"Twój komputer został zablokowany, gdyż wykryto przeprowadzony przez niego atak na sieć komputerową NSM. Istnieje duże prawdopodobieństwo, iż atak jest przeprowadzany przez wirusa"
NSM to mój provider, dodam że wcześniej nie było takich problemów. Podłączone są dwa komputery poprzez routher.
Poniżej wstawiam logi z HiJack i Combofix-a :
- Kod: Zaznacz wszystko
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:05:18, on 2009-04-23
Platform: Windows XP Dodatek SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWSN\System32\smss.exe
C:\WINDOWSN\system32\winlogon.exe
C:\WINDOWSN\system32\services.exe
C:\WINDOWSN\system32\lsass.exe
C:\WINDOWSN\system32\svchost.exe
C:\WINDOWSN\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\D-Tools\daemon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Nowe Gadu-Gadu\gg.exe
C:\WINDOWSN\system32\spoolsv.exe
C:\Program Files\Nowe Gadu-Gadu\spellchecker_gg.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWSN\system32\nvsvc32.exe
C:\WINDOWSN\system32\svchost.exe
C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
C:\WINDOWSN\system32\wbem\wmiapsrv.exe
C:\WINDOWSN\system32\notepad.exe
C:\WINDOWSN\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWSN\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWSN\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QlbCtrl.exe] C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=050809 serial=DR12WEX-1504397-KTY lang=EN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWSN\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [Nowe Gadu-Gadu] "C:\Program Files\Nowe Gadu-Gadu\gg.exe"
O4 - HKCU\..\Run: [IncrediMail] C:\Program Files\IncrediMail\bin\IncMail.exe /c
O8 - Extra context menu item: E&ksport do programu Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\jp2iexp.dll
O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWSN\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWSN\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {68282C51-9459-467B-95BF-3C0E89627E55} (MksSkanerOnline Class) - http://www.mks.com.pl/skaner/SkanerOnline.cab
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Com4QLBEx - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWSN\system32\nvsvc32.exe
--
End of file - 5443 bytes
COMBOFIX
- Kod: Zaznacz wszystko
ComboFix 09-04-23.A3 - Asi 2009-04-23 21:42.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.3.1250.48.1045.18.1983.1461 [GMT 2:00]
Uruchomiony z: c:\documents and settings\Asi\Pulpit\ComboFix.exe
AV: avast! antivirus 4.8.1335 [VPS 090423-0] *On-access scanning disabled* (Updated)
* Utworzono nowy punkt przywracania
UWAGA - TEN KOMPUTER NIE MA ZAINSTALOWANEJ KONSOLI ODZYSKIWANIA !!
.
((((((((((((((((((((((((((((((((((((((( Usunięto )))))))))))))))))))))))))))))))))))))))))))))))))
.
c:\windowsn\system32\pthreadGC2.dll
.
((((((((((((((((((((((((( Pliki utworzone od 2009-05-23 do 2009-4-23 )))))))))))))))))))))))))))))))
.
2009-04-22 21:13 . 2009-04-22 21:13 -------- d-----w c:\documents and settings\Asi\workspace
2009-04-22 19:25 . 2009-04-22 19:25 -------- d-----w c:\program files\uTorrent
2009-04-22 19:25 . 2009-04-22 23:48 -------- d-----w c:\documents and settings\Asi\Dane aplikacji\uTorrent
2009-04-22 13:36 . 2009-04-22 13:45 -------- d-----w c:\program files\SkanerOnline
2009-04-21 19:28 . 2009-04-21 19:28 -------- d-----w c:\program files\Common Files\Java
2009-04-20 11:53 . 2009-04-20 11:53 -------- d-----w c:\documents and settings\Asi\Dane aplikacji\Apple Computer
2009-04-19 20:08 . 2009-04-19 20:08 0 ----a-w c:\documents and settings\Asi\autorun.bat
2009-04-19 18:57 . 2009-04-19 18:57 -------- d-----w c:\documents and settings\Asi\Ustawienia lokalne\Dane aplikacji\{32A3A4F2-B792-11D6-A78A-00B0D0150180}
2009-04-19 18:22 . 2009-04-19 18:22 73728 ----a-w c:\windowsn\system32\javacpl.cpl
2009-04-18 07:28 . 2009-02-09 11:26 2190336 -c----w c:\windowsn\system32\dllcache\ntoskrnl.exe
2009-04-18 07:28 . 2009-02-09 11:26 2146816 -c----w c:\windowsn\system32\dllcache\ntkrnlmp.exe
2009-04-18 07:28 . 2009-02-09 11:26 2025472 -c----w c:\windowsn\system32\dllcache\ntkrpamp.exe
2009-04-17 16:02 . 2008-10-24 11:21 455296 -c----w c:\windowsn\system32\dllcache\mrxsmb.sys
2009-04-17 09:17 . 2009-04-18 07:52 -------- d--h--w c:\windowsn\$hf_mig$
2009-04-17 07:11 . 2008-06-14 17:36 273024 -c----w c:\windowsn\system32\dllcache\bthport.sys
2009-04-17 07:11 . 2008-06-14 17:36 273024 ------w c:\windowsn\system32\drivers\bthport.sys
2009-04-15 17:32 . 2009-04-21 19:13 -------- d-----w C:\Users
2009-04-15 17:14 . 2009-04-15 17:14 -------- d-----w c:\documents and settings\NetworkService.ZARZĄDZANIE NT\Ustawienia lokalne\Dane aplikacji\Apple
2009-04-15 17:12 . 2009-04-15 17:12 -------- d-----w c:\windowsn\Sun
2009-04-14 21:39 . 2009-04-14 21:39 -------- d-----w c:\documents and settings\All Users.WINDOWSN\Dane aplikacji\Apple Computer
2009-04-14 21:39 . 2009-04-14 21:39 -------- d-----w c:\documents and settings\Asi\Ustawienia lokalne\Dane aplikacji\Apple
2009-04-14 21:39 . 2009-04-14 21:39 -------- d-----w c:\documents and settings\All Users.WINDOWSN\Dane aplikacji\Apple
2009-04-14 21:38 . 2009-04-14 21:38 -------- d-----w c:\documents and settings\Asi\Ustawienia lokalne\Dane aplikacji\Apple Computer
2009-04-14 20:19 . 2009-04-14 20:19 -------- d-----w c:\program files\Common Files\Adobe AIR
2009-04-14 20:03 . 2009-04-14 20:07 -------- d-----w c:\documents and settings\Asi\Dane aplikacji\Dev-Cpp
2009-04-14 18:47 . 2009-04-16 09:20 279 ----a-w c:\windowsn\wcx_ftp.ini
2009-04-12 13:44 . 2001-10-26 15:29 5632 ----a-w c:\windowsn\system32\ptpusb.dll
2009-04-12 13:44 . 2008-04-14 20:50 159232 ----a-w c:\windowsn\system32\ptpusd.dll
2009-04-12 13:44 . 2008-04-13 22:15 15104 -c--a-w c:\windowsn\system32\dllcache\usbscan.sys
2009-04-12 13:44 . 2008-04-13 22:15 15104 ----a-w c:\windowsn\system32\drivers\usbscan.sys
2009-04-11 18:40 . 2009-04-11 18:40 -------- d-----w c:\documents and settings\Asi\Dane aplikacji\OpenOffice.org
2009-04-11 18:38 . 2009-04-14 20:18 -------- d-----w c:\program files\OpenOffice.org 3
2009-04-11 18:37 . 2009-04-11 18:37 -------- d-----w c:\documents and settings\Asi\OpenOffice.org 3.0 (pl) Installation Files
2009-04-10 19:22 . 2009-04-20 23:21 -------- d-----w c:\documents and settings\Asi\Ustawienia lokalne\Dane aplikacji\WMTools Downloaded Files
2009-04-09 21:22 . 2009-04-09 21:22 -------- d-----w c:\documents and settings\Asi\Dane aplikacji\Media Player Classic
2009-04-08 12:18 . 2003-06-18 23:31 17920 ----a-w c:\windowsn\system32\mdimon.dll
2009-04-08 12:16 . 2009-04-08 12:17 -------- d-----w c:\windowsn\SHELLNEW
2009-04-08 11:47 . 2009-04-08 11:47 -------- d-----w c:\documents and settings\Asi\Dane aplikacji\Corel
2009-04-08 11:19 . 2009-02-13 09:31 55640 ----a-w c:\windowsn\system32\drivers\avgntflt.sys
2009-04-08 11:13 . 2008-08-02 09:58 44544 ----a-w c:\windowsn\system32\msxml4a.dll
2009-04-08 10:59 . 2009-04-14 22:10 -------- d-----w c:\documents and settings\Asi\Ustawienia lokalne\Dane aplikacji\Adobe
2009-04-08 10:58 . 2009-04-12 13:23 113616 ----a-w c:\documents and settings\Asi\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-04-08 10:54 . 2009-04-19 18:22 410984 ----a-w c:\windowsn\system32\deploytk.dll
2009-04-08 10:50 . 2009-04-08 10:50 -------- d-----w c:\documents and settings\Asi\Dane aplikacji\proDAD
2009-04-08 10:50 . 2009-04-08 10:50 -------- d-----w c:\program files\proDAD
2009-04-08 10:50 . 2004-03-29 14:23 90112 ----a-w c:\windowsn\unvise32.exe
2009-04-08 10:50 . 2009-04-08 10:50 -------- d-----w c:\program files\LooksBuilderSE
2009-04-08 10:50 . 2009-04-08 12:20 2161 ----a-w c:\windowsn\Graffiti5.2Pin.ini
2009-04-08 10:50 . 2003-07-09 08:43 45056 ----a-w c:\windowsn\system32\BFXSrcFilter.ax
2009-04-08 10:50 . 2003-07-01 14:49 69632 ----a-w c:\windowsn\system32\MtxPreview.dll
2009-04-08 10:50 . 2003-07-01 14:49 49152 ----a-w c:\windowsn\system32\MtxParhBFXPreview.dll
2009-04-08 10:50 . 2003-06-26 08:04 237568 ----a-r c:\windowsn\system32\qtmlClient.dll
2009-04-08 10:50 . 2003-01-20 07:08 49152 ----a-w c:\windowsn\system32\CvoAPI.dll
2009-04-08 10:49 . 2009-04-08 12:20 -------- d-----w c:\program files\Boris FX, Inc
2009-04-08 10:48 . 2005-09-23 21:18 171520 ----a-w c:\windowsn\system32\drivers\MarvinBus.sys
2009-04-08 10:48 . 2009-04-08 10:48 -------- dc----w c:\windowsn\system32\DRVSTORE
2009-04-08 10:47 . 2009-04-08 10:47 -------- d-----w c:\program files\Common Files\Pinnacle
2009-04-08 10:47 . 2009-04-08 10:47 -------- d-----w c:\documents and settings\Asi\Ustawienia lokalne\Dane aplikacji\Downloaded Installations
2009-04-08 10:47 . 2009-04-08 10:47 -------- d-----w c:\documents and settings\All Users.WINDOWSN\Dane aplikacji\Pinnacle Studio Ultimate
2009-04-08 10:44 . 2009-04-08 10:44 -------- d-----w c:\program files\Common Files\Yahoo!
2009-04-08 10:44 . 2009-04-08 10:48 -------- d-----w c:\program files\Pinnacle
2009-04-08 10:44 . 2009-04-08 10:44 -------- d-----w c:\documents and settings\All Users.WINDOWSN\Dane aplikacji\Studio 12
2009-04-08 10:44 . 2009-04-08 10:44 -------- d-----w c:\documents and settings\All Users.WINDOWSN\Dane aplikacji\Pinnacle Studio Plus
2009-04-08 10:41 . 2009-04-08 10:44 -------- d-----w c:\documents and settings\All Users.WINDOWSN\Dane aplikacji\Pinnacle
2009-04-08 10:40 . 2009-04-08 10:40 -------- d-----w c:\documents and settings\Asi\Ustawienia lokalne\Dane aplikacji\Microsoft Help
2009-04-08 10:40 . 2009-04-08 10:41 -------- d-----w c:\documents and settings\All Users.WINDOWSN\Dane aplikacji\Microsoft Help
2009-04-08 10:37 . 2009-04-08 10:37 154920 ----a-w c:\documents and settings\LocalService.ZARZĄDZANIE NT\Ustawienia lokalne\Dane aplikacji\FontCache3.0.0.0.dat
2009-04-08 10:36 . 2009-04-08 10:36 -------- d-----w c:\windowsn\system32\XPSViewer
2009-04-08 10:36 . 2008-07-06 12:06 89088 -c----w c:\windowsn\system32\dllcache\filterpipelineprintproc.dll
2009-04-08 10:36 . 2008-07-06 12:06 117760 ------w c:\windowsn\system32\prntvpt.dll
2009-04-08 10:36 . 2008-07-06 12:06 575488 -c----w c:\windowsn\system32\dllcache\xpsshhdr.dll
2009-04-08 10:36 . 2008-07-06 12:06 575488 ------w c:\windowsn\system32\xpsshhdr.dll
2009-04-08 10:36 . 2008-07-06 12:06 1676288 -c----w c:\windowsn\system32\dllcache\xpssvcs.dll
2009-04-08 10:36 . 2008-07-06 12:06 1676288 ------w c:\windowsn\system32\xpssvcs.dll
2009-04-08 10:36 . 2008-07-06 10:50 597504 -c----w c:\windowsn\system32\dllcache\printfilterpipelinesvc.exe
2009-04-08 10:29 . 2009-04-08 10:29 -------- d-----w c:\documents and settings\All Users.WINDOWSN\Dane aplikacji\Adobe Systems
2009-04-08 10:08 . 2009-04-08 12:18 424 ----a-w c:\windowsn\ODBC.INI
2009-04-08 09:59 . 2009-04-08 09:59 -------- d-----w c:\documents and settings\Asi\Dane aplikacji\XnView
2009-04-08 09:59 . 2009-04-16 10:16 1309 ----a-w c:\windowsn\WINCMD.INI
2009-04-08 09:55 . 2004-08-22 14:31 5248 ----a-w c:\windowsn\system32\drivers\d347prt.sys
2009-04-08 09:55 . 2004-08-22 14:31 155136 ----a-w c:\windowsn\system32\drivers\d347bus.sys
2009-04-08 09:55 . 2009-04-08 09:55 -------- d-----w c:\program files\D-Tools
2009-04-08 09:55 . 2009-04-08 09:55 -------- d-----w c:\windowsn\Downloaded Installations
2009-04-08 09:52 . 2009-04-08 09:52 -------- d-----w c:\documents and settings\Asi\Dane aplikacji\Blender Foundation
2009-04-08 09:52 . 2009-04-08 09:52 -------- d-----w c:\documents and settings\All Users.WINDOWSN\Dane aplikacji\Blender Foundation
2009-04-08 09:48 . 2008-04-13 22:15 26368 -c--a-w c:\windowsn\system32\dllcache\usbstor.sys
2009-04-08 09:20 . 2008-04-13 22:15 6272 -c--a-w c:\windowsn\system32\dllcache\splitter.sys
2009-04-08 09:09 . 2007-05-09 08:16 20888 ----a-w c:\windowsn\system32\net5211.cat
2009-04-08 09:09 . 2007-05-02 17:00 546976 ----a-w c:\windowsn\system32\drivers\ar5211.sys
2009-04-08 09:09 . 2007-05-02 17:00 546976 ----a-w c:\windowsn\system32\ar5211.sys
2009-04-08 09:09 . 2007-05-02 17:00 84470 ----a-w c:\windowsn\system32\net5211.inf
2009-04-08 09:09 . 2009-04-08 09:09 -------- d-----w c:\documents and settings\All Users.WINDOWSN\Dane aplikacji\Atheros
2009-04-08 09:08 . 2005-11-16 18:28 28928 ----a-w c:\windowsn\system32\drivers\rimmptsk.sys
2009-04-08 09:08 . 2005-11-01 16:08 308992 ----a-w c:\windowsn\system32\drivers\rixdptsk.sys
2009-04-08 09:08 . 2005-11-01 15:54 51584 ----a-w c:\windowsn\system32\drivers\rimsptsk.sys
2009-04-08 09:08 . 2005-05-06 16:06 16480 ----a-w c:\windowsn\system32\rixdicon.dll
2009-04-08 09:08 . 2004-09-03 10:00 90112 ----a-w c:\windowsn\system32\snymsico.dll
2009-04-08 09:06 . 2008-04-13 22:49 146048 -c--a-w c:\windowsn\system32\dllcache\portcls.sys
2009-04-08 09:06 . 2008-04-13 22:49 146048 ----a-w c:\windowsn\system32\drivers\portcls.sys
2009-04-08 09:06 . 2008-04-13 22:15 60160 -c--a-w c:\windowsn\system32\dllcache\drmk.sys
2009-04-08 09:06 . 2008-04-13 22:15 60160 ----a-w c:\windowsn\system32\drivers\drmk.sys
2009-04-08 09:05 . 2001-10-26 14:57 12160 -c--a-w c:\windowsn\system32\dllcache\mouhid.sys
2009-04-08 09:05 . 2001-10-26 14:57 12160 ----a-w c:\windowsn\system32\drivers\mouhid.sys
2009-04-08 09:05 . 2008-04-13 22:15 10368 -c--a-w c:\windowsn\system32\dllcache\hidusb.sys
2009-04-08 09:05 . 2008-04-13 22:15 10368 ----a-w c:\windowsn\system32\drivers\hidusb.sys
2009-04-08 01:03 . 2009-04-08 01:03 4444 ----a-w c:\windowsn\system32\pid.PNF
2009-04-08 01:01 . 2008-04-14 21:35 58880 ----a-w c:\windowsn\system32\drivers\redbook.sys
2009-04-08 01:01 . 2001-08-17 21:46 6400 ----a-w c:\windowsn\system32\drivers\enum1394.sys
2009-04-08 01:00 . 2008-04-14 22:50 77312 ----a-w c:\windowsn\system32\usbui.dll
2009-04-08 01:00 . 2008-04-14 00:06 8832 ----a-w c:\windowsn\system32\drivers\wmiacpi.sys
2009-04-08 01:00 . 2008-04-14 00:06 10240 ----a-w c:\windowsn\system32\drivers\compbatt.sys
2009-04-08 01:00 . 2008-04-14 00:06 14208 ----a-w c:\windowsn\system32\drivers\battc.sys
2009-04-08 01:00 . 2008-04-14 00:06 13952 ----a-w c:\windowsn\system32\drivers\CmBatt.sys
2009-04-08 00:56 . 2008-04-15 12:00 634012 -c--a-w c:\windowsn\system32\dllcache\NT5INF.CAT
2009-04-08 00:56 . 2008-04-15 12:00 2033887 -c--a-w c:\windowsn\system32\dllcache\NT5.CAT
2009-04-08 00:56 . 2008-04-15 12:00 16825 ----a-r c:\windowsn\SET8.tmp
2009-04-08 00:56 . 2008-04-15 12:00 1088840 ----a-r c:\windowsn\SET4.tmp
2009-04-08 00:56 . 2008-04-15 12:00 1246357 ----a-r c:\windowsn\SET3.tmp
2009-04-08 00:56 . 2009-04-08 00:57 -------- d--h--r c:\documents and settings\Default User.WINDOWSN\Dane aplikacji
2009-04-08 00:56 . 2009-04-23 11:03 -------- d--h--r c:\documents and settings\All Users.WINDOWSN\Dane aplikacji
2009-04-08 00:56 . 2009-04-23 19:41 -------- d--h--w c:\documents and settings\Default User.WINDOWSN
2009-04-08 00:56 . 2009-04-07 23:11 -------- d-----w c:\documents and settings\All Users.WINDOWSN
2009-04-08 00:54 . 2009-04-07 23:16 261 ----a-w c:\windowsn\system32\$winnt$.inf
2009-04-08 00:49 . 2009-04-08 00:54 -------- d-----w c:\windowsn\L2Schemas
2009-04-08 00:49 . 2009-04-08 00:54 -------- d-----w c:\windowsn\ehome
.
(((((((((((((((((((((((((((((((((((((((( Sekcja Find3M ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2009-04-22 19:26 . 2009-04-22 13:45 34146 ----a-w C:\mksbasel.cpp.log
2009-04-21 19:29 . 2009-03-10 20:28 -------- d-----w c:\program files\Java
2009-04-19 18:21 . 2008-04-15 12:00 83858 ----a-w c:\windowsn\system32\perfc015.dat
2009-04-19 18:21 . 2008-04-15 12:00 490522 ----a-w c:\windowsn\system32\perfh015.dat
2009-04-15 22:10 . 2009-02-17 23:31 -------- d-----w c:\program files\Nowe Gadu-Gadu
2009-04-08 11:53 . 2009-04-07 23:55 -------- d-----w c:\documents and settings\Asi\Dane aplikacji\Nowe Gadu-Gadu
2009-04-08 11:13 . 2009-03-09 18:38 -------- d-----w c:\program files\WinSCP
2009-04-08 11:13 . 2009-03-20 22:47 -------- d-----w c:\program files\TeXnicCenter
2009-04-08 10:51 . 2009-04-08 10:51 -------- d-----w c:\documents and settings\Asi\Dane aplikacji\pdfforge
2009-04-08 10:51 . 2009-03-09 11:21 -------- d-----w c:\program files\K-Lite Codec Pack
2009-04-08 10:49 . 2009-02-17 21:19 -------- d--h--w c:\program files\InstallShield Installation Information
2009-04-08 10:08 . 2009-02-19 19:57 -------- d-----w c:\program files\XnView
2009-04-08 09:37 . 2007-07-24 13:08 217088 ----a-w c:\windowsn\system32\UCI32A21.dll
2009-04-08 09:37 . 2007-12-18 10:18 732160 ----a-w c:\windowsn\system32\drivers\CHDAud.sys
2009-04-08 09:27 . 2009-04-08 09:27 0 ---ha-w c:\windowsn\system32\drivers\Msft_Kernel_HpqKbFiltr_01005.Wdf
2009-04-08 09:27 . 2009-04-08 09:27 0 ---ha-w c:\windowsn\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2009-04-08 09:22 . 2009-04-07 23:12 86333 ----a-w c:\windowsn\pchealth\helpctr\OfflineCache\index.dat
2009-04-08 09:21 . 2009-02-17 22:42 -------- d-----w c:\program files\CONEXANT
2009-04-08 00:02 . 2009-04-07 23:26 -------- d-----w c:\documents and settings\All Users.WINDOWSN\Dane aplikacji\IM
2009-04-08 00:01 . 2009-02-17 23:31 -------- d-----w c:\program files\IncrediMail
2009-04-07 23:28 . 2009-04-07 23:28 -------- d-----w c:\documents and settings\Asi\Dane aplikacji\Search Settings
2009-04-07 23:21 . 2009-04-07 23:21 -------- d-----w c:\documents and settings\Asi\Dane aplikacji\InstallShield
2009-04-07 23:08 . 2009-04-07 23:08 21856 ----a-w c:\windowsn\system32\emptyregdb.dat
2009-04-06 19:33 . 2009-04-06 19:33 -------- d-----w c:\documents and settings\Asiek\Dane aplikacji\Ahead
2009-04-06 19:26 . 2009-04-06 19:25 -------- d-----w c:\program files\Ahead
2009-04-06 19:25 . 2009-04-06 19:25 -------- d-----w c:\program files\Common Files\Ahead
2009-04-05 16:02 . 2009-04-05 16:02 -------- d-----w c:\program files\Alwil Software
2009-03-22 17:25 . 2009-03-22 17:25 -------- d-----w c:\documents and settings\Asiek\Dane aplikacji\Thinstall
2009-03-22 10:14 . 2009-03-22 10:14 -------- d-----w c:\program files\YouTube Downloader
2009-03-21 10:19 . 2009-03-13 18:15 510 ---ha-w C:\os629005.bin
2009-03-20 20:58 . 2009-03-20 20:54 -------- d-----w c:\program files\MiKTeX 2.7
2009-03-18 17:53 . 2009-03-18 17:52 -------- d-----w c:\program files\Altova
2009-03-18 17:52 . 2009-03-18 17:52 -------- d-----w c:\program files\Common Files\Altova
2009-03-18 07:37 . 2009-03-16 19:21 -------- d-----w c:\program files\Microsoft Silverlight
2009-03-16 22:33 . 2009-03-16 21:10 -------- d-----w c:\documents and settings\Asiek\Dane aplikacji\Dev-Cpp
2009-03-16 19:35 . 2009-02-17 21:21 74520 ----a-w c:\documents and settings\Asiek\Ustawienia lokalne\Dane aplikacji\GDIPFONTCACHEV1.DAT
2009-03-16 19:31 . 2009-03-16 19:21 -------- d-----w c:\program files\Microsoft SQL Server
2009-03-16 19:30 . 2009-03-16 19:30 -------- d-----w c:\program files\MSXML 6.0
2009-03-16 19:20 . 2009-03-16 19:18 -------- d-----w c:\program files\Microsoft Visual Studio 9.0
2009-03-16 19:19 . 2009-03-16 19:18 -------- d-----w c:\program files\Common Files\Merge Modules
2009-03-16 19:17 . 2009-03-16 19:17 -------- d-----w c:\program files\Microsoft SDKs
2009-03-16 19:15 . 2009-03-16 19:15 -------- d-----w c:\program files\MSBuild
2009-03-16 19:15 . 2009-03-16 19:15 -------- d-----w c:\program files\Reference Assemblies
2009-03-13 18:04 . 2009-03-13 18:04 -------- d-----w c:\program files\TI Education
2009-03-11 09:52 . 2009-02-18 22:09 -------- d-----w c:\program files\Microsoft Works
2009-03-11 09:48 . 2009-03-11 09:48 -------- d-----w c:\program files\MSXML 4.0
2009-03-10 21:42 . 2009-03-10 21:28 -------- d-----w c:\program files\Mercurial
2009-03-10 21:04 . 2009-03-10 21:04 -------- d-----w c:\program files\H2
2009-03-09 19:31 . 2009-03-09 19:08 -------- d-----w c:\program files\ABBYY PDF Transformer 2.0
2009-03-09 11:24 . 2009-03-09 11:24 -------- d-----w c:\program files\Windows Media Connect 2
2009-03-09 11:21 . 2009-03-09 11:21 -------- d-----w c:\documents and settings\Asiek\Dane aplikacji\Media Player Classic
2009-03-06 14:22 . 2008-04-15 12:00 285696 ----a-w c:\windowsn\system32\pdh.dll
2009-03-05 17:52 . 2009-03-05 17:52 -------- d-----w c:\documents and settings\Asiek\Dane aplikacji\Nokia Multimedia Player
2009-03-05 17:50 . 2009-03-05 17:50 -------- d-----w c:\documents and settings\Asiek\Dane aplikacji\Nokia
2009-03-05 17:50 . 2009-02-17 21:30 -------- d-----w c:\program files\DIFX
2009-03-05 17:50 . 2009-03-05 17:50 -------- d-----w c:\program files\Common Files\PCSuite
2009-03-05 17:50 . 2009-03-05 17:50 -------- d-----w c:\program files\Common Files\Nokia
2009-03-05 17:50 . 2009-03-05 17:50 -------- d-----w c:\program files\Nokia
2009-03-05 17:50 . 2009-03-05 17:50 -------- d-----w c:\documents and settings\Asiek\Dane aplikacji\PC Suite
2009-03-05 17:50 . 2009-03-05 17:50 -------- d-----w c:\program files\PC Connectivity Solution
2009-03-04 22:18 . 2009-03-04 22:18 -------- d-----w c:\documents and settings\Asiek\Dane aplikacji\Apple Computer
2009-03-03 21:39 . 2009-03-03 21:39 -------- d-----w c:\program files\Paragon Software
2009-03-02 18:10 . 2009-04-08 10:51 67584 ----a-w c:\windowsn\system32\ff_vfw.dll
2009-03-01 17:16 . 2009-03-01 17:15 -------- d-----w c:\program files\QuickTime
2009-03-01 17:15 . 2009-03-01 17:15 -------- d-----w c:\program files\Apple Software Update
2009-02-25 16:48 . 2009-02-25 16:48 -------- d-----w c:\documents and settings\Asiek\Dane aplikacji\Search Settings
2009-02-25 16:48 . 2009-02-25 16:48 -------- d-----w c:\documents and settings\Asiek\Dane aplikacji\pdfforge
2009-02-25 15:58 . 2009-02-25 15:57 -------- d-----w c:\program files\PDFCreator
2009-02-25 15:57 . 2009-02-25 15:57 -------- d-----w c:\program files\pdfforge Toolbar
2009-02-20 08:12 . 2008-04-15 12:00 668672 ----a-w c:\windowsn\system32\wininet.dll
2009-02-20 08:11 . 2008-04-15 12:00 81920 ----a-w c:\windowsn\system32\ieencode.dll
2009-02-17 21:33 . 2009-02-17 21:33 86 ----a-w C:\bcmwl5.log
2009-02-09 14:07 . 2008-04-15 12:00 1847040 ----a-w c:\windowsn\system32\win32k.sys
2009-02-09 11:26 . 2008-04-14 21:59 2025472 ----a-w c:\windowsn\system32\ntkrnlpa.exe
2009-02-09 11:26 . 2008-04-15 12:00 2146816 ----a-w c:\windowsn\system32\ntoskrnl.exe
2009-02-09 11:25 . 2008-04-15 12:00 111104 ----a-w c:\windowsn\system32\services.exe
2009-02-09 10:53 . 2008-04-15 12:00 731136 ----a-w c:\windowsn\system32\lsasrv.dll
2009-02-09 10:53 . 2008-04-15 12:00 686592 ----a-w c:\windowsn\system32\advapi32.dll
2009-02-09 10:53 . 2008-04-15 12:00 401408 ----a-w c:\windowsn\system32\rpcss.dll
2009-02-09 10:53 . 2008-04-15 12:00 722944 ----a-w c:\windowsn\system32\ntdll.dll
2009-02-06 10:39 . 2008-04-15 12:00 35328 ----a-w c:\windowsn\system32\sc.exe
2009-02-04 03:45 . 2009-04-07 23:21 453152 ----a-w c:\windowsn\system32\NVUNINST.EXE
2009-02-03 19:58 . 2008-04-15 12:00 56832 ----a-w c:\windowsn\system32\secur32.dll
.
((((((((((((((((((((((((((((((((((((( Wpisy startowe rejestru ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Uwaga* puste wpisy oraz domyślne, prawidłowe wpisy nie są pokazane
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Nowe Gadu-Gadu"="c:\program files\Nowe Gadu-Gadu\gg.exe" [2009-04-20 9818728]
"IncrediMail"="c:\program files\IncrediMail\bin\IncMail.exe" [2009-03-31 251264]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="c:\windowsn\system32\NvCpl.dll" [2007-08-23 8478720]
"NvMediaCenter"="c:\windowsn\system32\NvMcTray.dll" [2007-08-23 81920]
"QlbCtrl.exe"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2008-08-01 202032]
"DAEMON Tools-1033"="c:\program files\D-Tools\daemon.exe" [2004-08-22 81920]
"CorelDRAW Graphics Suite 11b"="c:\program files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe" [2003-11-25 729088]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2009-01-05 413696]
"avast!"="c:\progra~1\ALWILS~1\Avast4\ashDisp.exe" [2009-02-05 81000]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-04-19 148888]
"MSConfig"="c:\windowsn\PCHealth\HelpCtr\Binaries\MSConfig.exe" [2008-04-15 171520]
"nwiz"="nwiz.exe" - c:\windowsn\system32\nwiz.exe [2007-08-23 1626112]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
[HKLM\~\startupfolder\C:^Documents and Settings^Asi^Menu Start^Programy^Autostart^Adobe Gamma.lnk]
path=c:\documents and settings\Asi\Menu Start\Programy\Autostart\Adobe Gamma.lnk
backup=c:\windowsn\pss\Adobe Gamma.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^Asi^Menu Start^Programy^Autostart^OpenOffice.org 3.0.lnk]
path=c:\documents and settings\Asi\Menu Start\Programy\Autostart\OpenOffice.org 3.0.lnk
backup=c:\windowsn\pss\OpenOffice.org 3.0.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\IncrediMail\\bin\\IncMail.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImApp.exe"=
"c:\\Program Files\\IncrediMail\\bin\\ImpCnt.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\RM.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\Studio.exe"=
"c:\\Program Files\\Pinnacle\\Studio 12\\Programs\\umi.exe"=
"c:\\Program Files\\Nowe Gadu-Gadu\\gg.exe"=
"c:\\totalcmd\\TOTALCMD.EXE"=
"c:\\Documents and Settings\\Asi\\Moje dokumenty\\Moje programy\\eclipse\\eclipse.exe"=
"c:\\Program Files\\Java\\jre6\\bin\\javaw.exe"=
"c:\\Program Files\\Java\\jdk1.5.0_18\\bin\\javaw.exe"=
"c:\\Program Files\\uTorrent\\uTorrent.exe"=
R3 Com4QLBEx;Com4QLBEx;c:\program files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe [2008-04-03 193840]
S1 aswSP;avast! Self Protection; [x]
S2 aswFsBlk;aswFsBlk;c:\windowsn\system32\DRIVERS\aswFsBlk.sys [2009-02-05 20560]
.
Zawartość folderu 'Zaplanowane zadania'
2009-04-22 c:\windowsn\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34]
.
- - - - USUNIĘTO PUSTE WPISY - - - -
HKLM-Run-High Definition Audio Property Page Shortcut - CHDAudPropShortcut.exe
.
------- Skan uzupełniający -------
.
IE: E&ksport do programu Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
DPF: {68282C51-9459-467B-95BF-3C0E89627E55} - hxxp://www.mks.com.pl/skaner/SkanerOnline.cab
FF - ProfilePath - c:\documents and settings\Asi\Dane aplikacji\Mozilla\Firefox\Profiles\u4yqscuy.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.psyratownicze.net
FF - prefs.js: keyword.URL - hxxp://mystart.incredimail.com/?loc=ff_address_bar&search=
FF - component: c:\program files\Mozilla Firefox\extensions\{B922D405-6D13-4A2B-AE89-08A030DA4402}\components\pdfforgeToolbarFF.dll
FF - component: c:\program files\Mozilla Firefox\extensions\search@searchsettings.com\components\SearchSettingsFF.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
.
**************************************************************************
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-04-23 21:48
Windows 5.1.2600 Dodatek Service Pack 3 NTFS
skanowanie ukrytych procesów ...
skanowanie ukrytych wpisów autostartu ...
skanowanie ukrytych plików ...
skanowanie pomyślnie ukończone
ukryte pliki: 0
**************************************************************************
.
--------------------- ZABLOKOWANE KLUCZE REJESTRU ---------------------
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{47629D4B-2AD3-4e50-B716-A66C15C63153}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWSN\\system32\\OLE32.DLL"
"cd042efbbd7f7af1647644e76e06692b"=hex:c8,28,51,af,b0,29,a3,98,35,4d,30,c0,25,
82,3b,a8,c8,28,51,af,b0,29,a3,98,3e,af,63,4b,26,6b,a3,5d,e2,63,26,f1,3f,c8,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{604BB98A-A94F-4a5c-A67C-D8D3582C741C}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWSN\\system32\\OLE32.DLL"
"bca643cdc5c2726b20d2ecedcc62c59b"=hex:6a,9c,d6,61,af,45,84,18,ed,b8,04,7c,e3,
22,6f,cc,71,3b,04,66,8b,46,0d,96,71,ba,ce,41,24,fc,b2,ec,6a,9c,d6,61,af,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{684373FB-9CD8-4e47-B990-5A4466C16034}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWSN\\system32\\OLE32.DLL"
"2c81e34222e8052573023a60d06dd016"=hex:25,da,ec,7e,55,20,c9,26,96,eb,fa,66,1a,
07,74,8d,25,da,ec,7e,55,20,c9,26,29,d3,de,f6,e4,e5,15,ac,ff,7c,85,e0,43,d4,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{74554CCD-F60F-4708-AD98-D0152D08C8B9}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWSN\\system32\\OLE32.DLL"
"2582ae41fb52324423be06337561aa48"=hex:86,8c,21,01,be,91,eb,e7,7b,b0,84,7b,cc,
7a,5b,15,3e,1e,9e,e0,57,5a,93,61,b3,b5,c6,12,17,25,0c,38,86,8c,21,01,be,91,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{7EB537F9-A916-4339-B91B-DED8E83632C0}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWSN\\system32\\OLE32.DLL"
"caaeda5fd7a9ed7697d9686d4b818472"=hex:cd,44,cd,b9,a6,33,6c,cd,90,b7,b3,d1,9b,
2a,4e,4b,cd,44,cd,b9,a6,33,6c,cd,c4,46,a4,e4,85,89,f3,22,f5,1d,4d,73,a8,13,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{948395E8-7A56-4fb1-843B-3E52D94DB145}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWSN\\system32\\OLE32.DLL"
"a4a1bcf2cc2b8bc3716b74b2b4522f5d"=hex:50,93,e5,ab,ec,6a,4e,ab,bf,0e,84,96,61,
13,b0,20,b0,18,ed,a7,3f,8d,37,a4,4e,4b,b5,38,90,ec,87,63,df,20,58,62,78,6b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{AC3ED30B-6F1A-4bfc-A4F6-2EBDCCD34C19}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWSN\\system32\\OLE32.DLL"
"4d370831d2c43cd13623e232fed27b7b"=hex:fb,a7,78,e6,12,2f,9a,ea,de,97,97,a8,fd,
c1,5a,0c,31,77,e1,ba,b1,f8,68,02,9b,09,be,b7,b2,db,2a,89,fb,a7,78,e6,12,2f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{DE5654CA-EB84-4df9-915B-37E957082D6D}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWSN\\system32\\OLE32.DLL"
"1d68fe701cdea33e477eb204b76f993d"=hex:01,3a,48,fc,e8,04,4a,f1,30,2c,fd,1d,33,
46,72,1c,83,6c,56,8b,a0,85,96,ab,70,b4,84,1b,a2,5f,15,ea,01,3a,48,fc,e8,04,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{E39C35E8-7488-4926-92B2-2F94619AC1A5}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWSN\\system32\\OLE32.DLL"
"1fac81b91d8e3c5aa4b0a51804d844a3"=hex:51,fa,6e,91,28,9e,14,cc,e9,22,8e,a5,a0,
f9,ab,1a,51,fa,6e,91,28,9e,14,cc,de,d1,41,a0,c4,42,59,28,f6,0f,4e,58,98,5b,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{EACAFCE5-B0E2-4288-8073-C02FF9619B6F}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWSN\\system32\\OLE32.DLL"
"f5f62a6129303efb32fbe080bb27835b"=hex:b1,cd,45,5a,a8,c4,f8,b9,9f,54,37,ea,7d,
56,55,d6,b1,cd,45,5a,a8,c4,f8,b9,56,25,c7,96,b8,08,13,a9,3d,ce,ea,26,2d,45,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{F8F02ADD-7366-4186-9488-C21CB8B3DCEC}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWSN\\system32\\OLE32.DLL"
"fd4e2e1a3940b94dceb5a6a021f2e3c6"=hex:2a,b7,cc,b5,b9,7f,41,e7,d8,8b,6b,98,14,
16,1e,5d,e3,0e,66,d5,eb,bc,2f,6b,c0,47,62,f7,d1,20,4e,e9,2a,b7,cc,b5,b9,7f,\
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{FEE45DE2-A467-4bf9-BF2D-1411304BCD84}\InprocServer32*]
"ThreadingModel"="Apartment"
@="c:\\WINDOWSN\\system32\\OLE32.DLL"
"8a8aec57dd6508a385616fbc86791ec2"=hex:fa,ea,66,7f,d4,3b,6b,70,d1,2d,89,bc,f1,
86,d9,74,fa,ea,66,7f,d4,3b,6b,70,c6,09,64,e1,b1,18,10,6f,6c,43,2d,1e,aa,22,\
.
Czas ukończenia: 2009-04-23 21:49
ComboFix-quarantined-files.txt 2009-04-23 19:49
Przed: 184 078 462 976 bajtów wolnych
Po: 185 857 486 848 bajtów wolnych
370 --- E O F --- 2009-04-23 05:55
Będę bardzo wdzięczny za pomoc, Pozdrawiam
oraz skasuj folder C:\
