jakiś trojan nie daje mi spokoju - prosze o spr. loga

[Gryzak]

Witam! Mam problem a mianowicie mój Antywirus (mam KIS 6.0) cały czas mi wykrywa wirusa w pliku eraseme####.exe (ten krzyzyk oznacza numer) co chwila ten plik jest usuwany przez antywirus ale ten plik zaraz się znowu pojawia i zmienia numer co dzien mam takich nawet kilkanascie albo i kilkadziesiąt komunikatów i nie wiem jak tego się na stałe pozbyć. Prosze o pomoc Dodam że ten wirus to koń Trojański i jest bardzo złosliwy bo nie chce się usunąć w antywirusie jest on wykrywany pod nazwą: Backdoor.Win32.SdBot.aad

Oto logi z HJT i SR:

Logfile of HijackThis v1.99.1
Scan saved at 14:48:31, on 2007-04-11
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\mgabg.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\PDesk\PDesk.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MarBit\ALLPlayer\ALLPlayer.exe
C:\Documents and Settings\Marcin Binek\Pulpit\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nitka.net.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\system32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O8 - Extra context menu item: Dodaj do blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINNT\system32\klogon.dll
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: Usługa administracyjna Menedżera dysków logicznych (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINNT\system32\mgabg.exe

"Silent Runners.vbs", revision R50, http://www.silentrunners.org/
Operating System: Windows 2000
Output limited to non-default values, except where indicated by "{++}"


Startup items buried in registry:
---------------------------------

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"Gadu-Gadu" = ""C:\Program Files\Gadu-Gadu\gg.exe" /tray" ["Gadu-Gadu S.A."]
"eMuleAutoStart" = "C:\Program Files\eMule\emule.exe -AutoStart" ["http://www.emule-project.net"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\ {++}
"Matrox Powerdesk" = "C:\WINNT\system32\PDesk\PDesk.exe /Autolaunch" ["Matrox Graphics Inc."]
"Synchronization Manager" = "mobsync.exe /logon" [MS]
"AVP" = ""C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"" ["Kaspersky Lab"]

HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\
"{42071714-76d4-11d1-8b24-00a0c9068ff3}" = "Rozszerzenie CPL kadrowania wyświetlania"
-> {HKLM...CLSID} = "Rozszerzenie CPL kadrowania wyświetlania"
\InProcServer32\(Default) = "deskpan.dll" [file not found]
"{88895560-9AA2-1069-930E-00AA0030EBC8}" = "Rozszerzenie ikony HyperTerminalu"
-> {HKLM...CLSID} = "HyperTerminal Icon Ext"
\InProcServer32\(Default) = "C:\WINNT\system32\hticons.dll" ["Hilgraeve, Inc."]
"{E6FB5E20-DE35-11CF-9C87-00AA005127ED}" = "WebCheck"
-> {HKLM...CLSID} = "WebCheck"
\InProcServer32\(Default) = "C:\WINNT\system32\dllcache\checkweb.dll" [null data]
"{4A741382-48B4-11d2-AD84-00A024D24BF3}" = "Matrox PowerDesk Properties"
-> {HKLM...CLSID} = "Matrox PowerDesk Properties"
\InProcServer32\(Default) = "C:\WINNT\system32\PDesk\PDPAGES.DLL" ["Matrox Graphics Inc."]
"{B41DB860-8EE4-11D2-9906-E49FADC173CA}" = "WinRAR shell extension"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]
"{85E0B171-04FA-11D1-B7DA-00A0C90348D6}" = "Statystyki ochrony WWW"
-> {HKLM...CLSID} = "Statystyki ochrony WWW"
\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll" ["Kaspersky Lab"]

HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\
"WebCheck" = "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
-> {HKLM...CLSID} = "WebCheck"
\InProcServer32\(Default) = "C:\WINNT\system32\dllcache\checkweb.dll" [null data]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows\
<<!>> "AppInit_DLLs" = "C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll" ["Kaspersky Lab"]

HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
<<!>> klogon\DLLName = "C:\WINNT\system32\klogon.dll" ["Kaspersky Lab"]

HKLM\Software\Classes\*\shellex\ContextMenuHandlers\
Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ShellEx.dll" ["Kaspersky Lab"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Directory\shellex\ContextMenuHandlers\
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]

HKLM\Software\Classes\Folder\shellex\ContextMenuHandlers\
Kaspersky Anti-Virus\(Default) = "{dd230880-495a-11d1-b064-008048ec2fc5}"
-> {HKLM...CLSID} = (no title provided)
\InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ShellEx.dll" ["Kaspersky Lab"]
WinRAR\(Default) = "{B41DB860-8EE4-11D2-9906-E49FADC173CA}"
-> {HKLM...CLSID} = "WinRAR"
\InProcServer32\(Default) = "C:\Program Files\WinRAR\rarext.dll" [null data]


Group Policies {GPedit.msc branch and setting}:
-----------------------------------------------

Note: detected settings may not have any effect.

HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System\

"shutdownwithoutlogon" = (REG_DWORD) hex:0x00000001
{Computer Configuration|Windows Settings|Security Settings|Local Policies|Security Options|
Shutdown: Allow system to be shut down without having to log on}


Active Desktop and Wallpaper:
-----------------------------

Active Desktop may be enabled at this entry:
HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellState

Displayed if Active Desktop enabled and wallpaper not set by Group Policy:
HKCU\Software\Microsoft\Internet Explorer\Desktop\General\
"Wallpaper" = "C:\WINNT\Web\Wallpaper\window~1.bmp"

Displayed if Active Desktop disabled and wallpaper not set by Group Policy:
HKCU\Control Panel\Desktop\
"Wallpaper" = "C:\WINNT\Web\Wallpaper\window~1.bmp"


Winsock2 Service Provider DLLs:
-------------------------------

Namespace Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\NameSpace_Catalog5\Catalog_Entries\ {++}
000000000001\LibraryPath = "%SystemRoot%\System32\rnr20.dll" [MS]
000000000002\LibraryPath = "%SystemRoot%\System32\winrnr.dll" [MS]

Transport Service Providers

HKLM\System\CurrentControlSet\Services\Winsock2\Parameters\Protocol_Catalog9\Catalog_Entries\ {++}
0000000000##\PackedCatalogItem (contains) DLL [Company Name], (at) ## range:
%SystemRoot%\system32\msafd.dll [MS], 01 - 03, 06 - 11
%SystemRoot%\system32\rsvpsp.dll [MS], 04 - 05


Toolbars, Explorer Bars, Extensions:
------------------------------------

Explorer Bars

HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\

HKLM\Software\Classes\CLSID\{85E0B171-04FA-11D1-B7DA-00A0C90348D6}\(Default) = "Statystyki ochrony WWW"
Implemented Categories\{00021493-0000-0000-C000-000000000046}\ [vertical bar]
InProcServer32\(Default) = "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll" ["Kaspersky Lab"]

Extensions (Tools menu items, main toolbar menu buttons)

HKLM\Software\Microsoft\Internet Explorer\Extensions\
{1F460357-8A94-4D71-9CA3-AA4ACF32ED8E}\
"ButtonText" = "Statystyki ochrony WWW"


Running Services (Display Name, Service Name, Path {Service DLL}):
------------------------------------------------------------------

Kaspersky Internet Security 6.0, AVP, ""C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r" ["Kaspersky Lab"]
MGABGEXE, MGABGEXE, "C:\WINNT\system32\mgabg.exe" ["Matrox Graphics Inc."]
System zdarzeń COM+, EventSystem, "C:\WINNT\system32\svchost.exe -k netsvcs" {"C:\WINNT\system32\es.dll" [null data]}


----------
<<!>>: Suspicious data at a malware launch point.

+ This report excludes default entries except where indicated.
+ To see *everywhere* the script checks and *everything* it finds,
launch it from a command prompt or a shortcut with the -all parameter.
+ To search all directories of local fixed drives for DESKTOP.INI
DLL launch points, use the -supp parameter or answer "No" at the
first message box and "Yes" at the second message box.
---------- (total run time: 216 seconds, including 14 seconds for message boxes)

[wojtas]

daj loga z comboscana:
http://www.techsupportforum.com/sectools/Deckard/comboscan.exe

[Gryzak]

Prosze :

ComboScan v20070306.20 run by Marcin on 2007-04-11 at 16:36:14
Computer is in Normal Mode.
--------------------------------------------------------------------------------

Performed disk cleanup.


-- HijackThis (run as Marcin.exe) ----------------------------------------------

Logfile of HijackThis v1.99.1
Scan saved at 16:36:52, on 2007-04-11
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\mgabg.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\WINNT\system32\PDesk\PDesk.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe
C:\Program Files\eMule\emule.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\MarBit\ALLPlayer\ALLPlayer.exe
C:\Documents and Settings\Marcin Binek\Pulpit\comboscan.exe
C:\DOCUME~1\MARCIN~1\Pulpit\Marcin.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.nitka.net.pl/
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\system32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe"
O4 - HKCU\..\Run: [Gadu-Gadu] "C:\Program Files\Gadu-Gadu\gg.exe" /tray
O4 - HKCU\..\Run: [eMuleAutoStart] C:\Program Files\eMule\emule.exe -AutoStart
O8 - Extra context menu item: Dodaj do blokowanych banerów - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\ie_banner_deny.htm
O9 - Extra button: Statystyki ochrony WWW - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\scieplugin.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.pl/resources/virusscanner/kavwebscan_unicode.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O20 - Winlogon Notify: klogon - C:\WINNT\system32\klogon.dll
O23 - Service: Kaspersky Internet Security 6.0 (AVP) - Unknown owner - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r (file missing)
O23 - Service: Usługa administracyjna Menedżera dysków logicznych (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: MGABGEXE - Matrox Graphics Inc. - C:\WINNT\system32\mgabg.exe


-- File Associations -----------------------------------------------------------

.bat - batfile - "%1" %*
.chm - chm.file - "C:\WINNT\hh.exe" %1
.cmd - cmdfile - "%1" %*
.com - comfile - "%1" %*
.exe - exefile - "%1" %*
.hlp - hlpfile - %SystemRoot%\System32\winhlp32.exe %1
.inf - inffile - %SystemRoot%\System32\NOTEPAD.EXE %1
.ini - inifile - %SystemRoot%\System32\NOTEPAD.EXE %1
.js - JSFile - %SystemRoot%\System32\WScript.exe "%1" %*
.lnk - lnkfile - {00021401-0000-0000-C000-000000000046}
.pif - piffile - "%1" %*
.reg - regfile - regedit.exe "%1"
.scr - scrfile - "%1" /S
.txt - txtfile - %SystemRoot%\system32\NOTEPAD.EXE %1
.vbs - VBSFile - %SystemRoot%\System32\WScript.exe "%1" %*


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

3S CCDECODE (Closed Caption Decoder) - C:\WINNT\system32\drivers\ccdecode.sys
1R Cdr4_2K - C:\WINNT\system32\drivers\cdr4_2k.sys
1R Cdralw2k - C:\WINNT\system32\drivers\cdralw2k.sys
3R G400DH - C:\WINNT\system32\drivers\g400dhm.sys
0R imagedrv - C:\WINNT\system32\drivers\imagedrv.sys
0R imagesrv - C:\WINNT\system32\drivers\imagesrv.sys
0R kl1 - C:\WINNT\system32\drivers\kl1.sys
1R klif - C:\WINNT\system32\drivers\klif.sys
3S MPE (BDA MPE Filter) - C:\WINNT\system32\drivers\mpe.sys
3S MSTEE (Microsoft Streaming Tee/Sink-to-Sink Converter) - C:\WINNT\system32\drivers\mstee.sys
3R N100 (Compaq Ethernet or Fast Ethernet NIC NT Driver) - C:\WINNT\system32\drivers\n100nt5.sys
3S NABTSFEC (NABTS/FEC VBI Codec) - C:\WINNT\system32\drivers\nabtsfec.sys
3S NtApm (Sterownik interfejsu NT Apm/Legacy) - C:\WINNT\system32\drivers\NtApm.sys
0R PxHelp20 - C:\WINNT\system32\drivers\PxHelp20.sys
3S SLIP (BDA Slip De-Framer) - C:\WINNT\system32\drivers\slip.sys
3S streamip (BDA IPSink) - C:\WINNT\system32\drivers\streamip.sys
3S USBSTOR (Sterownik pamięci masowej USB) - C:\WINNT\system32\drivers\USBSTOR.SYS
4S WS2IFSL (Środowisko wspomagające dostawcę usług innych niż IFS - Windows Socket 2.0) - C:\WINNT\system32\drivers\ws2ifsl.sys
3S WSTCODEC (World Standard Teletext Codec) - C:\WINNT\system32\drivers\wstcodec.sys


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

4S 10156 - \\192.168.3.168\Admin$\eraseme_10146.exe
4S 10717 - \\192.168.3.168\Admin$\eraseme_24738.exe
4S 13381 - \\192.168.3.168\Admin$\eraseme_81473.exe
4S 17137 - \\192.168.3.168\Admin$\eraseme_02328.exe
4S 22534 - \\192.168.3.168\Admin$\eraseme_08071.exe
4S 22812 - \\192.168.3.168\Admin$\eraseme_01064.exe
4S 26112 - \\192.168.3.168\Admin$\eraseme_55422.exe
4S 26502 - \\192.168.3.168\Admin$\eraseme_58134.exe
4S 50247 - \\192.168.3.168\Admin$\eraseme_20317.exe
4S 54860 - \\192.168.3.168\Admin$\eraseme_62588.exe
4S 68570 - \\192.168.3.168\Admin$\eraseme_01305.exe
4S 85731 - \\192.168.3.168\Admin$\eraseme_76067.exe
2R AVP (Kaspersky Internet Security 6.0) - "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 6.0\avp.exe" -r
2R MGABGEXE - C:\WINNT\system32\mgabg.exe
3S WmdmPmSN (Usługa numeru seryjnego multimediów przenośnych) - C:\WINNT\System32\svchost.exe -k netsvcs


-- Files created between 2007-03-11 and 2007-04-11 -----------------------------

2007-04-11 14:49:35 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_290.dat<PEACEE~1.DAT>
2007-04-11 14:20:30 16384 --a-----t C:\WINNT\system32\Perflib_Perfdata_408.dat<PED8CA~1.DAT>
2007-04-11 07:47:56 16384 --a------ C:\WINNT\system32\Perflib_Perfdata_384.dat<PEC8E8~1.DAT>
2007-04-10 13:45:03 74396 --a------ C:\WINNT\system32\drivers\klin.dat
2007-04-10 13:45:03 75932 --a------ C:\WINNT\system32\drivers\klick.dat
2007-04-10 13:44:16 0 d-------- C:\Program Files\Kaspersky Lab<KASPER~1>
2007-04-10 13:44:11 32 --ahs---- C:\WINNT\system32\drivers\fidbox2.dat
2007-04-10 13:44:11 32 --ahs---- C:\WINNT\system32\drivers\fidbox.dat
2007-04-09 17:19:11 0 d-------- C:\Program Files\Damian Pasternak<DAMIAN~1>
2007-04-08 20:02:55 0 d-------- C:\Program Files\Maxis
2007-04-08 20:02:25 305664 --a------ C:\WINNT\IsUn0415.exe
2007-04-05 21:46:00 0 d-------- C:\WINNT\uninstall<UNINST~1>
2007-04-05 11:04:01 16384 --a------ C:\WINNT\system32\Perflib_Perfdata_378.dat<PERFLI~4.DAT>
2007-04-05 10:59:28 16384 --a------ C:\WINNT\system32\Perflib_Perfdata_40c.dat<PERFLI~3.DAT>
2007-04-05 10:51:41 0 d-------- C:\WINNT\system32\Kaspersky Lab<KASPER~1>
2007-04-04 18:52:37 16384 --a------ C:\WINNT\system32\Perflib_Perfdata_2e4.dat<PERFLI~1.DAT>
2007-04-04 18:40:02 146944 --a------ C:\WINNT\system32\msconfig.exe
2007-04-04 18:39:19 0 d-------- C:\WINNT\pss
2007-04-04 16:11:43 0 d-------- C:\Program Files\Satsuki Decoder Pack<SATSUK~1>
2007-04-04 16:09:52 499712 --a------ C:\WINNT\system32\msvcp71.dll
2007-04-04 16:09:49 0 d-------- C:\Program Files\ffdshow
2007-04-04 15:21:28 16384 --a------ C:\WINNT\system32\Perflib_Perfdata_2d0.dat<PERFLI~2.DAT>
2007-04-03 22:52:43 90 --a------ C:\WINNT\system32\imon1.dat
2007-04-01 20:00:00 0 d--h----- C:\WINNT\PIF
2007-04-01 15:19:33 0 d-------- C:\Program Files\DC++<DC__~1>
2007-04-01 15:00:57 107008 --a------ C:\WINNT\system32\FXTLS432.DLL
2007-04-01 15:00:54 722192 --a------ C:\WINNT\system32\VB40032.DLL
2007-04-01 13:05:44 0 d-------- C:\Program Files\IrfanView<IRFANV~1>
2007-03-31 14:34:34 127488 -----n--- C:\WINNT\system32\drivers\imagesrv.sys
2007-03-31 14:34:34 5888 -----n--- C:\WINNT\system32\drivers\imagedrv.sys
2007-03-31 14:33:45 364544 -----n--- C:\WINNT\system32\TwnLib4.dll
2007-03-31 14:33:45 106496 --a------ C:\WINNT\system32\TwnLib20.dll
2007-03-31 14:33:40 471040 -----n--- C:\WINNT\system32\ImagXRA7.dll
2007-03-31 14:33:40 262144 -----n--- C:\WINNT\system32\ImagXR7.dll
2007-03-31 14:33:40 476320 -----n--- C:\WINNT\system32\ImagXpr7.dll
2007-03-31 14:33:40 1568768 -----n--- C:\WINNT\system32\ImagX7.dll
2007-03-31 14:33:39 155648 --a------ C:\WINNT\system32\NeroCheck.exe<NEROCH~1.EXE>
2007-03-31 14:33:33 0 d-------- C:\Program Files\Common Files\Ahead
2007-03-31 14:33:31 0 d-------- C:\Program Files\Ahead
2007-03-31 14:28:56 136704 --a------ C:\WINNT\system32\iacenc.dll
2007-03-31 14:28:54 0 d-------- C:\Program Files\Ligos
2007-03-31 14:28:20 306688 --a------ C:\WINNT\IsUninst.exe
2007-03-31 13:50:31 0 d-------- C:\Program Files\jv16 PowerTools 2006<JV16PO~2>
2007-03-31 13:46:47 2608 --a------ C:\WINNT\system32\d3d9caps.dat
2007-03-31 13:39:46 3426072 --a------ C:\WINNT\system32\d3dx9_32.dll
2007-03-31 13:39:42 2414360 --a------ C:\WINNT\system32\d3dx9_31.dll
2007-03-31 13:39:17 2297552 --a------ C:\WINNT\system32\d3dx9_26.dll
2007-03-31 13:38:05 480256 --a------ C:\WINNT\system32\msvidctl.dll
2007-03-31 13:38:04 47104 --a------ C:\WINNT\system32\wstdecod.dll
2007-03-31 13:38:04 354816 --a------ C:\WINNT\system32\psisdecd.dll
2007-03-31 13:38:04 16896 --a------ C:\WINNT\system32\msyuv.dll
2007-03-31 13:38:04 4096 --a------ C:\WINNT\system32\ksuser.dll
2007-03-31 13:38:04 18688 --a------ C:\WINNT\system32\drivers\wstcodec.sys
2007-03-31 13:38:04 4096 --a------ C:\WINNT\system32\drivers\swenum.sys
2007-03-31 13:38:04 14976 --a------ C:\WINNT\system32\drivers\streamip.sys
2007-03-31 13:38:04 48512 --a------ C:\WINNT\system32\drivers\stream.sys
2007-03-31 13:38:04 10880 --a------ C:\WINNT\system32\drivers\slip.sys
2007-03-31 13:38:04 10112 --a------ C:\WINNT\system32\drivers\ndisip.sys
2007-03-31 13:38:04 83968 --a------ C:\WINNT\system32\drivers\nabtsfec.sys
2007-03-31 13:38:04 5504 --a------ C:\WINNT\system32\drivers\mstee.sys
2007-03-31 13:38:04 5248 --a------ C:\WINNT\system32\drivers\mspclock.sys
2007-03-31 13:38:04 7424 --a------ C:\WINNT\system32\drivers\mskssrv.sys
2007-03-31 13:38:04 56832 --a------ C:\WINNT\system32\drivers\msdv.sys
2007-03-31 13:38:04 15104 --a------ C:\WINNT\system32\drivers\mpe.sys
2007-03-31 13:38:04 130304 --a------ C:\WINNT\system32\drivers\ks.sys
2007-03-31 13:38:04 16384 --a------ C:\WINNT\system32\drivers\ccdecode.sys
2007-03-31 13:38:04 11392 --a------ C:\WINNT\system32\drivers\bdasup.sys
2007-03-31 13:38:03 733184 --a------ C:\WINNT\system32\qedwipes.dll
2007-03-31 13:38:02 1798144 --a------ C:\WINNT\system32\qedit.dll
2007-03-31 13:38:02 324096 --a------ C:\WINNT\system32\mswebdvd.dll
2007-03-31 13:38:02 13312 --a------ C:\WINNT\system32\msdmo.dll
2007-03-31 13:38:01 1231872 --a------ C:\WINNT\system32\quartz.dll
2007-03-31 13:38:01 470528 --a------ C:\WINNT\system32\qdvd.dll
2007-03-31 13:38:01 316928 --a------ C:\WINNT\system32\qdv.dll
2007-03-31 13:38:01 257024 --a------ C:\WINNT\system32\qcap.dll
2007-03-31 13:38:01 34304 --a------ C:\WINNT\system32\mciqtz32.dll
2007-03-31 13:38:01 18944 --a------ C:\WINNT\system32\encapi.dll
2007-03-31 13:38:01 132608 --a------ C:\WINNT\system32\devenum.dll
2007-03-31 13:38:01 49424 --a------ C:\WINNT\system32\d3dxof.dll
2007-03-31 13:38:01 364816 --a------ C:\WINNT\system32\d3drm.dll
2007-03-31 13:38:01 591120 --a------ C:\WINNT\system32\d3dramp.dll
2007-03-31 13:38:01 37648 --a------ C:\WINNT\system32\d3dpmesh.dll
2007-03-31 13:38:01 446224 --a------ C:\WINNT\system32\d3dim.dll
2007-03-31 13:38:01 64512 --a------ C:\WINNT\system32\amstream.dll
2007-03-31 13:38:00 18432 --a------ C:\WINNT\system32\dswave.dll
2007-03-31 13:38:00 122880 --a------ C:\WINNT\system32\dmusic.dll
2007-03-31 13:38:00 100864 --a------ C:\WINNT\system32\dmsynth.dll
2007-03-31 13:38:00 98816 --a------ C:\WINNT\system32\dmstyle.dll
2007-03-31 13:38:00 76800 --a------ C:\WINNT\system32\dmscript.dll
2007-03-31 13:38:00 33280 --a------ C:\WINNT\system32\dmloader.dll
2007-03-31 13:38:00 181248 --a------ C:\WINNT\system32\dmime.dll
2007-03-31 13:38:00 58368 --a------ C:\WINNT\system32\dmcompos.dll
2007-03-31 13:38:00 27136 --a------ C:\WINNT\system32\dmband.dll
2007-03-31 13:38:00 664576 --a------ C:\WINNT\system32\dinput8.dll
2007-03-31 13:38:00 1703936 --a------ C:\WINNT\system32\d3d9.dll
2007-03-31 13:37:59 1201152 --a------ C:\WINNT\system32\d3d8.dll
2007-03-31 13:37:58 66408 --a------ C:\WINNT\system32\dxdllreg.exe
2007-03-31 13:37:58 1769472 --a------ C:\WINNT\system32\dxdiagn.dll
2007-03-31 13:37:58 974848 --a------ C:\WINNT\system32\dxdiag.exe
2007-03-31 13:37:58 491520 --a------ C:\WINNT\system32\dsdmoprp.dll
2007-03-31 13:37:58 186880 --a------ C:\WINNT\system32\dsdmo.dll
2007-03-31 13:37:58 112128 --a------ C:\WINNT\system32\dpvvox.dll
2007-03-31 13:37:58 80896 --a------ C:\WINNT\system32\dpvsetup.exe
2007-03-31 13:37:58 381952 --a------ C:\WINNT\system32\dpvoice.dll
2007-03-31 13:37:58 19968 --a------ C:\WINNT\system32\dpvacm.dll
2007-03-31 13:37:58 16896 --a------ C:\WINNT\system32\dpnsvr.exe
2007-03-31 13:37:58 3072 --a------ C:\WINNT\system32\dpnlobby.dll
2007-03-31 13:37:58 68096 --a------ C:\WINNT\system32\dpnhupnp.dll
2007-03-31 13:37:58 32768 --a------ C:\WINNT\system32\dpnhpast.dll
2007-03-31 13:37:58 723968 --a------ C:\WINNT\system32\dpnet.dll
2007-03-31 13:37:58 3072 --a------ C:\WINNT\system32\dpnaddr.dll
2007-03-31 13:37:58 44032 --a------ C:\WINNT\system32\dimap.dll
2007-03-31 13:37:58 459264 --a------ C:\WINNT\system32\diactfrm.dll
2007-03-31 13:37:57 31744 --a------ C:\WINNT\system32\pid.dll
2007-03-31 13:37:57 206336 --a------ C:\WINNT\system32\gcdef.dll
2007-03-31 13:37:57 1189888 --a------ C:\WINNT\system32\dx8vb.dll
2007-03-31 13:37:57 602624 --a------ C:\WINNT\system32\dx7vb.dll
2007-03-31 13:37:57 1294336 --a------ C:\WINNT\system32\dsound3d.dll
2007-03-31 13:37:57 381952 --a------ C:\WINNT\system32\dsound.dll
2007-03-31 13:37:57 79360 --a------ C:\WINNT\system32\dpwsockx.dll
2007-03-31 13:37:57 77824 --a------ C:\WINNT\system32\dpmodemx.dll
2007-03-31 13:37:57 230400 --a------ C:\WINNT\system32\dplayx.dll
2007-03-31 13:37:57 28160 --a------ C:\WINNT\system32\dplaysvr.exe
2007-03-31 13:37:57 645120 --a------ C:\WINNT\system32\dinput.dll
2007-03-31 13:37:57 292864 --a------ C:\WINNT\system32\ddraw.dll
2007-03-31 13:37:57 797184 --a------ C:\WINNT\system32\d3dim700.dll
2007-03-31 13:37:57 7168 --a------ C:\WINNT\system32\d3d8thk.dll
2007-03-31 13:37:32 0 d-------- C:\WINNT\system32\DirectX
2007-03-31 13:04:23 0 d-------- C:\Program Files\eMule
2007-03-31 12:57:05 0 d-------- C:\Program Files\Common Files\Skype
2007-03-31 12:55:57 0 d-------- C:\Program Files\Skype
2007-03-31 12:43:28 0 d--h----- C:\WINNT\$SQLUninstallMDAC25SP3-KB927779-x86-PLK$<$SQLUN~1>
2007-03-31 12:18:27 90384 --a------ C:\WINNT\system32\CRYPTDLG.DLL
2007-03-31 12:14:25 2071368 --a------ C:\WINNT\system32\wmvcore.dll
2007-03-31 11:24:12 1168 --a------ C:\WINNT\mozver.dat
2007-03-31 11:21:42 0 --a------ C:\WINNT\nsreg.dat
2007-03-31 10:46:58 0 d-------- C:\WINNT\system32\BITS
2007-03-31 10:45:17 424448 -----n--- C:\WINNT\system32\xpob2res.dll
2007-03-31 10:45:17 17408 --a------ C:\WINNT\system32\qmgrprxy.dll
2007-03-31 10:45:17 7168 -----n--- C:\WINNT\system32\bitsprx3.dll
2007-03-31 10:45:17 7680 -----n--- C:\WINNT\system32\bitsprx2.dll
2007-03-31 10:45:04 0 d-------- C:\Program Files\Odkurzacz<ODKURZ~1>
2007-03-31 10:44:39 0 d--hs---- C:\Recycled
2007-03-31 10:42:22 0 d-------- C:\Program Files\Gadu-Gadu<GADU-G~1>
2007-03-31 10:40:23 57344 --a------ C:\WINNT\uneng.exe
2007-03-31 10:40:23 401462 --a------ C:\WINNT\system32\Msvcp60.dll
2007-03-31 10:40:23 49152 --a------ C:\WINNT\system32\cdrtc.dll
2007-03-31 10:40:23 45056 --a------ C:\WINNT\system32\cdral.dll
2007-03-31 10:40:23 0 d-------- C:\Program Files\Common Files\Adaptec Shared<ADAPTE~1>
2007-03-31 10:39:40 98304 --a------ C:\WINNT\system32\wmpshell.dll
2007-03-31 10:39:40 225280 --a------ C:\WINNT\system32\wmpdxm.dll
2007-03-31 10:39:40 106496 --a------ C:\WINNT\system32\wmpasf.dll
2007-03-31 10:39:40 190464 --a------ C:\WINNT\system32\wmerror.dll
2007-03-31 10:39:40 7680 --a------ C:\WINNT\system32\asferror.dll
2007-03-31 10:39:39 20480 --a------ C:\WINNT\system32\wmpui.dll
2007-03-31 10:39:39 2977792 --a------ C:\WINNT\system32\wmploc.dll
2007-03-31 10:39:39 20480 --a------ C:\WINNT\system32\wmpcore.dll
2007-03-31 10:39:39 20480 --a------ C:\WINNT\system32\wmpcd.dll
2007-03-31 10:39:21 23552 --a------ C:\WINNT\system32\wmdmps.dll
2007-03-31 10:39:21 27136 --a------ C:\WINNT\system32\wmdmlog.dll
2007-03-31 10:39:21 246272 --a------ C:\WINNT\system32\mswmdm.dll
2007-03-31 10:39:21 365704 --a------ C:\WINNT\system32\msscp.dll
2007-03-31 10:39:21 201728 --a------ C:\WINNT\system32\mspmsp.dll
2007-03-31 10:39:21 52736 --a------ C:\WINNT\system32\mspmsnsv.dll
2007-03-31 10:39:21 159232 --a------ C:\WINNT\system32\CEWMDM.dll
2007-03-31 10:37:55 115880 -----n--- C:\WINNT\system32\pxinsi64.exe
2007-03-31 10:37:55 129784 -----n--- C:\WINNT\system32\pxafs.dll
2007-03-31 10:37:55 36528 -----n--- C:\WINNT\system32\drivers\PxHelp20.sys
2007-03-31 10:37:55 2560 -----n--- C:\WINNT\system32\drivers\cdralw2k.sys
2007-03-31 10:37:55 2432 -----n--- C:\WINNT\system32\drivers\cdr4_2k.sys
2007-03-31 10:37:32 895736 --a------ C:\WINNT\system32\wmvdmod.dll
2007-03-31 10:37:32 413944 --a------ C:\WINNT\system32\wmspdmod.dll
2007-03-31 10:37:32 240640 --a------ C:\WINNT\system32\mpg4dmod.dll
2007-03-31 10:37:32 384512 --a------ C:\WINNT\system32\mp4sdmod.dll
2007-03-31 10:37:32 317176 --a------ C:\WINNT\system32\mp43dmod.dll
2007-03-31 10:37:31 1003008 --a------ C:\WINNT\system32\wmvdmoe2.dll
2007-03-31 10:37:31 940544 --a------ C:\WINNT\system32\wmspdmoe.dll
2007-03-31 10:37:31 774904 --a------ C:\WINNT\system32\wmsdmod.dll
2007-03-31 10:37:31 396528 --a------ C:\WINNT\system32\wmadmod.dll
2007-03-31 10:37:30 1119744 --a------ C:\WINNT\system32\wmsdmoe2.dll
2007-03-31 10:37:30 1022464 --a------ C:\WINNT\system32\wmnetmgr.dll
2007-03-31 10:37:30 151552 --a------ C:\WINNT\system32\wmidx.dll
2007-03-31 10:37:30 222208 --a------ C:\WINNT\system32\wmasf.dll
2007-03-31 10:37:30 716288 --a------ C:\WINNT\system32\wmadmoe.dll
2007-03-31 10:37:30 237568 --a------ C:\WINNT\system32\qasf.dll
2007-03-31 10:37:30 103936 --a------ C:\WINNT\system32\logagent.exe
2007-03-31 10:37:30 6656 --a------ C:\WINNT\system32\laprxy.dll
2007-03-31 10:37:28 260096 --a------ C:\WINNT\system32\msnetobj.dll
2007-03-31 10:37:28 696320 --a------ C:\WINNT\system32\drmv2clt.dll
2007-03-31 10:37:28 87040 --a------ C:\WINNT\system32\drmstor.dll
2007-03-31 10:37:28 306424 --a------ C:\WINNT\system32\drmclien.dll
2007-03-31 10:37:28 294400 --a------ C:\WINNT\system32\blackbox.dll
2007-03-31 10:36:36 0 d-------- C:\Program Files\Winamp
2007-03-31 10:36:15 0 d-------- C:\Program Files\MarBit
2007-03-31 10:35:36 0 d-------- C:\WINNT\SoftwareDistribution<SOFTWA~1>
2007-03-31 10:35:13 173536 --a------ C:\WINNT\system32\wuweb.dll
2007-03-31 10:35:13 18200 --a------ C:\WINNT\system32\wups2.dll
2007-03-31 10:35:13 41240 --a------ C:\WINNT\system32\wups.dll
2007-03-31 10:35:13 128280 --a------ C:\WINNT\system32\wucltui.dll
2007-03-31 10:35:13 195352 --a------ C:\WINNT\system32\wuaueng1.dll
2007-03-31 10:35:13 175384 --a------ C:\WINNT\system32\wuauclt1.exe
2007-03-31 10:35:13 466200 --a------ C:\WINNT\system32\wuapi.dll
2007-03-31 10:29:11 0 d-------- C:\Program Files\Mozilla Firefox<MOZILL~1>
2007-03-31 10:26:56 0 d-------- C:\WINNT\system32\Macromed
2007-03-31 10:22:21 0 d-------- C:\WINNT\RegisteredPackages<REGIST~2>
2007-03-31 10:19:26 0 d--h----- C:\WINNT\msdownld.tmp
2007-03-31 10:19:22 0 d-------- C:\WINNT\Pliki Instalatora aktualizacji Windows Update<PLIKII~1>
2007-03-31 10:13:43 343552 --a------ C:\WINNT\system32\drivers\g400dhm.sys
2007-03-31 10:13:42 2390144 --a------ C:\WINNT\system32\g400dhd.dll
2007-03-31 10:13:27 0 d-------- C:\WINNT\system32\PDesk
2007-03-31 10:13:27 81920 --a------ C:\WINNT\system32\mgabg.exe
2007-03-31 10:13:26 962560 --a------ C:\WINNT\system32\g400icd.dll
2007-03-31 10:05:26 0 d-------- C:\WINNT\system32\Windows Media<WINDOW~1>
2007-03-31 10:04:37 22752 --a------ C:\WINNT\system32\spupdsvc.exe
2007-03-31 10:03:52 0 d--h----- C:\WINNT\$NtUpdateRollupPackUninstall$<$NTUPD~1>
2007-03-31 10:03:46 0 d-------- C:\WINNT\msiinst.tmp
2007-03-31 10:01:39 0 d-------- C:\WINNT\system32\NtmsData
2007-03-31 10:01:14 0 d--hs---- C:\WINNT\Installer<INSTAL~1>
2007-03-31 10:01:06 0 d--h----- C:\WINNT\system32\GroupPolicy<GROUPP~1>
2007-03-31 10:01:04 0 d--hs---- C:\WINNT\CSC
2007-03-31 09:51:33 0 d-------- C:\WINNT\system32\rpcproxy
2007-03-31 09:51:33 0 d-------- C:\WINNT\system32\rocket
2007-03-31 09:51:33 0 d-------- C:\WINNT\system32\inetsrv
2007-03-31 09:51:33 0 d-------- C:\WINNT\mww32
2007-03-31 09:51:33 0 d-------- C:\WINNT\ime
2007-03-31 09:51:33 0 d-------- C:\Program Files\microsoft frontpage<MICROS~1>
2007-03-31 09:48:18 0 -rahs---- C:\MSDOS.SYS
2007-03-31 09:48:18 0 -rahs---- C:\IO.SYS
2007-03-31 09:48:18 0 ---h----- C:\CONFIG.SYS
2007-03-31 09:48:18 0 ---h----- C:\AUTOEXEC.BAT
2007-03-31 09:47:11 135440 --a------ C:\WINNT\system32\mapi32.dll
2007-03-31 09:46:37 0 dr------- C:\WINNT\Offline Web Pages<OFFLIN~1>
2007-03-31 09:46:37 0 d---s---- C:\WINNT\Downloaded Program Files<DOWNLO~1>
2007-03-31 09:46:16 3072 --a------ C:\WINNT\system32\nmevtmsg.dll
2007-03-31 09:46:16 63248 --a------ C:\WINNT\system32\ils.dll
2007-03-31 09:46:15 12560 --a------ C:\WINNT\system32\nmmkcert.dll
2007-03-31 09:46:15 54032 --a------ C:\WINNT\system32\msconf.dll
2007-03-31 09:46:15 21776 --a------ C:\WINNT\system32\mnmsrvc.exe
2007-03-31 09:46:15 32880 --a------ C:\WINNT\system32\mnmdd.dll
2007-03-31 09:46:08 0 d---s---- C:\WINNT\Tasks
2007-03-31 09:46:08 10000 --a------ C:\WINNT\system32\mstinit.exe
2007-03-31 09:46:07 49936 --a------ C:\WINNT\system32\icwphbk.dll
2007-03-31 09:46:07 58640 --a------ C:\WINNT\system32\icwdial.dll
2007-03-31 09:46:06 256784 --a------ C:\WINNT\system32\inetcfg.dll
2007-03-31 09:46:06 5904 --a------ C:\WINNT\system32\icfgnt5.dll
2007-03-31 09:45:53 222480 --a------ C:\WINNT\system32\mstask.dll
2007-03-31 09:45:53 75024 --a------ C:\WINNT\system32\isign32.dll
2007-03-31 09:45:26 15144 --a------ C:\WINNT\system32\emptyregdb.dat<EMPTYR~1.DAT>
2007-03-31 09:44:41 0 d-------- C:\WINNT\Registration<REGIST~1>
2007-03-31 09:44:21 0 d-------- C:\WINNT\system32\DTCLog
2007-03-31 09:44:16 0 d--h----- C:\Program Files\WindowsUpdate<WINDOW~3>
2007-03-31 09:44:11 6416 --a------ C:\WINNT\system32\write.exe
2007-03-31 09:43:55 68880 --a------ C:\WINNT\system32\sndvol32.exe
2007-03-31 09:43:55 119568 --a------ C:\WINNT\system32\mplay32.exe
2007-03-31 09:43:54 339216 --a------ C:\WINNT\system32\cdplayer.exe
2007-03-31 09:43:49 76048 --a------ C:\WINNT\system32\avwav.dll
2007-03-31 09:43:49 17168 --a------ C:\WINNT\system32\avmeter.dll
2007-03-31 09:43:48 67344 --a------ C:\WINNT\system32\winchat.exe
2007-03-31 09:43:40 100112 --a------ C:\WINNT\system32\clipbrd.exe
2007-03-31 09:43:39 407312 --a------ C:\WINNT\system32\getuname.dll
2007-03-31 09:43:38 34576 --a------ C:\WINNT\system32\sol.exe
2007-03-31 09:43:38 90896 --a------ C:\WINNT\system32\charmap.exe
2007-03-31 09:43:38 91920 --a------ C:\WINNT\system32\calc.exe
2007-03-31 09:43:37 96528 --a------ C:\WINNT\system32\winmine.exe
2007-03-31 09:43:37 33552 --a------ C:\WINNT\system32\tifflt.dll
2007-03-31 09:43:37 34064 --a------ C:\WINNT\system32\freecell.exe
2007-03-31 09:43:37 0 d-------- C:\Program Files\Accessories<ACCESS~1>
2007-03-31 09:43:36 641808 --a------ C:\WINNT\system32\xiffr3_0.dll
2007-03-31 09:43:36 25872 --a------ C:\WINNT\system32\oitwa400.dll
2007-03-31 09:43:36 13072 --a------ C:\WINNT\system32\oissq400.dll
2007-03-31 09:43:36 21776 --a------ C:\WINNT\system32\oislb400.dll
2007-03-31 09:43:36 13072 --a------ C:\WINNT\system32\oiprt400.dll
2007-03-31 09:43:36 38160 --a------ C:\WINNT\system32\jpeg2x32.dll
2007-03-31 09:43:36 27920 --a------ C:\WINNT\system32\jpeg1x32.dll
2007-03-31 09:43:36 13584 --a------ C:\WINNT\system32\imgshl.dll
2007-03-31 09:43:35 19728 --a------ C:\WINNT\system32\xolehlp.dll
2007-03-31 09:43:35 62224 --a------ C:\WINNT\system32\imgcmn.dll
2007-03-31 09:43:34 6928 --a------ C:\WINNT\system32\msdtc.exe
2007-03-31 09:43:33 71440 --a------ C:\WINNT\system32\stclient.dll
2007-03-31 09:43:33 35600 --a------ C:\WINNT\system32\mtxlegih.dll
2007-03-31 09:43:33 3856 --a------ C:\WINNT\system32\mtxex.dll
2007-03-31 09:43:33 149776 --a------ C:\WINNT\system32\DComExt.dll
2007-03-31 09:43:33 21776 --a------ C:\WINNT\system32\comclust.exe
2007-03-31 09:43:33 29968 --a------ C:\WINNT\system32\comaddin.dll
2007-03-31 09:43:32 84240 --a------ C:\WINNT\system32\txflog.dll
2007-03-31 09:43:32 146192 --a------ C:\WINNT\system32\comsnap.dll
2007-03-31 09:43:32 55056 --a------ C:\WINNT\system32\catsrvps.dll
2007-03-31 09:43:31 108304 --a------ C:\WINNT\system32\sndrec32.exe
2007-03-31 09:43:31 581392 --a------ C:\WINNT\system32\hypertrm.dll
2007-03-31 09:43:31 21776 --a------ C:\WINNT\system32\hticons.dll
2007-03-31 09:43:31 154384 --a------ C:\WINNT\system32\accwiz.exe
2007-03-31 09:43:30 54032 --a------ C:\WINNT\system32\packager.exe
2007-03-31 09:43:30 321808 --a------ C:\WINNT\system32\mspaint.exe
2007-03-31 09:43:30 230160 --a------ C:\WINNT\system32\avtapi.dll
2007-03-31 09:43:30 0 d-------- C:\Program Files\Windows NT<WINDOW~1>
2007-03-31 09:43:29 9216 --a------ C:\WINNT\system32\wuauserv.dll
2007-03-31 09:43:29 1343768 --a------ C:\WINNT\system32\wuaueng.dll
2007-03-31 09:43:29 125208 --a------ C:\WINNT\system32\wuauclt.exe
2007-03-31 09:43:29 62736 --a------ C:\WINNT\system32\oiui400.dll
2007-03-31 09:43:28 444176 --a------ C:\WINNT\system32\oieng400.dll
2007-03-31 09:43:28 123152 --a------ C:\WINNT\system32\mtxoci.dll
2007-03-31 09:43:27 153872 --a------ C:\WINNT\system32\msdtcui.dll
2007-03-31 09:43:27 96016 --a------ C:\WINNT\system32\msdtclog.dll
2007-03-31 09:43:26 1836272 -ra------ C:\WINNT\system32\dtcsetup.exe
2007-03-31 09:43:25 26896 --a------ C:\WINNT\system32\mtxdm.dll
2007-03-31 09:43:25 98576 --a------ C:\WINNT\system32\comrepl.dll
2007-03-31 09:43:25 0 d-------- C:\WINNT\system32\Com
2007-03-31 09:43:25 41744 --a------ C:\WINNT\system32\colbact.dll
2007-03-31 09:43:24 97040 --a------ C:\WINNT\system32\clbcatex.dll
2007-03-31 09:43:24 595728 --a------ C:\WINNT\system32\catsrvut.dll
2007-03-31 09:43:24 165648 --a------ C:\WINNT\system32\catsrv.dll
2007-03-31 09:43:23 631056 --a------ C:\WINNT\system32\comuid.dll
2007-03-31 09:39:02 4816 --a------ C:\WINNT\system32\drivers\MSPQM.sys
2007-03-31 09:38:59 73872 --a------ C:\WINNT\system32\drivers\wdmaud.sys
2007-03-31 09:38:58 148304 --a------ C:\WINNT\system32\drivers\kmixer.sys
2007-03-31 09:38:55 47568 --a------ C:\WINNT\system32\drivers\sysaudio.sys
2007-03-31 09:38:51 51152 --a------ C:\WINNT\system32\drivers\DMusic.sys
2007-03-31 09:38:48 53552 --a------ C:\WINNT\system32\drivers\swmidi.sys
2007-03-31 09:38:43 2896 --a------ C:\WINNT\system32\drivers\audstub.sys
2007-03-31 09:38:42 9264 --a------ C:\WINNT\system32\drivers\NtApm.sys
2007-03-31 09:37:07 9808 --a------ C:\WINNT\system32\drivers\gameenum.sys
2007-03-31 09:36:37 21008 --a------ C:\WINNT\system32\drivers\AGP440.SYS
2007-03-31 09:36:35 60688 --a------ C:\WINNT\system32\usbui.dll
2007-03-31 09:36:29 88336 --a------ C:\WINNT\system32\drivers\n100nt5.sys
2007-03-31 09:36:27 44528 --a------ C:\WINNT\system32\drivers\es1371mp.sys
2007-03-31 09:36:25 148208 --a------ C:\WINNT\system32\drivers\portcls.sys
2007-03-31 09:36:12 36496 --a------ C:\WINNT\system32\drivers\redbook.sys
2007-03-31 09:35:00 0 d-------- C:\Program Files\Common Files\ODBC
2007-03-31 09:34:55 0 d-------- C:\WINNT\Speech
2007-03-31 09:34:52 5392 --a------ C:\WINNT\delttsul.exe
2007-03-31 09:34:52 0 dr------- C:\Program Files<PROGRA~1>
2007-03-31 09:34:45 7440 -ra------ C:\WINNT\system32\kbdycl.dll
2007-03-31 09:34:45 7440 -ra------ C:\WINNT\system32\kbdsl1.dll
2007-03-31 09:34:45 7440 -ra------ C:\WINNT\system32\kbdsl.dll
2007-03-31 09:34:45 6416 -ra------ C:\WINNT\system32\kbdhu1.dll
2007-03-31 09:34:45 7440 -ra------ C:\WINNT\system32\kbdhu.dll
2007-03-31 09:34:45 7440 -ra------ C:\WINNT\system32\kbdcz2.dll
2007-03-31 09:34:45 7440 -ra------ C:\WINNT\system32\kbdcz1.dll
2007-03-31 09:34:45 7952 -ra------ C:\WINNT\system32\kbdcz.dll
2007-03-31 09:34:45 7440 -ra------ C:\WINNT\system32\kbdcr.dll
2007-03-31 09:34:45 7440 -ra------ C:\WINNT\system32\KBDAL.DLL
2007-03-31 09:34:44 6416 -ra------ C:\WINNT\system32\kbdro.dll
2007-03-31 09:34:43 149504 --a------ C:\WINNT\system32\spxcoins.dll
2007-03-31 09:34:43 85776 --a------ C:\WINNT\system32\dgsetup.dll
2007-03-31 09:34:43 123904 --a------ C:\WINNT\system32\dgrpsetu.dll
2007-03-31 09:34:42 176400 --a------ C:\WINNT\system32\EqnClass.Dll
2007-03-31 09:34:42 6416 --a------ C:\WINNT\system32\batt.dll
2007-03-31 09:34:42 9168 --a------ C:\WINNT\system\VER.DLL
2007-03-31 09:34:41 21344 --a------ C:\WINNT\system\TAPI.DLL
2007-03-31 09:34:40 5120 --a------ C:\WINNT\system\SHELL.DLL
2007-03-31 09:34:40 24064 --a------ C:\WINNT\system\OLESVR.DLL
2007-03-31 09:34:40 83456 --a------ C:\WINNT\system\OLECLI.DLL
2007-03-31 09:34:40 127008 --a------ C:\WINNT\system\MSVIDEO.DLL
2007-03-31 09:34:39 69104 --a------ C:\WINNT\system\MMSYSTEM.DLL
2007-03-31 09:34:39 9936 --a------ C:\WINNT\system\LZEXPAND.DLL
2007-03-31 09:34:39 28848 --a------ C:\WINNT\system\COMMDLG.DLL
2007-03-31 09:34:38 35600 --a------ C:\WINNT\TASKMAN.EXE
2007-03-31 09:34:38 108016 --a------ C:\WINNT\system\AVIFILE.DLL
2007-03-31 09:34:38 70096 --a------ C:\WINNT\system\AVICAP.DLL
2007-03-31 09:34:38 51472 --a------ C:\WINNT\NOTEPAD.EXE
2007-03-31 09:34:37 47376 --a------ C:\WINNT\system32\spoolsv.exe
2007-03-31 09:34:37 81168 --a------ C:\WINNT\system32\spoolss.dll
2007-03-31 09:34:35 36112 --a------ C:\WINNT\system32\storprop.dll
2007-03-31 09:34:14 0 d-------- C:\WINNT\system32\CatRoot
2007-03-31 09:33:59 0 d-------- C:\Documents and Settings<DOCUME~1>
2007-03-31 09:29:23 0 d-------- C:\WINNT
2007-03-31 09:29:23 0 d---s---- C:\WINNT\Web
2007-03-31 09:29:23 0 d-------- C:\WINNT\twain_32
2007-03-31 09:29:23 0 d-------- C:\WINNT\system32
2007-03-31 09:29:23 0 d-------- C:\WINNT\system32\wins
2007-03-31 09:29:23 0 d-------- C:\WINNT\system32\wbem
2007-03-31 09:29:23 0 d-------- C:\WINNT\system32\spool
2007-03-31 09:29:23 0 d-------- C:\WINNT\system32\ShellExt
2007-03-31 09:29:23 0 d-------- C:\WINNT\system32\Setup
2007-03-31 09:29:23 0 d-------- C:\WINNT\system32\ras
2007-03-31 09:29:23 0 d-------- C:\WINNT\system32\os2
2007-03-31 09:29:23 0 d-------- C:\WINNT\system32\npp
2007-03-31 09:29:23 0 d-------- C:\WINNT\system32\mui
2007-03-31 09:29:23 0 d-------- C:\WINNT\system32\ie_de
2007-03-31 09:29:23 0 d-------- C:\WINNT\system32\ias
2007-03-31 09:29:23 0 d-------- C:\WINNT\system32\export
2007-03-31 09:29:23 0 d-------- C:\WINNT\system32\drivers
2007-03-31 09:29:23 0 d-------- C:\WINNT\system32\drivers\etc
2007-03-31 09:29:23 0 d-------- C:\WINNT\system32\drivers\disdn
2007-03-31 09:29:23 0 dr-hs---- C:\WINNT\system32\dllcache
2007-03-31 09:29:23 0 d-------- C:\WINNT\system32\dhcp
2007-03-31 09:29:23 0 d-------- C:\WINNT\system32\config
2007-03-31 09:29:23 0 d-------- C:\WINNT\system
2007-03-31 09:29:23 0 d-------- C:\WINNT\security
2007-03-31 09:29:23 0 d-------- C:\WINNT\repair
2007-03-31 09:29:23 0 d-------- C:\WINNT\msapps
2007-03-31 09:29:23 0 d-------- C:\WINNT\msagent
2007-03-31 09:29:23 0 d-------- C:\WINNT\Media
2007-03-31 09:29:23 0 d--h----- C:\WINNT\inf
2007-03-31 09:29:23 0 d-------- C:\WINNT\Help
2007-03-31 09:29:23 0 dr--s---- C:\WINNT\Fonts
2007-03-31 09:29:23 0 d-------- C:\WINNT\Driver Cache<DRIVER~1>
2007-03-31 09:29:23 0 d-------- C:\WINNT\Debug
2007-03-31 09:29:23 0 d-------- C:\WINNT\Cursors
2007-03-31 09:29:23 0 d-------- C:\WINNT\Connection Wizard<CONNEC~1>
2007-03-31 09:29:23 0 d-------- C:\WINNT\Config
2007-03-31 09:29:23 0 d-------- C:\WINNT\AppPatch
2007-03-31 09:29:23 0 d-------- C:\WINNT\addins


-- Find3M Report ---------------------------------------------------------------

2007-04-10 13:19:46 17680 --a------ C:\WINNT\system32\tftp.exe
2007-04-10 13:19:46 41232 --a------ C:\WINNT\system32\ftp.exe
2007-04-04 13:37:26 0 d-------- C:\Documents and Settings\Marcin Binek\Dane aplikacji\Comodo
2007-04-02 18:27:06 96048 --a------ C:\WINNT\system32\sfc.dll
2007-04-02 15:59:56 0 d-------- C:\Documents and Settings\Marcin Binek\Dane aplikacji\Media Player Classic<MEDIAP~1>
2007-04-01 19:29:18 0 d-------- C:\Documents and Settings\Marcin Binek\Dane aplikacji\Help
2007-03-31 12:57:20 0 d-------- C:\Documents and Settings\Marcin Binek\Dane aplikacji\Skype
2007-03-31 11:21:08 0 d-------- C:\Documents and Settings\Marcin Binek\Dane aplikacji\Mozilla
2007-03-31 10:27:00 0 d-------- C:\Documents and Settings\Marcin Binek\Dane aplikacji\Macromedia<MACROM~1>
2007-03-31 10:01:16 0 d-------- C:\Documents and Settings\Marcin Binek\Dane aplikacji\Identities<IDENTI~1>
2007-03-31 09:47:10 0 d---s---- C:\Documents and Settings\Marcin Binek\Dane aplikacji\Microsoft<MICROS~1>
2007-03-31 09:47:04 342104 --a------ C:\WINNT\system32\perfh015.dat
2007-03-31 09:47:04 45842 --a------ C:\WINNT\system32\perfc015.dat
2007-03-31 09:46:40 22039 ---h----- C:\Program Files\folder.htt
2007-03-31 09:46:40 271 ---h----- C:\Program Files\desktop.ini
2007-03-13 11:45:56 246032 --a------ C:\WINNT\system32\WINSRV.DLL
2007-03-06 13:18:54 381200 --a------ C:\WINNT\system32\USER32.DLL
2007-03-06 13:18:52 38160 --a------ C:\WINNT\system32\mf3216.dll
2007-03-06 13:18:52 235280 --a------ C:\WINNT\system32\GDI32.DLL
2007-03-06 13:15:58 1642128 --a------ C:\WINNT\system32\WIN32K.SYS
2007-02-21 22:00:28 10752 --a------ C:\WINNT\system32\ff_vfw.dll
2007-01-29 23:04:00 200768 --a------ C:\WINNT\system32\klogon.dll


-- Registry Dump ---------------------------------------------------------------


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"Gadu-Gadu"="\"C:\\Program Files\\Gadu-Gadu\\gg.exe\" /tray"
"eMuleAutoStart"="C:\\Program Files\\eMule\\emule.exe -AutoStart"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"Matrox Powerdesk"="C:\\WINNT\\system32\\PDesk\\PDesk.exe /Autolaunch"
"Synchronization Manager"="mobsync.exe /logon"
"AVP"="\"C:\\Program Files\\Kaspersky Lab\\Kaspersky Internet Security 6.0\\avp.exe\""

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"="C:\\Program Files\\Internet Explorer\\Connection Wizard\\icwconn1.exe /desktop"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Synchronization Manager]
"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"
"item"="mobsync"
"hkey"="HKLM"
"command"="mobsync.exe /logon"
"inimapping"="0"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"="C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll"


[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"internat.exe"="internat.exe"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
rpcss REG_MULTI_SZ RpcSs\0\0
wugroup REG_MULTI_SZ wuauserv\0\0
BITSgroup REG_MULTI_SZ BITS\0\0

*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_08564
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_15085
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_15446
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_22621
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_24444
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_24770
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_25500
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_45676
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_47384
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_48580
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_48725
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_50167
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_61068
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_62417
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_77401
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_78236
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_78628
*newlycreated* - HKEY_LOCAL_MACHINE\system\currentcontrolset\enum\root\LEGACY_87238


-- End of ComboScan: finished at 2007-04-11 at 16:52:43 ------------------------

[wojtas]

sciagnij gmera:

http://gmer.net/gmer.zip

1) Rootkit >>> zaznaczone Pokaż wszystko >>> wskazane tylko Usługi >>> Szukaj >>> Kopiuj >>> CTRL+V do posta
2) Rootkit >>> odznaczone Pokaż wszystko >>> wskazane wszystkie obiekty do skanu >>> Szukaj >>> Kopiuj >>> CTRL+V do posta

[Gryzak]

Nie wqiem co jest nie tak już tyle razy ściągałem ten program a on i tak nie chce wcale się uruchomić poprostu po jego włączeniu uruchamia mi się ponownie komputer i nie wiem co zrobić

[Red]

no to zastosuj:

http://www.wiruskill.pl/forum/viewtopic.php?t=53

przelec wszystkim czym sie da ....

[neoleszczyk_Doradca]

ej a moze poprostu daj kwarantanne czy cos w tym rodzaju zeby przetrzymywalo wirusa a potem usun go

[Red]

W tym przypadku nie prościej.