Zamulony xp wolno otwiera stronki i foldery

**Posty:** 44 · przez **adamo88** 19 Sty 2009, 22:19

co najdziwniejsze najwolniej otwiera sie jeden folder na partycji E - inne szybciej, strony w Operze 9.63 bardzo powoli - zwlaszcza wczytywanie obrazkow na stronach
log z HijackThis

Kod: Zaznacz wszystko: Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:09:47, on 2009-01-19 Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.5730.0013) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\LEXBCES.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\crypserv.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe C:\ElsaWin\bin\LcSvrAdm.exe C:\ElsaWin\bin\LcSvrDba.exe C:\ElsaWin\bin\LcSvrHis.exe C:\Program Files\Common Files\LightScribe\LSSrvc.exe C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe C:\WINDOWS\system32\nvsvc32.exe C:\WINDOWS\system32\svchost.exe C:\ElsaWin\bin\VSgate.exe C:\ElsaWin\bin\LcSvrAuf.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Kerio\Personal Firewall 4\kpf4gui.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\RTHDCPL.EXE C:\WINDOWS\system32\RUNDLL32.EXE C:\WINDOWS\VM305_STI.EXE C:\Program Files\Unlocker\UnlockerAssistant.exe C:\Program Files\RivaTuner v2.11\RivaTuner.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Konnekt\konnekt.exe C:\WINDOWS\system32\winlogon.exe C:\Program Files\Gadu-Gadu\gg.exe C:\instalki\od virusow\HiJackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.wp.pl/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\OFFICE~1\Office12\GRA8E1~1.DLL O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [BigDog305] C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305) O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe" O4 - HKLM\..\Run: [RivaTunerStartupDaemon] "C:\Program Files\RivaTuner v2.11\RivaTuner.exe" /S O4 - HKLM\..\Run: [RivaTuner] "C:\Program Files\RivaTuner v2.11\RivaTuner.exe" /T O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto O4 - HKLM\..\Run: [LexPPS.exe] C:\WINDOWS\system32\lexpps.exe O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Konnekt] "C:\Program Files\Konnekt\konnekt.exe" /autostart O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA LOKALNA') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'USŁUGA SIECIOWA') O4 - HKUS\S-1-5-21-2025429265-2077806209-842925246-1004\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'JA') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - S-1-5-21-2025429265-2077806209-842925246-1004 Startup: Skrót do avp.exe.lnk = C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe (User 'JA') O4 - S-1-5-21-2025429265-2077806209-842925246-1004 User Startup: Skrót do avp.exe.lnk = C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 2009\avp.exe (User 'JA') O8 - Extra context menu item: E&ksportuj do programu Microsoft Excel - res://C:\PROGRA~1\OFFICE~1\Office12\EXCEL.EXE/3000 O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\OFFICE~1\Office12\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\OFFICE~1\Office12\GR99D3~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O18 - Protocol: vw-wi - {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - C:\ElsaWin\bin\wiProt.dll O23 - Service: Crypkey License - Unknown owner - C:\WINDOWS\SYSTEM32\crypserv.exe O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe O23 - Service: ELSA Administration Service (LcSvrAdm) - Volkswagen AG - C:\ElsaWin\bin\LcSvrAdm.exe O23 - Service: ELSA Auftragsverwaltungs Service (LcSvrAuf) - Volkswagen AG - C:\ElsaWin\bin\LcSvrAuf.exe O23 - Service: ELSA DBA Server (LcSvrDba) - Volkswagen AG - C:\ElsaWin\bin\LcSvrDba.exe O23 - Service: ELSA Historie Server (LcSvrHis) - Volkswagen AG - C:\ElsaWin\bin\LcSvrHis.exe O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe O23 - Service: ELSA Vaudis Service (VSGate) - Volkswagen AG - C:\ElsaWin\bin\VSgate.exe -- End of file - 7351 bytes

log z SillentRunners

Kod: Zaznacz wszystko: "Silent Runners.vbs", revision 58, http://www.silentrunners.org/ Operating System: Windows XP Output limited to non-default values, except where indicated by "{++}" Startup items buried in registry: --------------------------------- HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++} "CTFMON.EXE" = "C:\WINDOWS\system32\ctfmon.exe" [MS] "Konnekt" = ""C:\Program Files\Konnekt\konnekt.exe" /autostart" ["Stamina"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ {++} "RTHDCPL" = "RTHDCPL.EXE" ["Realtek Semiconductor Corp."] "NvCplDaemon" = "RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup" [MS] "NvMediaCenter" = "RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit" [MS] "BigDog305" = "C:\WINDOWS\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)" ["Vimicro"] "UnlockerAssistant" = ""C:\Program Files\Unlocker\UnlockerAssistant.exe"" [null data] "RivaTunerStartupDaemon" = ""C:\Program Files\RivaTuner v2.11\RivaTuner.exe" /S" [empty string] "RivaTuner" = ""C:\Program Files\RivaTuner v2.11\RivaTuner.exe" /T" [empty string] "SunJavaUpdateSched" = ""C:\Program Files\Java\jre6\bin\jusched.exe"" ["Sun Microsystems, Inc."] "MSConfig" = "C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto" [MS] "LexPPS.exe" = "C:\WINDOWS\system32\lexpps.exe" ["Lexmark International, Inc."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ {18DF081C-E8AD-4283-A596-FA578C2EBDC3}\(Default) = "AcroIEHelperStub" -> {HKLM...CLSID} = "Adobe PDF Link Helper" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll" ["Adobe Systems Incorporated"] {22BF413B-C6D2-4d91-82A9-A0F997BA588C}\(Default) = "Skype add-on (mastermind)" -> {HKLM...CLSID} = "Skype add-on (mastermind)" \InProcServer32\(Default) = "C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll" ["Skype Technologies S.A."] {72853161-30C5-4D22-B7F9-0BBC1D38A37E}\(Default) = (no title provided) -> {HKLM...CLSID} = "Groove GFS Browser Helper" \InProcServer32\(Default) = "C:\PROGRA~1\OFFICE~1\Office12\GRA8E1~1.DLL" [MS] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}\(Default) = (no title provided) -> {HKLM...CLSID} = "Java(tm) Plug-In SSV Helper" \InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\ssv.dll" ["Sun Microsystems, Inc."] {DBC80044-A445-435b-BC74-9C25C1C588A9}\(Default) = (no title provided) -> {HKLM...CLSID} = "Java(tm) Plug-In 2 SSV Helper" \InProcServer32\(Default) = "C:\Program Files\Java\jre6\bin\jp2ssv.dll" ["Sun Microsystems, Inc."] {E7E6F031-17CE-4C07-BC86-EABFE594F69C}\(Default) = "JQSIEStartDetectorImpl" -> {HKLM...CLSID} = "JQSIEStartDetectorImpl Class" \InProcServer32\(Default) = "C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll" ["Sun Microsystems, Inc."] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\ "{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania" -> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania" \InProcServer32\(Default) = "deskpan.dll" [file not found] "{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu" -> {HKLM...CLSID} = "HyperTerminal Icon Ext" \InProcServer32\(Default) = "C:\WINDOWS\system32\hticons.dll" ["Hilgraeve, Inc."] "{EFA24E62-B078-11d0-89E4-00C04FC9E26E}" = "History Band" -> {HKLM...CLSID} = "History Band" \InProcServer32\(Default) = "C:\WINDOWS\system32\shdocvw.dll" [MS] "{A70C977A-BF00-412C-90B7-034C51DA2439}" = "NvCpl DesktopContext Class" -> {HKLM...CLSID} = "DesktopContext Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{FFB699E0-306A-11d3-8BD1-00104B6F7516}" = "Play on my TV helper" -> {HKLM...CLSID} = "NVIDIA CPL Extension" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvcpl.dll" ["NVIDIA Corporation"] "{1CDB2949-8F65-4355-8456-263E7C208A5D}" = "Desktop Explorer" -> {HKLM...CLSID} = "Desktop Explorer" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A47}" = "Desktop Explorer Menu" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{1E9B04FB-F9E5-4718-997B-B8DA88302A48}" = "nView Desktop Context Menu" -> {HKLM...CLSID} = "nView Desktop Context Menu" \InProcServer32\(Default) = "C:\WINDOWS\system32\nvshell.dll" ["NVIDIA Corporation"] "{4EFE464B-3D0B-4800-A5DE-2321283A3256}" = "QCD IconHandler" -> {HKLM...CLSID} = "QIconHandler Class" \InProcServer32\(Default) = "C:\Program Files\Quintessential Player\QCDIcons.dll" [empty string] "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"] "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" = "UnlockerShellExtension" -> {HKLM...CLSID} = "UnlockerShellExtension" \InProcServer32\(Default) = "C:\Program Files\Unlocker\UnlockerCOM.dll" [null data] "{72853161-30C5-4D22-B7F9-0BBC1D38A37E}" = "Groove GFS Browser Helper" -> {HKLM...CLSID} = "Groove GFS Browser Helper" \InProcServer32\(Default) = "C:\PROGRA~1\OFFICE~1\Office12\GRA8E1~1.DLL" [MS] "{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}" = "Groove GFS Explorer Bar" -> {HKLM...CLSID} = "Groove Folder Synchronization" \InProcServer32\(Default) = "C:\PROGRA~1\OFFICE~1\Office12\GRA8E1~1.DLL" [MS] "{A449600E-1DC6-4232-B948-9BD794D62056}" = "Groove GFS Stub Icon Handler" -> {HKLM...CLSID} = "Groove GFS Stub Icon Handler" \InProcServer32\(Default) = "C:\PROGRA~1\OFFICE~1\Office12\GRA8E1~1.DLL" [MS] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook" -> {HKLM...CLSID} = "Groove GFS Stub Execution Hook" \InProcServer32\(Default) = "C:\PROGRA~1\OFFICE~1\Office12\GRA8E1~1.DLL" [MS] "{6C467336-8281-4E60-8204-430CED96822D}" = "Groove GFS Context Menu Handler" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\PROGRA~1\OFFICE~1\Office12\GRA8E1~1.DLL" [MS] "{387E725D-DC16-4D76-B310-2C93ED4752A0}" = "Groove XML Icon Handler" -> {HKLM...CLSID} = "Groove XML Icon Handler" \InProcServer32\(Default) = "C:\PROGRA~1\OFFICE~1\Office12\GRA8E1~1.DLL" [MS] "{16F3DD56-1AF5-4347-846D-7C10C4192619}" = "Groove Explorer Icon Overlay 3 (GFS Folder)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 3 (GFS Folder)" \InProcServer32\(Default) = "C:\PROGRA~1\OFFICE~1\Office12\GRA8E1~1.DLL" [MS] "{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}" = "Groove Explorer Icon Overlay 2 (GFS Stub)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2 (GFS Stub)" \InProcServer32\(Default) = "C:\PROGRA~1\OFFICE~1\Office12\GRA8E1~1.DLL" [MS] "{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}" = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" \InProcServer32\(Default) = "C:\PROGRA~1\OFFICE~1\Office12\GRA8E1~1.DLL" [MS] "{99FD978C-D287-4F50-827F-B2C658EDA8E7}" = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" \InProcServer32\(Default) = "C:\PROGRA~1\OFFICE~1\Office12\GRA8E1~1.DLL" [MS] "{920E6DB1-9907-4370-B3A0-BAFC03D81399}" = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" -> {HKLM...CLSID} = "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" \InProcServer32\(Default) = "C:\PROGRA~1\OFFICE~1\Office12\GRA8E1~1.DLL" [MS] "{42042206-2D85-11D3-8CFF-005004838597}" = "Microsoft Office HTML Icon Handler" -> {HKLM...CLSID} = (no title provided) \InProcServer32\(Default) = "C:\Program Files\Office2007\Office12\msohevi.dll" [MS] "{993BE281-6695-4BA5-8A2A-7AACBFAAB69E}" = "Microsoft Office Metadata Handler" -> {HKLM...CLSID} = "Microsoft Office Metadata Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97}" = "Microsoft Office Thumbnail Handler" -> {HKLM...CLSID} = "Microsoft Office Thumbnail Handler" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll" [MS] "{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2}" = "NeroCoverEd Live Icons" -> {HKLM...CLSID} = "NeroCoverEdLiveIcons Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero 9\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"] "{1CA6BBC9-E9FA-4021-822B-075DF1837B63}" = "NeroDigitalIconHandler" -> {HKLM...CLSID} = "NeroDigitalIconHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Nero\SMC\NeroDigitalExt.dll" ["Nero AG"] "{846083A4-BFC6-4447-985C-6578B466A7D7}" = "NeroDigitalPropSheetHandler" -> {HKLM...CLSID} = "NeroDigitalPropSheetHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Nero\SMC\NeroDigitalExt.dll" ["Nero AG"] "{C9E60ED7-FEAE-477b-B6A6-7D62103A0C6B}" = "NeroDigitalColumnHandler" -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Nero\SMC\NeroDigitalExt.dll" ["Nero AG"] "{4FBFFA8D-F390-471a-AE46-FEB93623AD63}" = "NeroDigitalInfoHandler" -> {HKLM...CLSID} = "NeroDigitalInfoHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Nero\SMC\NeroDigitalExt.dll" ["Nero AG"] "{EDCC595A-F0EE-4d81-B554-D5D01C7AFB87}" = "NeroDigitalThumbnailHandler" -> {HKLM...CLSID} = "NeroDigitalThumbnailHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Nero\SMC\NeroDigitalExt.dll" ["Nero AG"] "{23170F69-40C1-278A-1000-000100020000}" = "7-Zip Shell Extension" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\ <<!>> "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}" = "Groove GFS Stub Execution Hook" -> {HKLM...CLSID} = "Groove GFS Stub Execution Hook" \InProcServer32\(Default) = "C:\PROGRA~1\OFFICE~1\Office12\GRA8E1~1.DLL" [MS] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\ "WPDShServiceObj" = "{AAA288BA-9A4C-45B0-95D7-94D524869DB5}" -> {HKLM...CLSID} = "WPDShServiceObj Class" \InProcServer32\(Default) = "C:\WINDOWS\system32\wpdshserviceobj.dll" [MS] HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ <<!>> dimsntfy\DLLName = "C:\WINDOWS\System32\dimsntfy.dll" [MS] HKLM\SOFTWARE\Classes\PROTOCOLS\Filter\ <<!>> text/xml\CLSID = "{807563E5-5146-11D5-A672-00B0D022E945}" -> {HKLM...CLSID} = "Microsoft Office InfoPath XML Mime Filter" \InProcServer32\(Default) = "C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL" [MS] HKLM\SOFTWARE\Classes\Folder\shellex\ColumnHandlers\ {C9E60ED7-FEAE-477b-B6A6-7D62103A0C6B}\(Default) = "NeroDigitalExt.NeroDigitalColumnHandler" -> {HKLM...CLSID} = "NeroDigitalColumnHandler Class" \InProcServer32\(Default) = "C:\Program Files\Common Files\Nero\SMC\NeroDigitalExt.dll" ["Nero AG"] {F9DB5320-233E-11D1-9F84-707F02C10627}\(Default) = "PDF Column Info" -> {HKLM...CLSID} = "PDF Shell Extension" \InProcServer32\(Default) = "C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll" ["Adobe Systems, Inc."] HKLM\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] Cover Designer\(Default) = "{73FCA462-9BD5-4065-A73F-A8E5F6904EF7}" -> {HKLM...CLSID} = "NeroCoverEdContextMenu Class" \InProcServer32\(Default) = "C:\Program Files\Nero\Nero 9\Nero CoverDesigner\CoverEdExtension.dll" ["Nero AG"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\PROGRA~1\OFFICE~1\Office12\GRA8E1~1.DLL" [MS] HKLM\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\ 7-Zip\(Default) = "{23170F69-40C1-278A-1000-000100020000}" -> {HKLM...CLSID} = "7-Zip Shell Extension" \InProcServer32\(Default) = "C:\Program Files\7-Zip\7-zip.dll" ["Igor Pavlov"] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\PROGRA~1\OFFICE~1\Office12\GRA8E1~1.DLL" [MS] HKLM\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\ UnlockerShellExtension\(Default) = "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" -> {HKLM...CLSID} = "UnlockerShellExtension" \InProcServer32\(Default) = "C:\Program Files\Unlocker\UnlockerCOM.dll" [null data] WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}" -> {HKLM...CLSID} = "WinRAR" \InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" ["Alexander Roshal"] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\PROGRA~1\OFFICE~1\Office12\GRA8E1~1.DLL" [MS] HKLM\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\ UnlockerShellExtension\(Default) = "{DDE4BEEB-DDE6-48fd-8EB5-035C09923F83}" -> {HKLM...CLSID} = "UnlockerShellExtension" \InProcServer32\(Default) = "C:\Program Files\Unlocker\UnlockerCOM.dll" [null data] XXX Groove GFS Context Menu Handler XXX\(Default) = "{6C467336-8281-4E60-8204-430CED96822D}" -> {HKLM...CLSID} = "Groove GFS Context Menu Handler" \InProcServer32\(Default) = "C:\PROGRA~1\OFFICE~1\Office12\GRA8E1~1.DLL" [MS] Default executables: -------------------- <<!>> HKLM\SOFTWARE\Classes\.com\(Default) = "ComFile" Group Policies {GPedit.msc branch and setting}: ----------------------------------------------- Note: detected settings may not have any effect. HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoDrives" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\ "NoDrives" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System\ "HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLogoffScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideStartupScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "RunLogonScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "RunStartupScriptSync" = (REG_DWORD) dword:0x00000000 {unrecognized setting} HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ "shutdownwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Shutdown: Allow system to be shut down without having to log on} "undockwithoutlogon" = (REG_DWORD) dword:0x00000001 {Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options| Devices: Allow undock without having to log on} "HideLegacyLogonScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideLogoffScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "RunLogonScriptSync" = (REG_DWORD) dword:0x00000001 {unrecognized setting} "RunStartupScriptSync" = (REG_DWORD) dword:0x00000000 {unrecognized setting} "HideStartupScripts" = (REG_DWORD) dword:0x00000000 {unrecognized setting} Active Desktop and Wallpaper: ----------------------------- Active Desktop may be disabled at this entry: HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState Displayed if Active Desktop enabled and wallpaper not set by Group Policy: HKCU\Software\Microsoft\Internet Explorer\Desktop\General\ "Wallpaper" = "C:\WINDOWS\system32\config\systemprofile\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Displayed if Active Desktop disabled and wallpaper not set by Group Policy: HKCU\Control Panel\Desktop\ "Wallpaper" = "C:\Documents and Settings\adamo88\Ustawienia lokalne\Dane aplikacji\Microsoft\Wallpaper1.bmp" Windows Portable Device AutoPlay Handlers ----------------------------------------- HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\AutoplayHandlers\Handlers\ BridgeCS4ImportMediaOnArrival\ "Provider" = "Adobe Bridge CS4" "InvokeProgID" = "Adobe.adobebridgeCS4" "InvokeVerb" = "launch" HKLM\SOFTWARE\Classes\Adobe.adobebridgeCS4\shell\launch\command\(Default) = "C:\Program Files\Adobe\Adobe Bridge CS4\bridgeproxy.exe -v %1" ["Adobe Systems, Inc."] BridgeCS4NonVolumeHandler\ "Provider" = "Adobe Bridge CS4" "ProgID" = "Adobe.adobebridgeMTP_1" HKLM\SOFTWARE\Classes\Adobe.adobebridgeMTP_1\CLSID\(Default) = "{1E6C711B-6D70-4a65-8AB6-745DC19BE2A6}" -> {HKLM...CLSID} = "Adobe Bridge CS4" \LocalServer32\(Default) = "C:\Program Files\Adobe\Adobe Bridge CS4\bridgeproxy.exe -m" ["Adobe Systems, Inc."] LightScribeOnArrivalAP\ "Provider" = "LightScribe Direct Disc Labeling" "InvokeProgID" = "LightScribe.AutoPlayHandler" "InvokeVerb" = "LabelLightScribeDisc" HKLM\SOFTWARE\Classes\LightScribe.AutoPlayHandler\shell\LabelLightScribeDisc\command\(Default) = "C:\Program Files\Common Files\LightScribe\LsLauncher.exe" ["Hewlett-Packard Company"] MSCDBurningOnArrival\ "Provider" = "@%SystemRoot%\system32\SHELL32.dll,-17170" "InvokeProgID" = "Folder" "InvokeVerb" = "open" HKLM\SOFTWARE\Classes\Folder\shell\open\command\(Default) = "C:\WINDOWS\Explorer.exe /idlist,%I,%L" [MS] MSOpenFolder\ "Provider" = "@%SystemRoot%\system32\SHELL32.dll,-17155" "InvokeProgID" = "Folder" "InvokeVerb" = "open" HKLM\SOFTWARE\Classes\Folder\shell\open\command\(Default) = "C:\WINDOWS\Explorer.exe /idlist,%I,%L" [MS] MSPlayMediaOnArrival\ "Provider" = "@wmploc.dll,-6502" "InvokeProgID" = "WMP.PlayMedia" "InvokeVerb" = "play" HKLM\SOFTWARE\Classes\WMP.PlayMedia\shell\play\DropTarget\CLSID = "{CE3FB1D1-02AE-4a5f-A6E9-D9F1B4073E6C}" -> {HKLM...CLSID} = "WMP Play As Playlist Launcher" \InProcServer32\(Default) = "C:\WINDOWS\system32\wmpshell.dll" [MS] MSPrintPicturesOnArrival\ "Provider" = "@%SystemRoot%\system32\SHELL32.dll,-17159" "InvokeProgID" = "Applications\shimgvw.dll" "InvokeVerb" = "print" HKLM\SOFTWARE\Classes\Applications\shimgvw.dll\shell\print\command\(Default) = "rundll32.exe C:\WINDOWS\system32\shimgvw.dll,ImageView_Fullscreen %1" [MS] HKLM\SOFTWARE\Classes\Applications\shimgvw.dll\shell\print\DropTarget\CLSID = "{60fd46de-f830-4894-a628-6fa81bc0190d}" -> {HKLM...CLSID} = "Obiekt DropTarget dla Kreatora drukowania fotografii" \InProcServer32\(Default) = "C:\WINDOWS\system32\photowiz.dll" [MS] MSShowPicturesOnArrival\ "Provider" = "@%SystemRoot%\system32\SHELL32.dll,-17157" "InvokeProgID" = "Shell.AutoplayForSlideShow.1" "InvokeVerb" = "open" HKLM\SOFTWARE\Classes\Shell.AutoplayForSlideShow.1\shell\open\DropTarget\CLSID = "{00E7B358-F65B-4dcf-83DF-CD026B94BFD4}" -> {HKLM...CLSID} = "Autoodtwarzanie pokazu slajdów w powłoce" \LocalServer32\(Default) = "rundll32.exe C:\WINDOWS\system32\shimgvw.dll,ImageView_COMServer {00E7B358-F65B-4dcf-83DF-CD026B94BFD4}" [MS] MSWiaEventHandler\ "Provider" = "@%systemroot%\System32\wiaacmgr.exe,-101" "InvokeProgID" = "WIA.AutoplayDropHandler.1" "InvokeVerb" = "open" HKLM\SOFTWARE\Classes\WIA.AutoplayDropHandler.1\shell\open\DropTarget\CLSID = "{F1ABE2B5-C073-4dba-B6EB-FD7A5111DD8F}" -> {HKLM...CLSID} = "Miejsce docelowe autoodtwarzania WIA" \InProcServer32\(Default) = "C:\WINDOWS\System32\wiadefui.dll" [MS] MSWPDShellNamespaceHandler\ "Provider" = "@%SystemRoot%\System32\WPDShextRes.dll,-501" "CLSID" = "{A55803CC-4D53-404c-8557-FD63DBA95D24}" "InitCmdLine" = " " -> {HKLM...CLSID} = "WPDShextAutoplay" \LocalServer32\(Default) = "C:\WINDOWS\system32\WPDShextAutoplay.exe" [MS] NeroAutoPlay9AudioToNeroDigital\ "Provider" = "Nero SoundTrax" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "AudioToNeroDigital_PlayCDAudioOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\AudioToNeroDigital_PlayCDAudioOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 9\Nero SoundTrax\SoundTrax.exe /" ["Nero AG"] NeroAutoPlay9CDAudio\ "Provider" = "Nero Express" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "CDAudio_HandleCDBurningOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\CDAudio_HandleCDBurningOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 9\Nero Express\NeroExpress.exe -w /New:AudioCD" ["Nero AG"] NeroAutoPlay9CopyCD\ "Provider" = "Nero Express" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "CopyCD_PlayMusicFilesOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\CopyCD_PlayMusicFilesOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 9\Nero Express\NeroExpress.exe -w /Dialog:DiscCopy" ["Nero AG"] NeroAutoPlay9DataDisc\ "Provider" = "Nero Express" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "DataDisc_HandleCDBurningOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\DataDisc_HandleCDBurningOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 9\Nero Express\NeroExpress.exe -w /New:ISODisc" ["Nero AG"] NeroAutoPlay9DVDVideoToNeroDigital\ "Provider" = "Nero Recode" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "DVDVideoToNeroDigital_PlayDVDMovieOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\DVDVideoToNeroDigital_PlayDVDMovieOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 9\Nero Recode\Recode.exe /New:ReAuthorNeroDigital" ["Nero AG"] NeroAutoPlay9LaunchNeroStartSmart\ "Provider" = "Nero StartSmart" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "LaunchNeroStartSmart_HandleCDBurningOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\LaunchNeroStartSmart_HandleCDBurningOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 9\Nero StartSmart\NeroStartSmart.exe /AutoPlay" ["Nero AG"] NeroAutoPlay9PlayAudioCD\ "Provider" = "Nero ShowTime" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "PlayAudioCD_PlayMusicFilesOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\PlayAudioCD_PlayMusicFilesOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 9\Nero ShowTime\ShowTime.exe /Play %L" ["Nero AG"] NeroAutoPlay9PlayDVD\ "Provider" = "Nero ShowTime" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "PlayDVD_PlayVideoFilesOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\PlayDVD_PlayVideoFilesOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 9\Nero ShowTime\ShowTime.exe /Play %L" ["Nero AG"] NeroAutoPlay9RipCD\ "Provider" = "Nero Burning ROM" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "RipCD_PlayCDAudioOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\RipCD_PlayCDAudioOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 9\Nero Burning ROM\Nero.exe /Dialog:SaveTracks %L" ["Nero AG"] NeroAutoPlay9TranscodeVideo\ "Provider" = "Nero Recode" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "TranscodeVideo_PlayDVDMovieOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\TranscodeVideo_PlayDVDMovieOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 9\Nero Recode\Recode.exe /New:CopyDVDVideo" ["Nero AG"] NeroAutoPlay9VideoCapture\ "Provider" = "Nero Vision" "ProgID" = "Shell.HWEventHandlerShellExecute" "InitCmdLine" = ""C:\Program Files\Nero\Nero 9\Nero Vision\NeroVision.exe" /New:VideoCapture" HKLM\SOFTWARE\Classes\Shell.HWEventHandlerShellExecute\CLSID\(Default) = "{FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" -> {HKLM...CLSID} = "ShellExecute HW Event Handler" \LocalServer32\(Default) = "rundll32.exe shell32.dll,SHCreateLocalServerRunDll {FFB8655F-81B9-4fce-B89C-9A6BA76D13E7}" [MS] NeroAutoPlay9ViewPhotos\ "Provider" = "Nero PhotoSnap Viewer" "InvokeProgID" = "Nero.AutoPlay8" "InvokeVerb" = "ViewPhotos_ShowPicturesOnArrival" HKLM\SOFTWARE\Classes\Nero.AutoPlay8\shell\ViewPhotos_ShowPicturesOnArrival\command\(Default) = "C:\Program Files\Nero\Nero 9\Nero PhotoSnap\PhotoSnapViewer.exe /" ["Nero AG"] PDVDPlayDVDMovieOnArrival\ "Provider" = "PowerDVD" "InvokeProgID" = "DVD" "InvokeVerb" = "PlayWithPowerDVD" HKLM\SOFTWARE\Classes\DVD\shell\PlayWithPowerDVD\Command\(Default) = ""C:\Program Files\PowerDVD\PowerDVD.exe" "%l"" ["CyberLink Corp."] Winsock2 Service Provider DLLs: ------------------------------- Namespace Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++} 000000000001\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] 000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS] 000000000003\LibraryPath = "%SystemRoot%\System32\mswsock.dll" [MS] Transport Service Providers HKLM\SYSTEM\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++} 0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range: %SystemRoot%\system32\mswsock.dll [MS], 01 - 03, 06 - 13 %SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05 Toolbars, Explorer Bars, Extensions: ------------------------------------ Explorer Bars HKLM\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\ HKLM\SOFTWARE\Classes\CLSID\{2A541AE1-5BF6-4665-A8A3-CFA9672E4291}\(Default) = "Groove Folder Synchronization" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\OFFICE~1\Office12\GRA8E1~1.DLL" [MS] HKLM\SOFTWARE\Classes\CLSID\{FF059E31-CC5A-4E2E-BF3B-96E929D65503}\(Default) = "&Poszukaj" Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar] InProcServer32\(Default) = "C:\PROGRA~1\OFFICE~1\Office12\REFIEBAR.DLL" [MS] Extensions (Tools menu items, main toolbar menu buttons) HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions\ {77BF5300-1474-4EC7-9980-D32B190E9B07}\ "ButtonText" = "Skype" "CLSIDExtension" = "{77BF5300-1474-4EC7-9980-D32B190E9B07}" -> {HKLM...CLSID} = "Skype add-on (button)" \InProcServer32\(Default) = "C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll" ["Skype Technologies S.A."] {92780B25-18CC-41C8-B9BE-3C9C571A8263}\ "ButtonText" = "Research" {FB5F1910-F110-11D2-BB9E-00C04F795683}\ "ButtonText" = "Messenger" "MenuText" = "Windows Messenger" "Exec" = "C:\Program Files\Messenger\msmsgs.exe" [MS] Running Services (Display Name, Service Name, Path {Service DLL}): ------------------------------------------------------------------ Crypkey License, Crypkey License, "crypserv.exe" [null data] ELSA Administration Service, LcSvrAdm, "C:\ElsaWin\bin\LcSvrAdm.exe" ["Volkswagen AG"] ELSA Auftragsverwaltungs Service, LcSvrAuf, "C:\ElsaWin\bin\LcSvrAuf.exe" ["Volkswagen AG"] ELSA DBA Server, LcSvrDba, "C:\ElsaWin\bin\LcSvrDba.exe" ["Volkswagen AG"] ELSA Historie Server, LcSvrHis, "C:\ElsaWin\bin\LcSvrHis.exe" ["Volkswagen AG"] ELSA Vaudis Service, VSGate, "C:\ElsaWin\bin\VSgate.exe" ["Volkswagen AG"] Java Quick Starter, JavaQuickStarterService, ""C:\Program Files\Java\jre6\bin\jqs.exe" -service -config "C:\Program Files\Java\jre6\lib\deploy\jqs\jqs.conf"" ["Sun Microsystems, Inc."] Kerio Personal Firewall 4, KPF4, ""C:\Program Files\Kerio\Personal Firewall 4\kpf4ss.exe"" ["Kerio Technologies"] LexBce Server, LexBceS, "C:\WINDOWS\system32\LEXBCES.EXE" ["Lexmark International, Inc."] LightScribeService Direct Disc Labeling Service, LightScribeService, ""C:\Program Files\Common Files\LightScribe\LSSrvc.exe"" ["Hewlett-Packard Company"] Nero BackItUp Scheduler 4.0, Nero BackItUp Scheduler 4.0, "C:\Program Files\Common Files\Nero\Nero BackItUp 4\NBService.exe" ["Nero AG"] NVIDIA Display Driver Service, NVSvc, "C:\WINDOWS\system32\nvsvc32.exe" ["NVIDIA Corporation"] Print Monitors: --------------- HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors\ Lexmark Network Port\Driver = "LEXLMPM.DLL" ["Lexmark International, Inc."] ---------- (launch time: 2009-01-19 21:10:43) <<!>>: Suspicious data at a malware launch point. + This report excludes default entries except where indicated. + To see *everywhere* the script checks and *everything* it finds, launch it from a command prompt or a shortcut with the -all parameter. + To search all directories of local fixed drives for DESKTOP.INI DLL launch points, use the -supp parameter or answer "No" at the first message box and "Yes" at the second message box. ---------- (total run time: 52 seconds, including 8 seconds for message boxes)

**Posty:** 18165 · przez **wojtas** 19 Sty 2009, 22:25

Wykonaj to co jest podane w tym temacie

Zastosuj SDFix . Po pobraniu uruchom go a rozpakuje się do C:\SDFix. Uruchom komputer w trybie awaryjnym (F8 przy stracie systemu). Będąc w awaryjnym uruchom plik RunThis.bat z folderu SDFixa. Zatwierdź czyszczenie przez Y. Poczekaj aż ukończy i komputer zresetuje

Potem wejdz do folderu C:\SDFix wrzuc zawartość pliku Report.txt + log z combofixa oraz daj loga z hijacka

**Posty:** 44 · przez **adamo88** 20 Sty 2009, 09:18

zrobilem tak jak napisales, SDFix dzialal od wczoraj i gdzies z rana dopiero skonczyl dzialanie, ale juz czuje roznice w szybkosci kompa :]
nie moge dodac logu z SDFix i HiJacKThis bo pisze ze za duzo znakow w poscie, a jak pod spodem probuje jako 2 post zamiescic to i tak sie scala i nie da rady wyslac wiec podaje link do tych logow http://wklej.org/id/41809/

log z ComboFix

Kod: Zaznacz wszystko: ComboFix 09-01-19.05 - adamo88 2009-01-20 8:07:33.2 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.3.1250.1.1045.18.1023.524 [GMT 1:00] Uruchomiony z: c:\instalki\do cs\ComboFix.exe FW: Kerio Personal Firewall *enabled* * Utworzono nowy punkt przywracania UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !! . ((((((((((((((((((((((((( Pliki utworzone od 2008-12-20 do 2009-01-20 ))))))))))))))))))))))))))))))) . 2009-01-19 22:39 . 2009-01-20 08:08 <DIR> d--h----- c:\documents and settings\Administrator\Ustawienia lokalne 2009-01-19 22:39 . 2008-10-28 20:49 <DIR> d-------- c:\documents and settings\Administrator\Ulubione 2009-01-19 22:39 . 2008-10-28 20:03 <DIR> d--h----- c:\documents and settings\Administrator\Szablony 2009-01-19 22:39 . 2008-10-28 20:49 <DIR> d-------- c:\documents and settings\Administrator\Pulpit 2009-01-19 22:39 . 2008-10-28 20:49 <DIR> d-------- c:\documents and settings\Administrator\Moje dokumenty 2009-01-19 22:39 . 2008-10-28 20:49 <DIR> dr------- c:\documents and settings\Administrator\Menu Start 2009-01-19 22:39 . 2008-10-28 20:49 <DIR> dr-h----- c:\documents and settings\Administrator\Dane aplikacji 2009-01-19 22:39 . 2009-01-19 22:39 <DIR> d-------- c:\documents and settings\Administrator 2009-01-18 11:18 . 2009-01-18 11:18 <DIR> d-------- c:\documents and settings\JA\Dane aplikacji\CyberLink 2009-01-17 19:34 . 2009-01-17 19:35 <DIR> d-------- c:\program files\Kopia CS3 2009-01-17 10:50 . 2009-01-17 10:50 10,890 --a------ c:\windows\system32\drivers\fwdrv.err 2009-01-15 10:08 . 2009-01-15 10:08 1,908 --a------ c:\windows\diagwrn.xml 2009-01-15 10:08 . 2009-01-15 10:08 1,908 --a------ c:\windows\diagerr.xml 2009-01-15 10:05 . 2009-01-15 10:06 <DIR> d-------- c:\program files\Real Alternative 2009-01-15 10:05 . 2009-01-15 10:06 <DIR> d-------- c:\program files\Media Player Classic 2009-01-14 18:07 . 2009-01-14 18:07 <DIR> d-------- c:\program files\Kerio 2009-01-11 15:26 . 2008-02-07 17:10 <DIR> d--h----- C:\ckis 2009-01-09 15:09 . 2009-01-11 15:30 <DIR> d-------- c:\documents and settings\adamo88\Dane aplikacji\Kaspersky_Key_Finder_(KKF 2009-01-06 22:36 . 2009-01-06 22:36 <DIR> d-------- C:\VW 2009-01-06 22:35 . 2009-01-06 22:35 571 --a------ c:\windows\ODBC.INI 2009-01-06 22:33 . 2009-01-06 22:33 <DIR> d-------- c:\program files\Diagnose-BK 2009-01-06 22:33 . 2009-01-06 23:35 <DIR> d-------- C:\ElsaWin 2009-01-06 22:33 . 2007-07-11 11:17 528,384 --a------ c:\windows\system32\ElsaCfg.cpl 2009-01-06 22:30 . 1996-11-06 13:05 302,592 --a------ c:\windows\unin0407.exe 2009-01-06 22:29 . 1996-11-05 17:13 299,008 --a------ c:\windows\uninst.exe 2009-01-06 01:35 . 2009-01-06 01:35 <DIR> d-------- c:\program files\ISO Commander 2009-01-06 01:23 . 2009-01-06 01:23 <DIR> d-------- c:\program files\7-Zip 2009-01-05 10:19 . 2009-01-05 10:19 <DIR> d-------- c:\program files\Polski VAG 4.9 2009-01-05 08:41 . 2009-01-05 08:57 <DIR> d-------- C:\upd 2009-01-05 08:41 . 2009-01-05 08:57 <DIR> d-------- C:\pict 2009-01-05 08:41 . 2009-01-05 08:57 <DIR> d-------- C:\diag 2009-01-05 08:41 . 2009-01-05 08:41 <DIR> d-------- C:\data 2008-12-31 18:07 . 2008-12-31 18:07 <DIR> d-------- c:\documents and settings\adamo88\Dane aplikacji\CyberLink 2008-12-31 18:06 . 2008-12-31 18:06 <DIR> d-------- c:\program files\PowerDVD 2008-12-31 18:06 . 2008-12-31 18:06 <DIR> d-------- c:\program files\CyberLink 2008-12-31 18:06 . 2008-12-31 18:06 <DIR> d-------- c:\documents and settings\All Users\Dane aplikacji\CyberLink 2008-12-30 13:56 . 2008-12-30 13:56 <DIR> d-------- c:\program files\Edgard 2008-12-28 15:03 . 2009-01-17 18:41 <DIR> d-------- c:\program files\CS 2008-12-28 14:13 . 2009-01-17 19:48 <DIR> d-------- c:\program files\CS3 2008-12-23 22:36 . 2008-12-23 22:37 <DIR> d-------- c:\program files\Kopia Kopia CS 2008-12-21 19:14 . 2008-12-21 19:14 <DIR> d-------- c:\program files\AMX Mod X 2008-12-21 19:09 . 2008-12-28 14:10 <DIR> d-------- c:\program files\CS2 . (((((((((((((((((((((((((((((((((((((((( Sekcja Find3M )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2009-01-19 16:51 --------- d-----w c:\program files\DC++ 2009-01-19 08:52 --------- d-----w c:\documents and settings\JA\Dane aplikacji\Skype 2009-01-19 08:51 --------- d-----w c:\documents and settings\JA\Dane aplikacji\skypePM 2009-01-17 15:28 --------- d-----w c:\documents and settings\adamo88\Dane aplikacji\Skype 2009-01-17 13:28 --------- d-----w c:\documents and settings\adamo88\Dane aplikacji\skypePM 2009-01-15 09:07 --------- d-----w c:\program files\DAEMON 2009-01-14 17:03 --------- d-----w c:\program files\Common Files\InstallShield 2009-01-14 16:57 --------- d-----w c:\program files\Kaspersky Lab 2009-01-06 10:07 --------- d-----w c:\program files\Opera 2008-12-31 17:06 --------- d--h--w c:\program files\InstallShield Installation Information 2008-12-16 21:31 --------- d-----w c:\program files\MoorHunt 2008-12-14 11:18 --------- d-----w c:\program files\Java 2008-12-08 12:13 --------- d-----w c:\program files\KERIO Firewall 2008-12-08 01:54 --------- d-----w c:\program files\DivX 2008-12-07 23:51 --------- d-----w c:\program files\GerbMagic 2008-12-07 23:51 --------- d-----w c:\program files\Design Explorer 99 SE 2008-12-07 23:49 --------- d-----w c:\program files\Common Files\Novell Shared 2008-12-04 21:39 --------- d-----w c:\program files\SpeedFan 2008-11-27 19:27 --------- d-----w c:\documents and settings\adamo88\Dane aplikacji\NeroDCTemplates 2008-11-25 22:36 --------- d-----w c:\program files\Wru 2008-11-24 21:44 --------- d-----w c:\program files\totalcmd 2008-11-23 21:33 --------- d-----w c:\program files\AC3Filter 2008-11-23 10:29 --------- d-----w c:\program files\Common Files\Adobe 2008-11-21 21:47 524,288 ----a-w c:\windows\system32\DivXsm.exe 2008-11-21 21:47 3,596,288 ----a-w c:\windows\system32\qt-dx331.dll 2008-11-21 21:46 200,704 ----a-w c:\windows\system32\ssldivx.dll 2008-11-21 21:46 1,044,480 ----a-w c:\windows\system32\libdivx.dll 2008-11-21 21:44 161,096 ----a-w c:\windows\system32\DivXCodecVersionChecker.exe 2008-11-21 21:44 12,288 ----a-w c:\windows\system32\DivXWMPExtType.dll 2008-11-10 04:43 410,984 ----a-w c:\windows\system32\deploytk.dll 2008-10-28 19:16 315,392 ----a-w c:\windows\HideWin.exe . ------- Sigcheck ------- 2008-05-08 19:02 361344 accf5a9a1ffaa490f33dba1c632b95e1 c:\windows\system32\drivers\tcpip.sys . ((((((((((((((((((((((((((((( snapshot@2008-11-11_21.23.22,85 ))))))))))))))))))))))))))))))))))))))))) . + 2008-12-16 21:34:06 68,608 ----a-w c:\windows\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll + 2008-12-16 21:34:10 72,192 ----a-w c:\windows\assembly\GAC_32\ISymWrapper\2.0.0.0__b03f5f7f11d50a3a\ISymWrapper.dll + 2008-12-16 21:34:10 4,308,992 ----a-w c:\windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\mscorlib.dll + 2008-12-16 21:34:11 482,304 ----a-w c:\windows\assembly\GAC_32\System.Data.OracleClient\2.0.0.0__b77a5c561934e089\System.Data.OracleClient.dll + 2008-12-16 21:34:08 2,878,976 ----a-w c:\windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll + 2008-12-16 21:34:04 258,048 ----a-w c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.dll + 2008-12-16 21:34:04 114,176 ----a-w c:\windows\assembly\GAC_32\System.EnterpriseServices\2.0.0.0__b03f5f7f11d50a3a\System.EnterpriseServices.Wrapper.dll + 2008-12-16 21:34:13 260,096 ----a-w c:\windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll + 2008-12-16 21:34:07 5,025,792 ----a-w c:\windows\assembly\GAC_32\System.Web\2.0.0.0__b03f5f7f11d50a3a\System.Web.dll + 2008-12-16 21:34:06 10,752 ----a-w c:\windows\assembly\GAC_MSIL\Accessibility\2.0.0.0__b03f5f7f11d50a3a\Accessibility.dll + 2008-12-16 21:34:04 503,808 ----a-w c:\windows\assembly\GAC_MSIL\AspNetMMCExt\2.0.0.0__b03f5f7f11d50a3a\AspNetMMCExt.dll + 2008-12-16 21:34:05 13,312 ----a-w c:\windows\assembly\GAC_MSIL\cscompmgd\8.0.0.0__b03f5f7f11d50a3a\cscompmgd.dll + 2008-12-16 21:34:09 8,192 ----a-w c:\windows\assembly\GAC_MSIL\IEExecRemote\2.0.0.0__b03f5f7f11d50a3a\IEExecRemote.dll + 2008-12-16 21:34:10 36,864 ----a-w c:\windows\assembly\GAC_MSIL\IEHost\2.0.0.0__b03f5f7f11d50a3a\IEHost.dll + 2008-12-16 21:34:10 5,632 ----a-w c:\windows\assembly\GAC_MSIL\IIEHost\2.0.0.0__b03f5f7f11d50a3a\IIEHost.dll + 2008-12-16 21:34:05 413,696 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Engine\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Engine.dll + 2008-12-16 21:34:05 36,864 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Framework\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Framework.dll + 2008-12-16 21:34:06 647,168 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Tasks\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Tasks.dll + 2008-12-16 21:34:06 73,728 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.Build.Utilities\2.0.0.0__b03f5f7f11d50a3a\Microsoft.Build.Utilities.dll + 2008-12-16 21:34:05 745,472 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.JScript\8.0.0.0__b03f5f7f11d50a3a\Microsoft.JScript.dll + 2008-12-16 21:34:13 110,592 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility.Data\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.Data.dll + 2008-12-16 21:34:13 372,736 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Compatibility\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Compatibility.dll + 2008-12-16 21:34:02 28,672 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.Vsa.dll + 2008-12-16 21:34:13 667,648 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualBasic\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll + 2008-12-16 21:34:13 5,632 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.VisualC\8.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualC.Dll + 2008-12-16 21:34:04 12,800 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.Vsa.Vb.CodeDOMProcessor\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.Vb.CodeDOMProcessor.dll + 2008-12-16 21:34:03 32,768 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft.Vsa\8.0.0.0__b03f5f7f11d50a3a\Microsoft.Vsa.dll + 2008-12-16 21:34:03 7,168 ----a-w c:\windows\assembly\GAC_MSIL\Microsoft_VsaVb\8.0.0.0__b03f5f7f11d50a3a\Microsoft_VsaVb.dll + 2008-12-16 21:34:12 110,592 ----a-w c:\windows\assembly\GAC_MSIL\sysglobl\2.0.0.0__b03f5f7f11d50a3a\sysglobl.dll + 2008-12-16 21:34:06 81,920 ----a-w c:\windows\assembly\GAC_MSIL\System.Configuration.Install\2.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll + 2008-12-16 21:34:12 389,120 ----a-w c:\windows\assembly\GAC_MSIL\System.Configuration\2.0.0.0__b03f5f7f11d50a3a\System.configuration.dll + 2008-12-16 21:34:11 716,800 ----a-w c:\windows\assembly\GAC_MSIL\System.Data.SqlXml\2.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll + 2008-12-16 21:34:05 884,736 ----a-w c:\windows\assembly\GAC_MSIL\System.Deployment\2.0.0.0__b03f5f7f11d50a3a\System.Deployment.dll + 2008-12-16 21:34:09 5,050,368 ----a-w c:\windows\assembly\GAC_MSIL\System.Design\2.0.0.0__b03f5f7f11d50a3a\System.Design.dll + 2008-12-16 21:34:07 188,416 ----a-w c:\windows\assembly\GAC_MSIL\System.DirectoryServices.Protocols\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.Protocols.dll + 2008-12-16 21:34:07 397,312 ----a-w c:\windows\assembly\GAC_MSIL\System.DirectoryServices\2.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll + 2008-12-16 21:34:07 81,920 ----a-w c:\windows\assembly\GAC_MSIL\System.Drawing.Design\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.Design.dll + 2008-12-16 21:34:12 700,416 ----a-w c:\windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll + 2008-12-16 21:34:11 368,640 ----a-w c:\windows\assembly\GAC_MSIL\System.Management\2.0.0.0__b03f5f7f11d50a3a\System.Management.dll + 2008-12-16 21:34:12 258,048 ----a-w c:\windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\System.Messaging.dll + 2008-12-16 21:34:11 299,008 ----a-w c:\windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll + 2008-12-16 21:34:11 131,072 ----a-w c:\windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap\2.0.0.0__b03f5f7f11d50a3a\System.Runtime.Serialization.Formatters.Soap.dll + 2008-12-16 21:34:06 258,048 ----a-w c:\windows\assembly\GAC_MSIL\System.Security\2.0.0.0__b03f5f7f11d50a3a\System.Security.dll + 2008-12-16 21:34:07 114,688 ----a-w c:\windows\assembly\GAC_MSIL\System.ServiceProcess\2.0.0.0__b03f5f7f11d50a3a\System.ServiceProcess.dll + 2008-12-16 21:34:13 835,584 ----a-w c:\windows\assembly\GAC_MSIL\System.Web.Mobile\2.0.0.0__b03f5f7f11d50a3a\System.Web.Mobile.dll + 2008-12-16 21:34:07 86,016 ----a-w c:\windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\System.Web.RegularExpressions.dll + 2008-12-16 21:34:08 823,296 ----a-w c:\windows\assembly\GAC_MSIL\System.Web.Services\2.0.0.0__b03f5f7f11d50a3a\System.Web.Services.dll + 2008-12-16 21:34:08 5,316,608 ----a-w c:\windows\assembly\GAC_MSIL\System.Windows.Forms\2.0.0.0__b77a5c561934e089\System.Windows.Forms.dll + 2008-12-16 21:34:08 2,035,712 ----a-w c:\windows\assembly\GAC_MSIL\System.Xml\2.0.0.0__b77a5c561934e089\System.XML.dll + 2008-12-16 21:34:12 3,018,752 ----a-w c:\windows\assembly\GAC_MSIL\System\2.0.0.0__b77a5c561934e089\System.dll + 2008-12-17 09:55:10 26,624 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Accessibility\fdce489c4d2f7e4cbb9ec42b63ad799d\Accessibility.ni.dll + 2008-12-17 09:55:12 860,160 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\AspNetMMCExt\[u]0[/u]9a3d55447dd1f40b759186b0231b0d4\AspNetMMCExt.ni.dll + 2008-12-17 09:55:13 237,568 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\b593088ff315b64d8410c7d90e29e1ba\CustomMarshalers.ni.dll + 2008-12-17 09:55:12 15,360 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\dfsvc\265bd50fdbf8654984a85ba323917015\dfsvc.ni.exe + 2008-12-17 09:55:14 880,640 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\2f44407771641a4da9c636dc2900092f\Microsoft.Build.Engine.ni.dll + 2008-12-17 09:55:15 81,920 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Fra#\8c0acc4bc563ba43a8e5cbd7397bb026\Microsoft.Build.Framework.ni.dll + 2008-12-17 09:55:18 1,691,648 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Tas#\efda6394d2a2734ea6f9b1861d2ff187\Microsoft.Build.Tasks.ni.dll + 2008-12-17 09:55:18 163,840 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Uti#\88885a29fb3d83439e63733c8d2d5b19\Microsoft.Build.Utilities.ni.dll + 2008-12-17 09:55:20 1,724,416 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\Microsoft.VisualBas#\e1af7bc7e34a314fbf6dab4ccb9b1df3\Microsoft.VisualBasic.ni.dll + 2008-12-16 21:34:52 11,415,552 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\mscorlib\de79476966ce1447911039f5476b26af\mscorlib.ni.dll + 2008-12-17 09:55:22 962,560 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\6d7b68f544ee5049a7f1b5c43ac49271\System.Configuration.ni.dll + 2008-12-16 21:36:27 6,688,768 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Data\aca8c66b3b3cba4b8e2e05fdc2663bc2\System.Data.ni.dll + 2008-12-17 09:55:23 1,712,128 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Deployment\67c77b50536e8344acc0e7d018c95cd7\System.Deployment.ni.dll + 2008-12-16 21:36:50 10,723,328 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Design\558d4e0f8a552f42bfee68a30f481b85\System.Design.ni.dll + 2008-12-17 09:55:26 512,000 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\4c7a04acee66c34e84b60daffb8af1a4\System.DirectoryServices.Protocols.ni.dll + 2008-12-17 09:55:25 1,220,608 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\c93f15ccb111834c96be07099f8454d3\System.DirectoryServices.ni.dll + 2008-12-16 21:35:18 229,376 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing.Desi#\a210a0ceed200c4184ef9be3905c0a76\System.Drawing.Design.ni.dll + 2008-12-16 21:35:22 1,626,112 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\26c9db6057bfe442a9a4786d87ac75ef\System.Drawing.ni.dll + 2008-12-17 09:55:27 659,456 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\3d07406d56abcb4499e1ef5d5106f794\System.EnterpriseServices.ni.dll + 2008-12-17 09:55:27 294,912 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\3d07406d56abcb4499e1ef5d5106f794\System.EnterpriseServices.Wrapper.dll + 2008-12-17 09:55:28 729,088 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Security\3ba63967b7df3d43a9145d95d62da204\System.Security.ni.dll + 2008-12-17 09:55:30 684,032 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\cb532587a90fd5458e6a1b5c380aee4b\System.Transactions.ni.dll + 2008-12-17 09:55:50 2,310,144 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Mobile\820d4e8397aaae43ab706319c9e48eb8\System.Web.Mobile.ni.dll + 2008-12-17 09:55:50 237,568 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.RegularE#\280af6b332a77c49866b4a8b517c35aa\System.Web.RegularExpressions.ni.dll + 2008-12-17 09:55:53 1,945,600 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web.Services\a19781564e51bc4b98d33307195e0b8d\System.Web.Services.ni.dll + 2008-12-17 09:55:46 11,808,768 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Web\cdff5a129f3dfe488e9c711a8d759939\System.Web.ni.dll + 2008-12-16 21:35:50 13,107,200 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\a4c19d45edd8c645b56239e52146428b\System.Windows.Forms.ni.dll + 2008-12-16 21:36:08 5,640,192 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System.Xml\79e6f203c194044984b448560c3ff192\System.Xml.ni.dll + 2008-12-16 21:35:16 8,093,696 ----a-w c:\windows\assembly\NativeImages_v2.0.50727_32\System\73205621cc1c8c42a9c28d655e175071\System.ni.dll + 2005-10-20 16:00:28 157,696 ----a-w c:\windows\ERUNT\ERUNT.EXE + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX\ERDNT.EXE + 2009-01-19 21:40:27 385,024 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000001\NTUSER.DAT + 2009-01-19 21:40:27 8,192 ----a-w c:\windows\ERUNT\SDFIX\Users\[u]0[/u]0000002\UsrClass.dat + 2008-08-07 14:27:04 163,328 ----a-w c:\windows\ERUNT\SDFIX_First_Run\ERDNT.EXE + 2008-11-11 21:29:50 2,322,432 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000001\NTUSER.DAT + 2008-11-11 21:29:50 36,864 ----a-w c:\windows\ERUNT\SDFIX_First_Run\Users\[u]0[/u]0000002\UsrClass.dat + 2008-11-16 18:44:15 15,086 ----a-r c:\windows\Installer\{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}\ARPPRODUCTICON.exe + 2008-11-16 18:44:15 65,536 ----a-r c:\windows\Installer\{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}\LightScribeWebsite_9607541794D946E89D5752F753E35CC4.exe + 2008-11-16 18:44:15 323,584 ----a-r c:\windows\Installer\{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}\NewShortcut1_C673DF680CDE41FC9DFBF63D31DE4F28.exe + 2008-11-16 18:44:15 339,968 ----a-r c:\windows\Installer\{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}\NewShortcut1_FE82206EF6124B479F4EDD27A1E056A4.exe + 2008-11-16 18:44:15 323,584 ----a-r c:\windows\Installer\{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}\NewShortcut2_C673DF680CDE41FC9DFBF63D31DE4F28.exe + 2008-11-16 18:44:15 65,536 ----a-r c:\windows\Installer\{0E7DBD52-B097-4F2B-A7C7-F105B0D20FDB}\QuickDemoUrl_E9752251A5AD4678977047FD65566D18.exe + 2008-11-16 16:51:18 1,165,584 ----a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\accicons.exe + 2008-11-16 16:51:18 20,240 ----a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\cagicon.exe + 2008-11-16 16:51:18 159,504 ----a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\inficon.exe + 2008-11-16 16:51:18 184,080 ----a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\joticon.exe + 2008-11-16 16:51:18 217,864 ----a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\misc.exe + 2008-11-16 16:51:18 18,704 ----a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\mspicons.exe + 2008-11-16 16:51:19 35,088 ----a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\oisicon.exe + 2008-11-16 16:51:18 845,584 ----a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\outicon.exe + 2008-11-16 16:51:18 922,384 ----a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pptico.exe + 2008-11-16 16:51:18 272,648 ----a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\pubs.exe + 2008-11-16 16:51:19 888,080 ----a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\wordicon.exe + 2008-11-16 16:51:18 1,172,240 ----a-r c:\windows\Installer\{90120000-0030-0000-0000-0000000FF1CE}\xlicons.exe + 2008-11-16 16:40:28 217,864 ----a-r c:\windows\Installer\{90120000-006E-0415-0000-0000000FF1CE}\misc.exe + 2005-09-23 06:28:52 72,704 ----a-w c:\windows\Microsoft.NET\Framework\NETFXSBS10.exe + 2005-09-23 06:29:04 5,120 ----a-w c:\windows\Microsoft.NET\Framework\sbs_diasymreader.dll + 2005-09-23 06:29:04 5,120 ----a-w c:\windows\Microsoft.NET\Framework\sbs_iehost.dll + 2005-09-23 06:29:04 5,120 ----a-w c:\windows\Microsoft.NET\Framework\sbs_microsoft.jscript.dll + 2005-09-23 06:29:04 5,632 ----a-w c:\windows\Microsoft.NET\Framework\sbs_microsoft.vsa.vb.codedomprocessor.dll + 2005-09-23 06:29:04 5,120 ----a-w c:\windows\Microsoft.NET\Framework\sbs_mscordbi.dll + 2005-09-23 06:29:04 5,120 ----a-w c:\windows\Microsoft.NET\Framework\sbs_mscorrc.dll + 2005-09-23 06:29:04 5,120 ----a-w c:\windows\Microsoft.NET\Framework\sbs_mscorsec.dll + 2005-09-23 06:29:04 5,120 ----a-w c:\windows\Microsoft.NET\Framework\sbs_system.configuration.install.dll + 2005-09-23 06:29:04 5,120 ----a-w c:\windows\Microsoft.NET\Framework\sbs_system.data.dll + 2005-09-23 06:29:04 5,120 ----a-w c:\windows\Microsoft.NET\Framework\sbs_system.enterpriseservices.dll + 2005-09-23 06:29:04 5,120 ----a-w c:\windows\Microsoft.NET\Framework\sbs_VsaVb7rt.dll + 2005-09-23 06:29:04 5,120 ----a-w c:\windows\Microsoft.NET\Framework\sbs_wminet_utils.dll + 2005-09-23 06:28:52 7,680 ----a-w c:\windows\Microsoft.NET\Framework\sbscmp10.dll + 2005-09-23 06:28:56 7,680 ----a-w c:\windows\Microsoft.NET\Framework\sbscmp20_mscorwks.dll + 2005-09-23 06:28:58 7,680 ----a-w c:\windows\Microsoft.NET\Framework\sbscmp20_perfcounter.dll + 2005-09-23 06:28:56 7,680 ----a-w c:\windows\Microsoft.NET\Framework\SharedReg12.dll + 2005-09-23 06:28:52 86,528 ----a-w c:\windows\Microsoft.NET\Framework\v1.0.3705\mscormmc.dll + 2005-09-23 06:28:36 18,944 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\alinkui.dll + 2005-09-23 06:28:42 136,192 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\cscompui.dll + 2005-09-23 06:28:44 4,608 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\CvtResUI.dll + 2005-09-23 06:29:04 183,808 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\vbc7ui.dll + 2005-09-23 06:28:28 208,896 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\1033\Vsavb7rtUI.dll + 2005-09-23 06:28:56 10,752 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Accessibility.dll + 2005-09-23 06:28:58 138,240 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\AdoNetDiag.dll + 2005-09-23 06:28:36 87,552 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\alink.dll + 2005-09-23 06:28:58 55,488 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\AppLaunch.exe + 2005-09-23 06:28:32 36,864 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe + 2005-09-23 06:28:32 10,752 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_filter.dll + 2005-09-23 06:28:32 8,192 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_isapi.dll + 2005-09-23 06:28:32 23,552 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Aspnet_perf.dll + 2005-09-23 06:28:32 70,656 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_rc.dll + 2005-09-23 06:28:32 13,824 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe + 2005-09-23 06:28:32 26,824 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe + 2005-09-23 06:28:32 106,496 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe + 2005-09-23 06:28:32 29,896 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe + 2005-09-23 06:28:32 29,888 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe + 2005-09-23 06:28:32 503,808 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\AspNetMMCExt.dll + 2005-09-23 06:28:56 106,496 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\CasPol.exe + 2005-09-23 06:28:56 88,576 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\CORPerfMonExt.dll + 2005-09-23 06:28:42 76,984 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\csc.exe + 2005-09-23 06:28:42 1,144,832 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\cscomp.dll + 2005-09-23 06:28:42 13,312 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\cscompmgd.dll + 2005-09-23 06:28:58 17,920 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Culture.dll + 2005-09-23 06:28:56 68,608 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\CustomMarshalers.dll + 2005-09-23 06:28:44 31,936 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe + 2005-09-23 06:28:38 52,736 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\dfdll.dll + 2005-09-23 06:28:38 4,608 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe + 2005-09-23 06:29:12 547,840 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\diasymreader.dll + 2005-09-23 06:28:56 788,992 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\EventLogMessages.dll + 2005-09-23 06:28:50 9,216 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\fusion.dll + 2005-09-23 06:28:56 9,728 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExec.exe + 2005-09-23 06:28:56 8,192 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IEExecRemote.dll + 2005-09-23 06:28:56 36,864 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IEHost.dll + 2005-09-23 06:28:56 5,632 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\IIEHost.dll + 2005-09-23 06:28:56 224,952 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ilasm.exe + 2005-09-23 06:28:56 28,672 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe + 2005-09-23 06:28:56 55,296 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\InstallUtilLib.dll + 2005-09-23 06:28:56 72,192 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ISymWrapper.dll + 2005-09-23 06:28:48 40,960 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe + 2005-09-23 06:01:16 609,472 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe + 2005-09-23 05:29:48 80,896 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1025.dll + 2005-09-23 05:32:24 80,896 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1028.dll + 2005-09-23 05:34:10 82,944 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1029.dll + 2005-09-23 05:34:12 81,920 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1030.dll + 2005-09-23 05:34:44 85,504 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1031.dll + 2005-09-23 05:36:24 87,552 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1032.dll + 2005-09-23 02:46:14 80,896 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1033.dll + 2005-09-23 05:38:26 81,408 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1035.dll + 2005-09-23 05:38:52 86,016 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1036.dll + 2005-09-23 05:40:30 80,896 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1037.dll + 2005-09-23 05:40:32 83,968 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1038.dll + 2005-09-23 05:40:56 84,480 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1040.dll + 2005-09-23 05:42:58 80,896 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1041.dll + 2005-09-23 05:44:58 80,896 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1042.dll + 2005-09-23 05:46:38 83,456 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1043.dll + 2005-09-23 05:46:38 81,920 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1044.dll + 2005-09-23 05:46:40 83,456 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1045.dll + 2005-09-23 05:47:04 82,432 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1046.dll + 2005-09-23 05:47:30 82,432 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1049.dll + 2005-09-23 05:47:32 81,920 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1053.dll + 2005-09-23 05:47:32 80,896 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.1055.dll + 2005-09-23 05:30:18 80,896 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.2052.dll + 2005-09-23 05:47:06 84,480 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.2070.dll + 2005-09-23 05:29:50 80,896 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.3076.dll + 2005-09-23 05:36:48 85,504 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.res.3082.dll + 2005-09-23 06:57:06 245,408 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\unicows.dll + 2005-09-23 06:28:48 413,696 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Engine.dll + 2005-09-23 06:28:48 36,864 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Framework.dll + 2005-09-23 06:28:48 647,168 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Tasks.dll + 2005-09-23 06:28:48 73,728 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Build.Utilities.dll + 2005-09-23 06:28:48 745,472 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.JScript.dll + 2005-09-23 06:29:10 110,592 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.Data.dll + 2005-09-23 06:29:10 372,736 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Compatibility.dll + 2005-09-23 06:29:08 667,648 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.dll + 2005-09-23 06:28:30 28,672 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualBasic.Vsa.dll + 2005-09-23 06:29:10 5,632 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.VisualC.Dll + 2005-09-23 06:28:30 32,768 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.dll + 2005-09-23 06:28:30 12,800 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft.Vsa.Vb.CodeDOMProcessor.dll + 2005-09-23 06:28:30 7,168 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\Microsoft_VsaVb.dll + 2005-09-23 06:28:32 87,552 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\MmcAspExt.dll + 2005-09-23 06:28:48 69,632 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe + 2005-09-23 06:28:56 800,768 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordacwks.dll + 2005-09-23 06:28:56 73,216 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordbc.dll + 2005-09-23 06:28:56 288,768 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscordbi.dll + 2005-09-23 06:28:56 36,864 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorie.dll + 2005-09-23 06:28:56 326,144 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorjit.dll + 2005-09-23 06:28:56 81,408 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorld.dll + 2005-09-23 06:28:56 4,308,992 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorlib.dll + 2005-09-23 06:28:56 102,400 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorpe.dll + 2005-09-23 06:29:00 330,752 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll + 2005-09-23 06:28:56 67,072 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsec.dll + 2005-09-23 06:28:50 9,216 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsn.dll + 2005-09-23 06:28:56 226,816 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvc.dll + 2005-09-23 06:28:56 66,240 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe + 2005-09-23 06:28:56 10,240 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscortim.dll + 2005-09-23 06:28:50 5,615,616 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll + 2005-09-23 06:29:00 22,528 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\MUI\[u]0[/u]409\mscorsecr.dll + 2005-09-23 06:28:56 96,440 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ngen.exe + 2005-09-23 06:28:56 14,848 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\normalization.dll + 2005-09-23 06:28:56 78,336 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\PerfCounter.dll + 2005-09-23 06:28:50 136,192 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\peverify.dll + 2005-09-23 06:28:56 53,248 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe + 2005-09-23 06:28:56 32,768 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe + 2005-09-23 06:29:02 59,072 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\regtlibv12.exe + 2005-09-23 06:28:58 7,680 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\sbscmp20_mscorlib.dll + 2005-09-23 06:28:56 107,520 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\shfusion.dll + 2005-09-23 06:29:00 85,504 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\ShFusRes.dll + 2005-09-23 06:28:56 377,344 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\SOS.dll + 2005-09-23 06:28:56 110,592 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\sysglobl.dll + 2005-09-23 06:28:58 389,120 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.configuration.dll + 2005-09-23 06:28:56 81,920 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Configuration.Install.dll + 2005-09-23 06:28:56 2,878,976 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.dll + 2005-09-23 06:28:56 482,304 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.OracleClient.dll + 2005-09-23 06:28:56 716,800 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Data.SqlXml.dll + 2005-09-23 06:28:38 884,736 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Deployment.dll + 2005-09-23 06:28:56 5,050,368 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Design.dll + 2005-09-23 06:28:56 397,312 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.dll + 2005-09-23 06:28:56 188,416 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.DirectoryServices.Protocols.dll + 2005-09-23 06:28:56 3,018,752 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.dll + 2005-09-23 06:28:56 81,920 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.Design.dll + 2005-09-23 06:28:56 700,416 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Drawing.dll + 2005-09-23 06:28:56 258,048 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.dll + 2005-09-23 06:28:56 47,616 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Thunk.dll + 2005-09-23 06:28:56 114,176 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.EnterpriseServices.Wrapper.dll + 2005-09-23 06:28:56 368,640 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Management.dll + 2005-09-23 06:28:56 258,048 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Messaging.dll + 2005-09-23 06:28:56 299,008 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Remoting.dll + 2005-09-23 06:28:56 131,072 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Runtime.Serialization.Formatters.Soap.dll + 2005-09-23 06:28:56 258,048 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Security.dll + 2005-09-23 06:28:56 114,688 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.ServiceProcess.dll + 2005-09-23 06:28:56 260,096 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Transactions.dll + 2005-09-23 06:28:56 5,025,792 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.dll + 2005-09-23 06:28:56 835,584 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.Mobile.dll + 2005-09-23 06:28:56 86,016 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.RegularExpressions.dll + 2005-09-23 06:28:56 823,296 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Web.Services.dll + 2005-09-23 06:28:56 5,316,608 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.Windows.Forms.dll + 2005-09-23 06:28:56 2,035,712 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\System.XML.dll + 2005-09-23 06:28:56 71,680 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\TLBREF.DLL + 2005-09-23 06:29:06 1,140,920 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe + 2005-09-23 06:28:30 1,306,624 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\VsaVb7rt.dll + 2005-09-23 06:28:32 298,496 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\webengine.dll + 2005-09-23 06:28:56 28,160 ----a-w c:\windows\Microsoft.NET\Framework\v2.0.50727\WMINet_Utils.dll - 2000-08-31 07:00:00 28,672 ----a-w c:\windows\NIRCMD.exe + 2000-08-31 07:00:00 29,696 ----a-w c:\windows\NIRCMD.exe + 1997-04-09 20:31:22 20,768 ----a-w c:\windows\system32\CKLDRV.sys + 1997-10-09 12:33:54 240,128 ----a-w c:\windows\system32\CkRfresh.exe - 2008-10-28 19:12:04 16,384 --sha-w c:\windows\system32\config\systemprofile\Cookies\index.dat + 2009-01-14 10:38:07 16,384 --sha-w c:\windows\system32\config\systemprofile\Cookies\index.dat - 2008-10-28 19:12:04 32,768 --sha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat + 2009-01-14 10:38:07 32,768 --sha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Historia\History.IE5\index.dat - 2008-10-28 19:12:04 32,768 --sha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat + 2009-01-14 10:38:07 32,768 --sha-w c:\windows\system32\config\systemprofile\Ustawienia lokalne\Temporary Internet Files\Content.IE5\index.dat + 1997-04-09 21:04:50 50,176 ----a-w c:\windows\system32\CrypServ.exe + 2006-03-31 11:40:58 2,388,176 ----a-w c:\windows\system32\d3dx9_30.dll + 2005-09-23 06:28:38 83,456 ----a-w c:\windows\system32\dfshim.dll - 2008-09-16 00:11:56 683,520 ----a-w c:\windows\system32\DivX.dll + 2008-11-21 21:45:06 684,032 ----a-w c:\windows\system32\DivX.dll - 2008-09-16 00:11:58 823,296 ----a-w c:\windows\system32\divx_xx07.dll + 2008-11-21 21:45:08 823,296 ----a-w c:\windows\system32\divx_xx07.dll - 2008-09-16 00:11:58 815,104 ----a-w c:\windows\system32\divx_xx0a.dll + 2008-11-21 21:45:08 815,104 ----a-w c:\windows\system32\divx_xx0a.dll - 2008-09-16 00:11:58 823,296 ----a-w c:\windows\system32\divx_xx0c.dll + 2008-11-21 21:45:08 823,296 ----a-w c:\windows\system32\divx_xx0c.dll - 2008-09-16 00:11:58 802,816 ----a-w c:\windows\system32\divx_xx11.dll + 2008-11-21 21:45:08 802,816 ----a-w c:\windows\system32\divx_xx11.dll + 2008-04-13 23:15:36 15,104 -c--a-w c:\windows\system32\dllcache\usbscan.sys - 2008-09-16 00:12:02 81,920 ----a-w c:\windows\system32\dpl100.dll + 2008-11-21 21:45:16 81,920 ----a-w c:\windows\system32\dpl100.dll - 2008-09-16 00:12:00 294,912 ----a-w c:\windows\system32\dpu10.dll + 2008-11-21 21:45:12 294,912 ----a-w c:\windows\system32\dpu10.dll - 2008-09-16 00:12:00 294,912 ----a-w c:\windows\system32\dpu11.dll + 2008-11-21 21:45:12 294,912 ----a-w c:\windows\system32\dpu11.dll - 2008-09-16 00:12:00 53,248 ----a-w c:\windows\system32\dpuGUI10.dll + 2008-11-21 21:45:12 53,248 ----a-w c:\windows\system32\dpuGUI10.dll - 2008-09-16 00:12:00 593,920 ----a-w c:\windows\system32\dpuGUI11.dll + 2008-11-21 21:45:12 593,920 ----a-w c:\windows\system32\dpuGUI11.dll - 2008-09-16 00:12:00 344,064 ----a-w c:\windows\system32\dpus11.dll + 2008-11-21 21:45:12 344,064 ----a-w c:\windows\system32\dpus11.dll - 2008-09-16 00:12:00 57,344 ----a-w c:\windows\system32\dpv11.dll + 2008-11-21 21:45:12 57,344 ----a-w c:\windows\system32\dpv11.dll + 2005-03-21 14:39:16 270,336 ----a-w c:\windows\system32\drivers\fwdrv.sys + 2008-11-16 16:29:24 685,816 ----a-w c:\windows\system32\drivers\sptd.sys + 2008-04-13 23:15:36 15,104 ----a-w c:\windows\system32\drivers\usbscan.sys + 2005-06-13 09:03:12 60,768 ----a-w c:\windows\system32\drivers\w800bus.sys + 2005-06-13 09:08:30 6,144 ----a-w c:\windows\system32\drivers\w800cm.sys + 2005-06-13 09:08:30 6,144 ----a-w c:\windows\system32\drivers\w800cmnt.sys + 2005-06-13 09:05:08 9,264 ----a-w c:\windows\system32\drivers\w800mdfl.sys + 2005-06-13 09:05:16 96,224 ----a-w c:\windows\system32\drivers\w800mdm.sys + 2005-06-13 09:06:58 87,792 ----a-w c:\windows\system32\drivers\w800mgmt.sys + 2005-06-13 09:08:36 85,664 ----a-w c:\windows\system32\drivers\w800obex.sys + 2005-06-13 09:03:06 5,744 ----a-w c:\windows\system32\drivers\w800wh.sys + 2005-06-13 09:03:06 5,744 ----a-w c:\windows\system32\drivers\w800whnt.sys - 2008-09-16 00:12:02 196,608 ----a-w c:\windows\system32\dtu100.dll + 2008-11-21 21:45:16 196,608 ----a-w c:\windows\system32\dtu100.dll + 2006-10-26 13:10:08 1,190,688 ----a-w c:\windows\system32\FM20.DLL + 2006-10-26 12:10:06 33,088 ----a-w c:\windows\system32\FM20ENU.DLL - 2008-10-28 19:11:12 93,480 ----a-w c:\windows\system32\FNTCACHE.DAT + 2008-11-17 09:00:49 188,200 ----a-w c:\windows\system32\FNTCACHE.DAT + 1996-04-03 19:33:26 5,248 ----a-w c:\windows\system32\giveio.sys + 2004-06-22 19:06:00 1,040,384 ----a-w c:\windows\system32\GnucCOM.dll + 1998-09-21 11:45:28 177,152 ----a-w c:\windows\system32\hdk3an32.dll + 1997-08-27 19:34:22 172,544 ----a-w c:\windows\system32\hdk3anim.dll + 1997-05-27 01:35:46 82,944 ----a-w c:\windows\system32\hdk3cr32.dll + 1997-05-27 01:35:02 82,944 ----a-w c:\windows\system32\hdk3cryp.dll + 1998-11-16 18:40:00 284,160 ----a-w c:\windows\system32\hdk3ct32.dll + 1997-08-15 01:17:46 241,664 ----a-w c:\windows\system32\hdk3ctnt.dll + 1998-04-15 15:56:22 29,696 ----a-w c:\windows\system32\hdk3ht32.dll + 2008-07-04 09:23:36 1,757,184 ----a-w c:\windows\system32\imagX7.dll + 2008-07-04 09:23:38 497,296 ----a-w c:\windows\system32\imagXpr7.dll + 2008-07-04 09:23:42 258,048 ----a-w c:\windows\system32\imagXR7.dll + 2008-07-04 09:23:46 802,816 ----a-w c:\windows\system32\imagXRA7.dll + 2006-10-26 12:45:04 207,360 ----a-w c:\windows\system32\INKED.DLL + 2008-11-10 04:43:37 144,792 ----a-w c:\windows\system32\java.exe + 2008-11-10 04:43:38 144,792 ----a-w c:\windows\system32\javaw.exe + 2008-11-10 04:43:39 148,888 ----a-w c:\windows\system32\javaws.exe + 2005-09-23 06:28:52 270,848 ----a-w c:\windows\system32\mscoree.dll + 2005-09-23 06:28:52 150,016 ----a-w c:\windows\system32\mscorier.dll + 2005-09-23 06:28:52 74,240 ----a-w c:\windows\system32\mscories.dll + 1998-04-24 18:40:18 330,000 ----a-w c:\windows\system32\MSEXCH35.DLL + 1998-04-24 18:40:18 250,128 ----a-w c:\windows\system32\MSEXCL35.DLL + 1998-04-24 18:40:20 1,045,776 ----a-w c:\windows\system32\MSJET35.DLL + 1996-11-15 02:01:00 33,552 ----a-w c:\windows\system32\MSJINT32.DLL + 1998-04-24 18:40:24 123,664 ----a-w c:\windows\system32\MSJINT35.DLL + 1998-04-22 23:00:00 1,233,680 ----a-w c:\windows\system32\Msjt4jlt.dll + 1996-11-15 02:01:00 98,356 ----a-w c:\windows\system32\MSJTER32.DLL + 1998-04-24 18:40:20 24,848 ----a-w c:\windows\system32\MSJTER35.DLL + 1998-04-24 18:40:20 166,160 ----a-w c:\windows\system32\MSLTUS35.DLL + 1998-04-24 18:40:20 250,128 ----a-w c:\windows\system32\MSPDOX35.DLL + 1998-04-24 18:40:20 252,176 ----a-w c:\windows\system32\MSRD2X35.DLL + 1998-04-24 18:40:22 407,312 ----a-w c:\windows\system32\MSREPL35.DLL + 2006-07-24 09:50:38 125,744 ----a-w c:\windows\system32\MSSTDFMT.DLL + 1998-04-24 18:40:22 165,648 ----a-w c:\windows\system32\MSTEXT35.DLL + 1998-04-24 18:40:22 287,504 ----a-w c:\windows\system32\MSXBSE35.DLL + 2003-04-18 15:46:22 1,233,920 ----a-w c:\windows\system32\msxml4.dll + 2003-04-18 15:29:26 82,432 ----a-w c:\windows\system32\msxml4r.dll + 2005-09-23 06:29:00 6,144 ----a-w c:\windows\system32\mui\[u]0[/u]409\mscorees.dll + 2005-09-23 06:28:56 32,768 ----a-w c:\windows\system32\netfxperf.dll + 1994-03-30 23:00:00 86,800 ----a-w c:\windows\system32\ODBCINST.DLL + 1998-05-31 14:58:14 72,704 ----a-w c:\windows\system32\Odbctl32.dll - 2008-10-28 19:13:25 39,992 ----a-w c:\windows\system32\perfc009.dat + 2008-12-16 21:36:55 58,596 ----a-w c:\windows\system32\perfc009.dat - 2008-10-28 19:13:25 49,492 ----a-w c:\windows\system32\perfc015.dat + 2008-12-16 21:36:55 74,230 ----a-w c:\windows\system32\perfc015.dat - 2008-10-28 19:13:25 311,604 ----a-w c:\windows\system32\perfh009.dat + 2008-12-16 21:36:55 392,296 ----a-w c:\windows\system32\perfh009.dat - 2008-10-28 19:13:25 355,486 ----a-w c:\windows\system32\perfh015.dat + 2008-12-16 21:36:55 448,004 ----a-w c:\windows\system32\perfh015.dat + 2001-06-23 00:31:20 278,528 ----a-w c:\windows\system32\pncrt.dll + 1998-03-26 03:57:34 6,656 ----a-w c:\windows\system32\pndx5016.dll + 1998-05-12 19:36:44 5,632 ----a-w c:\windows\system32\pndx5032.dll + 2001-10-26 16:29:42 5,632 ----a-w c:\windows\system32\ptpusb.dll + 2008-04-14 21:50:46 159,232 ----a-w c:\windows\system32\ptpusd.dll + 2006-10-07 04:18:32 185,952 ----a-w c:\windows\system32\rmoc3260.dll + 2006-07-24 09:50:40 39,728 ----a-w c:\windows\system32\SCP32.DLL + 2006-09-24 13:28:46 5,248 ----a-w c:\windows\system32\speedfan.sys + 2006-03-17 14:49:46 368,640 ----a-w c:\windows\system32\twnlib4.dll + 2006-07-24 09:50:40 47,920 ----a-w c:\windows\system32\VBAME.DLL + 1998-05-17 23:00:00 368,912 ----a-w c:\windows\system32\Vbar332.dll + 2006-10-26 12:45:04 293,376 ----a-w c:\windows\system32\WISPTIS.EXE + 2009-01-19 21:52:03 16,384 ----atw c:\windows\temp\Perflib_Perfdata_718.dat + 2008-11-16 18:44:40 1,233,920 ----a-w c:\windows\WinSxS\x86_Microsoft.MSXML2_6bd6b9abf345378f_4.20.9818.0_x-ww_8ff50c5d\msxml4.dll + 2008-11-16 18:44:40 82,432 ----a-w c:\windows\WinSxS\x86_Microsoft.MSXML2R_6bd6b9abf345378f_4.1.0.0_x-ww_29c3ad6a\msxml4r.dll + 2006-10-26 12:40:34 95,744 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_6e805841\ATL80.dll + 2006-10-26 12:40:36 479,232 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcm80.dll + 2006-10-26 12:40:36 548,864 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcp80.dll + 2006-10-26 12:40:36 626,688 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_0de06acd\msvcr80.dll + 2006-10-26 12:40:36 1,093,632 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfc80.dll + 2006-10-26 12:40:36 1,079,808 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfc80u.dll + 2006-10-26 12:40:36 69,632 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfcm80.dll + 2006-10-26 12:40:36 57,344 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_dec6ddd2\mfcm80u.dll + 2006-10-26 12:40:36 40,960 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80CHS.dll + 2006-10-26 12:40:36 45,056 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80CHT.dll + 2006-10-26 12:40:36 65,536 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80DEU.dll + 2006-10-26 12:40:36 57,344 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ENU.dll + 2006-10-26 12:40:36 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ESP.dll + 2006-10-26 12:40:36 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80FRA.dll + 2006-10-26 12:40:36 61,440 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80ITA.dll + 2006-10-26 12:40:36 49,152 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80JPN.dll + 2006-10-26 12:40:36 49,152 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.42_x-ww_3415f6d0\mfc80KOR.dll + 2008-12-16 21:34:04 258,048 ----a-w c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.dll + 2008-12-16 21:34:04 114,176 ----a-w c:\windows\WinSxS\x86_System.EnterpriseServices_b03f5f7f11d50a3a_2.0.0.0_x-ww_7d5f3790\System.EnterpriseServices.Wrapper.dll . -- Migawka wyzerowana -- . ((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360] "Konnekt"="c:\program files\Konnekt\konnekt.exe" [2005-05-24 503808] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-10-07 13574144] "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2008-10-07 86016] "BigDog305"="c:\windows\VM305_STI.EXE" [2005-08-05 61440] "UnlockerAssistant"="c:\program files\Unlocker\UnlockerAssistant.exe" [2008-05-02 15872] "RivaTunerStartupDaemon"="c:\program files\RivaTuner v2.11\RivaTuner.exe" [2008-09-16 2715648] "RivaTuner"="c:\program files\RivaTuner v2.11\RivaTuner.exe" [2008-09-16 2715648] "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-10 136600] "RTHDCPL"="RTHDCPL.EXE" [2008-02-19 c:\windows\RTHDCPL.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "msacm.ac3filter"= ac3filter.acm [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Menu Start^Programy^Autostart^Adobe Gamma Loader.lnk] path=c:\documents and settings\All Users\Menu Start\Programy\Autostart\Adobe Gamma Loader.lnk backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] --a------ 2008-06-12 02:38 34672 c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager] --a------ 2008-08-14 07:58 611712 c:\program files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Pro Agent] --a------ 2007-09-06 14:08 136136 c:\program files\DAEMON\DTProAgent.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Gadu-Gadu] --a------ 2008-03-20 11:04 2127296 c:\program files\Gadu-Gadu\gg.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] --a------ 2006-10-27 00:47 31016 c:\program files\Office2007\Office12\GrooveMonitor.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] -ra------ 2008-09-29 17:57 21755688 c:\program files\Skype\Phone\Skype.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz] --a------ 2008-10-07 13:33 1630208 c:\windows\system32\nwiz.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\Konnekt\\konnekt.exe"= "i:\\Direct Connect\\DCPlusPlus.exe"= "c:\\instalki\\Direct Connect\\DCPlusPlus.exe"= "c:\\Program Files\\DC++\\DCPlusPlus.exe"= "c:\\Program Files\\CS\\hl.exe"= "c:\\Program Files\\Opera\\opera.exe"= "c:\\Program Files\\Common Files\\Adobe\\CS4ServiceManager\\CS4ServiceManager.exe"= "c:\\WINDOWS\\system32\\LEXPPS.EXE"= "c:\\Program Files\\Office2007\\Office12\\GROOVE.EXE"= "c:\\Program Files\\Skype\\Phone\\Skype.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "5353:TCP"= 5353:TCP:Adobe CSI CS4 R1 fwdrv;Firewall Driver;c:\windows\system32\drivers\fwdrv.sys [2005-03-21 270336] R3 LcSvrAuf;ELSA Auftragsverwaltungs Service;c:\elsawin\bin\LcSvrAuf.exe [2009-01-06 1306624] R3 ZSMC0305;A4 TECH PC Camera V;c:\windows\system32\drivers\usbVM305.sys [2008-10-29 391688] R4 LcSvrAdm;ELSA Administration Service;c:\elsawin\bin\LcSvrAdm.exe [2009-01-06 147456] R4 LcSvrDba;ELSA DBA Server;c:\elsawin\bin\LcSvrDba.exe [2009-01-06 241664] R4 LcSvrHis;ELSA Historie Server;c:\elsawin\bin\LcSvrHis.exe [2009-01-06 217088] R4 VSGate;ELSA Vaudis Service;c:\elsawin\bin\VSGate.exe [2009-01-06 81920] [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}] "c:\program files\Common Files\LightScribe\LSRunOnce.exe" . - - - - USUNIĘTO PUSTE WPISY - - - - MSConfigStartUp-AVP - c:\program files\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe . ------- Skan uzupełniający ------- . uStart Page = hxxp://www.wp.pl/ IE: E&ksportuj do programu Microsoft Excel - c:\progra~1\OFFICE~1\Office12\EXCEL.EXE/3000 Handler: vw-wi - {0F3C833F-FB28-40EA-8CB9-6A55B996C3F6} - c:\elsawin\bin\wiprot.dll . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2009-01-20 08:09:02 Windows 5.1.2600 Dodatek Service Pack 3 NTFS skanowanie ukrytych procesów ... skanowanie ukrytych wpisów autostartu ... HKLM\Software\Microsoft\Windows\CurrentVersion\Run BigDog305 = c:\windows\VM305_STI.EXE VIMICRO USB PC Camera (ZC0305)???????????????????0?????????@?????????????? skanowanie ukrytych plików ... skanowanie pomyślnie ukończone ukryte pliki: 0 ************************************************************************** . Czas ukończenia: 2009-01-20 8:10:26 ComboFix-quarantined-files.txt 2009-01-20 07:10:22 ComboFix2.txt 2008-11-11 20:24:02 Przed: 52 606 369 792 bajtów wolnych Po: 55,453,724,672 bajtów wolnych 593

**Posty:** 18165 · przez **wojtas** 20 Sty 2009, 18:04

1. Ściągnij OTMoveIt i go włacz i odpal go z opcji CleanUp

oraz skasuj folder C:\Qoobox
2. wykonaj optymalizację windowsa
3.sciagnij ATF_Cleaner
zaznacz
Windows Temp
All users Temp
Temporary internet files
Recycle Bin
i wcisnij EMPTY SELECTED
4.Wyłącz przywracanie systemu ( właściwości mój komputer-zakładka przywracanie - wyłącz przywracanie na wszystkich dyskach). Po chwili włącz je powrotem
5.Przeskanuj obszar mojego komputera http://www.kaspersky.pl/virusscanner.html (uruchom przez IE) Daj raport z niego na forum.

i tym:

FixIEDef.

**Posty:** 44 · przez **adamo88** 21 Sty 2009, 10:20

przeskanowalem kaspersky'm chyba z 15h trwalo :1:

skasowalem te zagrozenia

Kod: Zaznacz wszystko: Nazwa pliku Nazwa zagrożenia Liczba zagrożeń C:\instalki\od virusow\Kaspersky_Key_Finder_WM_Daniel0s.rar Zainfekowany: HackTool.MSIL.KKFinder.q 1 C:\instalki\od virusow\Sprawdzone_i_dzala.rar Zainfekowany: Trojan.Win32.Agent.rzw 1 C:\Program Files\Kaspersky Lab\Kaspersky Solution.exe Zainfekowany: Trojan.Win32.Agent.rzw 1 Wybrany obszar został przeskanowany.

a oto raport z FixIeDef

Kod: Zaznacz wszystko: ******************************************************************************** * * * FixIEDef Log * * Version 1.7.20.6773 * * * ******************************************************************************** Created at 09:16:56 on Wednesday, January 21, 2009 Time Zone : Logged On User : adamo88 Operating System : Microsoft Windows XP Professional Dodatek Service Pack 3 OS Version : 5.1.2600 System Langauge : Polish Keyboard Layout : Polish Processor : X86 Intel(R) Pentium(R) 4 CPU 2.80GHz System Drive : C:\ Windows Directory : C:\WINDOWS System Directory : C:\WINDOWS\system32 System Drive Type : Fixed System Drive Status : READY System Drive Label : System Drive Size : 100 GB System Drive Free : 52.8 GB Total Physical Memory: 1023 MB Free Physical Memory : 690 MB Total Page File : 1023 MB Free Page File : 2105 MB Total Virtual Memory : 2048 MB Free Virtual Memory : 1971 MB Boot State : Normal boot -------------------------------------------------------------------------------- !!! userinit.exe is Clean !!! -------------------------------------------------------------------------------- !!! Files that have been deleted !!! No malicious files found -------------------------------------------------------------------------------- !!! Directories that have been removed !!! No malicious directories to be removed -------------------------------------------------------------------------------- !!! Registry entries that have been removed !!! No malicious Registry entries found ================================================================================ All Done :) ShadowPuterDude Safe Surfing!!!

**Posty:** 18165 · przez **wojtas** 21 Sty 2009, 15:45

jest ok

Autor postu otrzymał pochwałę