektóre programy.

**Posty:** 18165 · przez **wojtas** 18 Paź 2008, 12:29

zastosuj:

smitfraudfix z opcji 2
(sciagasz -> uruchamiasz-> klikasz dowolny klawisz -> wpisujesz w programie 2 i enter potem czekasz chwile -> gdy wyskoczy pytanie w programie Do you want to clean the registry ? to wpisujesz literke Y i znowu enter i czekasz do wyskoczenia raportu (znak ze skan dobiegł konca)

Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

**Posty:** 30 · przez **svieru** 18 Paź 2008, 17:11

już wczoraj, zanim napisałeś, udało mi się przeskanować smitfraudem (nie miałem internetu więc nie mogłem wrzucić od razu),
oto log:

Kod: Zaznacz wszystko: SmitFraudFix v2.362 Scan done at 21:37:37,48, 2008-10-17 Run from C:\Documents and Settings\Adam\Pulpit\SmitfraudFix OS: Microsoft Windows XP [Wersja 5.1.2600] - Windows_NT The filesystem type is NTFS Fix run in normal mode »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Killing process »»»»»»»»»»»»»»»»»»»»»»»» hosts 127.0.0.1 ZieF.pl 127.0.0.1 localhost »»»»»»»»»»»»»»»»»»»»»»»» VACFix VACFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix S!Ri's WS2Fix: LSP not Found. »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix GenericRenosFix by S!Ri »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files Problem while deleting C:\WINDOWS\system32\brastk.exe C:\WINDOWS\system32\_scui.cpl Deleted »»»»»»»»»»»»»»»»»»»»»»»» IEDFix IEDFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» 404Fix 404Fix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» AntiXPVSTFix AntiXPVSTFix Credits: Malware Analysis & Diagnostic Code: S!Ri »»»»»»»»»»»»»»»»»»»»»»»» RK »»»»»»»»»»»»»»»»»»»»»»»» DNS Description: Karta Realtek RTL8029(AS) PCI Ethernet Adapter - Sterownik miniport Harmonogramu pakietów DNS Server Search Order: 192.0.2.2 DNS Server Search Order: 87.239.216.6 HKLM\SYSTEM\CCS\Services\Tcpip\..\{2F618E1A-80CC-468A-931B-79899F4B881B}: DhcpNameServer=192.0.2.2 87.239.216.6 HKLM\SYSTEM\CS2\Services\Tcpip\..\{2F618E1A-80CC-468A-931B-79899F4B881B}: DhcpNameServer=192.0.2.2 87.239.216.6 HKLM\SYSTEM\CS3\Services\Tcpip\..\{2F618E1A-80CC-468A-931B-79899F4B881B}: DhcpNameServer=192.0.2.2 87.239.216.6 HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.0.2.2 87.239.216.6 HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.0.2.2 87.239.216.6 HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.0.2.2 87.239.216.6 »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System !!!Attention, following keys are not inevitably infected!!! [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon] "System"="" »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning Registry Cleaning done. »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix !!!Attention, following keys are not inevitably infected!!! SrchSTS.exe by S!Ri Search SharedTaskScheduler's .dll »»»»»»»»»»»»»»»»»»»»»»»» Reboot C:\WINDOWS\system32\brastk.exe Deleted »»»»»»»»»»»»»»»»»»»»»»»» End

a następnie coś 'drgnęło' i udało się przeskanować combofixem,
oto log

Kod: Zaznacz wszystko: ComboFix 08-10-16.08 - Adam 2008-10-17 22:09:01.1 - NTFSx86 MINIMAL Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.162 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Adam\Pulpit\ComboFix.exe [COLOR=RED][B]UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !![/B][/COLOR] . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Adam\Cookies\ahybaropus.sys C:\Documents and Settings\Adam\Cookies\pocisusafi.bin C:\Documents and Settings\Adam\Cookies\xukubimiw.lib C:\Documents and Settings\Adam\Menu Start\Programy\XP_AntiSpyware C:\Documents and Settings\Adam\Menu Start\Programy\XP_AntiSpyware\Uninstall.lnk C:\Documents and Settings\Adam\Menu Start\Programy\XP_AntiSpyware\XP_AntiSpyware.lnk C:\Documents and Settings\Adam\Ustawienia lokalne\Temporary Internet Files\atiqumyd.bat C:\Documents and Settings\Adam\Ustawienia lokalne\Temporary Internet Files\edunifyhu.com C:\Documents and Settings\Adam\Ustawienia lokalne\Temporary Internet Files\evypo.reg C:\Documents and Settings\Adam\Ustawienia lokalne\Temporary Internet Files\fbk.sts C:\Documents and Settings\Adam\Ustawienia lokalne\Temporary Internet Files\fubaqogu.lib C:\Documents and Settings\Adam\Ustawienia lokalne\Temporary Internet Files\ifelipy.bat C:\Documents and Settings\Adam\Ustawienia lokalne\Temporary Internet Files\opus.com C:\Documents and Settings\Adam\Ustawienia lokalne\Temporary Internet Files\opyhinituh.bat C:\Documents and Settings\Adam\Ustawienia lokalne\Temporary Internet Files\xiqaqywex.reg C:\Documents and Settings\Adam\Ustawienia lokalne\Temporary Internet Files\yzojepu.vbs C:\Program Files\XP_AntiSpyware C:\Program Files\XP_AntiSpyware\AVEngn.dll C:\Program Files\XP_AntiSpyware\data\daily.cvd C:\Program Files\XP_AntiSpyware\htmlayout.dll C:\Program Files\XP_AntiSpyware\Microsoft.VC80.CRT\Microsoft.VC80.CRT.manifest C:\Program Files\XP_AntiSpyware\Microsoft.VC80.CRT\msvcm80.dll C:\Program Files\XP_AntiSpyware\Microsoft.VC80.CRT\msvcp80.dll C:\Program Files\XP_AntiSpyware\Microsoft.VC80.CRT\msvcr80.dll C:\Program Files\XP_AntiSpyware\pthreadVC2.dll C:\Program Files\XP_AntiSpyware\Uninstall.exe C:\Program Files\XP_AntiSpyware\wscui.cpl C:\Program Files\XP_AntiSpyware\XP_Antispyware.cfg C:\Program Files\XP_AntiSpyware\XP_AntiSpyware.exe C:\WINDOWS\BMc795f220.txt C:\WINDOWS\BMc795f220.xml C:\WINDOWS\IE4 Error Log.txt C:\WINDOWS\msacm32.drv C:\WINDOWS\pskt.ini C:\WINDOWS\system32\cktapjot.ini C:\WINDOWS\system32\dllcache\beep.sys C:\WINDOWS\system32\drivers\str.sys C:\WINDOWS\system32\drivers\synsenddrv.sys C:\WINDOWS\system32\FhjSvyay.ini C:\WINDOWS\system32\FhjSvyay.ini2 C:\WINDOWS\system32\ljJBqolL.dll C:\WINDOWS\system32\mxiughgx.ini C:\WINDOWS\system32\ujwapfuw.ini C:\WINDOWS\system32\wini10451631.exe C:\WINDOWS\system32\xnujdfyi.ini . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_SYNSEND -------\Service_synsend ((((((((((((((((((((((((( Pliki utworzone od 2008-09-17 do 2008-10-17 ))))))))))))))))))))))))))))))) . 2008-10-17 22:01 . 2008-10-17 22:01 19,036 --a------ C:\Documents and Settings\Adam\Dane aplikacji\beqofa.vbs 2008-10-17 22:01 . 2008-10-17 22:01 17,854 --a------ C:\WINDOWS\seheh.bat 2008-10-17 22:01 . 2008-10-17 22:01 17,381 --a------ C:\WINDOWS\emobyfo.bat 2008-10-17 22:01 . 2008-10-17 22:01 15,620 --a------ C:\WINDOWS\system32\widukiz.ban 2008-10-17 22:01 . 2008-10-17 22:01 15,332 --a------ C:\WINDOWS\siridaca.reg 2008-10-17 22:01 . 2008-10-17 22:01 13,915 --a------ C:\Documents and Settings\All Users\Dane aplikacji\hyni.scr 2008-10-17 22:01 . 2008-10-17 22:01 13,635 --a------ C:\Program Files\Common Files\rivahiky.com 2008-10-17 22:01 . 2008-10-17 22:01 12,076 --a------ C:\WINDOWS\system32\upycomeju.inf 2008-10-17 22:01 . 2008-10-17 22:01 11,804 --a------ C:\WINDOWS\zohy.exe 2008-10-17 22:01 . 2008-10-17 22:01 11,166 --a------ C:\WINDOWS\system32\upoludu.dl 2008-10-17 22:01 . 2008-10-17 22:01 11,151 --a------ C:\WINDOWS\xojomawaf.pif 2008-10-17 22:01 . 2008-10-17 22:01 10,655 --a------ C:\WINDOWS\system32\ujofala.dl 2008-10-17 22:01 . 2008-10-17 22:01 10,243 --a------ C:\Documents and Settings\All Users\Dane aplikacji\owagavoh.bat 2008-10-17 22:01 . 2008-10-17 22:01 10,115 --a------ C:\WINDOWS\system32\wofiric.com 2008-10-17 19:06 . 2008-10-17 19:06 0 --a------ C:\WINDOWS\system32\4.tmp 2008-10-17 19:06 . 2008-10-17 19:06 0 --a------ C:\WINDOWS\system32\3.tmp 2008-10-17 19:05 . 2008-10-17 19:06 88 --a------ C:\WINDOWS\system32\2.tmp 2008-10-17 18:00 . 2008-10-17 18:00 <DIR> d-------- C:\!KillBox 2008-10-17 17:57 . 2008-10-17 17:57 <DIR> d-------- C:\!FixIEDef 2008-10-17 16:59 . 2008-10-17 22:11 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-10-17 16:59 . 2008-06-30 23:41 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-10-17 16:59 . 2008-06-30 21:50 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-10-17 16:59 . 2008-06-30 23:41 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-10-17 16:59 . 2008-06-30 23:41 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-10-17 16:59 . 2008-06-30 23:41 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-10-17 16:59 . 2008-06-30 23:41 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-10-17 16:59 . 2008-10-17 16:59 <DIR> d-------- C:\Documents and Settings\Administrator 2008-10-17 14:06 . 2008-10-17 22:03 94,720 --a------ C:\WINDOWS\system32\drivers\bdf4f3e6.sys 2008-10-17 14:06 . 2008-10-17 14:06 47,104 --a------ C:\WINDOWS\system32\drivers\eystkexpstvtm.sys 2008-10-12 21:46 . 2008-10-11 11:19 386,048 --a------ C:\DZWONEK DLA MAMY.mp3 2008-10-12 21:38 . 2008-10-12 21:38 1,154,048 --a------ C:\w branzy.mp3 2008-10-12 21:36 . 2008-10-12 21:36 <DIR> d-------- C:\Program Files\MP3SPLITTER 2008-10-12 20:55 . 2004-08-03 23:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys 2008-10-12 20:55 . 2004-08-03 23:08 25,600 --a--c--- C:\WINDOWS\system32\dllcache\usbser.sys 2008-10-12 20:55 . 2006-10-08 21:51 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-10-12 20:55 . 2008-10-12 20:55 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-10-12 20:55 . 2008-10-12 20:55 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-10-12 20:46 . 2008-10-12 20:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nokia 2008-10-12 20:39 . 2008-10-12 20:39 <DIR> d-------- C:\Program Files\MSXML 6.0 2008-10-12 20:39 . 2008-02-01 16:17 138,112 --a------ C:\WINDOWS\system32\drivers\nmwcdnsu.sys 2008-10-12 20:39 . 2008-02-01 16:17 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdnsuc.sys 2008-10-12 20:20 . 2008-10-12 20:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-10-12 20:20 . 2008-10-12 20:56 <DIR> d-------- C:\Documents and Settings\Adam\Dane aplikacji\PC Suite 2008-10-12 20:20 . 2008-10-12 21:56 <DIR> d-------- C:\Documents and Settings\Adam\Dane aplikacji\Nokia 2008-10-12 20:17 . 2008-10-12 20:17 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-10-12 20:17 . 2008-10-12 20:17 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-10-12 20:15 . 2008-10-12 20:15 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-10-12 20:15 . 2008-10-12 20:15 <DIR> d-------- C:\Program Files\DIFX 2008-10-12 20:15 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys 2008-10-12 20:14 . 2008-10-12 20:39 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2008-10-12 20:14 . 2008-05-07 07:39 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-10-12 20:14 . 2008-05-07 07:38 659,968 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-10-12 20:14 . 2008-02-01 16:17 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2008-10-12 20:14 . 2008-05-07 07:38 20,864 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys 2008-10-12 20:14 . 2008-05-07 07:38 17,536 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys 2008-10-12 20:14 . 2008-05-07 07:38 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys 2008-10-12 20:14 . 2008-06-06 09:24 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys 2008-10-12 20:13 . 2008-10-12 20:39 <DIR> d-------- C:\Program Files\Nokia 2008-10-12 20:00 . 2008-10-12 20:33 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-10-03 23:02 . 2008-10-17 15:46 <DIR> d-------- C:\Program Files\Odkurzacz 2008-10-03 18:42 . 2008-10-03 18:47 17,667,832 --a------ C:\TheTreasuresOfMontezuma_1660.exe . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-17 20:01 12,157 ----a-w C:\Program Files\Common Files\rajoha.ban 2008-10-17 19:39 2,338 ----a-w C:\WINDOWS\system32\tmp.reg 2008-10-10 06:58 92,672 ----a-w C:\WINDOWS\system32\o4Patch.exe 2008-10-10 06:58 92,672 ----a-w C:\WINDOWS\system32\IEDFix.C.exe 2008-10-03 21:26 --------- d-----w C:\Program Files\eMule 2008-10-03 21:26 --------- d-----w C:\Documents and Settings\Adam\Dane aplikacji\skypePM 2008-10-01 13:51 97,280 ----a-w C:\WINDOWS\system32\VACFix.exe 2008-09-24 20:25 --------- d-----w C:\Documents and Settings\Adam\Dane aplikacji\Skype 2008-09-15 17:22 --------- d-----w C:\Program Files\SubEdit-Player 2008-09-08 21:38 98,304 ----a-w C:\WINDOWS\system32\AntiXPVSTFix.exe 2008-08-18 10:19 92,160 ----a-w C:\WINDOWS\system32\404Fix.exe 2008-07-26 20:48 7,252,937 ----a-w C:\odk11.2.0308setup_[www.programosy.pl].exe 2008-07-17 11:48 2,647,281 ----a-w C:\ComboFix.exe 2001-01-11 21:02 794,624 ----a-r C:\WINDOWS\inf\OTHER\AUDIO3D.DLL . ------- Sigcheck ------- 2004-08-04 01:44 1040896 e7586189f12eabd0e3a16d7bc83a940c C:\WINDOWS\explorer.exe 2004-08-04 01:44 1040896 9a1cb1324869091c0e8b409f1eb0b302 C:\WINDOWS\system32\dllcache\explorer.exe 2004-08-04 01:44 22528 63f12d57431dda1743d85654d2c902bd C:\WINDOWS\system32\ctfmon.exe 2004-08-04 01:44 22528 7f366cebdd69f7e58bd35cc92f4257b3 C:\WINDOWS\system32\dllcache\ctfmon.exe 2004-08-04 01:44 65024 4507f1ea279279794aa33e44ec2e8b6a C:\WINDOWS\system32\spoolsv.exe 2004-08-04 01:44 65024 c7fbef45a3794048a652d3a31969b152 C:\WINDOWS\system32\dllcache\spoolsv.exe 2004-08-04 01:44 32256 a228f0622c6046184d455b53dafae7a8 C:\WINDOWS\system32\userinit.exe 2004-08-04 01:44 32256 02894afbf4c4633fbad9c42e8572fea1 C:\WINDOWS\system32\dllcache\userinit.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "gadu-gadu"="C:\Program Files\GaduGadu\gg.exe" [2004-12-14 778240] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSConfig"="C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2004-08-04 166912] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) "NoFileAssociate"= 0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SLUNotify] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\GaduGadu\\gg.exe"= "F:\\Program Files\\eMule\\4\\emule.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-07-13 17408] S1 bdf4f3e6;bdf4f3e6;C:\WINDOWS\system32\drivers\bdf4f3e6.sys [2008-10-17 94720] S1 ensqio;ensqio;C:\WINDOWS\system32\DRIVERS\ensqio.sys [ ] S1 sbpcint4;SB AudioPCI 128;C:\WINDOWS\system32\DRIVERS\sbpcint4.sys [ ] S2 meykz;meykz;C:\WINDOWS\system32\drivers\eystkexpstvtm.sys [2008-10-17 47104] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2008-02-01 138112] S3 nmwcdnsuc;Nokia USB Flashing Generic;C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2008-02-01 8320] S4 CSIScanner;CSIScanner;C:\Program Files\PrevxCSI\prevxcsi.exe [ ] . - - - - USUNIĘTO PUSTE WPISY - - - - BHO-{d8cadfe4-81e7-4424-887f-dc661b79eaff} - C:\WINDOWS\system32\ljJBqolL.dll HKLM-Run-XP Antispyware 2009 - C:\Program Files\XP_Antispyware\XP_AntiSpyware.exe HKLM-Explorer_Run-0xictJ10Fp - C:\Documents and Settings\All Users\Dane aplikacji\verqxyxq\hqbudwdk.exe ShellExecuteHooks-{D8CADFE4-81E7-4424-887F-DC661B79EAFF} - C:\WINDOWS\system32\ljJBqolL.dll Notify-ljJBqolL - ljJBqolL.dll Notify-wintoi32 - wintoi32.dll . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\Adam\Dane aplikacji\Mozilla\Firefox\Profiles\bxd4678j.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://google.pl/ . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-17 22:15:03 Windows 5.1.2600 Dodatek Service Pack 2 NTFS detected NTDLL code modification: ZwOpenFile skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\Program Files\AVG Anti-Spyware 7.5\guard.exe . ************************************************************************** . Czas ukończenia: 2008-10-17 22:19:07 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-10-17 20:18:58 Przed: 1 352 855 552 bajtów wolnych Po: 1,252,188,160 bajtów wolnych 218

ten syf został usunięty zdaje się, ale pojawily sie inne problemy:
-za kazdym razem włącza się komunikat, że komputer się za 60sek wyłączy, jest to związane z usługą service,
-w normalnym trybie nie uruchamia się firefox (chociaz w menedżerze zadań jest jako włączony), podobnie dzieje się jak chcę uruchomić msconfig. gg się uruchamia ale nie włącza, czyli nie widzi internetu
-teraz piszę w trybie awaryjnym z obsługą sieci i FF działa, msconfig też
-po tym jak odlicza 60sek to się nie wyłącza ale wszystko zaczyna mulić, po uruchomieniu paru rzeczy po prostu się zawiesza,
-HJ też zaczął działać, oto log (ale z trybu awaryjnego)

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 17:10:21, on 2008-10-18 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Safe mode with network support Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe C:\WINDOWS\Explorer.EXE C:\Program Files\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\taskmgr.exe C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKCU\..\Run: [gadu-gadu] "C:\Program Files\GaduGadu\gg.exe" /tray O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\AVG Anti-Spyware 7.5\guard.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 2103 bytes

teraz spróbuje przeskanować kasperskym online w trybie awaryjnym

**Posty:** 18165 · przez **wojtas** 18 Paź 2008, 17:41

skasuj:

Kod: Zaznacz wszystko: O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Control Panel present

Otworz notatnik i wklej w nim to:

File::
C:\Documents and Settings\Adam\Dane aplikacji\beqofa.vbs
C:\WINDOWS\seheh.bat
C:\WINDOWS\emobyfo.bat
C:\WINDOWS\system32\widukiz.ban
C:\WINDOWS\siridaca.reg
C:\Documents and Settings\All Users\Dane aplikacji\hyni.scr
C:\Program Files\Common Files\rivahiky.com
C:\WINDOWS\system32\upycomeju.inf
C:\WINDOWS\zohy.exe
C:\WINDOWS\system32\upoludu.dl
C:\WINDOWS\xojomawaf.pif
C:\WINDOWS\system32\ujofala.dl
C:\Documents and Settings\All Users\Dane aplikacji\owagavoh.bat
C:\WINDOWS\system32\wofiric.com
C:\WINDOWS\system32\4.tmp
C:\WINDOWS\system32\3.tmp
C:\WINDOWS\system32\2.tmp
C:\WINDOWS\system32\drivers\bdf4f3e6.sys
C:\WINDOWS\system32\drivers\eystkexpstvtm.sys
C:\Program Files\Common Files\rajoha.ban
C:\WINDOWS\system32\tmp.reg
C:\WINDOWS\system32\o4Patch.exe
C:\WINDOWS\system32\IEDFix.C.exe
C:\WINDOWS\system32\404Fix.ex
C:\WINDOWS\system32\brastk.exe

Driver::
bdf4f3e6
meykz

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

Autor postu otrzymał pochwałę

**Posty:** 30 · przez **svieru** 19 Paź 2008, 03:34

wklejam log z combofixa
http://www.sendspace.pl/file/Y997txpM/
(musiałem wrzucić na sendspace'a, bo znów mi wyskoczył błąd - Twoja wiadomość zawiera 66629 znaków. Maksymalna dozwolona liczba znaków to 60000. Nawet jeden log z combofixa się nie mieścił)

oraz wklejam log z kasperskiego (znalazł 8 wirusów ale nie było tam opcji usuń/napraw ani nic takiego.
wrzucam plik txt na wyslijto.pl, bo post był za długi z wklejonym raportem i wyskoczył mi błąd

Kod: Zaznacz wszystko: Twoja wiadomość zawiera 142233 znaków. Maksymalna dozwolona liczba znaków to 60000.

http://s006.wyslijto.pl/?file_id=00551378514184060786

pierw skanowałem kasperskym, potem wykonałem tą operację w combofiksie, tak jak napisałeś wyżej.
po restarcie przy pracy combofixa system uruchomił się w normalnym trybie i działa FF, jest internet, komunikat '60sek' się nie pojawił, nie wiem jak będzie następnym razem. dzięki za wszelką pomoc

Dodano 19.10.2008 13:43:29:
Sprawdźcie, proszę, te logi, które zamieściłem w tych dwóch linkach. nie mogłem dać w tagach, bo przekraczały limit słów w poscie. dzięki

Kod: Zaznacz wszystko: [i][size=85]Dodano 20.10.2008 19:57:12:[/size][/i] [quote]ComboFix 08-10-16.08 - Adam 2008-10-19 3:09:06.2 - NTFSx86 NETWORK Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.76 [GMT 2:00] Uruchomiony z: C:\Documents and Settings\Adam\Pulpit\ComboFix.exe Użyto następujących komend :: C:\Documents and Settings\Adam\Pulpit\CFScript.txt FILE :: C:\Documents and Settings\Adam\Dane aplikacji\beqofa.vbs C:\Documents and Settings\All Users\Dane aplikacji\hyni.scr C:\Documents and Settings\All Users\Dane aplikacji\owagavoh.bat C:\Program Files\Common Files\rajoha.ban C:\Program Files\Common Files\rivahiky.com C:\WINDOWS\emobyfo.bat C:\WINDOWS\seheh.bat C:\WINDOWS\siridaca.reg C:\WINDOWS\system32\2.tmp C:\WINDOWS\system32\3.tmp C:\WINDOWS\system32\4.tmp C:\WINDOWS\system32\404Fix.ex C:\WINDOWS\system32\brastk.exe C:\WINDOWS\system32\drivers\bdf4f3e6.sys C:\WINDOWS\system32\drivers\eystkexpstvtm.sys C:\WINDOWS\system32\IEDFix.C.exe C:\WINDOWS\system32\o4Patch.exe C:\WINDOWS\system32\tmp.reg C:\WINDOWS\system32\ujofala.dl C:\WINDOWS\system32\upoludu.dl C:\WINDOWS\system32\upycomeju.inf C:\WINDOWS\system32\widukiz.ban C:\WINDOWS\system32\wofiric.com C:\WINDOWS\xojomawaf.pif C:\WINDOWS\zohy.exe . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Adam\Dane aplikacji\beqofa.vbs C:\Documents and Settings\All Users\Dane aplikacji\hyni.scr C:\Documents and Settings\All Users\Dane aplikacji\owagavoh.bat C:\Program Files\Common Files\rajoha.ban C:\Program Files\Common Files\rivahiky.com C:\WINDOWS\emobyfo.bat C:\WINDOWS\seheh.bat C:\WINDOWS\siridaca.reg C:\WINDOWS\system32\drivers\bdf4f3e6.sys C:\WINDOWS\system32\drivers\eystkexpstvtm.sys C:\WINDOWS\system32\drivers\str.sys C:\WINDOWS\system32\IEDFix.C.exe C:\WINDOWS\system32\o4Patch.exe C:\WINDOWS\system32\tmp.reg C:\WINDOWS\xojomawaf.pif C:\WINDOWS\zohy.exe . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Legacy_MEYKZ -------\Service_bdf4f3e6 -------\Service_meykz -------\Service_synsend ((((((((((((((((((((((((( Pliki utworzone od 2008-09-19 do 2008-10-19 ))))))))))))))))))))))))))))))) . 2008-10-18 17:13 . 2008-10-18 17:13 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-10-18 17:13 . 2008-10-18 17:13 <DIR> d-------- C:\WINDOWS\LastGood.Tmp 2008-10-18 17:13 . 2008-10-18 17:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-10-17 18:05 . 2007-09-06 00:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe 2008-10-17 18:05 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-10-17 18:05 . 2008-09-08 23:38 98,304 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe 2008-10-17 18:05 . 2008-10-01 15:51 97,280 --a------ C:\WINDOWS\system32\VACFix.exe 2008-10-17 18:05 . 2008-05-18 21:40 92,672 --a------ C:\WINDOWS\system32\IEDFix.exe 2008-10-17 18:05 . 2008-08-18 12:19 92,160 --a------ C:\WINDOWS\system32\404Fix.exe 2008-10-17 18:05 . 2003-06-05 21:13 61,440 --a------ C:\WINDOWS\system32\Process.exe 2008-10-17 18:05 . 2004-07-31 18:50 58,368 --a------ C:\WINDOWS\system32\dumphive.exe 2008-10-17 18:05 . 2007-10-04 00:36 36,352 --a------ C:\WINDOWS\system32\WS2Fix.exe 2008-10-17 18:00 . 2008-10-17 18:00 <DIR> d-------- C:\!KillBox 2008-10-17 17:57 . 2008-10-17 17:57 <DIR> d-------- C:\!FixIEDef 2008-10-17 16:59 . 2008-10-19 03:10 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-10-17 16:59 . 2008-06-30 23:41 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-10-17 16:59 . 2008-06-30 21:50 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-10-17 16:59 . 2008-06-30 23:41 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-10-17 16:59 . 2008-06-30 23:41 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-10-17 16:59 . 2008-06-30 23:41 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-10-17 16:59 . 2008-06-30 23:41 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-10-17 16:59 . 2008-10-17 16:59 <DIR> d-------- C:\Documents and Settings\Administrator 2008-10-12 21:46 . 2008-10-11 11:19 386,048 --a------ C:\DZWONEK DLA MAMY.mp3 2008-10-12 21:38 . 2008-10-12 21:38 1,154,048 --a------ C:\w branzy.mp3 2008-10-12 21:36 . 2008-10-12 21:36 <DIR> d-------- C:\Program Files\MP3SPLITTER 2008-10-12 20:55 . 2004-08-03 23:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys 2008-10-12 20:55 . 2004-08-03 23:08 25,600 --a--c--- C:\WINDOWS\system32\dllcache\usbser.sys 2008-10-12 20:55 . 2006-10-08 21:51 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-10-12 20:55 . 2008-10-12 20:55 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-10-12 20:55 . 2008-10-12 20:55 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-10-12 20:46 . 2008-10-12 20:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nokia 2008-10-12 20:39 . 2008-10-12 20:39 <DIR> d-------- C:\Program Files\MSXML 6.0 2008-10-12 20:39 . 2008-02-01 16:17 138,112 --a------ C:\WINDOWS\system32\drivers\nmwcdnsu.sys 2008-10-12 20:39 . 2008-02-01 16:17 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdnsuc.sys 2008-10-12 20:20 . 2008-10-12 20:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-10-12 20:20 . 2008-10-12 20:56 <DIR> d-------- C:\Documents and Settings\Adam\Dane aplikacji\PC Suite 2008-10-12 20:20 . 2008-10-12 21:56 <DIR> d-------- C:\Documents and Settings\Adam\Dane aplikacji\Nokia 2008-10-12 20:17 . 2008-10-12 20:17 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-10-12 20:17 . 2008-10-12 20:17 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-10-12 20:15 . 2008-10-12 20:15 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-10-12 20:15 . 2008-10-12 20:15 <DIR> d-------- C:\Program Files\DIFX 2008-10-12 20:15 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys 2008-10-12 20:14 . 2008-10-12 20:39 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2008-10-12 20:14 . 2008-05-07 07:39 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-10-12 20:14 . 2008-05-07 07:38 659,968 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-10-12 20:14 . 2008-02-01 16:17 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2008-10-12 20:14 . 2008-05-07 07:38 20,864 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys 2008-10-12 20:14 . 2008-05-07 07:38 17,536 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys 2008-10-12 20:14 . 2008-05-07 07:38 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys 2008-10-12 20:14 . 2008-06-06 09:24 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys 2008-10-12 20:13 . 2008-10-12 20:39 <DIR> d-------- C:\Program Files\Nokia 2008-10-12 20:00 . 2008-10-12 20:33 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-10-03 23:02 . 2008-10-17 15:46 <DIR> d-------- C:\Program Files\Odkurzacz 2008-10-03 18:42 . 2008-10-03 18:47 17,667,832 --a------ C:\TheTreasuresOfMontezuma_1660.exe . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-03 21:26 --------- d-----w C:\Program Files\eMule 2008-10-03 21:26 --------- d-----w C:\Documents and Settings\Adam\Dane aplikacji\skypePM 2008-09-24 20:25 --------- d-----w C:\Documents and Settings\Adam\Dane aplikacji\Skype 2008-09-15 17:22 --------- d-----w C:\Program Files\SubEdit-Player 2008-07-26 20:48 7,252,937 ----a-w C:\odk11.2.0308setup_[www.programosy.pl].exe 2001-01-11 21:02 794,624 ----a-r C:\WINDOWS\inf\OTHER\AUDIO3D.DLL . ------- Sigcheck ------- 2004-08-04 01:44 21504 eb346e509e03ffcc05bd339d071f2e8a C:\WINDOWS\system32\svchost.exe 2004-08-04 01:44 21504 5b6754a8befbc2f0a5d50a8c268067bb C:\WINDOWS\system32\dllcache\svchost.exe 2004-08-04 01:44 1040896 e7586189f12eabd0e3a16d7bc83a940c C:\WINDOWS\explorer.exe 2004-08-04 01:44 1040896 9a1cb1324869091c0e8b409f1eb0b302 C:\WINDOWS\system32\dllcache\explorer.exe 2004-08-04 01:44 115712 dffeab8e99c0b213155605314b14a923 C:\WINDOWS\system32\services.exe 2004-08-04 01:44 115712 5803347d628c458a1ed01d0bfdcdbfc7 C:\WINDOWS\system32\dllcache\services.exe 2004-08-04 01:44 22528 63f12d57431dda1743d85654d2c902bd C:\WINDOWS\system32\ctfmon.exe 2004-08-04 01:44 22528 7f366cebdd69f7e58bd35cc92f4257b3 C:\WINDOWS\system32\dllcache\ctfmon.exe 2004-08-04 01:44 65024 4507f1ea279279794aa33e44ec2e8b6a C:\WINDOWS\system32\spoolsv.exe 2004-08-04 01:44 65024 c7fbef45a3794048a652d3a31969b152 C:\WINDOWS\system32\dllcache\spoolsv.exe 2004-08-04 01:44 32256 a228f0622c6046184d455b53dafae7a8 C:\WINDOWS\system32\userinit.exe 2004-08-04 01:44 32256 02894afbf4c4633fbad9c42e8572fea1 C:\WINDOWS\system32\dllcache\userinit.exe . ((((((((((((((((((((((((((((( snapshot@2008-10-17_22.18.03.07 ))))))))))))))))))))))))))))))))))))))))) . - 2008-06-30 20:07:36 166,912 ----a-r C:\WINDOWS\Installer\{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}\places.exe + 2008-06-30 20:07:36 174,080 ----a-r C:\WINDOWS\Installer\{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}\places.exe - 2008-06-30 20:14:54 593,920 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\accicons.exe + 2008-06-30 20:14:54 602,112 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\accicons.exe - 2008-06-30 20:14:54 12,288 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\cagicon.exe + 2008-06-30 20:14:54 19,456 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\cagicon.exe - 2008-06-30 20:14:54 86,016 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\inficon.exe + 2008-06-30 20:14:54 94,208 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\inficon.exe - 2008-06-30 20:14:54 61,440 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\pubs.exe + 2008-06-30 20:14:54 69,632 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\pubs.exe - 2008-06-30 20:14:54 23,040 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\unbndico.exe + 2008-06-30 20:14:54 30,208 ----a-r C:\WINDOWS\Installer\{90110415-6000-11D3-8CFE-0150048383C9}\unbndico.exe - 2008-06-30 20:36:59 81,920 ----a-r C:\WINDOWS\Installer\{AE80641A-0C8D-4670-A518-B4EC154B1027}\ACDSeeDesktopShortcu_AE80641A0C8D4670A518B4EC154B1027.exe + 2008-06-30 20:36:59 90,112 ----a-r C:\WINDOWS\Installer\{AE80641A-0C8D-4670-A518-B4EC154B1027}\ACDSeeDesktopShortcu_AE80641A0C8D4670A518B4EC154B1027.exe - 2008-06-30 20:36:59 81,920 ----a-r C:\WINDOWS\Installer\{AE80641A-0C8D-4670-A518-B4EC154B1027}\ARPPRODUCTICON.exe + 2008-06-30 20:36:59 90,112 ----a-r C:\WINDOWS\Installer\{AE80641A-0C8D-4670-A518-B4EC154B1027}\ARPPRODUCTICON.exe - 2005-09-23 05:28:52 72,704 ----a-w C:\WINDOWS\Microsoft.NET\Framework\NETFXSBS10.exe + 2005-09-23 05:28:52 79,872 ----a-w C:\WINDOWS\Microsoft.NET\Framework\NETFXSBS10.exe - 2005-09-23 05:28:32 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe + 2005-09-23 05:28:32 45,056 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe - 2005-09-23 05:28:32 13,824 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe + 2005-09-23 05:28:32 20,992 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe - 2005-09-23 05:28:32 106,496 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe + 2005-09-23 05:28:32 114,688 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe - 2005-09-23 05:28:56 106,496 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CasPol.exe + 2005-09-23 05:28:56 114,688 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CasPol.exe - 2005-09-23 05:28:38 4,608 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe + 2005-09-23 05:28:38 11,776 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe - 2005-09-23 05:28:56 9,728 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExec.exe + 2005-09-23 05:28:56 16,896 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExec.exe - 2005-09-23 05:28:56 28,672 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe + 2005-09-23 05:28:56 36,864 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe - 2005-09-23 05:28:48 40,960 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\jsc.exe + 2005-09-23 05:28:48 49,152 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\jsc.exe - 2005-09-23 05:28:48 69,632 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe + 2005-09-23 05:28:48 77,824 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe - 2005-09-23 05:28:56 53,248 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe + 2005-09-23 05:28:56 61,440 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe - 2005-09-23 05:28:56 32,768 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe + 2005-09-23 05:28:56 40,960 ----a-w C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe - 2004-08-03 23:44:18 256,512 ----a-w C:\WINDOWS\msagent\agentsvr.exe + 2004-08-03 23:44:18 263,680 ----a-w C:\WINDOWS\msagent\agentsvr.exe - 2004-08-03 23:44:22 768,512 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe + 2004-08-03 23:44:22 775,680 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe - 2001-10-26 20:29:54 99,840 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.exe + 2001-10-26 20:29:54 107,008 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.exe - 2004-08-03 23:44:22 18,944 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HscUpd.exe + 2004-08-03 23:44:22 26,112 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\HscUpd.exe - 2001-10-26 20:29:58 35,328 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\notiflag.exe + 2001-10-26 20:29:58 42,496 ----a-w C:\WINDOWS\pchealth\helpctr\binaries\notiflag.exe - 2004-08-03 23:44:28 151,040 ----a-w C:\WINDOWS\pchealth\UploadLB\Binaries\UploadM.exe + 2004-08-03 23:44:28 158,208 ----a-w C:\WINDOWS\pchealth\UploadLB\Binaries\UploadM.exe - 2005-01-28 11:44:28 47,104 ----a-w C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\uwdf.exe + 2005-01-28 11:44:28 54,272 ----a-w C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\uwdf.exe - 2005-01-28 11:44:28 38,912 ----a-w C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wdfmgr.exe + 2005-01-28 11:44:28 46,080 ----a-w C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wdfmgr.exe - 2004-08-03 23:44:22 103,936 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\logagent.exe + 2004-08-03 23:44:22 111,104 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\logagent.exe - 2005-01-28 11:44:28 96,768 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\logagent.exe + 2005-01-28 11:44:28 103,936 ----a-w C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\logagent.exe - 2008-10-17 20:14:18 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-10-19 01:12:05 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-10-17 20:14:18 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat + 2008-10-19 01:12:05 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat - 2008-10-17 20:14:18 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat + 2008-10-19 01:12:05 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat - 2004-08-03 23:44:22 39,424 -c--a-w C:\WINDOWS\system32\dllcache\grpconv.exe + 2004-08-03 23:44:22 46,592 -c--a-w C:\WINDOWS\system32\dllcache\grpconv.exe - 2001-10-26 20:29:54 14,848 -c--a-w C:\WINDOWS\system32\dllcache\help.exe + 2001-10-26 20:29:54 22,016 -c--a-w C:\WINDOWS\system32\dllcache\help.exe - 2004-08-03 23:44:22 768,512 -c--a-w C:\WINDOWS\system32\dllcache\helpctr.exe + 2004-08-03 23:44:22 775,680 -c--a-w C:\WINDOWS\system32\dllcache\helpctr.exe - 2001-10-26 20:29:54 99,840 -c--a-w C:\WINDOWS\system32\dllcache\helphost.exe + 2001-10-26 20:29:54 107,008 -c--a-w C:\WINDOWS\system32\dllcache\helphost.exe - 2004-08-03 23:44:22 743,936 -c--a-w C:\WINDOWS\system32\dllcache\helpsvc.exe + 2004-08-03 23:44:22 751,104 -c--a-w C:\WINDOWS\system32\dllcache\helpsvc.exe - 2004-08-03 23:44:22 10,752 -c--a-w C:\WINDOWS\system32\dllcache\hh.exe + 2004-08-03 23:44:22 17,920 -c--a-w C:\WINDOWS\system32\dllcache\hh.exe - 2001-10-26 20:29:54 8,192 -c--a-w C:\WINDOWS\system32\dllcache\hostname.exe + 2001-10-26 20:29:54 15,360 -c--a-w C:\WINDOWS\system32\dllcache\hostname.exe - 2001-10-26 20:29:54 42,573 -c--a-w C:\WINDOWS\system32\dllcache\hrtzzm.exe + 2001-10-26 20:29:54 49,741 -c--a-w C:\WINDOWS\system32\dllcache\hrtzzm.exe - 2004-08-03 23:44:22 18,944 -c--a-w C:\WINDOWS\system32\dllcache\hscupd.exe + 2004-08-03 23:44:22 26,112 -c--a-w C:\WINDOWS\system32\dllcache\hscupd.exe - 2004-08-03 23:44:22 216,576 -c--a-w C:\WINDOWS\system32\dllcache\icwconn1.exe + 2004-08-03 23:44:22 223,744 -c--a-w C:\WINDOWS\system32\dllcache\icwconn1.exe - 2004-08-03 23:44:22 86,016 -c--a-w C:\WINDOWS\system32\dllcache\icwconn2.exe + 2004-08-03 23:44:22 94,208 -c--a-w C:\WINDOWS\system32\dllcache\icwconn2.exe - 2004-08-03 23:44:22 24,576 -c--a-w C:\WINDOWS\system32\dllcache\icwrmind.exe + 2004-08-03 23:44:22 32,768 -c--a-w C:\WINDOWS\system32\dllcache\icwrmind.exe - 2001-10-26 20:29:54 73,728 -c--a-w C:\WINDOWS\system32\dllcache\icwtutor.exe + 2001-10-26 20:29:54 81,920 -c--a-w C:\WINDOWS\system32\dllcache\icwtutor.exe - 2004-08-03 23:44:22 34,304 -c--a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe + 2004-08-03 23:44:22 41,472 -c--a-w C:\WINDOWS\system32\dllcache\ie4uinit.exe - 2004-08-03 23:44:22 18,432 -c--a-w C:\WINDOWS\system32\dllcache\iedw.exe + 2004-08-03 23:44:22 25,600 -c--a-w C:\WINDOWS\system32\dllcache\iedw.exe - 2004-08-03 23:44:22 93,184 -c--a-w C:\WINDOWS\system32\dllcache\iexplore.exe + 2004-08-03 23:44:22 100,352 -c--a-w C:\WINDOWS\system32\dllcache\iexplore.exe - 2004-08-03 23:44:22 114,688 -c--a-w C:\WINDOWS\system32\dllcache\iexpress.exe + 2004-08-03 23:44:22 121,856 -c--a-w C:\WINDOWS\system32\dllcache\iexpress.exe - 2001-10-26 20:29:54 15,360 -c--a-w C:\WINDOWS\system32\dllcache\iisreset.exe + 2001-10-26 20:29:54 22,528 -c--a-w C:\WINDOWS\system32\dllcache\iisreset.exe - 2004-08-03 23:44:22 31,232 -c--a-w C:\WINDOWS\system32\dllcache\iisrstas.exe + 2004-08-03 23:44:22 38,400 -c--a-w C:\WINDOWS\system32\dllcache\iisrstas.exe - 2001-10-26 20:29:54 6,656 -c--a-w C:\WINDOWS\system32\dllcache\iissync.exe + 2001-10-26 20:29:54 13,824 -c--a-w C:\WINDOWS\system32\dllcache\iissync.exe - 2004-08-03 23:44:22 150,016 -c--a-w C:\WINDOWS\system32\dllcache\imapi.exe + 2004-08-03 23:44:22 157,184 -c--a-w C:\WINDOWS\system32\dllcache\imapi.exe - 2001-08-18 00:56:28 44,032 -c--a-w C:\WINDOWS\system32\dllcache\imekrmig.exe + 2001-08-18 00:56:28 51,200 -c--a-w C:\WINDOWS\system32\dllcache\imekrmig.exe - 2001-08-18 00:06:18 311,359 -c--a-w C:\WINDOWS\system32\dllcache\imepadsv.exe + 2001-08-18 00:06:18 319,551 -c--a-w C:\WINDOWS\system32\dllcache\imepadsv.exe - 2001-08-18 00:07:58 57,398 -c--a-w C:\WINDOWS\system32\dllcache\imjpdadm.exe + 2001-08-18 00:07:58 65,590 -c--a-w C:\WINDOWS\system32\dllcache\imjpdadm.exe - 2004-08-03 21:31:54 307,257 -c--a-w C:\WINDOWS\system32\dllcache\imjpdct.exe + 2004-08-03 21:31:54 315,449 -c--a-w C:\WINDOWS\system32\dllcache\imjpdct.exe - 2004-08-03 21:31:56 155,705 -c--a-w C:\WINDOWS\system32\dllcache\imjpdsvr.exe + 2004-08-03 21:31:56 163,897 -c--a-w C:\WINDOWS\system32\dllcache\imjpdsvr.exe - 2004-08-03 21:31:58 196,665 -c--a-w C:\WINDOWS\system32\dllcache\imjpinst.exe + 2004-08-03 21:31:58 213,381 -c--a-w C:\WINDOWS\system32\dllcache\imjpinst.exe - 2004-08-03 21:32:00 208,952 -c--a-w C:\WINDOWS\system32\dllcache\imjpmig.exe + 2004-08-03 21:32:00 217,144 -c--a-w C:\WINDOWS\system32\dllcache\imjpmig.exe - 2004-08-03 21:32:12 233,527 -c--a-w C:\WINDOWS\system32\dllcache\imjprw.exe + 2004-08-03 21:32:12 241,719 -c--a-w C:\WINDOWS\system32\dllcache\imjprw.exe - 2001-08-18 00:07:30 45,109 -c--a-w C:\WINDOWS\system32\dllcache\imjpuex.exe + 2001-08-18 00:07:30 53,301 -c--a-w C:\WINDOWS\system32\dllcache\imjpuex.exe - 2004-08-03 21:32:16 262,200 -c--a-w C:\WINDOWS\system32\dllcache\imjputy.exe + 2004-08-03 21:32:16 270,392 -c--a-w C:\WINDOWS\system32\dllcache\imjputy.exe - 2001-08-18 00:56:28 59,904 -c--a-w C:\WINDOWS\system32\dllcache\imkrinst.exe + 2001-08-18 00:56:28 67,072 -c--a-w C:\WINDOWS\system32\dllcache\imkrinst.exe - 2004-08-03 21:31:50 59,392 -c--a-w C:\WINDOWS\system32\dllcache\imscinst.exe + 2004-08-03 21:31:50 74,168 -c--a-w C:\WINDOWS\system32\dllcache\imscinst.exe - 2004-08-03 23:44:22 15,872 -c--a-w C:\WINDOWS\system32\dllcache\inetin51.exe + 2004-08-03 23:44:22 23,040 -c--a-w C:\WINDOWS\system32\dllcache\inetin51.exe - 2001-10-26 20:29:54 7,680 -c--a-w C:\WINDOWS\system32\dllcache\inetmgr.exe + 2001-10-26 20:29:54 14,848 -c--a-w C:\WINDOWS\system32\dllcache\inetmgr.exe - 2004-08-03 23:44:22 20,480 -c--a-w C:\WINDOWS\system32\dllcache\inetwiz.exe + 2004-08-03 23:44:22 28,672 -c--a-w C:\WINDOWS\system32\dllcache\inetwiz.exe - 2004-08-03 23:44:22 57,344 -c--a-w C:\WINDOWS\system32\dllcache\ipconfig.exe + 2004-08-03 23:44:22 64,512 -c--a-w C:\WINDOWS\system32\dllcache\ipconfig.exe - 2001-10-26 20:29:54 45,056 -c--a-w C:\WINDOWS\system32\dllcache\ipsec6.exe + 2001-10-26 20:29:54 52,224 -c--a-w C:\WINDOWS\system32\dllcache\ipsec6.exe - 2004-08-03 23:44:22 53,760 -c--a-w C:\WINDOWS\system32\dllcache\ipv6.exe + 2004-08-03 23:44:22 60,928 -c--a-w C:\WINDOWS\system32\dllcache\ipv6.exe - 2004-08-03 23:44:22 24,064 -c--a-w C:\WINDOWS\system32\dllcache\ipxroute.exe + 2004-08-03 23:44:22 31,232 -c--a-w C:\WINDOWS\system32\dllcache\ipxroute.exe - 2001-10-26 20:29:54 16,384 -c--a-w C:\WINDOWS\system32\dllcache\isignup.exe + 2001-10-26 20:29:54 24,576 -c--a-w C:\WINDOWS\system32\dllcache\isignup.exe - 2001-10-26 20:29:54 9,728 -c--a-w C:\WINDOWS\system32\dllcache\label.exe + 2001-10-26 20:29:54 16,896 -c--a-w C:\WINDOWS\system32\dllcache\label.exe - 2001-10-26 20:29:54 29,696 -c--a-w C:\WINDOWS\system32\dllcache\lights.exe + 2001-10-26 20:29:54 36,864 -c--a-w C:\WINDOWS\system32\dllcache\lights.exe - 2001-10-26 20:29:54 26,624 -c--a-w C:\WINDOWS\system32\dllcache\lnkstub.exe + 2001-10-26 20:29:54 33,792 -c--a-w C:\WINDOWS\system32\dllcache\lnkstub.exe - 2004-08-03 23:44:22 75,264 -c--a-w C:\WINDOWS\system32\dllcache\locator.exe + 2004-08-03 23:44:22 82,432 -c--a-w C:\WINDOWS\system32\dllcache\locator.exe - 2001-10-26 20:29:56 5,120 -c--a-w C:\WINDOWS\system32\dllcache\lodctr.exe + 2001-10-26 20:29:56 12,288 -c--a-w C:\WINDOWS\system32\dllcache\lodctr.exe - 2005-01-28 11:44:28 96,768 -c--a-w C:\WINDOWS\system32\dllcache\logagent.exe + 2005-01-28 11:44:28 103,936 -c--a-w C:\WINDOWS\system32\dllcache\logagent.exe - 2004-08-03 23:44:22 60,928 -c--a-w C:\WINDOWS\system32\dllcache\logman.exe + 2004-08-03 23:44:22 68,096 -c--a-w C:\WINDOWS\system32\dllcache\logman.exe - 2001-10-26 20:29:56 15,872 -c--a-w C:\WINDOWS\system32\dllcache\logoff.exe + 2001-10-26 20:29:56 23,040 -c--a-w C:\WINDOWS\system32\dllcache\logoff.exe - 2004-08-03 23:44:30 220,672 -c--a-w C:\WINDOWS\system32\dllcache\logon.scr + 2004-08-03 23:44:30 227,840 -c--a-w C:\WINDOWS\system32\dllcache\logon.scr - 2004-08-03 23:44:22 515,072 -c--a-w C:\WINDOWS\system32\dllcache\logonui.exe + 2004-08-03 23:44:22 522,240 -c--a-w C:\WINDOWS\system32\dllcache\logonui.exe - 2001-10-26 20:29:56 6,144 -c--a-w C:\WINDOWS\system32\dllcache\lpq.exe + 2001-10-26 20:29:56 13,312 -c--a-w C:\WINDOWS\system32\dllcache\lpq.exe - 2001-10-26 20:29:56 8,192 -c--a-w C:\WINDOWS\system32\dllcache\lpr.exe + 2001-10-26 20:29:56 15,360 -c--a-w C:\WINDOWS\system32\dllcache\lpr.exe - 2004-08-03 23:44:22 13,312 -c--a-w C:\WINDOWS\system32\dllcache\lsass.exe + 2004-08-03 23:44:22 20,480 -c--a-w C:\WINDOWS\system32\dllcache\lsass.exe - 2004-08-03 23:44:22 73,216 -c--a-w C:\WINDOWS\system32\dllcache\magnify.exe + 2004-08-03 23:44:22 80,384 -c--a-w C:\WINDOWS\system32\dllcache\magnify.exe - 2004-08-03 23:44:22 85,504 -c--a-w C:\WINDOWS\system32\dllcache\makecab.exe + 2004-08-03 23:44:22 92,672 -c--a-w C:\WINDOWS\system32\dllcache\makecab.exe - 2001-10-26 20:29:56 34,816 -c--a-w C:\WINDOWS\system32\dllcache\migisol.exe + 2001-10-26 20:29:56 41,984 -c--a-w C:\WINDOWS\system32\dllcache\migisol.exe - 2004-08-03 23:44:22 103,936 -c--a-w C:\WINDOWS\system32\dllcache\migload.exe + 2004-08-03 23:44:22 111,104 -c--a-w C:\WINDOWS\system32\dllcache\migload.exe - 2004-08-03 23:44:22 786,432 -c--a-w C:\WINDOWS\system32\dllcache\migrate.exe + 2004-08-03 23:44:22 794,624 -c--a-w C:\WINDOWS\system32\dllcache\migrate.exe - 2004-08-03 23:44:22 7,680 -c--a-w C:\WINDOWS\system32\dllcache\migregdb.exe + 2004-08-03 23:44:22 14,848 -c--a-w C:\WINDOWS\system32\dllcache\migregdb.exe - 2004-08-03 23:44:22 242,688 -c--a-w C:\WINDOWS\system32\dllcache\migwiz.exe + 2004-08-03 23:44:22 249,856 -c--a-w C:\WINDOWS\system32\dllcache\migwiz.exe - 2004-08-03 23:44:22 238,592 -c--a-w C:\WINDOWS\system32\dllcache\migwiz_a.exe + 2004-08-03 23:44:22 245,760 -c--a-w C:\WINDOWS\system32\dllcache\migwiz_a.exe - 2004-08-03 23:44:22 815,616 -c--a-w C:\WINDOWS\system32\dllcache\mmc.exe + 2004-08-03 23:44:22 822,784 -c--a-w C:\WINDOWS\system32\dllcache\mmc.exe - 2004-08-03 23:44:22 32,768 -c--a-w C:\WINDOWS\system32\dllcache\mnmsrvc.exe + 2004-08-03 23:44:22 40,960 -c--a-w C:\WINDOWS\system32\dllcache\mnmsrvc.exe - 2004-08-03 23:44:22 143,872 -c--a-w C:\WINDOWS\system32\dllcache\mobsync.exe + 2004-08-03 23:44:22 151,040 -c--a-w C:\WINDOWS\system32\dllcache\mobsync.exe - 2004-08-03 23:44:22 17,408 -c--a-w C:\WINDOWS\system32\dllcache\mofcomp.exe + 2004-08-03 23:44:22 24,576 -c--a-w C:\WINDOWS\system32\dllcache\mofcomp.exe - 2001-10-26 20:29:56 8,192 -c--a-w C:\WINDOWS\system32\dllcache\mountvol.exe + 2001-10-26 20:29:56 15,360 -c--a-w C:\WINDOWS\system32\dllcache\mountvol.exe - 2004-08-03 23:44:24 3,555,328 -c--a-w C:\WINDOWS\system32\dllcache\moviemk.exe + 2004-08-03 23:44:24 3,562,496 -c--a-w C:\WINDOWS\system32\dllcache\moviemk.exe - 2004-08-03 23:44:24 124,928 -c--a-w C:\WINDOWS\system32\dllcache\mplay32.exe + 2004-08-03 23:44:24 132,096 -c--a-w C:\WINDOWS\system32\dllcache\mplay32.exe - 2004-08-03 23:44:24 4,639 -c--a-w C:\WINDOWS\system32\dllcache\mplayer2.exe + 2004-08-03 23:44:24 11,807 -c--a-w C:\WINDOWS\system32\dllcache\mplayer2.exe - 2001-10-26 20:29:58 22,016 -c--a-w C:\WINDOWS\system32\dllcache\mpnotify.exe + 2001-10-26 20:29:58 29,184 -c--a-w C:\WINDOWS\system32\dllcache\mpnotify.exe - 2004-08-03 23:44:24 19,968 -c--a-w C:\WINDOWS\system32\dllcache\mqbkup.exe + 2004-08-03 23:44:24 27,136 -c--a-w C:\WINDOWS\system32\dllcache\mqbkup.exe - 2004-08-03 23:44:24 4,608 -c--a-w C:\WINDOWS\system32\dllcache\mqsvc.exe + 2004-08-03 23:44:24 11,776 -c--a-w C:\WINDOWS\system32\dllcache\mqsvc.exe - 2004-08-03 23:44:24 117,248 -c--a-w C:\WINDOWS\system32\dllcache\mqtgsvc.exe + 2004-08-03 23:44:24 124,416 -c--a-w C:\WINDOWS\system32\dllcache\mqtgsvc.exe - 2001-10-26 20:29:58 13,824 -c--a-w C:\WINDOWS\system32\dllcache\mrinfo.exe + 2001-10-26 20:29:58 20,992 -c--a-w C:\WINDOWS\system32\dllcache\mrinfo.exe - 2004-08-03 23:44:24 159,744 -c--a-w C:\WINDOWS\system32\dllcache\msconfig.exe + 2004-08-03 23:44:24 166,912 -c--a-w C:\WINDOWS\system32\dllcache\msconfig.exe - 2004-08-03 23:44:24 6,144 -c--a-w C:\WINDOWS\system32\dllcache\msdtc.exe + 2004-08-03 23:44:24 13,312 -c--a-w C:\WINDOWS\system32\dllcache\msdtc.exe - 2001-10-26 20:29:58 22,528 -c--a-w C:\WINDOWS\system32\dllcache\msg.exe + 2001-10-26 20:29:58 29,696 -c--a-w C:\WINDOWS\system32\dllcache\msg.exe - 2001-10-26 20:29:58 128,000 -c--a-w C:\WINDOWS\system32\dllcache\mshearts.exe + 2001-10-26 20:29:58 135,168 -c--a-w C:\WINDOWS\system32\dllcache\mshearts.exe - 2004-08-03 23:44:24 29,184 -c--a-w C:\WINDOWS\system32\dllcache\mshta.exe + 2004-08-03 23:44:24 36,352 -c--a-w C:\WINDOWS\system32\dllcache\mshta.exe - 2004-08-03 23:44:24 77,312 -c--a-w C:\WINDOWS\system32\dllcache\msiexec.exe + 2004-08-03 23:44:24 84,480 -c--a-w C:\WINDOWS\system32\dllcache\msiexec.exe - 2004-08-03 23:44:24 60,928 -c--a-w C:\WINDOWS\system32\dllcache\msimn.exe + 2004-08-03 23:44:24 68,096 -c--a-w C:\WINDOWS\system32\dllcache\msimn.exe - 2001-10-26 20:29:58 40,448 -c--a-w C:\WINDOWS\system32\dllcache\msinfo32.exe + 2001-10-26 20:29:58 47,616 -c--a-w C:\WINDOWS\system32\dllcache\msinfo32.exe - 2004-08-03 23:44:24 40,960 -c--a-w C:\WINDOWS\system32\dllcache\msiregmv.exe + 2004-08-03 23:44:24 48,128 -c--a-w C:\WINDOWS\system32\dllcache\msiregmv.exe - 2001-10-26 20:29:58 28,160 -c--a-w C:\WINDOWS\system32\dllcache\msoobe.exe + 2001-10-26 20:29:58 35,328 -c--a-w C:\WINDOWS\system32\dllcache\msoobe.exe - 2004-08-03 23:44:26 345,088 -c--a-w C:\WINDOWS\system32\dllcache\mspaint.exe + 2004-08-03 23:44:26 352,256 -c--a-w C:\WINDOWS\system32\dllcache\mspaint.exe - 2001-10-26 20:29:58 6,656 -c--a-w C:\WINDOWS\system32\dllcache\msswchx.exe + 2001-10-26 20:29:58 13,824 -c--a-w C:\WINDOWS\system32\dllcache\msswchx.exe - 2004-08-03 23:44:26 12,288 -c--a-w C:\WINDOWS\system32\dllcache\mstinit.exe + 2004-08-03 23:44:26 19,456 -c--a-w C:\WINDOWS\system32\dllcache\mstinit.exe - 2004-08-03 23:33:18 408,576 -c--a-w C:\WINDOWS\system32\dllcache\mstsc.exe + 2004-08-03 23:33:18 415,744 -c--a-w C:\WINDOWS\system32\dllcache\mstsc.exe - 2001-10-26 20:29:58 111,104 -c--a-w C:\WINDOWS\system32\dllcache\mtstocom.exe + 2001-10-26 20:29:58 118,272 -c--a-w C:\WINDOWS\system32\dllcache\mtstocom.exe - 2004-08-03 23:44:26 55,296 -c--a-w C:\WINDOWS\system32\dllcache\narrator.exe + 2004-08-03 23:44:26 62,464 -c--a-w C:\WINDOWS\system32\dllcache\narrator.exe - 2001-10-26 20:29:58 21,504 -c--a-w C:\WINDOWS\system32\dllcache\nbtstat.exe + 2001-10-26 20:29:58 28,672 -c--a-w C:\WINDOWS\system32\dllcache\nbtstat.exe - 2004-08-03 23:44:26 4,096 -c--a-w C:\WINDOWS\system32\dllcache\nddeapir.exe + 2004-08-03 23:44:26 11,264 -c--a-w C:\WINDOWS\system32\dllcache\nddeapir.exe - 2004-08-03 23:44:26 42,496 -c--a-w C:\WINDOWS\system32\dllcache\net.exe + 2004-08-03 23:44:26 49,664 -c--a-w C:\WINDOWS\system32\dllcache\net.exe - 2004-08-03 23:44:26 124,928 -c--a-w C:\WINDOWS\system32\dllcache\net1.exe + 2004-08-03 23:44:26 132,096 -c--a-w C:\WINDOWS\system32\dllcache\net1.exe - 2004-08-03 23:44:26 114,688 -c--a-w C:\WINDOWS\system32\dllcache\netdde.exe + 2004-08-03 23:44:26 121,856 -c--a-w C:\WINDOWS\system32\dllcache\netdde.exe - 2004-08-03 23:46:50 332,288 -c--a-w C:\WINDOWS\system32\dllcache\netsetup.exe + 2004-08-03 23:46:50 343,040 -c--a-w C:\WINDOWS\system32\dllcache\netsetup.exe - 2004-08-03 23:44:26 87,040 -c--a-w C:\WINDOWS\system32\dllcache\netsh.exe + 2004-08-03 23:44:26 94,208 -c--a-w C:\WINDOWS\system32\dllcache\netsh.exe - 2004-08-03 23:44:26 38,400 -c--a-w C:\WINDOWS\system32\dllcache\netstat.exe + 2004-08-03 23:44:26 45,568 -c--a-w C:\WINDOWS\system32\dllcache\netstat.exe - 2004-08-03 23:44:26 70,144 -c--a-w C:\WINDOWS\system32\dllcache\notepad.exe + 2004-08-03 23:44:26 77,312 -c--a-w C:\WINDOWS\system32\dllcache\notepad.exe - 2001-10-26 20:29:58 35,328 -c--a-w C:\WINDOWS\system32\dllcache\notiflag.exe + 2001-10-26 20:29:58 42,496 -c--a-w C:\WINDOWS\system32\dllcache\notiflag.exe - 2004-08-03 23:44:26 15,360 -c--a-w C:\WINDOWS\system32\dllcache\nppagent.exe + 2004-08-03 23:44:26 22,528 -c--a-w C:\WINDOWS\system32\dllcache\nppagent.exe - 2004-08-03 23:44:26 79,872 -c--a-w C:\WINDOWS\system32\dllcache\nslookup.exe + 2004-08-03 23:44:26 87,040 -c--a-w C:\WINDOWS\system32\dllcache\nslookup.exe - 2004-08-03 23:44:26 1,221,632 -c--a-w C:\WINDOWS\system32\dllcache\ntbackup.exe + 2004-08-03 23:44:26 1,228,800 -c--a-w C:\WINDOWS\system32\dllcache\ntbackup.exe - 2001-10-26 20:30:00 31,744 -c--a-w C:\WINDOWS\system32\dllcache\ntsd.exe + 2001-10-26 20:30:00 38,912 -c--a-w C:\WINDOWS\system32\dllcache\ntsd.exe - 2004-08-03 23:44:26 420,352 -c--a-w C:\WINDOWS\system32\dllcache\ntvdm.exe + 2004-08-03 23:44:26 427,520 -c--a-w C:\WINDOWS\system32\dllcache\ntvdm.exe - 2001-10-26 20:30:00 128,512 -c--a-w C:\WINDOWS\system32\dllcache\nwscript.exe + 2001-10-26 20:30:00 135,680 -c--a-w C:\WINDOWS\system32\dllcache\nwscript.exe - 2004-08-03 23:44:26 32,768 -c--a-w C:\WINDOWS\system32\dllcache\odbcad32.exe + 2004-08-03 23:44:26 40,960 -c--a-w C:\WINDOWS\system32\dllcache\odbcad32.exe - 2004-08-03 23:44:26 69,632 -c--a-w C:\WINDOWS\system32\dllcache\odbcconf.exe + 2004-08-03 23:44:26 77,824 -c--a-w C:\WINDOWS\system32\dllcache\odbcconf.exe - 2004-08-03 23:44:26 60,928 -c--a-w C:\WINDOWS\system32\dllcache\oemig50.exe + 2004-08-03 23:44:26 68,096 -c--a-w C:\WINDOWS\system32\dllcache\oemig50.exe - 2004-08-03 23:44:26 51,712 -c--a-w C:\WINDOWS\system32\dllcache\oobebaln.exe + 2004-08-03 23:44:26 58,880 -c--a-w C:\WINDOWS\system32\dllcache\oobebaln.exe - 2004-08-03 23:44:26 70,144 -c--a-w C:\WINDOWS\system32\dllcache\opnfiles.exe + 2004-08-03 23:44:26 77,312 -c--a-w C:\WINDOWS\system32\dllcache\opnfiles.exe - 2004-08-03 23:44:26 216,064 -c--a-w C:\WINDOWS\system32\dllcache\osk.exe + 2004-08-03 23:44:26 223,232 -c--a-w C:\WINDOWS\system32\dllcache\osk.exe - 2001-10-26 20:30:00 41,472 -c--a-w C:\WINDOWS\system32\dllcache\osuninst.exe + 2001-10-26 20:30:00 48,640 -c--a-w C:\WINDOWS\system32\dllcache\osuninst.exe - 2004-08-03 23:44:26 59,392 -c--a-w C:\WINDOWS\system32\dllcache\packager.exe + 2004-08-03 23:44:26 66,560 -c--a-w C:\WINDOWS\system32\dllcache\packager.exe - 2001-10-26 20:30:00 22,528 -c--a-w C:\WINDOWS\system32\dllcache\pathping.exe + 2001-10-26 20:30:00 29,696 -c--a-w C:\WINDOWS\system32\dllcache\pathping.exe - 2001-10-26 20:30:00 15,360 -c--a-w C:\WINDOWS\system32\dllcache\pentnt.exe + 2001-10-26 20:30:00 22,528 -c--a-w C:\WINDOWS\system32\dllcache\pentnt.exe - 2004-08-03 23:44:26 15,872 -c--a-w C:\WINDOWS\system32\dllcache\perfmon.exe + 2004-08-03 23:44:26 23,040 -c--a-w C:\WINDOWS\system32\dllcache\perfmon.exe - 2004-08-03 23:44:26 283,136 -c--a-w C:\WINDOWS\system32\dllcache\pinball.exe + 2004-08-03 23:44:26 290,304 -c--a-w C:\WINDOWS\system32\dllcache\pinball.exe - 2004-08-03 23:44:26 18,944 -c--a-w C:\WINDOWS\system32\dllcache\ping.exe + 2004-08-03 23:44:26 26,112 -c--a-w C:\WINDOWS\system32\dllcache\ping.exe - 2001-10-26 20:30:00 33,792 -c--a-w C:\WINDOWS\system32\dllcache\ping6.exe + 2001-10-26 20:30:00 40,960 -c--a-w C:\WINDOWS\system32\dllcache\ping6.exe - 2004-08-03 21:31:50 70,144 -c--a-w C:\WINDOWS\system32\dllcache\pintlphr.exe + 2004-08-03 21:31:50 77,312 -c--a-w C:\WINDOWS\system32\dllcache\pintlphr.exe - 2004-08-03 23:44:26 49,152 -c--a-w C:\WINDOWS\system32\dllcache\powercfg.exe + 2004-08-03 23:44:26 56,320 -c--a-w C:\WINDOWS\system32\dllcache\powercfg.exe - 2001-10-26 20:30:00 9,216 -c--a-w C:\WINDOWS\system32\dllcache\print.exe + 2001-10-26 20:30:00 16,384 -c--a-w C:\WINDOWS\system32\dllcache\print.exe - 2004-08-03 23:44:26 109,568 -c--a-w C:\WINDOWS\system32\dllcache\progman.exe + 2004-08-03 23:44:26 116,736 -c--a-w C:\WINDOWS\system32\dllcache\progman.exe - 2004-08-03 23:44:26 50,688 -c--a-w C:\WINDOWS\system32\dllcache\proquota.exe + 2004-08-03 23:44:26 57,856 -c--a-w C:\WINDOWS\system32\dllcache\proquota.exe - 2004-08-03 23:44:26 9,728 -c--a-w C:\WINDOWS\system32\dllcache\proxycfg.exe + 2004-08-03 23:44:26 16,896 -c--a-w C:\WINDOWS\system32\dllcache\proxycfg.exe - 2001-10-26 20:30:00 17,408 -c--a-w C:\WINDOWS\system32\dllcache\qappsrv.exe + 2001-10-26 20:30:00 24,576 -c--a-w C:\WINDOWS\system32\dllcache\qappsrv.exe - 2004-08-03 23:44:26 20,992 -c--a-w C:\WINDOWS\system32\dllcache\qprocess.exe + 2004-08-03 23:44:26 28,160 -c--a-w C:\WINDOWS\system32\dllcache\qprocess.exe - 2001-10-26 20:30:00 9,728 -c--a-w C:\WINDOWS\system32\dllcache\query.exe + 2001-10-26 20:30:00 16,896 -c--a-w C:\WINDOWS\system32\dllcache\query.exe - 2001-10-26 20:30:00 16,896 -c--a-w C:\WINDOWS\system32\dllcache\quser.exe + 2001-10-26 20:30:00 24,064 -c--a-w C:\WINDOWS\system32\dllcache\quser.exe - 2001-10-26 20:30:00 22,528 -c--a-w C:\WINDOWS\system32\dllcache\qwinsta.exe + 2001-10-26 20:30:00 29,696 -c--a-w C:\WINDOWS\system32\dllcache\qwinsta.exe - 2001-10-26 20:30:00 11,776 -c--a-w C:\WINDOWS\system32\dllcache\rasautou.exe + 2001-10-26 20:30:00 18,944 -c--a-w C:\WINDOWS\system32\dllcache\rasautou.exe - 2001-10-26 20:30:00 11,776 -c--a-w C:\WINDOWS\system32\dllcache\rasdial.exe + 2001-10-26 20:30:00 18,944 -c--a-w C:\WINDOWS\system32\dllcache\rasdial.exe - 2004-08-03 23:44:26 56,832 -c--a-w C:\WINDOWS\system32\dllcache\rasphone.exe + 2004-08-03 23:44:26 64,000 -c--a-w C:\WINDOWS\system32\dllcache\rasphone.exe - 2004-08-03 23:44:26 35,840 -c--a-w C:\WINDOWS\system32\dllcache\rcimlby.exe + 2004-08-03 23:44:26 43,008 -c--a-w C:\WINDOWS\system32\dllcache\rcimlby.exe - 2004-08-03 23:44:26 22,016 -c--a-w C:\WINDOWS\system32\dllcache\rcp.exe + 2004-08-03 23:44:26 29,184 -c--a-w C:\WINDOWS\system32\dllcache\rcp.exe - 2004-08-03 23:44:26 62,464 -c--a-w C:\WINDOWS\system32\dllcache\rdpclip.exe + 2004-08-03 23:44:26 69,632 -c--a-w C:\WINDOWS\system32\dllcache\rdpclip.exe - 2004-08-03 23:44:26 13,824 -c--a-w C:\WINDOWS\system32\dllcache\rdsaddin.exe + 2004-08-03 23:44:26 20,992 -c--a-w C:\WINDOWS\system32\dllcache\rdsaddin.exe - 2004-08-03 23:44:26 67,072 -c--a-w C:\WINDOWS\system32\dllcache\rdshost.exe + 2004-08-03 23:44:26 74,240 -c--a-w C:\WINDOWS\system32\dllcache\rdshost.exe - 2001-10-26 20:30:00 7,168 -c--a-w C:\WINDOWS\system32\dllcache\recover.exe + 2001-10-26 20:30:00 14,336 -c--a-w C:\WINDOWS\system32\dllcache\recover.exe - 2004-08-03 23:44:28 53,248 -c--a-w C:\WINDOWS\system32\dllcache\reg.exe + 2004-08-03 23:44:28 60,416 -c--a-w C:\WINDOWS\system32\dllcache\reg.exe - 2004-08-03 23:44:28 149,504 -c--a-w C:\WINDOWS\system32\dllcache\regedit.exe + 2004-08-03 23:44:28 156,672 -c--a-w C:\WINDOWS\system32\dllcache\regedit.exe - 2001-10-26 20:30:00 3,584 -c--a-w C:\WINDOWS\system32\dllcache\regedt32.exe + 2001-10-26 20:30:00 10,752 -c--a-w C:\WINDOWS\system32\dllcache\regedt32.exe - 2001-10-26 20:30:00 33,792 -c--a-w C:\WINDOWS\system32\dllcache\regini.exe + 2001-10-26 20:30:00 40,960 -c--a-w C:\WINDOWS\system32\dllcache\regini.exe - 2001-10-26 20:30:00 14,848 -c--a-w C:\WINDOWS\system32\dllcache\register.exe + 2001-10-26 20:30:00 22,016 -c--a-w C:\WINDOWS\system32\dllcache\register.exe - 2004-08-03 23:44:28 12,288 -c--a-w C:\WINDOWS\system32\dllcache\regsvr32.exe + 2004-08-03 23:44:28 19,456 -c--a-w C:\WINDOWS\system32\dllcache\regsvr32.exe - 2001-10-26 20:30:00 4,608 -c--a-w C:\WINDOWS\system32\dllcache\regwiz.exe + 2001-10-26 20:30:00 11,776 -c--a-w C:\WINDOWS\system32\dllcache\regwiz.exe - 2001-10-26 20:30:00 33,792 -c--a-w C:\WINDOWS\system32\dllcache\relog.exe + 2001-10-26 20:30:00 40,960 -c--a-w C:\WINDOWS\system32\dllcache\relog.exe - 2001-10-26 20:30:00 12,800 -c--a-w C:\WINDOWS\system32\dllcache\replace.exe + 2001-10-26 20:30:00 19,968 -c--a-w C:\WINDOWS\system32\dllcache\replace.exe - 2001-10-26 20:30:00 9,728 -c--a-w C:\WINDOWS\system32\dllcache\reset.exe + 2001-10-26 20:30:00 16,896 -c--a-w C:\WINDOWS\system32\dllcache\reset.exe - 2004-08-03 23:44:28 14,336 -c--a-w C:\WINDOWS\system32\dllcache\rexec.exe + 2004-08-03 23:44:28 21,504 -c--a-w C:\WINDOWS\system32\dllcache\rexec.exe - 2001-10-26 20:30:00 20,480 -c--a-w C:\WINDOWS\system32\dllcache\route.exe + 2001-10-26 20:30:00 27,648 -c--a-w C:\WINDOWS\system32\dllcache\route.exe - 2001-10-26 20:03:18 25,600 -c--a-w C:\WINDOWS\system32\dllcache\routemon.exe + 2001-10-26 20:03:18 32,768 -c--a-w C:\WINDOWS\system32\dllcache\routemon.exe - 2004-08-03 23:44:28 15,360 -c--a-w C:\WINDOWS\system32\dllcache\rsh.exe + 2004-08-03 23:44:28 22,528 -c--a-w C:\WINDOWS\system32\dllcache\rsh.exe - 2001-10-26 20:30:02 54,272 -c--a-w C:\WINDOWS\system32\dllcache\rsm.exe + 2001-10-26 20:30:02 61,440 -c--a-w C:\WINDOWS\system32\dllcache\rsm.exe - 2001-10-26 20:30:02 24,576 -c--a-w C:\WINDOWS\system32\dllcache\rsmsink.exe + 2001-10-26 20:30:02 31,744 -c--a-w C:\WINDOWS\system32\dllcache\rsmsink.exe - 2001-10-26 20:30:02 49,152 -c--a-w C:\WINDOWS\system32\dllcache\rsmui.exe + 2001-10-26 20:30:02 56,320 -c--a-w C:\WINDOWS\system32\dllcache\rsmui.exe - 2004-08-03 23:44:28 107,520 -c--a-w C:\WINDOWS\system32\dllcache\rsnotify.exe + 2004-08-03 23:44:28 114,688 -c--a-w C:\WINDOWS\system32\dllcache\rsnotify.exe - 2001-10-26 20:30:02 62,976 -c--a-w C:\WINDOWS\system32\dllcache\rsopprov.exe + 2001-10-26 20:30:02 70,144 -c--a-w C:\WINDOWS\system32\dllcache\rsopprov.exe - 2004-08-03 23:44:28 382,976 -c--a-w C:\WINDOWS\system32\dllcache\rstrui.exe + 2004-08-03 23:44:28 390,144 -c--a-w C:\WINDOWS\system32\dllcache\rstrui.exe - 2001-10-26 20:30:02 132,608 -c--a-w C:\WINDOWS\system32\dllcache\rsvp.exe + 2001-10-26 20:30:02 139,776 -c--a-w C:\WINDOWS\system32\dllcache\rsvp.exe - 2004-08-03 23:44:28 77,824 -c--a-w C:\WINDOWS\system32\dllcache\rtcshare.exe + 2004-08-03 23:44:28 84,992 -c--a-w C:\WINDOWS\system32\dllcache\rtcshare.exe - 2001-10-26 20:30:02 16,896 -c--a-w C:\WINDOWS\system32\dllcache\runas.exe + 2001-10-26 20:30:02 24,064 -c--a-w C:\WINDOWS\system32\dllcache\runas.exe - 2004-08-03 23:44:28 33,280 -c--a-w C:\WINDOWS\system32\dllcache\rundll32.exe + 2004-08-03 23:44:28 40,448 -c--a-w C:\WINDOWS\system32\dllcache\rundll32.exe - 2004-08-03 23:44:28 14,336 -c--a-w C:\WINDOWS\system32\dllcache\runonce.exe + 2004-08-03 23:44:28 21,504 -c--a-w C:\WINDOWS\system32\dllcache\runonce.exe - 2001-10-26 20:30:02 42,574 -c--a-w C:\WINDOWS\system32\dllcache\rvsezm.exe + 2001-10-26 20:30:02 49,742 -c--a-w C:\WINDOWS\system32\dllcache\rvsezm.exe - 2001-10-26 20:30:02 16,384 -c--a-w C:\WINDOWS\system32\dllcache\rwinsta.exe + 2001-10-26 20:30:02 23,552 -c--a-w C:\WINDOWS\system32\dllcache\rwinsta.exe - 2001-10-26 20:30:02 36,864 -c--a-w C:\WINDOWS\system32\dllcache\sapisvr.exe + 2001-10-26 20:30:02 45,056 -c--a-w C:\WINDOWS\system32\dllcache\sapisvr.exe - 2004-08-03 23:44:28 13,824 -c--a-w C:\WINDOWS\system32\dllcache\savedump.exe + 2004-08-03 23:44:28 20,992 -c--a-w C:\WINDOWS\system32\dllcache\savedump.exe - 2001-10-26 20:30:02 31,232 -c--a-w C:\WINDOWS\system32\dllcache\sc.exe + 2001-10-26 20:30:02 38,400 -c--a-w C:\WINDOWS\system32\dllcache\sc.exe - 2004-08-03 23:44:28 98,304 -c--a-w C:\WINDOWS\system32\dllcache\scardsvr.exe + 2004-08-03 23:44:28 105,472 -c--a-w C:\WINDOWS\system32\dllcache\scardsvr.exe - 2004-08-03 23:44:28 36,864 -c--a-w C:\WINDOWS\system32\dllcache\scrcons.exe + 2004-08-03 23:44:28 44,032 -c--a-w C:\WINDOWS\system32\dllcache\scrcons.exe - 2004-08-03 23:44:30 9,216 -c--a-w C:\WINDOWS\system32\dllcache\scrnsave.scr + 2004-08-03 23:44:30 16,384 -c--a-w C:\WINDOWS\system32\dllcache\scrnsave.scr - 2004-08-03 23:44:28 128,000 -c--a-w C:\WINDOWS\system32\dllcache\sctasks.exe + 2004-08-03 23:44:28 135,168 -c--a-w C:\WINDOWS\system32\dllcache\sctasks.exe - 2004-08-03 23:44:28 77,824 -c--a-w C:\WINDOWS\system32\dllcache\sdbinst.exe + 2004-08-03 23:44:28 84,992 -c--a-w C:\WINDOWS\system32\dllcache\sdbinst.exe - 2004-08-03 23:44:28 18,944 -c--a-w C:\WINDOWS\system32\dllcache\secedit.exe + 2004-08-03 23:44:28 26,112 -c--a-w C:\WINDOWS\system32\dllcache\secedit.exe - 2004-08-03 23:44:28 141,824 -c--a-w C:\WINDOWS\system32\dllcache\sessmgr.exe + 2004-08-03 23:44:28 148,992 -c--a-w C:\WINDOWS\system32\dllcache\sessmgr.exe - 2004-08-03 23:44:28 32,768 -c--a-w C:\WINDOWS\system32\dllcache\sethc.exe + 2004-08-03 23:44:28 39,936 -c--a-w C:\WINDOWS\system32\dllcache\sethc.exe - 2004-08-03 23:44:28 23,040 -c--a-w C:\WINDOWS\system32\dllcache\setup.exe + 2004-08-03 23:44:28 30,208 -c--a-w C:\WINDOWS\system32\dllcache\setup.exe - 2004-08-03 23:44:28 774,144 -c--a-w C:\WINDOWS\system32\dllcache\setup_wm.exe + 2004-08-03 23:44:28 782,336 -c--a-w C:\WINDOWS\system32\dllcache\setup_wm.exe - 2004-08-03 23:44:28 73,728 -c--a-w C:\WINDOWS\system32\dllcache\setup50.exe + 2004-08-03 23:44:28 80,896 -c--a-w C:\WINDOWS\system32\dllcache\setup50.exe - 2001-10-26 20:30:02 9,728 -c--a-w C:\WINDOWS\system32\dllcache\sfc.exe + 2001-10-26 20:30:02 16,896 -c--a-w C:\WINDOWS\system32\dllcache\sfc.exe - 2001-10-26 20:30:02 15,360 -c--a-w C:\WINDOWS\system32\dllcache\shadow.exe + 2001-10-26 20:30:02 22,528 -c--a-w C:\WINDOWS\system32\dllcache\shadow.exe - 2004-08-03 23:44:28 42,496 -c--a-w C:\WINDOWS\system32\dllcache\shmgrate.exe + 2004-08-03 23:44:28 49,664 -c--a-w C:\WINDOWS\system32\dllcache\shmgrate.exe - 2004-08-03 23:44:28 78,336 -c--a-w C:\WINDOWS\system32\dllcache\shrpubw.exe + 2004-08-03 23:44:28 85,504 -c--a-w C:\WINDOWS\system32\dllcache\shrpubw.exe - 2003-03-24 13:52:04 16,437 -c--a-w C:\WINDOWS\system32\dllcache\shtml.exe + 2003-03-24 13:52:04 24,629 -c--a-w C:\WINDOWS\system32\dllcache\shtml.exe - 2004-08-03 23:44:28 20,480 -c--a-w C:\WINDOWS\system32\dllcache\shutdown.exe + 2004-08-03 23:44:28 27,648 -c--a-w C:\WINDOWS\system32\dllcache\shutdown.exe - 2001-10-26 20:30:02 42,573 -c--a-w C:\WINDOWS\system32\dllcache\shvlzm.exe + 2001-10-26 20:30:02 49,741 -c--a-w C:\WINDOWS\system32\dllcache\shvlzm.exe - 2004-08-03 23:44:28 70,656 -c--a-w C:\WINDOWS\system32\dllcache\sigverif.exe + 2004-08-03 23:44:28 77,824 -c--a-w C:\WINDOWS\system32\dllcache\sigverif.exe - 2004-08-03 23:44:28 26,112 -c--a-w C:\WINDOWS\system32\dllcache\skeys.exe + 2004-08-03 23:44:28 33,280 -c--a-w C:\WINDOWS\system32\dllcache\skeys.exe - 2004-08-03 23:44:28 8,192 -c--a-w C:\WINDOWS\system32\dllcache\smbinst.exe + 2004-08-03 23:44:28 15,360 -c--a-w C:\WINDOWS\system32\dllcache\smbinst.exe - 2004-08-03 23:44:28 236,544 -c--a-w C:\WINDOWS\system32\dllcache\smi2smir.exe + 2004-08-03 23:44:28 243,712 -c--a-w C:\WINDOWS\system32\dllcache\smi2smir.exe - 2004-08-03 23:44:28 91,136 -c--a-w C:\WINDOWS\system32\dllcache\smlogsvc.exe + 2004-08-03 23:44:28 98,304 -c--a-w C:\WINDOWS\system32\dllcache\smlogsvc.exe - 2004-08-03 23:44:28 132,608 -c--a-w C:\WINDOWS\system32\dllcache\sndrec32.exe + 2004-08-03 23:44:28 139,776 -c--a-w C:\WINDOWS\system32\dllcache\sndrec32.exe - 2001-10-26 20:30:02 139,264 -c--a-w C:\WINDOWS\system32\dllcache\sndvol32.exe + 2001-10-26 20:30:02 146,432 -c--a-w C:\WINDOWS\system32\dllcache\sndvol32.exe - 2004-08-03 23:44:28 32,256 -c--a-w C:\WINDOWS\system32\dllcache\snmp.exe + 2004-08-03 23:44:28 39,424 -c--a-w C:\WINDOWS\system32\dllcache\snmp.exe - 2004-08-03 23:44:28 8,704 -c--a-w C:\WINDOWS\system32\dllcache\snmptrap.exe + 2004-08-03 23:44:28 15,872 -c--a-w C:\WINDOWS\system32\dllcache\snmptrap.exe - 2001-10-26 20:30:02 57,344 -c--a-w C:\WINDOWS\system32\dllcache\sol.exe + 2001-10-26 20:30:02 64,512 -c--a-w C:\WINDOWS\system32\dllcache\sol.exe - 2001-10-26 20:30:02 23,552 -c--a-w C:\WINDOWS\system32\dllcache\sort.exe + 2001-10-26 20:30:02 30,720 -c--a-w C:\WINDOWS\system32\dllcache\sort.exe - 2004-08-03 23:44:28 539,136 -c--a-w C:\WINDOWS\system32\dllcache\spider.exe + 2004-08-03 23:44:28 546,304 -c--a-w C:\WINDOWS\system32\dllcache\spider.exe - 2004-08-03 21:59:36 12,800 -c--a-w C:\WINDOWS\system32\dllcache\spiisupd.exe + 2004-08-03 21:59:36 19,968 -c--a-w C:\WINDOWS\system32\dllcache\spiisupd.exe - 2004-08-03 23:44:28 11,776 -c--a-w C:\WINDOWS\system32\dllcache\spnpinst.exe + 2004-08-03 23:44:28 18,944 -c--a-w C:\WINDOWS\system32\dllcache\spnpinst.exe - 2001-10-26 20:30:02 47,104 -c--a-w C:\WINDOWS\system32\dllcache\srdiag.exe + 2001-10-26 20:30:02 54,272 -c--a-w C:\WINDOWS\system32\dllcache\srdiag.exe - 2004-08-03 23:44:30 708,608 -c--a-w C:\WINDOWS\system32\dllcache\ss3dfo.scr + 2004-08-03 23:44:30 716,800 -c--a-w C:\WINDOWS\system32\dllcache\ss3dfo.scr - 2004-08-03 23:44:30 19,968 -c--a-w C:\WINDOWS\system32\dllcache\ssbezier.scr + 2004-08-03 23:44:30 27,136 -c--a-w C:\WINDOWS\system32\dllcache\ssbezier.scr - 2004-08-03 23:44:30 393,216 -c--a-w C:\WINDOWS\system32\dllcache\ssflwbox.scr + 2004-08-03 23:44:30 401,408 -c--a-w C:\WINDOWS\system32\dllcache\ssflwbox.scr - 2004-08-03 23:44:30 20,992 -c--a-w C:\WINDOWS\system32\dllcache\ssmarque.scr + 2004-08-03 23:44:30 28,160 -c--a-w C:\WINDOWS\system32\dllcache\ssmarque.scr - 2004-08-03 23:44:30 47,104 -c--a-w C:\WINDOWS\system32\dllcache\ssmypics.scr + 2004-08-03 23:44:30 54,272 -c--a-w C:\WINDOWS\system32\dllcache\ssmypics.scr - 2004-08-03 23:44:30 18,944 -c--a-w C:\WINDOWS\system32\dllcache\ssmyst.scr + 2004-08-03 23:44:30 26,112 -c--a-w C:\WINDOWS\system32\dllcache\ssmyst.scr - 2004-08-03 23:44:32 610,304 -c--a-w C:\WINDOWS\system32\dllcache\sspipes.scr + 2004-08-03 23:44:32 618,496 -c--a-w C:\WINDOWS\system32\dllcache\sspipes.scr - 2004-08-03 23:44:32 14,848 -c--a-w C:\WINDOWS\system32\dllcache\ssstars.scr + 2004-08-03 23:44:32 22,016 -c--a-w C:\WINDOWS\system32\dllcache\ssstars.scr - 2004-08-03 23:44:32 679,936 -c--a-w C:\WINDOWS\system32\dllcache\sstext3d.scr + 2004-08-03 23:44:32 688,128 -c--a-w C:\WINDOWS\system32\dllcache\sstext3d.scr - 2004-08-03 23:44:28 14,848 -c--a-w C:\WINDOWS\system32\dllcache\stimon.exe + 2004-08-03 23:44:28 22,016 -c--a-w C:\WINDOWS\system32\dllcache\stimon.exe - 2001-10-26 20:30:02 9,216 -c--a-w C:\WINDOWS\system32\dllcache\subst.exe + 2001-10-26 20:30:02 16,384 -c--a-w C:\WINDOWS\system32\dllcache\subst.exe - 2001-10-26 20:30:02 51,200 -c--a-w C:\WINDOWS\system32\dllcache\syncapp.exe + 2001-10-26 20:30:02 58,368 -c--a-w C:\WINDOWS\system32\dllcache\syncapp.exe - 2001-10-26 20:30:02 70,144 -c--a-w C:\WINDOWS\system32\dllcache\sysinfo.exe + 2001-10-26 20:30:02 77,312 -c--a-w C:\WINDOWS\system32\dllcache\sysinfo.exe - 2001-10-26 20:30:02 37,376 -c--a-w C:\WINDOWS\system32\dllcache\syskey.exe + 2001-10-26 20:30:02 44,544 -c--a-w C:\WINDOWS\system32\dllcache\syskey.exe - 2004-08-03 23:44:28 107,008 -c--a-w C:\WINDOWS\system32\dllcache\sysocmgr.exe + 2004-08-03 23:44:28 114,176 -c--a-w C:\WINDOWS\system32\dllcache\sysocmgr.exe - 2001-10-26 20:30:02 3,072 -c--a-w C:\WINDOWS\system32\dllcache\systray.exe + 2001-10-26 20:30:02 10,240 -c--a-w C:\WINDOWS\system32\dllcache\systray.exe - 2001-10-26 20:30:02 74,752 -c--a-w C:\WINDOWS\system32\dllcache\taskkill.exe + 2001-10-26 20:30:02 81,920 -c--a-w C:\WINDOWS\system32\dllcache\taskkill.exe - 2001-10-26 20:30:02 73,728 -c--a-w C:\WINDOWS\system32\dllcache\tasklist.exe + 2001-10-26 20:30:02 80,896 -c--a-w C:\WINDOWS\system32\dllcache\tasklist.exe - 2001-10-26 20:30:02 15,360 -c--a-w C:\WINDOWS\system32\dllcache\taskman.exe + 2001-10-26 20:30:02 22,528 -c--a-w C:\WINDOWS\system32\dllcache\taskman.exe - 2004-08-03 23:44:28 139,776 -c--a-w C:\WINDOWS\system32\dllcache\taskmgr.exe + 2004-08-03 23:44:28 146,944 -c--a-w C:\WINDOWS\system32\dllcache\taskmgr.exe - 2001-10-26 20:30:02 13,312 -c--a-w C:\WINDOWS\system32\dllcache\tcmsetup.exe + 2001-10-26 20:30:02 20,480 -c--a-w C:\WINDOWS\system32\dllcache\tcmsetup.exe - 2001-10-26 20:30:02 19,456 -c--a-w C:\WINDOWS\system32\dllcache\tcpsvcs.exe + 2001-10-26 20:30:02 26,624 -c--a-w C:\WINDOWS\system32\dllcache\tcpsvcs.exe - 2003-03-24 13:52:04 32,827 -c--a-w C:\WINDOWS\system32\dllcache\tcptest.exe + 2003-03-24 13:52:04 41,019 -c--a-w C:\WINDOWS\system32\dllcache\tcptest.exe - 2004-08-03 23:44:28 77,312 -c--a-w C:\WINDOWS\system32\dllcache\telnet.exe + 2004-08-03 23:44:28 84,480 -c--a-w C:\WINDOWS\system32\dllcache\telnet.exe - 2001-10-26 20:30:02 16,896 -c--a-w C:\WINDOWS\system32\dllcache\tftp.exe + 2001-10-26 20:30:02 24,064 -c--a-w C:\WINDOWS\system32\dllcache\tftp.exe - 2004-08-03 21:32:16 44,032 -c--a-w C:\WINDOWS\system32\dllcache\tintlphr.exe + 2004-08-03 21:32:16 51,200 -c--a-w C:\WINDOWS\system32\dllcache\tintlphr.exe - 2004-08-03 21:32:16 455,168 -c--a-w C:\WINDOWS\system32\dllcache\tintsetp.exe + 2004-08-03 21:32:16 462,336 -c--a-w C:\WINDOWS\system32\dllcache\tintsetp.exe - 2004-08-03 23:44:28 63,488 -c--a-w C:\WINDOWS\system32\dllcache\tlntadmn.exe + 2004-08-03 23:44:28 70,656 -c--a-w C:\WINDOWS\system32\dllcache\tlntadmn.exe - 2004-08-03 23:44:28 80,384 -c--a-w C:\WINDOWS\system32\dllcache\tlntsess.exe + 2004-08-03 23:44:28 87,552 -c--a-w C:\WINDOWS\system32\dllcache\tlntsess.exe - 2004-08-03 23:44:28 75,264 -c--a-w C:\WINDOWS\system32\dllcache\tlntsvr.exe + 2004-08-03 23:44:28 82,432 -c--a-w C:\WINDOWS\system32\dllcache\tlntsvr.exe - 2004-08-03 23:44:28 347,136 -c--a-w C:\WINDOWS\system32\dllcache\tourstrt.exe + 2004-08-03 23:44:28 354,304 -c--a-w C:\WINDOWS\system32\dllcache\tourstrt.exe - 2004-08-03 23:44:28 260,096 -c--a-w C:\WINDOWS\system32\dllcache\tracerpt.exe + 2004-08-03 23:44:28 267,264 -c--a-w C:\WINDOWS\system32\dllcache\tracerpt.exe - 2004-08-03 23:44:28 12,800 -c--a-w C:\WINDOWS\system32\dllcache\tracert.exe + 2004-08-03 23:44:28 19,968 -c--a-w C:\WINDOWS\system32\dllcache\tracert.exe - 2001-10-26 20:30:04 32,256 -c--a-w C:\WINDOWS\system32\dllcache\tracert6.exe + 2001-10-26 20:30:04 39,424 -c--a-w C:\WINDOWS\system32\dllcache\tracert6.exe - 2001-10-26 20:30:04 15,360 -c--a-w C:\WINDOWS\system32\dllcache\tscon.exe + 2001-10-26 20:30:04 22,528 -c--a-w C:\WINDOWS\system32\dllcache\tscon.exe - 2004-08-03 23:33:20 44,544 -c--a-w C:\WINDOWS\system32\dllcache\tscupgrd.exe + 2004-08-03 23:33:20 51,712 -c--a-w C:\WINDOWS\system32\dllcache\tscupgrd.exe - 2001-10-26 20:30:04 15,360 -c--a-w C:\WINDOWS\system32\dllcache\tsdiscon.exe + 2001-10-26 20:30:04 22,528 -c--a-w C:\WINDOWS\system32\dllcache\tsdiscon.exe - 2001-10-26 20:30:04 16,384 -c--a-w C:\WINDOWS\system32\dllcache\tskill.exe + 2001-10-26 20:30:04 23,552 -c--a-w C:\WINDOWS\system32\dllcache\tskill.exe - 2001-10-26 20:30:04 14,336 -c--a-w C:\WINDOWS\system32\dllcache\tsprof.exe + 2001-10-26 20:30:04 21,504 -c--a-w C:\WINDOWS\system32\dllcache\tsprof.exe - 2001-10-26 20:30:04 17,920 -c--a-w C:\WINDOWS\system32\dllcache\tsshutdn.exe + 2001-10-26 20:30:04 25,088 -c--a-w C:\WINDOWS\system32\dllcache\tsshutdn.exe - 2001-10-26 20:30:04 25,600 -c--a-w C:\WINDOWS\system32\dllcache\twunk_32.exe + 2001-10-26 20:30:04 32,768 -c--a-w C:\WINDOWS\system32\dllcache\twunk_32.exe - 2001-10-26 20:30:04 36,864 -c--a-w C:\WINDOWS\system32\dllcache\typeperf.exe + 2001-10-26 20:30:04 44,032 -c--a-w C:\WINDOWS\system32\dllcache\typeperf.exe - 2001-10-26 20:30:04 4,096 -c--a-w C:\WINDOWS\system32\dllcache\unlodctr.exe + 2001-10-26 20:30:04 11,264 -c--a-w C:\WINDOWS\system32\dllcache\unlodctr.exe - 2004-08-03 23:44:28 208,896 -c--a-w C:\WINDOWS\system32\dllcache\unregmp2.exe + 2004-08-03 23:44:28 217,088 -c--a-w C:\WINDOWS\system32\dllcache\unregmp2.exe - 2001-10-26 20:30:04 16,896 -c--a-w C:\WINDOWS\system32\dllcache\unsecapp.exe + 2001-10-26 20:30:04 24,064 -c--a-w C:\WINDOWS\system32\dllcache\unsecapp.exe - 2004-08-03 23:44:28 151,040 -c--a-w C:\WINDOWS\system32\dllcache\uploadm.exe + 2004-08-03 23:44:28 158,208 -c--a-w C:\WINDOWS\system32\dllcache\uploadm.exe - 2004-08-03 23:44:28 16,896 -c--a-w C:\WINDOWS\system32\dllcache\upnpcont.exe + 2004-08-03 23:44:28 24,064 -c--a-w C:\WINDOWS\system32\dllcache\upnpcont.exe - 2004-08-03 23:44:30 18,432 -c--a-w C:\WINDOWS\system32\dllcache\ups.exe + 2004-08-03 23:44:30 25,600 -c--a-w C:\WINDOWS\system32\dllcache\ups.exe - 2004-08-03 23:44:30 50,176 -c--a-w C:\WINDOWS\system32\dllcache\utilman.exe + 2004-08-03 23:44:30 57,344 -c--a-w C:\WINDOWS\system32\dllcache\utilman.exe - 2001-10-26 20:30:04 102,400 -c--a-w C:\WINDOWS\system32\dllcache\verifier.exe + 2001-10-26 20:30:04 109,568 -c--a-w C:\WINDOWS\system32\dllcache\verifier.exe - 2001-10-26 20:30:04 33,792 -c--a-w C:\WINDOWS\system32\dllcache\vssadmin.exe + 2001-10-26 20:30:04 40,960 -c--a-w C:\WINDOWS\system32\dllcache\vssadmin.exe - 2004-08-03 23:44:30 291,840 -c--a-w C:\WINDOWS\system32\dllcache\vssvc.exe + 2004-08-03 23:44:30 299,008 -c--a-w C:\WINDOWS\system32\dllcache\vssvc.exe - 2001-10-26 20:30:06 51,200 -c--a-w C:\WINDOWS\system32\dllcache\w32tm.exe + 2001-10-26 20:30:06 58,368 -c--a-w C:\WINDOWS\system32\dllcache\w32tm.exe - 2004-08-03 23:44:30 46,080 -c--a-w C:\WINDOWS\system32\dllcache\wab.exe + 2004-08-03 23:44:30 53,248 -c--a-w C:\WINDOWS\system32\dllcache\wab.exe - 2004-08-03 23:44:30 30,208 -c--a-w C:\WINDOWS\system32\dllcache\wabmig.exe + 2004-08-03 23:44:30 37,376 -c--a-w C:\WINDOWS\system32\dllcache\wabmig.exe - 2001-10-26 20:30:06 12,288 -c--a-w C:\WINDOWS\system32\dllcache\wb32.exe + 2001-10-26 20:30:06 20,480 -c--a-w C:\WINDOWS\system32\dllcache\wb32.exe - 2004-08-03 23:44:30 118,272 -c--a-w C:\WINDOWS\system32\dllcache\wbemtest.exe + 2004-08-03 23:44:30 125,440 -c--a-w C:\WINDOWS\system32\dllcache\wbemtest.exe - 2004-08-03 23:44:30 66,048 -c--a-w C:\WINDOWS\system32\dllcache\wextract.exe + 2004-08-03 23:44:30 73,216 -c--a-w C:\WINDOWS\system32\dllcache\wextract.exe - 2004-08-03 23:44:30 435,712 -c--a-w C:\WINDOWS\system32\dllcache\wiaacmgr.exe + 2004-08-03 23:44:30 442,880 -c--a-w C:\WINDOWS\system32\dllcache\wiaacmgr.exe - 2004-08-03 23:44:30 285,696 -c--a-w C:\WINDOWS\system32\dllcache\winhlp32.exe + 2004-08-03 23:44:30 292,864 -c--a-w C:\WINDOWS\system32\dllcache\winhlp32.exe - 2001-10-26 20:30:06 8,192 -c--a-w C:\WINDOWS\system32\dllcache\winhstb.exe + 2001-10-26 20:30:06 15,360 -c--a-w C:\WINDOWS\system32\dllcache\winhstb.exe - 2004-08-03 23:44:30 504,832 -c--a-w C:\WINDOWS\system32\dllcache\winlogon.exe + 2004-08-03 23:44:30 512,000 -c--a-w C:\WINDOWS\system32\dllcache\winlogon.exe - 2001-10-26 20:30:06 13,824 -c--a-w C:\WINDOWS\system32\dllcache\winmgmt.exe + 2001-10-26 20:30:06 20,992 -c--a-w C:\WINDOWS\system32\dllcache\winmgmt.exe - 2001-10-26 20:30:06 119,808 -c--a-w C:\WINDOWS\system32\dllcache\winmine.exe

**Posty:** 7956 · przez **Magik** 20 Paź 2008, 20:45

Kod: Zaznacz wszystko: C:\TheTreasuresOfMontezuma_1660.exe

znasz ten plik?? jesli ni to usun go

start->uruchom->wpisz "dllcache"

i usun wszystkie pliki

do tego
1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem

Autor postu otrzymał pochwałę

**Posty:** 18165 · przez **wojtas** 20 Paź 2008, 22:43

Otworz notatnik i wklej w nim to:

File::
C:\WINDOWS\system32\drivers\bdf4f3e6.sys
F:\Programy\audioconverter_setup.exe

Folder::
C:\Qoobox

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.

**Posty:** 30 · przez **svieru** 21 Paź 2008, 12:54

log z combofixa

Kod: Zaznacz wszystko: ComboFix 08-10-19.04 - Adam 2008-10-21 12:46:34.3 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.91 [GMT 2:00] Uruchomiony z: C:\ComboFix.exe Użyto następujących komend :: C:\CFScript.txt FILE :: C:\WINDOWS\system32\drivers\bdf4f3e6.sys F:\Programy\audioconverter_setup.exe C:\Qoobox -- Whitelisted -- . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . F:\Programy\audioconverter_setup.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-21 do 2008-10-21 ))))))))))))))))))))))))))))))) . 2008-10-20 21:44 . 2008-10-20 21:45 2,992,910 -ra------ C:\ComboFix.exe 2008-10-20 18:53 . 2008-10-21 12:43 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak 2008-10-19 21:02 . 2008-10-19 21:02 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-10-19 13:39 . 2008-06-14 20:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-10-19 03:23 . 2008-10-19 03:23 10,752 --a------ C:\axee.exe 2008-10-19 03:16 . 2008-10-19 21:06 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2008-10-18 17:13 . 2008-10-18 17:13 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-10-18 17:13 . 2008-10-18 17:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-10-17 18:05 . 2006-04-27 17:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-10-17 18:05 . 2008-09-08 23:38 98,304 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe 2008-10-17 18:05 . 2003-06-05 21:13 61,440 --a------ C:\WINDOWS\system32\Process.exe 2008-10-17 16:59 . 2008-10-21 12:49 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-10-17 16:59 . 2008-06-30 23:41 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-10-17 16:59 . 2008-06-30 21:50 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-10-17 16:59 . 2008-06-30 23:41 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-10-17 16:59 . 2008-06-30 23:41 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-10-17 16:59 . 2008-06-30 23:41 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-10-17 16:59 . 2008-06-30 23:41 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-10-17 16:59 . 2008-10-17 16:59 <DIR> d-------- C:\Documents and Settings\Administrator 2008-10-12 21:46 . 2008-10-11 11:19 386,048 --a------ C:\DZWONEK DLA MAMY.mp3 2008-10-12 21:38 . 2008-10-12 21:38 1,154,048 --a------ C:\w branzy.mp3 2008-10-12 21:36 . 2008-10-12 21:36 <DIR> d-------- C:\Program Files\MP3SPLITTER 2008-10-12 20:55 . 2004-08-03 23:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys 2008-10-12 20:55 . 2006-10-08 21:51 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-10-12 20:55 . 2008-10-12 20:55 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-10-12 20:55 . 2008-10-12 20:55 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-10-12 20:46 . 2008-10-12 20:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nokia 2008-10-12 20:39 . 2008-10-12 20:39 <DIR> d-------- C:\Program Files\MSXML 6.0 2008-10-12 20:39 . 2008-02-01 16:17 138,112 --a------ C:\WINDOWS\system32\drivers\nmwcdnsu.sys 2008-10-12 20:39 . 2008-02-01 16:17 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdnsuc.sys 2008-10-12 20:20 . 2008-10-12 20:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-10-12 20:20 . 2008-10-12 20:56 <DIR> d-------- C:\Documents and Settings\Adam\Dane aplikacji\PC Suite 2008-10-12 20:20 . 2008-10-12 21:56 <DIR> d-------- C:\Documents and Settings\Adam\Dane aplikacji\Nokia 2008-10-12 20:17 . 2008-10-12 20:17 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-10-12 20:17 . 2008-10-12 20:17 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-10-12 20:15 . 2008-10-12 20:15 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-10-12 20:15 . 2008-10-12 20:15 <DIR> d-------- C:\Program Files\DIFX 2008-10-12 20:15 . 2007-09-17 15:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys 2008-10-12 20:14 . 2008-10-12 20:39 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2008-10-12 20:14 . 2008-05-07 07:39 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-10-12 20:14 . 2008-05-07 07:38 659,968 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-10-12 20:14 . 2008-02-01 16:17 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2008-10-12 20:14 . 2008-05-07 07:38 20,864 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys 2008-10-12 20:14 . 2008-05-07 07:38 17,536 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys 2008-10-12 20:14 . 2008-05-07 07:38 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys 2008-10-12 20:14 . 2008-06-06 09:24 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys 2008-10-12 20:13 . 2008-10-12 20:39 <DIR> d-------- C:\Program Files\Nokia 2008-10-12 20:00 . 2008-10-12 20:33 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-10-03 23:02 . 2008-10-17 15:46 <DIR> d-------- C:\Program Files\Odkurzacz . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-20 18:16 --------- d-----w C:\Program Files\Lavasoft 2008-10-03 21:26 --------- d-----w C:\Program Files\eMule 2008-10-03 21:26 --------- d-----w C:\Documents and Settings\Adam\Dane aplikacji\skypePM 2008-09-24 20:25 --------- d-----w C:\Documents and Settings\Adam\Dane aplikacji\Skype 2008-09-15 17:22 --------- d-----w C:\Program Files\SubEdit-Player 2008-09-15 15:40 1,846,272 ----a-w C:\WINDOWS\system32\win32k.sys 2008-08-28 10:04 333,056 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-08-20 05:38 662,016 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-14 13:46 2,181,632 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 13:46 2,059,008 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-07-26 20:48 7,252,937 ----a-w C:\odk11.2.0308setup_[www.programosy.pl].exe 2001-01-11 21:02 794,624 ----a-r C:\WINDOWS\inf\OTHER\AUDIO3D.DLL . ------- Sigcheck ------- 2008-04-14 19:21 21504 f1fb8a2b04336fefb9cf404ca7426f0e C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\svchost.exe 2004-08-04 01:44 21504 eb346e509e03ffcc05bd339d071f2e8a C:\WINDOWS\system32\svchost.exe 2004-08-04 01:44 1040896 e7586189f12eabd0e3a16d7bc83a940c C:\WINDOWS\explorer.exe 2008-04-14 19:21 1042432 dd3be74933e0492ce2dc861a0615da37 C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\explorer.exe 2008-04-14 19:21 116224 02229272269d48eeb9479de315881de5 C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\services.exe 2004-08-04 01:44 115712 dffeab8e99c0b213155605314b14a923 C:\WINDOWS\system32\services.exe 2008-04-14 19:21 22528 ecac55a1a53a82d6e3bec28f6f267a9f C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\ctfmon.exe 2004-08-04 01:44 22528 63f12d57431dda1743d85654d2c902bd C:\WINDOWS\system32\ctfmon.exe 2008-04-14 19:21 65024 ada8d9f5603cfafc04fd057704c71e2d C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\spoolsv.exe 2004-08-04 01:44 65024 4507f1ea279279794aa33e44ec2e8b6a C:\WINDOWS\system32\spoolsv.exe 2008-04-14 19:21 33792 4a8a03d74796514df17d9a71c5c8b09b C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\userinit.exe 2004-08-04 01:44 32256 a228f0622c6046184d455b53dafae7a8 C:\WINDOWS\system32\userinit.exe . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ----a-w 4,866,048 2006-01-26 16:21:46 F:\Program Files\eMule\4\bak\emule.exe ----a-w 4,866,048 2006-01-26 16:21:46 F:\Program Files\eMule\4\emule.exe ----a-w 368 2007-03-11 10:14:24 F:\Program Files\eMule\4\bak\downloads.txt ----a-w 12,542 2008-10-21 10:20:12 F:\Program Files\eMule\4\downloads.txt ----a-w 9,578 2007-03-11 10:15:10 F:\Program Files\eMule\4\bak\config\preferences.ini ----a-w 365 2007-03-11 10:14:20 F:\Program Files\eMule\4\bak\config\cryptkey.dat ----a-w 1 2007-03-11 10:14:46 F:\Program Files\eMule\4\bak\config\known2_64.met ----a-w 5 2007-03-11 10:15:00 F:\Program Files\eMule\4\bak\config\known.met ----a-w 5 2007-03-11 10:15:00 F:\Program Files\eMule\4\bak\config\cancelled.met ----a-w 2 2007-03-11 10:15:00 F:\Program Files\eMule\4\bak\config\AC_SearchStrings.dat ----a-w 2 2007-03-11 10:15:00 F:\Program Files\eMule\4\bak\config\AC_ServerMetURLs.dat ----a-w 2 2007-03-11 10:15:00 F:\Program Files\eMule\4\bak\config\AC_BootstrapIPs.dat ----a-w 61 2007-03-11 10:15:00 F:\Program Files\eMule\4\bak\config\preferences.dat ----a-w 1,638 2007-03-11 10:15:06 F:\Program Files\eMule\4\bak\config\statistics.ini ----a-w 2 2007-03-11 10:15:06 F:\Program Files\eMule\4\bak\config\shareddir.dat ----a-w 5 2007-03-11 10:15:08 F:\Program Files\eMule\4\bak\config\server.met ----a-w 5 2007-03-11 10:15:08 F:\Program Files\eMule\4\bak\config\clients.met ----a-w 5 2007-03-11 10:15:08 F:\Program Files\eMule\4\bak\config\emfriends.met ----a-w 778,240 2004-12-28 16:02:42 F:\Program Files\Gadu-gadu\bak\gg.exe ----a-w 778,240 2004-12-28 16:02:42 F:\Program Files\Gadu-gadu\gg.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "gadu-gadu"="C:\Program Files\GaduGadu\gg.exe" [2004-12-14 778240] "eMuleAutoStart"="F:\Program Files\eMule\4\emule.exe" [2006-01-26 4866048] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) "NoFileAssociate"= 0 (0x0) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SLUNotify] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\GaduGadu\\gg.exe"= "F:\\Program Files\\eMule\\4\\emule.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-07-13 17408] S1 ensqio;ensqio;C:\WINDOWS\system32\DRIVERS\ensqio.sys [ ] S1 sbpcint4;SB AudioPCI 128;C:\WINDOWS\system32\DRIVERS\sbpcint4.sys [ ] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2008-02-01 138112] S3 nmwcdnsuc;Nokia USB Flashing Generic;C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2008-02-01 8320] S4 CSIScanner;CSIScanner;C:\Program Files\PrevxCSI\prevxcsi.exe [ ] *Newly Created Service* - CATCHME . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-21 12:49:37 Windows 5.1.2600 Dodatek Service Pack 2 NTFS detected NTDLL code modification: ZwOpenFile skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-10-21 12:52:37 ComboFix-quarantined-files.txt 2008-10-21 10:52:31 Przed: 1 428 635 648 bajtów wolnych Po: 1,417,740,288 bajtów wolnych 165 --- E O F --- 2008-10-19 19:06:23

Dodano 26.10.2008 21:38:11:
Witam, po złapaniu tego syfu nie działał m.in. Total commander, acd see, Nero (wyskakiwały błędy przy uruchamianiu programów)
Commandera przeinstalowałem wtedy i działa elegancko do dziś.
Dziś odinstalowałem Nero i Acd See. Nero nie chciał się odinstaloować z opcji Uninstall ani dodaj/usuń programy. Usunąłem folder, nie chce się jednak usunąć jeden plik - NeroBurnPlugin.dll z folderu C:\Program Files\Ahead\WMPBurn. Zainstalowałem CDBurnerXP. Gdy go włączam pojawia się komunikat:

Natomiast AcdSee usunąłem z dodaj usuń programy bez problemów, zainstalowałem nowszą wersję i pojawia się komunikat:

Prawie na pewno są to te same komunikaty co przed przeinstalowaniem. Co powinienem zrobić? Z góry serdecznie dziękuję za pomoc.

**Posty:** 18165 · przez **wojtas** 26 Paź 2008, 21:44

znasz to:

C:\axee.exe

jesli nie to usun do kosza potem daj nowy log z combo oraz nowy raport z kaspra

**Posty:** 30 · przez **svieru** 26 Paź 2008, 22:35

Usunąłem ten axee.exe. Killbox usunął też po restarcie NeroBurnPlugin.dll. Nadal pokazuje mi te same dwa komunikaty przy CdBurnerze i Acd See.

Kod: Zaznacz wszystko: Oto log z combofixa ComboFix 08-10-25.01 - Adam 2008-10-26 21:18:04.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.144 [GMT 1:00] Uruchomiony z: C:\ComboFix.exe * Utworzono nowy punkt przywracania . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-26 do 2008-10-26 ))))))))))))))))))))))))))))))) . 2008-10-26 20:21 . 2008-10-26 20:21 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems 2008-10-26 20:20 . 2008-10-26 20:20 <DIR> d-------- C:\Program Files\ACD Systems 2008-10-26 20:19 . 2005-09-08 17:53 <DIR> d-------- C:\Program Files\ACDSee Standard v8.0 2008-10-26 20:15 . 2008-10-26 20:15 <DIR> d-------- C:\Program Files\CDBurnerXP 2008-10-26 20:09 . 2008-10-26 20:11 3,169,808 --a------ C:\Program Files\cdbxp_setup_4.2.2.1012.exe 2008-10-26 19:33 . 2008-10-26 19:34 <DIR> d-------- C:\!KillBox 2008-10-24 20:11 . 2008-10-24 20:11 <DIR> d-------- C:\logi, killbox, fixiedef 2008-10-24 17:51 . 2008-10-24 17:51 136 --a------ C:\WINDOWS\system32\D3.tmp 2008-10-24 17:51 . 2008-10-24 17:51 0 --a------ C:\WINDOWS\system32\D6.tmp 2008-10-24 17:51 . 2008-10-24 17:51 0 --a------ C:\WINDOWS\system32\D5.tmp 2008-10-24 17:51 . 2008-10-24 17:51 0 --a------ C:\WINDOWS\system32\D4.tmp 2008-10-24 11:49 . 2008-10-15 18:00 332,800 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll 2008-10-23 16:12 . 2008-10-23 16:12 128 --a------ C:\WINDOWS\system32\2.tmp 2008-10-23 16:12 . 2008-10-23 16:12 0 --a------ C:\WINDOWS\system32\5.tmp 2008-10-23 16:12 . 2008-10-23 16:12 0 --a------ C:\WINDOWS\system32\4.tmp 2008-10-23 16:12 . 2008-10-23 16:12 0 --a------ C:\WINDOWS\system32\3.tmp 2008-10-21 14:12 . 2008-10-21 14:13 <DIR> d-------- C:\Program Files\totalcmd 2008-10-21 12:04 . 2008-10-21 12:04 <DIR> d-------- C:\Program Files\Seagate 2008-10-21 12:04 . 2008-10-21 12:04 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Seagate 2008-10-20 20:44 . 2008-10-26 21:16 2,995,771 -ra------ C:\ComboFix.exe 2008-10-20 17:53 . 2008-10-21 11:43 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak 2008-10-19 20:02 . 2008-10-19 20:02 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-10-19 12:39 . 2008-06-14 19:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-10-19 02:16 . 2008-10-24 23:48 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2008-10-18 16:13 . 2008-10-18 16:13 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-10-18 16:13 . 2008-10-18 16:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-10-17 17:05 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-10-17 17:05 . 2008-09-08 22:38 98,304 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe 2008-10-17 17:05 . 2003-06-05 20:13 61,440 --a------ C:\WINDOWS\system32\Process.exe 2008-10-17 15:59 . 2008-10-26 21:19 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-10-17 15:59 . 2008-06-30 22:41 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-10-17 15:59 . 2008-06-30 20:50 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-10-17 15:59 . 2008-06-30 22:41 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-10-17 15:59 . 2008-06-30 22:41 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-10-17 15:59 . 2008-06-30 22:41 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-10-17 15:59 . 2008-06-30 22:41 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-10-17 15:59 . 2008-10-17 15:59 <DIR> d-------- C:\Documents and Settings\Administrator 2008-10-12 20:46 . 2008-10-11 10:19 386,048 --a------ C:\DZWONEK DLA MAMY.mp3 2008-10-12 20:38 . 2008-10-12 20:38 1,154,048 --a------ C:\w branzy.mp3 2008-10-12 20:36 . 2008-10-12 20:36 <DIR> d-------- C:\Program Files\MP3SPLITTER 2008-10-12 19:55 . 2004-08-03 22:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys 2008-10-12 19:55 . 2006-10-08 20:51 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-10-12 19:55 . 2008-10-12 19:55 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-10-12 19:55 . 2008-10-12 19:55 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-10-12 19:46 . 2008-10-12 19:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nokia 2008-10-12 19:39 . 2008-10-12 19:39 <DIR> d-------- C:\Program Files\MSXML 6.0 2008-10-12 19:39 . 2008-02-01 15:17 138,112 --a------ C:\WINDOWS\system32\drivers\nmwcdnsu.sys 2008-10-12 19:39 . 2008-02-01 15:17 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdnsuc.sys 2008-10-12 19:20 . 2008-10-12 19:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-10-12 19:20 . 2008-10-12 19:56 <DIR> d-------- C:\Documents and Settings\Adam\Dane aplikacji\PC Suite 2008-10-12 19:20 . 2008-10-12 20:56 <DIR> d-------- C:\Documents and Settings\Adam\Dane aplikacji\Nokia 2008-10-12 19:17 . 2008-10-12 19:17 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-10-12 19:17 . 2008-10-12 19:17 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-10-12 19:15 . 2008-10-12 19:15 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-10-12 19:15 . 2008-10-12 19:15 <DIR> d-------- C:\Program Files\DIFX 2008-10-12 19:15 . 2007-09-17 14:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys 2008-10-12 19:14 . 2008-10-12 19:39 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2008-10-12 19:14 . 2008-05-07 06:39 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-10-12 19:14 . 2008-05-07 06:38 659,968 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-10-12 19:14 . 2008-02-01 15:17 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2008-10-12 19:14 . 2008-05-07 06:38 20,864 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys 2008-10-12 19:14 . 2008-05-07 06:38 17,536 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys 2008-10-12 19:14 . 2008-05-07 06:38 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys 2008-10-12 19:14 . 2008-06-06 08:24 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys 2008-10-12 19:13 . 2008-10-12 19:39 <DIR> d-------- C:\Program Files\Nokia 2008-10-12 19:00 . 2008-10-12 19:33 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-10-03 22:02 . 2008-10-17 14:46 <DIR> d-------- C:\Program Files\Odkurzacz . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-26 19:21 --------- d-----w C:\Program Files\Common Files\ACD Systems 2008-10-26 19:14 14,670,916 ----a-w C:\Program Files\ACDSee.v8.0.Standard._.JJLMeira._osloskop.net_.rar 2008-10-26 19:00 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-10-26 18:59 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-10-26 18:31 --------- d-----w C:\Program Files\Ahead 2008-10-21 11:04 --------- d-----w C:\Program Files\InstallShield Installation Information 2008-10-20 18:16 --------- d-----w C:\Program Files\Lavasoft 2008-10-03 21:26 --------- d-----w C:\Program Files\eMule 2008-10-03 21:26 --------- d-----w C:\Documents and Settings\Adam\Dane aplikacji\skypePM 2008-09-24 20:25 --------- d-----w C:\Documents and Settings\Adam\Dane aplikacji\Skype 2008-09-15 17:22 --------- d-----w C:\Program Files\SubEdit-Player 2008-09-15 15:40 1,846,272 ----a-w C:\WINDOWS\system32\win32k.sys 2008-08-28 10:04 333,056 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-08-20 05:38 662,016 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-14 13:46 2,181,632 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 13:46 2,059,008 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2008-07-26 20:48 7,252,937 ----a-w C:\odk11.2.0308setup_[www.programosy.pl].exe 2001-01-11 21:02 794,624 ----a-r C:\WINDOWS\inf\OTHER\AUDIO3D.DLL . ------- Sigcheck ------- 2008-04-14 18:21 21504 f1fb8a2b04336fefb9cf404ca7426f0e C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\svchost.exe 2004-08-04 00:44 21504 eb346e509e03ffcc05bd339d071f2e8a C:\WINDOWS\system32\svchost.exe 2004-08-04 00:44 1040896 e7586189f12eabd0e3a16d7bc83a940c C:\WINDOWS\explorer.exe 2008-04-14 18:21 1042432 dd3be74933e0492ce2dc861a0615da37 C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\explorer.exe 2008-04-14 18:21 116224 02229272269d48eeb9479de315881de5 C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\services.exe 2004-08-04 00:44 115712 dffeab8e99c0b213155605314b14a923 C:\WINDOWS\system32\services.exe 2008-04-14 18:21 22528 ecac55a1a53a82d6e3bec28f6f267a9f C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\ctfmon.exe 2004-08-04 00:44 22528 63f12d57431dda1743d85654d2c902bd C:\WINDOWS\system32\ctfmon.exe 2008-04-14 18:21 65024 ada8d9f5603cfafc04fd057704c71e2d C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\spoolsv.exe 2004-08-04 00:44 65024 4507f1ea279279794aa33e44ec2e8b6a C:\WINDOWS\system32\spoolsv.exe 2008-04-14 18:21 33792 4a8a03d74796514df17d9a71c5c8b09b C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\userinit.exe 2004-08-04 00:44 32256 a228f0622c6046184d455b53dafae7a8 C:\WINDOWS\system32\userinit.exe . ((((((((((((((((((((((((((((( snapshot@2008-10-21_12.50.40.02 ))))))))))))))))))))))))))))))))))))))))) . - 2005-10-20 18:02:28 174,080 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\ERDNT.EXE + 2005-10-20 19:02:28 174,080 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\ERDNT.EXE - 2000-08-31 06:00:00 89,504 ----a-w C:\WINDOWS\fdsv.exe + 2000-08-31 06:00:00 97,696 ----a-w C:\WINDOWS\fdsv.exe - 2000-08-31 06:00:00 80,412 ----a-w C:\WINDOWS\grep.exe + 2000-08-31 06:00:00 87,580 ----a-w C:\WINDOWS\grep.exe + 2008-10-21 11:04:35 77,824 ----a-r C:\WINDOWS\Installer\{48B0F38D-1913-44F3-99AA-D4C55A2B038E}\ARPPRODUCTICON.exe + 2008-10-21 11:04:35 77,824 ----a-r C:\WINDOWS\Installer\{48B0F38D-1913-44F3-99AA-D4C55A2B038E}\NewShortcut1_D5E5682B2798457BBBF70892B58EFF3A.exe + 2008-10-21 11:04:35 77,824 ----a-r C:\WINDOWS\Installer\{48B0F38D-1913-44F3-99AA-D4C55A2B038E}\NewShortcut2_60EEB642E9E045A2A676B9D8FE17C4A9.exe + 2008-10-21 11:04:35 53,248 ----a-r C:\WINDOWS\Installer\{48B0F38D-1913-44F3-99AA-D4C55A2B038E}\NewShortcut3_129CE8B7DA8F497CB4428DA1D987019D.exe - 2008-06-30 20:36:59 90,112 ----a-r C:\WINDOWS\Installer\{AE80641A-0C8D-4670-A518-B4EC154B1027}\ACDSeeDesktopShortcu_AE80641A0C8D4670A518B4EC154B1027.exe + 2008-10-26 19:21:10 90,112 ----a-r C:\WINDOWS\Installer\{AE80641A-0C8D-4670-A518-B4EC154B1027}\ACDSeeDesktopShortcu_AE80641A0C8D4670A518B4EC154B1027.exe - 2008-06-30 20:36:59 90,112 ----a-r C:\WINDOWS\Installer\{AE80641A-0C8D-4670-A518-B4EC154B1027}\ACDSeePMShortcut_AE80641A0C8D4670A518B4EC154B1027.exe + 2008-10-26 19:21:10 90,112 ----a-r C:\WINDOWS\Installer\{AE80641A-0C8D-4670-A518-B4EC154B1027}\ACDSeePMShortcut_AE80641A0C8D4670A518B4EC154B1027.exe - 2008-06-30 20:36:59 90,112 ----a-r C:\WINDOWS\Installer\{AE80641A-0C8D-4670-A518-B4EC154B1027}\ARPPRODUCTICON.exe + 2008-10-26 19:21:10 90,112 ----a-r C:\WINDOWS\Installer\{AE80641A-0C8D-4670-A518-B4EC154B1027}\ARPPRODUCTICON.exe - 2008-06-30 20:36:59 53,248 ----a-r C:\WINDOWS\Installer\{AE80641A-0C8D-4670-A518-B4EC154B1027}\DevDetectPMShortcut_ECE0113B23D04DD889E6D2F026CABF03.exe + 2008-10-26 19:21:10 53,248 ----a-r C:\WINDOWS\Installer\{AE80641A-0C8D-4670-A518-B4EC154B1027}\DevDetectPMShortcut_ECE0113B23D04DD889E6D2F026CABF03.exe - 2000-08-31 06:00:00 37,888 ----a-w C:\WINDOWS\NIRCMD.exe + 2000-08-31 07:00:00 37,888 ----a-w C:\WINDOWS\NIRCMD.exe - 2000-08-31 06:00:00 169,472 ----a-w C:\WINDOWS\SWREG.exe + 2000-08-31 07:00:00 169,472 ----a-w C:\WINDOWS\SWREG.exe - 2000-08-31 06:00:00 212,480 ----a-w C:\WINDOWS\SWXCACLS.exe + 2000-08-31 06:00:00 219,648 ----a-w C:\WINDOWS\SWXCACLS.exe - 2005-07-07 15:47:06 536,576 ----a-w C:\WINDOWS\system32\ACDSee.scr + 2005-07-07 16:47:06 528,384 ----a-w C:\WINDOWS\system32\ACDSee.scr - 2008-10-21 10:19:35 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-10-26 10:03:45 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-10-21 10:19:35 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat + 2008-10-26 10:03:45 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat - 2008-10-21 10:19:35 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat + 2008-10-26 10:03:45 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat - 2002-01-05 02:48:16 974,848 ----a-w C:\WINDOWS\system32\mfc70.dll + 2002-01-05 03:48:16 974,848 ----a-w C:\WINDOWS\system32\mfc70.dll - 2002-01-05 02:36:38 964,608 ----a-w C:\WINDOWS\system32\mfc70u.dll + 2002-01-05 03:36:38 964,608 ----a-w C:\WINDOWS\system32\mfc70u.dll + 2008-10-07 10:19:42 16,721,856 ----a-w C:\WINDOWS\system32\MRT.exe - 2004-08-03 23:44:06 2,804,224 ----a-w C:\WINDOWS\system32\msi.dll + 2005-05-03 10:58:36 2,890,240 ----a-w C:\WINDOWS\system32\msi.dll - 2004-08-03 23:44:24 84,480 ----a-w C:\WINDOWS\system32\msiexec.exe + 2005-05-03 10:58:36 86,016 ----a-w C:\WINDOWS\system32\msiexec.exe - 2004-08-03 23:44:06 331,264 ----a-w C:\WINDOWS\system32\msihnd.dll + 2005-05-03 10:58:36 271,360 ----a-w C:\WINDOWS\system32\msihnd.dll - 2004-08-03 23:43:08 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll + 2005-05-03 10:58:36 884,736 ----a-w C:\WINDOWS\system32\msimsg.dll - 2004-08-03 23:44:06 44,032 ----a-w C:\WINDOWS\system32\msisip.dll + 2005-05-03 10:58:36 15,360 ----a-w C:\WINDOWS\system32\msisip.dll - 2002-01-05 01:38:38 54,784 ----a-w C:\WINDOWS\system32\msvci70.dll + 2002-01-05 02:38:38 54,784 ----a-w C:\WINDOWS\system32\msvci70.dll - 2002-01-05 01:40:20 487,424 ----a-w C:\WINDOWS\system32\msvcp70.dll + 2002-01-05 02:40:20 487,424 ----a-w C:\WINDOWS\system32\msvcp70.dll - 2002-01-05 01:37:28 344,064 ----a-w C:\WINDOWS\system32\msvcr70.dll + 2002-01-05 02:37:28 344,064 ----a-w C:\WINDOWS\system32\msvcr70.dll - 2004-08-03 23:44:08 332,288 ----a-w C:\WINDOWS\system32\netapi32.dll + 2008-10-15 17:00:47 332,800 ----a-w C:\WINDOWS\system32\netapi32.dll - 2008-07-02 20:42:25 70,000 ----a-w C:\WINDOWS\system32\perfc009.dat + 2008-10-26 10:07:23 70,000 ----a-w C:\WINDOWS\system32\perfc009.dat - 2008-07-02 20:42:25 89,596 ----a-w C:\WINDOWS\system32\perfc015.dat + 2008-10-26 10:07:23 89,596 ----a-w C:\WINDOWS\system32\perfc015.dat - 2008-07-02 20:42:25 417,744 ----a-w C:\WINDOWS\system32\perfh009.dat + 2008-10-26 10:07:23 417,744 ----a-w C:\WINDOWS\system32\perfh009.dat - 2008-07-02 20:42:25 475,756 ----a-w C:\WINDOWS\system32\perfh015.dat + 2008-10-26 10:07:23 475,756 ----a-w C:\WINDOWS\system32\perfh015.dat - 2000-08-31 06:00:00 68,096 ----a-w C:\WINDOWS\zip.exe + 2000-08-31 06:00:00 75,264 ----a-w C:\WINDOWS\zip.exe . -- Migawka wyzerowana -- . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ----a-w 4,866,048 2006-01-26 17:21:46 F:\Program Files\eMule\4\bak\emule.exe ----a-w 4,866,048 2006-01-26 17:21:46 F:\Program Files\eMule\4\emule.exe ----a-w 368 2007-03-11 11:14:24 F:\Program Files\eMule\4\bak\downloads.txt ----a-w 14,372 2008-10-26 19:51:22 F:\Program Files\eMule\4\downloads.txt ----a-w 9,578 2007-03-11 11:15:10 F:\Program Files\eMule\4\bak\config\preferences.ini ----a-w 365 2007-03-11 11:14:20 F:\Program Files\eMule\4\bak\config\cryptkey.dat ----a-w 1 2007-03-11 11:14:46 F:\Program Files\eMule\4\bak\config\known2_64.met ----a-w 5 2007-03-11 11:15:00 F:\Program Files\eMule\4\bak\config\known.met ----a-w 5 2007-03-11 11:15:00 F:\Program Files\eMule\4\bak\config\cancelled.met ----a-w 2 2007-03-11 11:15:00 F:\Program Files\eMule\4\bak\config\AC_SearchStrings.dat ----a-w 2 2007-03-11 11:15:00 F:\Program Files\eMule\4\bak\config\AC_ServerMetURLs.dat ----a-w 2 2007-03-11 11:15:00 F:\Program Files\eMule\4\bak\config\AC_BootstrapIPs.dat ----a-w 61 2007-03-11 11:15:00 F:\Program Files\eMule\4\bak\config\preferences.dat ----a-w 1,638 2007-03-11 11:15:06 F:\Program Files\eMule\4\bak\config\statistics.ini ----a-w 2 2007-03-11 11:15:06 F:\Program Files\eMule\4\bak\config\shareddir.dat ----a-w 5 2007-03-11 11:15:08 F:\Program Files\eMule\4\bak\config\server.met ----a-w 5 2007-03-11 11:15:08 F:\Program Files\eMule\4\bak\config\clients.met ----a-w 5 2007-03-11 11:15:08 F:\Program Files\eMule\4\bak\config\emfriends.met ----a-w 778,240 2004-12-28 17:02:42 F:\Program Files\Gadu-gadu\bak\gg.exe ----a-w 778,240 2004-12-28 17:02:42 F:\Program Files\Gadu-gadu\gg.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "gadu-gadu"="C:\Program Files\GaduGadu\gg.exe" [2004-12-14 778240] "eMuleAutoStart"="F:\Program Files\eMule\4\emule.exe" [2006-01-26 4866048] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) "NoFileAssociate"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\GaduGadu\\gg.exe"= "F:\\Program Files\\eMule\\4\\emule.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-07-13 17408] S1 ensqio;ensqio;C:\WINDOWS\system32\DRIVERS\ensqio.sys [ ] S1 sbpcint4;SB AudioPCI 128;C:\WINDOWS\system32\DRIVERS\sbpcint4.sys [ ] S2 Basics Service;Basics Service;C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe [2007-10-09 124280] S2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe [2008-06-15 71096] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2008-02-01 138112] S3 nmwcdnsuc;Nokia USB Flashing Generic;C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2008-02-01 8320] S4 CSIScanner;CSIScanner;C:\Program Files\PrevxCSI\prevxcsi.exe [ ] *Newly Created Service* - NMSACCESSU . - - - - USUNIĘTO PUSTE WPISY - - - - SafeBoot-SLUNotify . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\Adam\Dane aplikacji\Mozilla\Firefox\Profiles\bxd4678j.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://google.pl/ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-26 21:19:59 Windows 5.1.2600 Dodatek Service Pack 2 NTFS detected NTDLL code modification: ZwOpenFile skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-10-26 21:22:35 ComboFix-quarantined-files.txt 2008-10-26 20:22:30 ComboFix2.txt 2008-10-21 10:52:39 Przed: 1 649 332 224 bajtów wolnych Po: 1,640,464,384 bajtów wolnych 260 --- E O F --- 2008-10-24 22:48:35

**Posty:** 18165 · przez **wojtas** 26 Paź 2008, 22:54

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka oraz ten nowy raport z kaspra

**Posty:** 30 · przez **svieru** 27 Paź 2008, 20:30

1)Zrobiłem to co było podane w temacie programem wwdc, lecz po ponownym uruchomieniu nie łączył się z internetem, odznaczyłem z powrotem Netbios i teraz wygląda to tak:

Następnie bez żadnych błędów zainstalowałem tą łatkę. Na wszelki wypadek chciałem chciałem też skorzystać z tego Seconfig Xp ale gdy uruchamiam i klikam TAK (Do you accept...?) to wyskakuje za każdym razem ponownie to samo okno.
2)log z SDFix:

Kod: Zaznacz wszystko: [b]SDFix: Version 1.237 [/b] Run by Adam on 2008-10-27 at 11:37 Microsoft Windows XP [Wersja 5.1.2600] Running From: C:\SDFix [b]Checking Services [/b]: Restoring Default Security Values Restoring Default Hosts File Rebooting [b]Checking Files [/b]: Trojan Files Found: C:\WINDOWS\system32\2.tmp - Deleted C:\WINDOWS\system32\3.tmp - Deleted C:\WINDOWS\system32\4.tmp - Deleted C:\WINDOWS\system32\5.tmp - Deleted C:\WINDOWS\system32\2.tmp - Deleted Removing Temp Files [b]ADS Check [/b]: [b]Final Check [/b]: catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-27 11:41:50 Windows 5.1.2600 Dodatek Service Pack 2 NTFS detected NTDLL code modification: ZwOpenFile scanning hidden processes ... scanning hidden services & system hive ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 [b]Remaining Services [/b]: Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\eMule\\emule.exe"="C:\\Program Files\\eMule\\emule.exe:*:Enabled:eMule" "C:\\Program Files\\GaduGadu\\gg.exe"="C:\\Program Files\\GaduGadu\\gg.exe:*:Enabled:Gadu-Gadu - program glowny" "F:\\Program Files\\eMule\\4\\emule.exe"="F:\\Program Files\\eMule\\4\\emule.exe:*:Enabled:eMule" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe:*:Enabled:Skype" "\\??\\C:\\WINDOWS\\system32\\winlogon.exe"="\\??\\C:\\WINDOWS\\system32\\winlogon.exe:*:enabled:@shell32.dll,-1" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" [b]Remaining Files [/b]: File Backups: - C:\SDFix\backups\backups.zip [b]Files with Hidden Attributes [/b]: Mon 15 Sep 2008 1,562,960 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDHelper.dll" Thu 14 Aug 2008 1,429,840 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe" Wed 30 Jul 2008 4,891,984 A.SHR --- "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" [b]Finished![/b]

3)log z Combofixa

Kod: Zaznacz wszystko: ComboFix 08-10-25.01 - Adam 2008-10-27 11:45:11.5 - NTFSx86 NETWORK Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.131 [GMT 1:00] Uruchomiony z: C:\ComboFix.exe . ((((((((((((((((((((((((( Pliki utworzone od 2008-09-27 do 2008-10-27 ))))))))))))))))))))))))))))))) . 2008-10-27 11:36 . 2008-10-27 11:36 578,560 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll 2008-10-27 11:34 . 2008-10-27 11:34 <DIR> d-------- C:\WINDOWS\ERUNT 2008-10-26 22:51 . 2008-10-27 11:42 <DIR> d-------- C:\SDFix 2008-10-26 20:21 . 2008-10-26 20:21 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems 2008-10-26 20:20 . 2008-10-26 20:20 <DIR> d-------- C:\Program Files\ACD Systems 2008-10-26 20:19 . 2005-09-08 17:53 <DIR> d-------- C:\Program Files\ACDSee Standard v8.0 2008-10-26 20:15 . 2008-10-26 20:15 <DIR> d-------- C:\Program Files\CDBurnerXP 2008-10-26 20:09 . 2008-10-26 20:11 3,169,808 --a------ C:\Program Files\cdbxp_setup_4.2.2.1012.exe 2008-10-26 19:53 . 2008-10-26 19:56 14,968,808 --a------ C:\spybotsd160.exe 2008-10-24 20:11 . 2008-10-26 21:30 <DIR> d-------- C:\logi, killbox, fixiedef 2008-10-24 17:51 . 2008-10-24 17:51 136 --a------ C:\WINDOWS\system32\D3.tmp 2008-10-24 17:51 . 2008-10-24 17:51 0 --a------ C:\WINDOWS\system32\D6.tmp 2008-10-24 17:51 . 2008-10-24 17:51 0 --a------ C:\WINDOWS\system32\D5.tmp 2008-10-24 17:51 . 2008-10-24 17:51 0 --a------ C:\WINDOWS\system32\D4.tmp 2008-10-24 11:49 . 2008-10-15 18:00 332,800 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll 2008-10-21 14:12 . 2008-10-21 14:13 <DIR> d-------- C:\Program Files\totalcmd 2008-10-21 12:04 . 2008-10-21 12:04 <DIR> d-------- C:\Program Files\Seagate 2008-10-21 12:04 . 2008-10-21 12:04 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Seagate 2008-10-20 20:44 . 2008-10-26 21:16 2,995,771 -ra------ C:\ComboFix.exe 2008-10-20 17:53 . 2008-10-21 11:43 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak 2008-10-19 20:02 . 2008-10-19 20:02 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-10-19 12:39 . 2008-06-14 19:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-10-19 02:16 . 2008-10-26 22:40 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2008-10-18 16:13 . 2008-10-18 16:13 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-10-18 16:13 . 2008-10-18 16:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-10-17 17:05 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-10-17 17:05 . 2008-09-08 22:38 98,304 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe 2008-10-17 17:05 . 2003-06-05 20:13 61,440 --a------ C:\WINDOWS\system32\Process.exe 2008-10-17 15:59 . 2008-10-27 11:46 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-10-17 15:59 . 2008-06-30 22:41 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-10-17 15:59 . 2008-06-30 20:50 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-10-17 15:59 . 2008-06-30 22:41 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-10-17 15:59 . 2008-06-30 22:41 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-10-17 15:59 . 2008-06-30 22:41 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-10-17 15:59 . 2008-06-30 22:41 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-10-17 15:59 . 2008-10-17 15:59 <DIR> d-------- C:\Documents and Settings\Administrator 2008-10-12 20:46 . 2008-10-11 10:19 386,048 --a------ C:\DZWONEK DLA MAMY.mp3 2008-10-12 20:38 . 2008-10-12 20:38 1,154,048 --a------ C:\w branzy.mp3 2008-10-12 20:36 . 2008-10-12 20:36 <DIR> d-------- C:\Program Files\MP3SPLITTER 2008-10-12 19:55 . 2004-08-03 22:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys 2008-10-12 19:55 . 2006-10-08 20:51 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-10-12 19:55 . 2008-10-12 19:55 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-10-12 19:55 . 2008-10-12 19:55 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-10-12 19:46 . 2008-10-12 19:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nokia 2008-10-12 19:39 . 2008-10-12 19:39 <DIR> d-------- C:\Program Files\MSXML 6.0 2008-10-12 19:39 . 2008-02-01 15:17 138,112 --a------ C:\WINDOWS\system32\drivers\nmwcdnsu.sys 2008-10-12 19:39 . 2008-02-01 15:17 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdnsuc.sys 2008-10-12 19:20 . 2008-10-12 19:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-10-12 19:20 . 2008-10-12 19:56 <DIR> d-------- C:\Documents and Settings\Adam\Dane aplikacji\PC Suite 2008-10-12 19:20 . 2008-10-12 20:56 <DIR> d-------- C:\Documents and Settings\Adam\Dane aplikacji\Nokia 2008-10-12 19:17 . 2008-10-12 19:17 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-10-12 19:17 . 2008-10-12 19:17 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-10-12 19:15 . 2008-10-12 19:15 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-10-12 19:15 . 2008-10-12 19:15 <DIR> d-------- C:\Program Files\DIFX 2008-10-12 19:15 . 2007-09-17 14:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys 2008-10-12 19:14 . 2008-10-12 19:39 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2008-10-12 19:14 . 2008-05-07 06:39 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-10-12 19:14 . 2008-05-07 06:38 659,968 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-10-12 19:14 . 2008-02-01 15:17 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2008-10-12 19:14 . 2008-05-07 06:38 20,864 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys 2008-10-12 19:14 . 2008-05-07 06:38 17,536 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys 2008-10-12 19:14 . 2008-05-07 06:38 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys 2008-10-12 19:14 . 2008-06-06 08:24 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys 2008-10-12 19:13 . 2008-10-12 19:39 <DIR> d-------- C:\Program Files\Nokia 2008-10-12 19:00 . 2008-10-12 19:33 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-10-03 22:02 . 2008-10-17 14:46 <DIR> d-------- C:\Program Files\Odkurzacz . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-26 19:21 --------- d-----w C:\Program Files\Common Files\ACD Systems 2008-10-26 19:14 14,670,916 ----a-w C:\Program Files\ACDSee.v8.0.Standard._.JJLMeira._osloskop.net_.rar 2008-10-26 19:00 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-10-26 18:59 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-10-21 11:04 --------- d-----w C:\Program Files\InstallShield Installation Information 2008-10-20 18:16 --------- d-----w C:\Program Files\Lavasoft 2008-10-03 21:26 --------- d-----w C:\Program Files\eMule 2008-10-03 21:26 --------- d-----w C:\Documents and Settings\Adam\Dane aplikacji\skypePM 2008-09-24 20:25 --------- d-----w C:\Documents and Settings\Adam\Dane aplikacji\Skype 2008-09-15 17:22 --------- d-----w C:\Program Files\SubEdit-Player 2008-09-15 15:40 1,846,272 ----a-w C:\WINDOWS\system32\win32k.sys 2008-08-28 10:04 333,056 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-08-20 05:38 662,016 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-14 13:46 2,181,632 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 13:46 2,059,008 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2001-01-11 21:02 794,624 ----a-r C:\WINDOWS\inf\OTHER\AUDIO3D.DLL . ------- Sigcheck ------- 2008-04-14 18:21 21504 f1fb8a2b04336fefb9cf404ca7426f0e C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\svchost.exe 2004-08-04 00:44 21504 eb346e509e03ffcc05bd339d071f2e8a C:\WINDOWS\system32\svchost.exe 2004-08-04 00:44 1040896 e7586189f12eabd0e3a16d7bc83a940c C:\WINDOWS\explorer.exe 2008-04-14 18:21 1042432 dd3be74933e0492ce2dc861a0615da37 C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\explorer.exe 2008-04-14 18:21 116224 02229272269d48eeb9479de315881de5 C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\services.exe 2004-08-04 00:44 115712 dffeab8e99c0b213155605314b14a923 C:\WINDOWS\system32\services.exe 2008-04-14 18:21 22528 ecac55a1a53a82d6e3bec28f6f267a9f C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\ctfmon.exe 2004-08-04 00:44 22528 63f12d57431dda1743d85654d2c902bd C:\WINDOWS\system32\ctfmon.exe 2008-04-14 18:21 65024 ada8d9f5603cfafc04fd057704c71e2d C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\spoolsv.exe 2004-08-04 00:44 65024 4507f1ea279279794aa33e44ec2e8b6a C:\WINDOWS\system32\spoolsv.exe 2008-04-14 18:21 33792 4a8a03d74796514df17d9a71c5c8b09b C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\userinit.exe 2004-08-04 00:44 32256 a228f0622c6046184d455b53dafae7a8 C:\WINDOWS\system32\userinit.exe . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ----a-w 4,866,048 2006-01-26 17:21:46 F:\Program Files\eMule\4\bak\emule.exe ----a-w 4,866,048 2006-01-26 17:21:46 F:\Program Files\eMule\4\emule.exe ----a-w 368 2007-03-11 11:14:24 F:\Program Files\eMule\4\bak\downloads.txt ----a-w 14,194 2008-10-27 10:31:42 F:\Program Files\eMule\4\downloads.txt ----a-w 9,578 2007-03-11 11:15:10 F:\Program Files\eMule\4\bak\config\preferences.ini ----a-w 365 2007-03-11 11:14:20 F:\Program Files\eMule\4\bak\config\cryptkey.dat ----a-w 1 2007-03-11 11:14:46 F:\Program Files\eMule\4\bak\config\known2_64.met ----a-w 5 2007-03-11 11:15:00 F:\Program Files\eMule\4\bak\config\known.met ----a-w 5 2007-03-11 11:15:00 F:\Program Files\eMule\4\bak\config\cancelled.met ----a-w 2 2007-03-11 11:15:00 F:\Program Files\eMule\4\bak\config\AC_SearchStrings.dat ----a-w 2 2007-03-11 11:15:00 F:\Program Files\eMule\4\bak\config\AC_ServerMetURLs.dat ----a-w 2 2007-03-11 11:15:00 F:\Program Files\eMule\4\bak\config\AC_BootstrapIPs.dat ----a-w 61 2007-03-11 11:15:00 F:\Program Files\eMule\4\bak\config\preferences.dat ----a-w 1,638 2007-03-11 11:15:06 F:\Program Files\eMule\4\bak\config\statistics.ini ----a-w 2 2007-03-11 11:15:06 F:\Program Files\eMule\4\bak\config\shareddir.dat ----a-w 5 2007-03-11 11:15:08 F:\Program Files\eMule\4\bak\config\server.met ----a-w 5 2007-03-11 11:15:08 F:\Program Files\eMule\4\bak\config\clients.met ----a-w 5 2007-03-11 11:15:08 F:\Program Files\eMule\4\bak\config\emfriends.met ----a-w 778,240 2004-12-28 17:02:42 F:\Program Files\Gadu-gadu\bak\gg.exe ----a-w 778,240 2004-12-28 17:02:42 F:\Program Files\Gadu-gadu\gg.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "gadu-gadu"="C:\Program Files\GaduGadu\gg.exe" [2004-12-14 778240] "eMuleAutoStart"="F:\Program Files\eMule\4\emule.exe" [2006-01-26 4866048] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) "NoFileAssociate"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\GaduGadu\\gg.exe"= "F:\\Program Files\\eMule\\4\\emule.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-07-13 17408] S1 ensqio;ensqio;C:\WINDOWS\system32\DRIVERS\ensqio.sys [ ] S1 sbpcint4;SB AudioPCI 128;C:\WINDOWS\system32\DRIVERS\sbpcint4.sys [ ] S2 Basics Service;Basics Service;C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe [2007-10-09 124280] S2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe [2008-06-15 71096] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2008-02-01 138112] S3 nmwcdnsuc;Nokia USB Flashing Generic;C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2008-02-01 8320] S4 CSIScanner;CSIScanner;C:\Program Files\PrevxCSI\prevxcsi.exe [ ] . . ------- Skan uzupełniający ------- . FireFox -: Profile - C:\Documents and Settings\Adam\Dane aplikacji\Mozilla\Firefox\Profiles\bxd4678j.default\ FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://google.pl/ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-27 11:46:59 Windows 5.1.2600 Dodatek Service Pack 2 NTFS detected NTDLL code modification: ZwOpenFile skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2008-10-27 11:49:31 ComboFix-quarantined-files.txt 2008-10-27 10:49:27 ComboFix2.txt 2008-10-26 20:22:37 Przed: 1 573 064 704 bajtów wolnych Po: 1,562,914,816 bajtów wolnych 183 --- E O F --- 2008-10-24 22:48:35

4)log z HJ

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:59:09, on 2008-10-27 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\GaduGadu\gg.exe F:\Program Files\eMule\4\emule.exe C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe C:\Program Files\CDBurnerXP\NMSAccessU.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O4 - HKCU\..\Run: [gadu-gadu] "C:\Program Files\GaduGadu\gg.exe" /tray O4 - HKCU\..\Run: [eMuleAutoStart] F:\Program Files\eMule\4\emule.exe -AutoStart O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\Skype4COM.dll O23 - Service: Basics Service - Seagate Technology LLC - C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe O23 - Service: NMSAccessU - Unknown owner - C:\Program Files\CDBurnerXP\NMSAccessU.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe -- End of file - 2147 bytes

5)Kaspersky 2 razy mi się zaciął przy skanowaniu. Dzisiaj po 3-ech godzinach skanowania znalazł
Nazwa zagrożenia 3
Zainfekowanych obiektów 3
Podejrzanych obiektów 837
Czas skanowania 02:53:48
Uruchom skanowanie
Trwa skanowanie(58%)
Raportu nie mogę wkleić, bo nie mogę go włączyć. Zawiesił się i nie pokazuje mi tej zakładki RAPORT. Spróbuje go jeszcze raz uruchomić (chyba że ten raport jest gdzieś ukryty na dysku?)

**Posty:** 684 · przez **djarta** 28 Paź 2008, 09:17

Powiem to tak:

SDFix - czysto.

HJT - czysto.

WWDC - Nie podoba mi się tyle tych otwartych portów!

Wklej do Notatnika:

Kod: Zaznacz wszystko: File:: C:\WINDOWS\system32\D3.tmp C:\WINDOWS\system32\D6.tmp C:\WINDOWS\system32\D5.tmp C:\WINDOWS\system32\D4.tmp Driver:: ensqio sbpcint4

>>Plik>>Zapisz jako... >>> CFScript
Przeciągnij i upuść plik CFScript.txt na plik ComboFix.exe
-->

Ma się rozpocząć usuwanie. (i powstanie log).Daj ten log, który powstanie w trakcie usuwania.
Jeśli pójdzie dobrze, to: Po restarcie usuń ręcznie folder C:\Qoobox.

5)Kaspersky 2 razy mi się zaciął przy skanowaniu. Dzisiaj po 3-ech godzinach skanowania znalazł
Nazwa zagrożenia 3
Zainfekowanych obiektów 3
Podejrzanych obiektów 837
Czas skanowania 02:53:48
Uruchom skanowanie
Trwa skanowanie(58%)
Raportu nie mogę wkleić, bo nie mogę go włączyć. Zawiesił się i nie pokazuje mi tej zakładki RAPORT. Spróbuje go jeszcze raz uruchomić (chyba że ten raport jest gdzieś ukryty na dysku?)

Nie ma go na dysku.
Trochę za dużo "podejrzanych obiektów" - czyżby coś gorszego jest u Ciebie w komputerze? :1:

=====================
K.

Autor postu otrzymał pochwałę

**Posty:** 30 · przez **svieru** 28 Paź 2008, 13:11

log z combofix:

Kod: Zaznacz wszystko: ComboFix 08-10-25.01 - Adam 2008-10-28 11:55:02.6 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.2.1250.1.1045.18.68 [GMT 1:00] Uruchomiony z: C:\ComboFix.exe Użyto następujących komend :: C:\CFScript.txt FILE :: C:\WINDOWS\system32\D3.tmp C:\WINDOWS\system32\D4.tmp C:\WINDOWS\system32\D5.tmp C:\WINDOWS\system32\D6.tmp . ((((((((((((((((((((((((((((((((((((((( Usunięto ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\system32\D3.tmp C:\WINDOWS\system32\D4.tmp C:\WINDOWS\system32\D5.tmp C:\WINDOWS\system32\D6.tmp . ((((((((((((((((((((((((((((((((((((((( Sterowniki/Usługi ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\Service_ensqio -------\Service_sbpcint4 ((((((((((((((((((((((((( Pliki utworzone od 2008-09-28 do 2008-10-28 ))))))))))))))))))))))))))))))) . 2008-10-27 12:07 . 2008-10-27 12:07 <DIR> d-------- C:\WINDOWS\Sun 2008-10-27 12:06 . 2008-10-27 12:06 410,976 --a------ C:\WINDOWS\system32\deploytk.dll 2008-10-27 12:06 . 2008-10-27 12:06 73,728 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-10-27 12:05 . 2008-10-27 12:05 <DIR> d-------- C:\Program Files\Java 2008-10-27 11:36 . 2008-10-27 11:36 578,560 --a--c--- C:\WINDOWS\system32\dllcache\user32.dll 2008-10-27 11:34 . 2008-10-27 11:34 <DIR> d-------- C:\WINDOWS\ERUNT 2008-10-26 22:51 . 2008-10-27 11:42 <DIR> d-------- C:\SDFix 2008-10-26 20:21 . 2008-10-26 20:21 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\ACD Systems 2008-10-26 20:20 . 2008-10-26 20:20 <DIR> d-------- C:\Program Files\ACD Systems 2008-10-26 20:19 . 2005-09-08 17:53 <DIR> d-------- C:\Program Files\ACDSee Standard v8.0 2008-10-26 20:15 . 2008-10-26 20:15 <DIR> d-------- C:\Program Files\CDBurnerXP 2008-10-26 20:09 . 2008-10-26 20:11 3,169,808 --a------ C:\Program Files\cdbxp_setup_4.2.2.1012.exe 2008-10-26 19:53 . 2008-10-26 19:56 14,968,808 --a------ C:\spybotsd160.exe 2008-10-24 20:11 . 2008-10-26 21:30 <DIR> d-------- C:\logi, killbox, fixiedef 2008-10-24 11:49 . 2008-10-15 18:00 332,800 -----c--- C:\WINDOWS\system32\dllcache\netapi32.dll 2008-10-21 14:12 . 2008-10-21 14:13 <DIR> d-------- C:\Program Files\totalcmd 2008-10-21 12:04 . 2008-10-21 12:04 <DIR> d-------- C:\Program Files\Seagate 2008-10-21 12:04 . 2008-10-21 12:04 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Seagate 2008-10-20 20:44 . 2008-10-26 21:16 2,995,771 -ra------ C:\ComboFix.exe 2008-10-20 17:53 . 2008-10-21 11:43 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak 2008-10-19 20:02 . 2008-10-19 20:02 <DIR> d-------- C:\Program Files\MSXML 4.0 2008-10-19 12:39 . 2008-06-14 19:01 273,024 --------- C:\WINDOWS\system32\drivers\bthport.sys 2008-10-19 02:16 . 2008-10-26 22:40 <DIR> d--h----- C:\WINDOWS\$hf_mig$ 2008-10-18 16:13 . 2008-10-18 16:13 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab 2008-10-18 16:13 . 2008-10-18 16:13 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Kaspersky Lab 2008-10-17 17:05 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe 2008-10-17 17:05 . 2008-09-08 22:38 98,304 --a------ C:\WINDOWS\system32\AntiXPVSTFix.exe 2008-10-17 17:05 . 2003-06-05 20:13 61,440 --a------ C:\WINDOWS\system32\Process.exe 2008-10-17 15:59 . 2008-10-28 11:57 <DIR> d--h----- C:\Documents and Settings\Administrator\Ustawienia lokalne 2008-10-17 15:59 . 2008-06-30 22:41 <DIR> d-------- C:\Documents and Settings\Administrator\Ulubione 2008-10-17 15:59 . 2008-06-30 20:50 <DIR> d--h----- C:\Documents and Settings\Administrator\Szablony 2008-10-17 15:59 . 2008-06-30 22:41 <DIR> d-------- C:\Documents and Settings\Administrator\Pulpit 2008-10-17 15:59 . 2008-06-30 22:41 <DIR> d-------- C:\Documents and Settings\Administrator\Moje dokumenty 2008-10-17 15:59 . 2008-06-30 22:41 <DIR> dr------- C:\Documents and Settings\Administrator\Menu Start 2008-10-17 15:59 . 2008-06-30 22:41 <DIR> dr-h----- C:\Documents and Settings\Administrator\Dane aplikacji 2008-10-17 15:59 . 2008-10-17 15:59 <DIR> d-------- C:\Documents and Settings\Administrator 2008-10-12 20:46 . 2008-10-11 10:19 386,048 --a------ C:\DZWONEK DLA MAMY.mp3 2008-10-12 20:38 . 2008-10-12 20:38 1,154,048 --a------ C:\w branzy.mp3 2008-10-12 20:36 . 2008-10-12 20:36 <DIR> d-------- C:\Program Files\MP3SPLITTER 2008-10-12 19:55 . 2004-08-03 22:08 25,600 --a------ C:\WINDOWS\system32\drivers\usbser.sys 2008-10-12 19:55 . 2006-10-08 20:51 23,856 --a------ C:\WINDOWS\system32\spupdsvc.exe 2008-10-12 19:55 . 2008-10-12 19:55 0 --ah----- C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf 2008-10-12 19:55 . 2008-10-12 19:55 0 --ah----- C:\WINDOWS\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf 2008-10-12 19:46 . 2008-10-12 19:46 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Nokia 2008-10-12 19:39 . 2008-10-12 19:39 <DIR> d-------- C:\Program Files\MSXML 6.0 2008-10-12 19:39 . 2008-02-01 15:17 138,112 --a------ C:\WINDOWS\system32\drivers\nmwcdnsu.sys 2008-10-12 19:39 . 2008-02-01 15:17 8,320 --a------ C:\WINDOWS\system32\drivers\nmwcdnsuc.sys 2008-10-12 19:20 . 2008-10-12 19:20 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\PC Suite 2008-10-12 19:20 . 2008-10-12 19:56 <DIR> d-------- C:\Documents and Settings\Adam\Dane aplikacji\PC Suite 2008-10-12 19:20 . 2008-10-12 20:56 <DIR> d-------- C:\Documents and Settings\Adam\Dane aplikacji\Nokia 2008-10-12 19:17 . 2008-10-12 19:17 <DIR> d-------- C:\Program Files\Common Files\PCSuite 2008-10-12 19:17 . 2008-10-12 19:17 <DIR> d-------- C:\Program Files\Common Files\Nokia 2008-10-12 19:15 . 2008-10-12 19:15 <DIR> d-------- C:\Program Files\PC Connectivity Solution 2008-10-12 19:15 . 2008-10-12 19:15 <DIR> d-------- C:\Program Files\DIFX 2008-10-12 19:15 . 2007-09-17 14:53 21,632 --a------ C:\WINDOWS\system32\drivers\pccsmcfd.sys 2008-10-12 19:14 . 2008-10-12 19:39 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE 2008-10-12 19:14 . 2008-05-07 06:39 1,419,232 --a------ C:\WINDOWS\system32\wdfcoinstaller01005.dll 2008-10-12 19:14 . 2008-05-07 06:38 659,968 --a------ C:\WINDOWS\system32\nmwcdcocls.dll 2008-10-12 19:14 . 2008-02-01 15:17 90,624 --a------ C:\WINDOWS\system32\nmwcdcls.dll 2008-10-12 19:14 . 2008-05-07 06:38 20,864 --a------ C:\WINDOWS\system32\drivers\ccdcmbo.sys 2008-10-12 19:14 . 2008-05-07 06:38 17,536 --a------ C:\WINDOWS\system32\drivers\ccdcmb.sys 2008-10-12 19:14 . 2008-05-07 06:38 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerfltj.sys 2008-10-12 19:14 . 2008-06-06 08:24 8,064 --a------ C:\WINDOWS\system32\drivers\usbser_lowerflt.sys 2008-10-12 19:13 . 2008-10-12 19:39 <DIR> d-------- C:\Program Files\Nokia 2008-10-12 19:00 . 2008-10-12 19:33 <DIR> d-------- C:\Documents and Settings\All Users\Dane aplikacji\Installations 2008-10-03 22:02 . 2008-10-17 14:46 <DIR> d-------- C:\Program Files\Odkurzacz . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-10-26 19:21 --------- d-----w C:\Program Files\Common Files\ACD Systems 2008-10-26 19:14 14,670,916 ----a-w C:\Program Files\ACDSee.v8.0.Standard._.JJLMeira._osloskop.net_.rar 2008-10-26 19:00 --------- d-----w C:\Program Files\Spybot - Search & Destroy 2008-10-26 18:59 --------- d-----w C:\Documents and Settings\All Users\Dane aplikacji\Spybot - Search & Destroy 2008-10-21 11:04 --------- d-----w C:\Program Files\InstallShield Installation Information 2008-10-20 18:16 --------- d-----w C:\Program Files\Lavasoft 2008-10-03 21:26 --------- d-----w C:\Program Files\eMule 2008-10-03 21:26 --------- d-----w C:\Documents and Settings\Adam\Dane aplikacji\skypePM 2008-09-24 20:25 --------- d-----w C:\Documents and Settings\Adam\Dane aplikacji\Skype 2008-09-15 17:22 --------- d-----w C:\Program Files\SubEdit-Player 2008-09-15 15:40 1,846,272 ----a-w C:\WINDOWS\system32\win32k.sys 2008-08-28 10:04 333,056 ----a-w C:\WINDOWS\system32\drivers\srv.sys 2008-08-20 05:38 662,016 ----a-w C:\WINDOWS\system32\wininet.dll 2008-08-14 13:46 2,181,632 ----a-w C:\WINDOWS\system32\ntoskrnl.exe 2008-08-14 13:46 2,059,008 ----a-w C:\WINDOWS\system32\ntkrnlpa.exe 2001-01-11 21:02 794,624 ----a-r C:\WINDOWS\inf\OTHER\AUDIO3D.DLL . ------- Sigcheck ------- 2008-04-14 18:21 21504 f1fb8a2b04336fefb9cf404ca7426f0e C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\svchost.exe 2004-08-04 00:44 21504 eb346e509e03ffcc05bd339d071f2e8a C:\WINDOWS\system32\svchost.exe 2004-08-04 00:44 1040896 e7586189f12eabd0e3a16d7bc83a940c C:\WINDOWS\explorer.exe 2008-04-14 18:21 1042432 dd3be74933e0492ce2dc861a0615da37 C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\explorer.exe 2008-04-14 18:21 116224 02229272269d48eeb9479de315881de5 C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\services.exe 2004-08-04 00:44 115712 dffeab8e99c0b213155605314b14a923 C:\WINDOWS\system32\services.exe 2008-04-14 18:21 22528 ecac55a1a53a82d6e3bec28f6f267a9f C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\ctfmon.exe 2004-08-04 00:44 22528 63f12d57431dda1743d85654d2c902bd C:\WINDOWS\system32\ctfmon.exe 2008-04-14 18:21 65024 ada8d9f5603cfafc04fd057704c71e2d C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\spoolsv.exe 2004-08-04 00:44 65024 4507f1ea279279794aa33e44ec2e8b6a C:\WINDOWS\system32\spoolsv.exe 2008-04-14 18:21 33792 4a8a03d74796514df17d9a71c5c8b09b C:\WINDOWS\SoftwareDistribution\Download\dd64aa87403cfac627c6c8f37d245aa4\userinit.exe 2004-08-04 00:44 32256 a228f0622c6046184d455b53dafae7a8 C:\WINDOWS\system32\userinit.exe . ((((((((((((((((((((((((((((( snapshot@2008-10-27_11.47.52,38 ))))))))))))))))))))))))))))))))))))))))) . - 2005-10-20 18:02:28 174,080 ----a-w C:\WINDOWS\ERDNT\subs\ERDNT.EXE + 2005-10-20 19:02:28 163,328 ----a-w C:\WINDOWS\ERDNT\subs\ERDNT.EXE - 2008-10-27 10:39:55 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat + 2008-10-28 10:58:49 16,384 ----a-w C:\WINDOWS\system32\config\systemprofile\Cookies\index.dat - 2008-10-27 10:39:55 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat + 2008-10-28 10:58:49 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat - 2008-10-27 10:39:55 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat + 2008-10-28 10:58:49 32,768 ----a-w C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat + 2008-10-27 11:06:01 144,792 ----a-w C:\WINDOWS\system32\java.exe + 2008-10-27 11:06:01 144,792 ----a-w C:\WINDOWS\system32\javaw.exe + 2008-10-27 11:06:01 148,888 ----a-w C:\WINDOWS\system32\javaws.exe + 2008-10-28 10:59:05 16,384 ----atw C:\WINDOWS\temp\Perflib_Perfdata_7cc.dat . ((((((((((((((((((((((((((((((((((((((((((((( AWF )))))))))))))))))))))))))))))))))))))))))))))))))))))))))) . ----a-w 4,866,048 2006-01-26 17:21:46 F:\Program Files\eMule\4\bak\emule.exe ----a-w 4,866,048 2006-01-26 17:21:46 F:\Program Files\eMule\4\emule.exe ----a-w 368 2007-03-11 11:14:24 F:\Program Files\eMule\4\bak\downloads.txt ----a-w 14,188 2008-10-28 10:59:38 F:\Program Files\eMule\4\downloads.txt ----a-w 9,578 2007-03-11 11:15:10 F:\Program Files\eMule\4\bak\config\preferences.ini ----a-w 365 2007-03-11 11:14:20 F:\Program Files\eMule\4\bak\config\cryptkey.dat ----a-w 1 2007-03-11 11:14:46 F:\Program Files\eMule\4\bak\config\known2_64.met ----a-w 5 2007-03-11 11:15:00 F:\Program Files\eMule\4\bak\config\known.met ----a-w 5 2007-03-11 11:15:00 F:\Program Files\eMule\4\bak\config\cancelled.met ----a-w 2 2007-03-11 11:15:00 F:\Program Files\eMule\4\bak\config\AC_SearchStrings.dat ----a-w 2 2007-03-11 11:15:00 F:\Program Files\eMule\4\bak\config\AC_ServerMetURLs.dat ----a-w 2 2007-03-11 11:15:00 F:\Program Files\eMule\4\bak\config\AC_BootstrapIPs.dat ----a-w 61 2007-03-11 11:15:00 F:\Program Files\eMule\4\bak\config\preferences.dat ----a-w 1,638 2007-03-11 11:15:06 F:\Program Files\eMule\4\bak\config\statistics.ini ----a-w 2 2007-03-11 11:15:06 F:\Program Files\eMule\4\bak\config\shareddir.dat ----a-w 5 2007-03-11 11:15:08 F:\Program Files\eMule\4\bak\config\server.met ----a-w 5 2007-03-11 11:15:08 F:\Program Files\eMule\4\bak\config\clients.met ----a-w 5 2007-03-11 11:15:08 F:\Program Files\eMule\4\bak\config\emfriends.met ----a-w 778,240 2004-12-28 17:02:42 F:\Program Files\Gadu-gadu\bak\gg.exe ----a-w 778,240 2004-12-28 17:02:42 F:\Program Files\Gadu-gadu\gg.exe . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "gadu-gadu"="C:\Program Files\GaduGadu\gg.exe" [2004-12-14 778240] "eMuleAutoStart"="F:\Program Files\eMule\4\emule.exe" [2006-01-26 4866048] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer] "NoResolveTrack"= 1 (0x1) "NoFileAssociate"= 0 (0x0) [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-] "AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe" [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\eMule\\emule.exe"= "C:\\Program Files\\GaduGadu\\gg.exe"= "F:\\Program Files\\eMule\\4\\emule.exe"= "C:\\Program Files\\Skype\\Phone\\Skype.exe"= R0 pxark;pxark;C:\WINDOWS\system32\drivers\pxark.sys [2008-07-13 17408] R2 Basics Service;Basics Service;C:\Program Files\Seagate\Basics\Service\SyncServicesBasics.exe [2007-10-09 124280] R2 JavaQuickStarterService;Java Quick Starter;C:\Program Files\Java\jre6\bin\jqs.exe [2008-10-27 152984] R2 NMSAccessU;NMSAccessU;C:\Program Files\CDBurnerXP\NMSAccessU.exe [2008-06-15 71096] S3 nmwcdnsu;Nokia USB Flashing Phone Parent;C:\WINDOWS\system32\drivers\nmwcdnsu.sys [2008-02-01 138112] S3 nmwcdnsuc;Nokia USB Flashing Generic;C:\WINDOWS\system32\drivers\nmwcdnsuc.sys [2008-02-01 8320] S4 CSIScanner;CSIScanner;C:\Program Files\PrevxCSI\prevxcsi.exe [ ] . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-10-28 11:59:21 Windows 5.1.2600 Dodatek Service Pack 2 NTFS detected NTDLL code modification: ZwOpenFile skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . ------------------------ Pozostałe uruchomione procesy ------------------------ . C:\WINDOWS\system32\wdfmgr.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe . ************************************************************************** . Czas ukończenia: 2008-10-28 12:03:09 - komputer został uruchomiony ponownie ComboFix-quarantined-files.txt 2008-10-28 11:03:02 ComboFix2.txt 2008-10-27 10:49:32 ComboFix3.txt 2008-10-26 20:22:37 Przed: 1 748 090 880 bajtów wolnych Po: 1,789,419,520 bajtów wolnych 216 --- E O F --- 2008-10-24 22:48:35

djarta napisał(a):WWDC - Nie podoba mi się tyle tych otwartych portów!

Jak zamknąłem NetBios to komputer w ogoóle sieci nie wykrywał. Co do DCOM RPC, po restarcie wtedy był zamnięty, teraz jakieś ostrzeżenie jest i żółta ikona. mam dać CLOSE 135?

Co do Kasperskiego-skanowałem skanerem online, zaraz spróbuje ponownie, jak się uda to wrzucę raport

Dodano 28.10.2008 15:11:49:
EDIT: udało mi się przeskanować kasperskim obszary krytyczne. z powodu limitu słów w poście umieszczam cały LOG na sendspace.pl -> http://www.sendspace.pl/file/HE3BM3cp/
tutaj część loga:

Kod: Zaznacz wszystko: -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7 REPORT Tuesday, October 28, 2008 Operating System: Microsoft Windows XP Professional Dodatek Service Pack 2 (build 2600) Kaspersky Online Scanner 7 version: 7.0.25.0 Program database last update: Tuesday, October 28, 2008 07:30:41 Records in database: 1352982 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - Critical Areas: C:\Documents and Settings\Adam\Menu Start\Programy\Autostart C:\Documents and Settings\All Users\Menu Start\Programy\Autostart C:\Program Files C:\WINDOWS Scan statistics: Files scanned: 21000 Threat name: 3 Infected objects: 3 Suspicious objects: 772 Duration of the scan: 01:16:27 File name / Threat name / Threats count C:\WINDOWS\system32\services.exe/C:\WINDOWS\system32\services.exe Suspicious: Type_Win32 1 C:\WINDOWS\system32\svchost.exe/C:\WINDOWS\system32\svchost.exe Suspicious: Type_Win32 2 C:\WINDOWS\System32\svchost.exe/C:\WINDOWS\System32\svchost.exe Suspicious: Type_Win32 1 C:\Program Files\Ashampoo\Ashampoo WinOptimizer 5\ash_updateMediator.exe Suspicious: Type_Win32 1 C:\Program Files\Ashampoo\Ashampoo WinOptimizer 5\DeleteUserData.exe Suspicious: Type_Win32 1 C:\Program Files\C-Media\WIN_ME\CMUNINST.EXE Suspicious: Type_Win32 1 C:\Program Files\C-Media\WIN_ME\Setup.exe Suspicious: Type_Win32 1 C:\Program Files\CDBurnerXP\cdbxpcmd.exe Suspicious: Type_Win32 1 C:\Program Files\Common Files\ACD Systems\EN\ACDDnlMgr.exe Suspicious: Type_Win32 1 C:\Program Files\Common Files\ACD Systems\EN\DevDetect.exe Suspicious: Type_Win32 1 C:\Program Files\Common Files\ACD Systems\EN\Sync.exe Suspicious: Type_Win32 1 C:\Program Files\Common Files\InstallShield\Driver\7\Intel 32\IDriver.exe Suspicious: Type_Win32 1 C:\Program Files\Common Files\Microsoft Shared\MSInfo\msinfo32.exe Suspicious: Type_Win32 1 C:\Program Files\Common Files\Microsoft Shared\Speech\sapisvr.exe Suspicious: Type_Win32 1 C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe Suspicious: Type_Win32 1 C:\Program Files\DAP\dapxrpt.exe Suspicious: Type_Win32 1 C:\Program Files\DAP\RestartApp.exe Suspicious: Type_Win32 1 C:\Program Files\DAP\UNWISE.EXE Suspicious: Type_Win32 1 C:\Program Files\eMule\LinkCreator.exe Suspicious: Type_Win32 1 C:\Program Files\GaduGadu\gg.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\DestTest.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\hposid01.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\hpqacdse.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\hpqaol08.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\hpqclpbd.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\hpqcsaha.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\hpqdirec.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\hpqdstcp.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\hpqEmlsz.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\hpqirs08.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\hpqpprop.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\hpqprntw.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\hpqptc08.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\hpqste08.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\hpqtax08.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\hpqtbx01.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\hpqudc08.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\hpqvpswp.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\ppcue.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\bin\svtf.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\digitalimagingmonitor\hpzscr01.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\esupport\hpzscr01.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\help\player\fscommand\3900_load_photo.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\help\player\fscommand\3900_paper_jam.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\help\player\fscommand\3900_replace_cartridge.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\help\player\fscommand\buffer_swf.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprblog.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\Product Assistant\bin\hprbui.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\{3819891A-030B-4a4e-98ED-B28A649E48AB}\hpzcdl01.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\{3819891A-030B-4a4e-98ED-B28A649E48AB}\hpzsetup.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\{3819891A-030B-4a4e-98ED-B28A649E48AB}\setup\hpzpsl01.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\{3819891A-030B-4a4e-98ED-B28A649E48AB}\setup\hpzscr01.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Digital Imaging\{3819891A-030B-4a4e-98ED-B28A649E48AB}\setup.exe Suspicious: Type_Win32 1 C:\Program Files\HP\HP Software Update\HPWUCli.exe Suspicious: Type_Win32 1 C:\Program Files\HP\HP Software Update\hpwuSchd2.exe Suspicious: Type_Win32 1 C:\Program Files\HP\HP Software Update\SelfUpdate.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Image Zone Express\HP_IZE.exe Suspicious: Type_Win32 1 C:\Program Files\HP\Temp\{3819891A-030B-4a4e-98ED-B28A649E48AB}\setup\hpzscr01.exe Suspicious: Type_Win32 1 C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe Suspicious: Type_Win32 1 C:\Program Files\Internet Explorer\Connection Wizard\icwconn2.exe Suspicious: Type_Win32 1 C:\Program Files\Internet Explorer\Connection Wizard\icwrmind.exe Suspicious: Type_Win32 1 C:\Program Files\Internet Explorer\Connection Wizard\icwtutor.exe Suspicious: Type_Win32 1 C:\Program Files\Internet Explorer\Connection Wizard\inetwiz.exe Suspicious: Type_Win32 1 C:\Program Files\Internet Explorer\Connection Wizard\isignup.exe Suspicious: Type_Win32 1 C:\Program Files\Internet Explorer\iedw.exe Suspicious: Type_Win32 1 C:\Program Files\Internet Explorer\IEXPLORE.EXE Suspicious: Type_Win32 1 C:\Program Files\MP3SPLITTER\MP3Splitter.exe Suspicious: Type_Win32 1 C:\Program Files\MSN Gaming Zone\Windows\bckgzm.exe Suspicious: Type_Win32 1 C:\Program Files\MSN Gaming Zone\Windows\chkrzm.exe Suspicious: Type_Win32 1 C:\Program Files\MSN Gaming Zone\Windows\hrtzzm.exe Suspicious: Type_Win32 1 C:\Program Files\MSN Gaming Zone\Windows\Rvsezm.exe Suspicious: Type_Win32 1 C:\Program Files\MSN Gaming Zone\Windows\shvlzm.exe Suspicious: Type_Win32 1 C:\Program Files\MSN Gaming Zone\Windows\zClientm.exe Suspicious: Type_Win32 1 C:\Program Files\Nokia\Connectivity Cable Driver\setupextcmb.exe Suspicious: Type_Win32 1 C:\Program Files\Nokia\Flashing Cable Driver\setupextnsu.exe Suspicious: Type_Win32 1 C:\Program Files\Nokia\Nokia PC Suite 7\ApplicationInstaller.exe Suspicious: Type_Win32 1 C:\Program Files\Nokia\Nokia PC Suite 7\CommunicationCentre.exe Suspicious: Type_Win32 1 C:\Program Files\Nokia\Nokia PC Suite 7\ConnectionManager.exe Suspicious: Type_Win32 1 C:\Program Files\Nokia\Nokia PC Suite 7\ConversionHandler.exe Suspicious: Type_Win32 1 C:\Program Files\Nokia\Nokia PC Suite 7\GetConnected.exe Suspicious: Type_Win32 1 C:\Program Files\Nokia\Nokia PC Suite 7\ImageStore.exe Suspicious: Type_Win32 1 C:\Program Files\Nokia\Nokia PC Suite 7\OneTouchAccess.exe Suspicious: Type_Win32 1 C:\Program Files\Nokia\Nokia PC Suite 7\PCSyncLV.exe Suspicious: Type_Win32 1 C:\Program Files\Outlook Express\msimn.exe Suspicious: Type_Win32 1 C:\Program Files\Outlook Express\oemig50.exe Suspicious: Type_Win32 1 C:\Program Files\Outlook Express\setup50.exe Suspicious: Type_Win32 1 C:\Program Files\Outlook Express\wab.exe Suspicious: Type_Win32 1 C:\Program Files\Outlook Express\wabmig.exe Suspicious: Type_Win32 1 C:\Program Files\PC Connectivity Solution\NclInstaller.exe Suspicious: Type_Win32 1 C:\Program Files\PC Connectivity Solution\ServiceLayer.exe Suspicious: Type_Win32 1 C:\Program Files\PC Connectivity Solution\Transports\NclBCBTSrv.exe Suspicious: Type_Win32 1 C:\Program Files\PC Connectivity Solution\Transports\NclIrSrv.exe Suspicious: Type_Win32 1 C:\Program Files\PC Connectivity Solution\Transports\NclIVTBTSrv.exe Suspicious: Type_Win32 1 C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrv.exe Suspicious: Type_Win32 1 C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe Suspicious: Type_Win32 1 C:\Program Files\PC Connectivity Solution\Transports\NclToBTSrv.exe Suspicious: Type_Win32 1 C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe Suspicious: Type_Win32 1 C:\Program Files\PCI Audio Applications\AudioRack.exe Suspicious: Type_Win32 1 C:\Program Files\PCI Audio Applications\CD Player.exe Suspicious: Type_Win32 1 C:\Program Files\PCI Audio Applications\MIDI Player.exe Suspicious: Type_Win32 1 C:\Program Files\PCI Audio Applications\MP3 Player.exe Suspicious: Type_Win32 1 C:\Program Files\PCI Audio Applications\Uninstall.exe Suspicious: Type_Win32 1 C:\Program Files\SubEdit-Player\codec\ac3filter\ac3config.exe Suspicious: Type_Win32 1 C:\Program Files\SubEdit-Player\codec\ffdshow\makeavis.exe Suspicious: Type_Win32 1 C:\Program Files\Windows Media Player\migrate.exe Suspicious: Type_Win32 1 C:\Program Files\Windows Media Player\setup_wm.exe Suspicious: Type_Win32 1 C:\Program Files\Windows Media Player\wmplayer.exe Suspicious: Type_Win32 1 C:\Program Files\Windows NT\Accessories\wordpad.exe Suspicious: Type_Win32 1 C:\Program Files\Windows NT\dialer.exe Suspicious: Type_Win32 1 C:\Program Files\Windows NT\hypertrm.exe Suspicious: Type_Win32 1 C:\Program Files\Windows NT\Pinball\PINBALL.EXE Suspicious: Type_Win32 1 C:\Program Files\WinRAR\Rar.exe Suspicious: Type_Win32 1 C:\Program Files\WinRAR\Uninstall.exe Suspicious: Type_Win32 1 C:\Program Files\WinRAR\UnRAR.exe Suspicious: Type_Win32 1 C:\WINDOWS\$hf_mig$\KB951072-v2\SP2QFE\tzchange.exe Suspicious: Type_Win32 1 C:\WINDOWS\$hf_mig$\KB951072-v2\SP3GDR\tzchange.exe Suspicious: Type_Win32 1 C:\WINDOWS\$hf_mig$\KB951072-v2\SP3QFE\tzchange.exe Suspicious: Type_Win32 1 C:\WINDOWS\$hf_mig$\KB956390\SP2QFE\iedw.exe Suspicious: Type_Win32 1 C:\WINDOWS\$MSI31Uninstall_KB893803v2$\msiexec.exe Suspicious: Type_Win32 1 C:\WINDOWS\$NtUninstallKB956390$\iedw.exe Suspicious: Type_Win32 1 C:\WINDOWS\$NtUninstallKB956390$\iedw.exe.000 Suspicious: Type_Win32 1 C:\WINDOWS\cmuninst.exe Suspicious: Type_Win32 1 C:\WINDOWS\hh.exe Suspicious: Type_Win32 1 C:\WINDOWS\inf\unregmp2.exe Suspicious: Type_Win32 1 C:\WINDOWS\Installer\{17BD85F9-3B88-4C85-BB47-4AB8DD68F8BB}\NewShortcut16_F7578A24A4B240E4BA057EF931EB25B5.exe Suspicious: Type_Win32 1 C:\WINDOWS\Installer\{17BD85F9-3B88-4C85-BB47-4AB8DD68F8BB}\NewShortcut20_F7578A24A4B240E4BA057EF931EB25B5.exe Suspicious: Type_Win32 1 C:\WINDOWS\Installer\{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}\places.exe Suspicious: Type_Win32 1 C:\WINDOWS\Installer\{48B0F38D-1913-44F3-99AA-D4C55A2B038E}\ARPPRODUCTICON.exe Suspicious: Type_Win32 1 C:\WINDOWS\Installer\{48B0F38D-1913-44F3-99AA-D4C55A2B038E}\NewShortcut1_D5E5682B2798457BBBF70892B58EFF3A.exe Suspicious: Type_Win32 1 C:\WINDOWS\Installer\{48B0F38D-1913-44F3-99AA-D4C55A2B038E}\NewShortcut2_60EEB642E9E045A2A676B9D8FE17C4A9.exe Suspicious: Type_Win32 1 C:\WINDOWS\Installer\{48B0F38D-1913-44F3-99AA-D4C55A2B038E}\NewShortcut3_129CE8B7DA8F497CB4428DA1D987019D.exe Suspicious: Type_Win32 1 C:\WINDOWS\Installer\{AE80641A-0C8D-4670-A518-B4EC154B1027}\ACDSeeDesktopShortcu_AE80641A0C8D4670A518B4EC154B1027.exe Suspicious: Type_Win32 1 C:\WINDOWS\Installer\{AE80641A-0C8D-4670-A518-B4EC154B1027}\ACDSeePMShortcut_AE80641A0C8D4670A518B4EC154B1027.exe Suspicious: Type_Win32 1 C:\WINDOWS\Installer\{AE80641A-0C8D-4670-A518-B4EC154B1027}\ARPPRODUCTICON.exe Suspicious: Type_Win32 1 C:\WINDOWS\Installer\{AE80641A-0C8D-4670-A518-B4EC154B1027}\DevDetectPMShortcut_ECE0113B23D04DD889E6D2F026CABF03.exe Suspicious: Type_Win32 1 C:\WINDOWS\Installer\{C04E32E0-0416-434D-AFB9-6969D703A9EF}\icon.exe Suspicious: Type_Win32 1 C:\WINDOWS\IsUninst.exe Suspicious: Type_Win32 1 C:\WINDOWS\Microsoft.NET\Framework\NETFXSBS10.exe Suspicious: Type_Win32 1 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe Suspicious: Type_Win32 1 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe Suspicious: Type_Win32 1 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe Suspicious: Type_Win32 1 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\CasPol.exe Suspicious: Type_Win32 1 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe Suspicious: Type_Win32 1 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\IEExec.exe Suspicious: Type_Win32 1 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe Suspicious: Type_Win32 1 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\jsc.exe Suspicious: Type_Win32 1 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe Suspicious: Type_Win32 1 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe Suspicious: Type_Win32 1 C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe Suspicious: Type_Win32 1 C:\WINDOWS\msagent\agentsvr.exe Suspicious: Type_Win32 1 C:\WINDOWS\NOTEPAD.EXE Suspicious: Type_Win32 1 C:\WINDOWS\pchealth\helpctr\binaries\HelpCtr.exe Suspicious: Type_Win32 1 C:\WINDOWS\pchealth\helpctr\binaries\HelpHost.exe Suspicious: Type_Win32 1 C:\WINDOWS\pchealth\helpctr\binaries\HelpSvc.exe Suspicious: Type_Win32 1 C:\WINDOWS\pchealth\helpctr\binaries\HscUpd.exe Suspicious: Type_Win32 1 C:\WINDOWS\pchealth\helpctr\binaries\msconfig.exe Suspicious: Type_Win32 1 C:\WINDOWS\pchealth\helpctr\binaries\notiflag.exe Suspicious: Type_Win32 1 C:\WINDOWS\pchealth\UploadLB\Binaries\UploadM.exe Suspicious: Type_Win32 1 C:\WINDOWS\regedit.exe Suspicious: Type_Win32 1 C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\uwdf.exe Suspicious: Type_Win32 1 C:\WINDOWS\RegisteredPackages\{981FB688-E76B-4246-987B-92083185B90A}\wdfmgr.exe Suspicious: Type_Win32 1 C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}\logagent.exe Suspicious: Type_Win32 1 C:\WINDOWS\RegisteredPackages\{AAC1D942-0B38-4E37-9E4E-5B96A9DD2170}$BACKUP$\System\logagent.exe Suspicious: Type_Win32 1 C:\WINDOWS\sed.exe Suspicious: Type_Win32 1 C:\WINDOWS\SoftwareDistribution\Download\3f6beceda3deca00a8492601b0b62bfb\sp2gdr\tzchange.exe Suspicious: Type_Win32 1 ...

**Posty:** 684 · przez **djarta** 28 Paź 2008, 18:09

No niestety, musze to powiedzieć, masz wirusa który infekuję wszystkie końcówki *.exe!

Przeskanuj tym programem: KVRT, usuwaj all co znajdzie.

==============
K.

**Posty:** 30 · przez **svieru** 29 Paź 2008, 09:48

Przeskanowałem wczoraj dysk C i D, zaznaczyłem w KVRT żeby usuwał wszystko ... no i są jaja. komputer uruchamia się do momentu gdy mam wybrać konto użytkownika (nigdy o to nie pytał bo mam jedno konto, pytał tylko w trybie awaryjnym). gdy klikam to 'trwa wylogowywanie...' i znow wlacza sie to samo okno i znów wybieram to konto i tak w kółko, w ogóle się dalej nie uruchamia. to samo dzieje się w trybie awaryjnym. teraz piszę z innego komputera. no i nie mam pojęcia co mogę zrobić. na domiar złego, mój bezmózgi brat wyłączył wczoraj tamten komputer gdy mnie nie było i nie mam zapisanego raportu.